@morit/cli 1.0.0

package/src/cli.js

@@ -0,0 +1,414 @@
+import { spawn } from "node:child_process";
+import { mkdir, readFile, unlink, writeFile } from "node:fs/promises";
+import { basename, dirname, join, resolve } from "node:path";
+import { MoritCloudClient, MoritCloudError } from "./cloud-client.js";
+import { filesDigest, readProjectConfig, writeProjectConfig } from "./config.js";
+import { clearCredential, loadCredential, saveCredential } from "./secure-store.js";
+import {
+  buildProjectDirectory,
+  internal as sdkInternal,
+  readProjectDirectory,
+  scaffoldProjectDirectory,
+  validateProjectDirectory,
+} from "./workspace.js";
+
+const DEFAULT_API_URL = "https://developers.moring.co";
+const HELP = `Official Morit Developer CLI
+
+Usage:
+  morit login [--token <access-token>] [--api-url <origin>]
+  morit logout
+  morit plugin setup [directory] --id <plugin.id> --name <name> --publisher <publisher>
+  morit plugin add [directory]
+  morit plugin validate [directory]
+  morit plugin build [directory] [--output <file.mplg>]
+  morit plugin sync [directory] [--pull] [--force]
+  morit plugin deploy [directory] [--visibility private|public] [--file-name <file.mplg>]
+  morit project list
+  morit project get <project-id>
+  morit project delete <project-id>
+  morit deployment list [project-id]
+  morit deployment get <deployment-id>
+  morit deployment publish <deployment-id> --visibility private|public
+
+Use --json for machine-readable output. Credentials are stored in the operating-system keyring.
+`;
+
+function parseArguments(argv) {
+  const result = { positionals: [], flags: {} };
+  const booleans = new Set(["--json", "--pull", "--force"]);
+  for (let index = 0; index < argv.length; index += 1) {
+    const value = argv[index];
+    if (!value.startsWith("--")) {
+      result.positionals.push(value);
+      continue;
+    }
+    if (booleans.has(value)) {
+      result.flags[value.slice(2)] = true;
+      continue;
+    }
+    const next = argv[index + 1];
+    if (!next || next.startsWith("--")) throw new Error(`${value} requires a value`);
+    result.flags[value.slice(2)] = next;
+    index += 1;
+  }
+  return result;
+}
+
+function output(stdout, value, json = false) {
+  if (json) {
+    stdout.write(`${JSON.stringify(value, null, 2)}\n`);
+    return;
+  }
+  if (typeof value === "string") stdout.write(`${value}\n`);
+  else stdout.write(`${JSON.stringify(value, null, 2)}\n`);
+}
+
+function openBrowser(url) {
+  const [command, args] = process.platform === "win32"
+    ? ["rundll32.exe", ["url.dll,FileProtocolHandler", url]]
+    : process.platform === "darwin"
+      ? ["open", [url]]
+      : ["xdg-open", [url]];
+  const child = spawn(command, args, { detached: true, stdio: "ignore", windowsHide: true });
+  child.unref();
+}
+
+function safeHttpsUrl(value, requiredOrigin) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new Error("Morit CLI authorization URL is invalid");
+  }
+  if (
+    url.protocol !== "https:"
+    || url.origin !== requiredOrigin
+    || url.username
+    || url.password
+    || url.hash
+  ) {
+    throw new Error("Morit CLI authorization URL is invalid");
+  }
+  return url.toString();
+}
+
+function validateDeviceAuthorization(value, apiUrl) {
+  const verification = safeHttpsUrl(value?.verification_uri, apiUrl);
+  const complete = safeHttpsUrl(value?.verification_uri_complete, apiUrl);
+  if (
+    typeof value?.device_code !== "string"
+    || !/^[A-Za-z0-9_-]{40,60}$/.test(value.device_code)
+    || typeof value?.user_code !== "string"
+    || !/^[A-Z0-9]{4}-[A-Z0-9]{4}$/.test(value.user_code)
+    || !Number.isInteger(value?.expires_in)
+    || value.expires_in < 60
+    || value.expires_in > 900
+    || !Number.isInteger(value?.interval)
+    || value.interval < 2
+    || value.interval > 30
+  ) {
+    throw new Error("Morit CLI authorization response is invalid");
+  }
+  return {
+    ...value,
+    verification_uri: verification,
+    verification_uri_complete: complete,
+  };
+}
+
+function validateDeviceToken(value) {
+  if (
+    typeof value?.access_token !== "string"
+    || !/^sk_live_[A-Za-z0-9]{32}$/.test(value.access_token)
+    || typeof value?.organization_id !== "string"
+    || !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value.organization_id)
+    || !Array.isArray(value?.scopes)
+    || value.scopes.some((scope) => typeof scope !== "string")
+  ) {
+    throw new Error("Morit CLI token response is invalid");
+  }
+  return value;
+}
+
+async function authenticatedClient(options) {
+  const credential = await (options.loadCredential || loadCredential)();
+  if (!credential) throw new Error("Run morit login first");
+  return {
+    credential,
+    client: new MoritCloudClient({
+      apiUrl: credential.apiUrl,
+      token: credential.token,
+      fetchImpl: options.fetchImpl || fetch,
+    }),
+  };
+}
+
+function pluginRoot(parsed, cwd) {
+  return resolve(cwd, parsed.positionals[0] || ".");
+}
+
+function manifestMetadata(manifest) {
+  return {
+    icon: manifest.icon ?? null,
+    short_description: manifest.short_description || "",
+    category: manifest.category || "other",
+    keywords: Array.isArray(manifest.keywords) ? manifest.keywords : [],
+    developer: manifest.developer || { name: manifest.publisher || "" },
+    homepage_url: manifest.homepage_url ?? null,
+    privacy_policy_url: manifest.privacy_policy_url ?? null,
+  };
+}
+
+async function setupPlugin(root, flags) {
+  let project;
+  try {
+    project = await readProjectDirectory(root);
+  } catch (error) {
+    if (!flags.id || !flags.name || !flags.publisher) {
+      throw new Error("An existing valid manifest.json or --id, --name, and --publisher is required");
+    }
+    await scaffoldProjectDirectory(root, {
+      plugin_id: flags.id,
+      name: flags.name,
+      publisher: flags.publisher,
+      description: flags.description || "",
+      advanced: true,
+    });
+    project = await readProjectDirectory(root);
+  }
+  const current = await readProjectConfig(root);
+  const configPath = await writeProjectConfig(root, current || {
+    project_id: null,
+    organization_id: null,
+    revision: 0,
+    source_digest: project.digest,
+    api_url: DEFAULT_API_URL,
+  });
+  return { configured: true, config_path: configPath, plugin_id: project.manifest.id, linked: Boolean(current?.project_id) };
+}
+
+export async function linkPluginProject(root, client, organizationId) {
+  const source = await readProjectDirectory(root);
+  const existing = await readProjectConfig(root);
+  if (existing?.project_id) throw new Error(`Project is already linked to ${existing.project_id}`);
+  const response = await client.createProject({
+    plugin_id: source.manifest.id,
+    name: source.manifest.name,
+    description: source.manifest.description || "",
+    publisher: source.manifest.publisher,
+    files: source.files,
+    metadata: manifestMetadata(source.manifest),
+  });
+  const project = response.project;
+  const remoteFiles = project.files || {};
+  if (typeof remoteFiles["manifest.json"] === "string") {
+    await writeFile(join(root, "manifest.json"), remoteFiles["manifest.json"], "utf8");
+  }
+  const refreshed = await readProjectDirectory(root);
+  await writeProjectConfig(root, {
+    project_id: project.id,
+    organization_id: project.organization_id || organizationId,
+    revision: project.revision,
+    source_digest: refreshed.digest,
+    api_url: client.apiUrl,
+  });
+  return project;
+}
+
+export async function pushPluginProject(root, client) {
+  const config = await readProjectConfig(root);
+  if (!config?.project_id) throw new Error("Run morit plugin add first");
+  const source = await readProjectDirectory(root);
+  const response = await client.syncProject(config.project_id, { revision: config.revision, files: source.files });
+  const project = response.project;
+  await writeProjectConfig(root, {
+    ...config,
+    revision: project.revision,
+    source_digest: source.digest,
+    api_url: client.apiUrl,
+  });
+  return project;
+}
+
+export async function pullPluginProject(root, client, force = false) {
+  const config = await readProjectConfig(root);
+  if (!config?.project_id) throw new Error("Run morit plugin add first");
+  const current = await readProjectDirectory(root);
+  if (!force && config.source_digest && current.digest !== config.source_digest) {
+    throw new Error("Local source changed since the last sync; push it or use --force to replace it");
+  }
+  const { project } = await client.project(config.project_id);
+  const files = project.files || {};
+  for (const [name, content] of Object.entries(files)) {
+    const safeName = sdkInternal.safeFilePath(name);
+    const target = join(root, ...safeName.split("/"));
+    await mkdir(dirname(target), { recursive: true });
+    await writeFile(target, sdkInternal.projectFileBytes(safeName, content));
+  }
+  for (const name of Object.keys(current.files)) {
+    if (!(name in files)) await unlink(join(root, ...name.split("/"))).catch(() => undefined);
+  }
+  const refreshed = await readProjectDirectory(root);
+  await writeProjectConfig(root, {
+    ...config,
+    revision: project.revision,
+    source_digest: refreshed.digest,
+    api_url: client.apiUrl,
+  });
+  return project;
+}
+
+async function login(parsed, options, stdout) {
+  const apiUrl = parsed.flags["api-url"] || DEFAULT_API_URL;
+  const fetchImpl = options.fetchImpl || fetch;
+  const directToken = parsed.flags.token || process.env.MORIT_ACCESS_TOKEN?.trim();
+  if (directToken) {
+    const client = new MoritCloudClient({ apiUrl, token: directToken, fetchImpl });
+    const identity = await client.whoami();
+    await (options.saveCredential || saveCredential)({ token: directToken, apiUrl: client.apiUrl, organizationId: identity.organization_id });
+    output(stdout, parsed.flags.json ? identity : `Signed in to organization ${identity.organization_id}`, parsed.flags.json);
+    return 0;
+  }
+  const client = new MoritCloudClient({ apiUrl, fetchImpl });
+  const authorization = validateDeviceAuthorization(
+    await client.request("/api/v1/cli/device/start", {
+      method: "POST",
+      body: { scopes: ["plugin:read", "plugin:write", "plugin:build", "plugin:deploy"] },
+      authenticated: false,
+    }),
+    client.apiUrl,
+  );
+  stdout.write(`Open ${authorization.verification_uri}\nEnter code: ${authorization.user_code}\n`);
+  (options.openBrowser || openBrowser)(authorization.verification_uri_complete);
+  const deadline = Date.now() + authorization.expires_in * 1000;
+  while (Date.now() < deadline) {
+    await (options.sleep || ((milliseconds) => new Promise((resolveSleep) => setTimeout(resolveSleep, milliseconds))))(authorization.interval * 1000);
+    try {
+      const token = validateDeviceToken(
+        await client.request("/api/v1/cli/device/token", {
+          method: "POST",
+          body: { device_code: authorization.device_code },
+          authenticated: false,
+          retries: 0,
+        }),
+      );
+      await (options.saveCredential || saveCredential)({
+        token: token.access_token,
+        apiUrl: client.apiUrl,
+        organizationId: token.organization_id,
+      });
+      output(stdout, parsed.flags.json ? { organization_id: token.organization_id, scopes: token.scopes } : "Morit CLI is connected", parsed.flags.json);
+      return 0;
+    } catch (error) {
+      if (error instanceof MoritCloudError && error.code === "authorization_pending") continue;
+      throw error;
+    }
+  }
+  throw new Error("CLI authorization expired; run morit login again");
+}
+
+export async function runCli(argv, options = {}) {
+  const stdout = options.stdout || process.stdout;
+  const cwd = resolve(options.cwd || process.cwd());
+  if (!argv.length || argv.includes("--help") || argv.includes("-h")) {
+    stdout.write(HELP);
+    return 0;
+  }
+  const [area, action, ...rest] = argv;
+  if (area === "login") return login(parseArguments(argv.slice(1)), options, stdout);
+  if (area === "logout") {
+    await (options.clearCredential || clearCredential)();
+    output(stdout, "Signed out of Morit CLI");
+    return 0;
+  }
+  const parsed = parseArguments(rest);
+  const json = Boolean(parsed.flags.json);
+
+  if (area === "plugin") {
+    const root = pluginRoot(parsed, cwd);
+    if (action === "setup") {
+      output(stdout, await setupPlugin(root, parsed.flags), json);
+      return 0;
+    }
+    if (action === "validate") {
+      output(stdout, await validateProjectDirectory(root), json);
+      return 0;
+    }
+    if (action === "build") {
+      output(stdout, await buildProjectDirectory(root, {
+        output: parsed.flags.output ? resolve(cwd, parsed.flags.output) : undefined,
+      }), json);
+      return 0;
+    }
+    const { client, credential } = await authenticatedClient(options);
+    if (action === "add") {
+      output(stdout, await linkPluginProject(root, client, credential.organizationId), json);
+      return 0;
+    }
+    if (action === "sync") {
+      output(stdout, parsed.flags.pull
+        ? await pullPluginProject(root, client, Boolean(parsed.flags.force))
+        : await pushPluginProject(root, client), json);
+      return 0;
+    }
+    if (action === "deploy") {
+      const project = await pushPluginProject(root, client);
+      const visibility = parsed.flags.visibility || "private";
+      if (!["private", "public"].includes(visibility)) throw new Error("--visibility must be private or public");
+      const artifact = await buildProjectDirectory(root, {});
+      const content = await readFile(artifact.output_path);
+      const response = await client.deploy(project.id, {
+        channel: "local_cli",
+        visibility,
+        file_name: parsed.flags["file-name"] || basename(artifact.output_path),
+        artifact: {
+          encoding: "base64",
+          content: content.toString("base64"),
+          size_bytes: artifact.size_bytes,
+          sha256: artifact.sha256,
+        },
+      });
+      output(stdout, { ...response.deployment, local_artifact_path: artifact.output_path }, json);
+      return 0;
+    }
+    throw new Error(`Unknown plugin command: ${action || "missing"}`);
+  }
+
+  const { client } = await authenticatedClient(options);
+  if (area === "project") {
+    if (action === "list") output(stdout, (await client.projects()).projects, json);
+    else if (action === "get" && parsed.positionals[0]) output(stdout, (await client.project(parsed.positionals[0])).project, json);
+    else if (action === "delete" && parsed.positionals[0]) output(stdout, await client.deleteProject(parsed.positionals[0]), json);
+    else throw new Error("Use morit project list|get <id>|delete <id>");
+    return 0;
+  }
+  if (area === "deployment") {
+    if (action === "list") {
+      let projectId = parsed.positionals[0];
+      if (!projectId) projectId = (await readProjectConfig(cwd))?.project_id;
+      if (!projectId) throw new Error("Provide a project id or run inside a linked Plugin Project");
+      output(stdout, (await client.deployments(projectId)).deployments, json);
+    } else if (action === "get" && parsed.positionals[0]) {
+      output(stdout, (await client.deployment(parsed.positionals[0])).deployment, json);
+    } else if (action === "publish" && parsed.positionals[0]) {
+      const visibility = parsed.flags.visibility;
+      if (!["private", "public"].includes(visibility)) throw new Error("--visibility must be private or public");
+      output(stdout, (await client.publish(parsed.positionals[0], visibility)).deployment, json);
+    } else {
+      throw new Error("Use morit deployment list|get <id>|publish <id> --visibility private|public");
+    }
+    return 0;
+  }
+  throw new Error(`Unknown command: ${area}`);
+}
+
+export const internal = {
+  HELP,
+  linkPluginProject,
+  login,
+  parseArguments,
+  pullPluginProject,
+  pushPluginProject,
+  setupPlugin,
+};

package/src/cloud-client.js

@@ -0,0 +1,89 @@
+import { normalizeApiOrigin } from "./config.js";
+
+const RETRYABLE = new Set([502, 503, 504]);
+
+export class MoritCloudError extends Error {
+  constructor(message, { status = 0, code = "cloud_error" } = {}) {
+    super(message);
+    this.status = status;
+    this.code = code;
+  }
+}
+
+export class MoritCloudClient {
+  constructor({ apiUrl = "https://developers.moring.co", token = null, fetchImpl = fetch } = {}) {
+    this.apiUrl = normalizeApiOrigin(apiUrl);
+    if (token !== null && (
+      typeof token !== "string"
+      || !token
+      || token.length > 256
+      || /[\r\n]/.test(token)
+    )) {
+      throw new MoritCloudError("Morit access token is invalid", {
+        status: 401,
+        code: "invalid_token",
+      });
+    }
+    this.token = token;
+    this.fetchImpl = fetchImpl;
+  }
+
+  async request(path, { method = "GET", body, authenticated = true, retries = 2 } = {}) {
+    const headers = { Accept: "application/json" };
+    if (body !== undefined) headers["Content-Type"] = "application/json";
+    if (authenticated) {
+      if (!this.token) throw new MoritCloudError("Run morit login first", { status: 401, code: "not_authenticated" });
+      headers.Authorization = `Bearer ${this.token}`;
+    }
+    for (let attempt = 0; ; attempt += 1) {
+      let response;
+      try {
+        response = await this.fetchImpl(new URL(path, this.apiUrl), {
+          method,
+          headers,
+          body: body === undefined ? undefined : JSON.stringify(body),
+          signal: AbortSignal.timeout(30_000),
+        });
+      } catch (error) {
+        if (attempt < retries && method === "GET") {
+          await new Promise((resolve) => setTimeout(resolve, 300 * (2 ** attempt)));
+          continue;
+        }
+        throw new MoritCloudError("Morit Cloud is unreachable; check the network and retry", { code: "network_error" });
+      }
+      const value = await response.json().catch(() => ({}));
+      if (response.ok) return value;
+      if (attempt < retries && method === "GET" && RETRYABLE.has(response.status)) {
+        await new Promise((resolve) => setTimeout(resolve, 300 * (2 ** attempt)));
+        continue;
+      }
+      const error = value?.error;
+      const message = typeof error === "string" ? error : error?.message;
+      if (response.status === 401) {
+        throw new MoritCloudError("Developer session expired; run morit login again", { status: 401, code: error?.code || "unauthorized" });
+      }
+      throw new MoritCloudError(message || `Morit Cloud returned HTTP ${response.status}`, {
+        status: response.status,
+        code: error?.code || "cloud_error",
+      });
+    }
+  }
+
+  projects() { return this.request("/api/v1/plugin-projects"); }
+  whoami() { return this.request("/api/v1/cli/whoami"); }
+  project(id) { return this.request(`/api/v1/plugin-projects/${encodeURIComponent(id)}`); }
+  createProject(input) { return this.request("/api/v1/plugin-projects", { method: "POST", body: input }); }
+  updateProject(id, input) { return this.request(`/api/v1/plugin-projects/${encodeURIComponent(id)}`, { method: "PATCH", body: input }); }
+  syncProject(id, input) { return this.request(`/api/v1/plugin-projects/${encodeURIComponent(id)}/source`, { method: "PUT", body: input }); }
+  deleteProject(id) { return this.request(`/api/v1/plugin-projects/${encodeURIComponent(id)}`, { method: "DELETE" }); }
+  deploy(id, input) { return this.request(`/api/v1/plugin-projects/${encodeURIComponent(id)}/deployments`, { method: "POST", body: input }); }
+  deployments(id) { return this.request(`/api/v1/plugin-projects/${encodeURIComponent(id)}/deployments`); }
+  deployment(id) { return this.request(`/api/v1/plugin-deployments/${encodeURIComponent(id)}`); }
+  publish(id, visibility) { return this.request(`/api/v1/plugin-deployments/${encodeURIComponent(id)}`, { method: "PATCH", body: { visibility } }); }
+  secrets(id) { return this.request(`/api/v1/plugin-projects/${encodeURIComponent(id)}/secrets`); }
+  putSecret(id, input) { return this.request(`/api/v1/plugin-projects/${encodeURIComponent(id)}/secrets`, { method: "PUT", body: input }); }
+  deleteSecret(id, name) { return this.request(`/api/v1/plugin-projects/${encodeURIComponent(id)}/secrets?name=${encodeURIComponent(name)}`, { method: "DELETE" }); }
+  connections(id) { return this.request(`/api/v1/plugin-projects/${encodeURIComponent(id)}/connections`); }
+  putConnection(id, input) { return this.request(`/api/v1/plugin-projects/${encodeURIComponent(id)}/connections`, { method: "PUT", body: input }); }
+  deleteConnection(id, connectionId) { return this.request(`/api/v1/plugin-projects/${encodeURIComponent(id)}/connections?connection_id=${encodeURIComponent(connectionId)}`, { method: "DELETE" }); }
+}

package/src/config.js

@@ -0,0 +1,82 @@
+import { createHash } from "node:crypto";
+import { chmod, mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { dirname, join, resolve } from "node:path";
+
+export const PROJECT_CONFIG = "morit-plugin.json";
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+
+export function normalizeApiOrigin(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new Error("Morit API URL must be an HTTPS origin");
+  }
+  if (
+    url.protocol !== "https:"
+    || !url.hostname
+    || url.username
+    || url.password
+    || (url.pathname !== "/" && url.pathname !== "")
+    || url.search
+    || url.hash
+    || (url.port && url.port !== "443")
+  ) {
+    throw new Error("Morit API URL must be an HTTPS origin");
+  }
+  return url.origin;
+}
+
+export async function readProjectConfig(root) {
+  const path = join(resolve(root), PROJECT_CONFIG);
+  let value;
+  try {
+    value = JSON.parse(await readFile(path, "utf8"));
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw new Error("morit-plugin.json is not valid JSON");
+  }
+  if (
+    value?.version !== 1
+    || (value.project_id !== null && !UUID.test(value.project_id))
+    || (value.organization_id !== null && !UUID.test(value.organization_id))
+    || !Number.isInteger(value.revision)
+    || value.revision < 0
+    || (value.source_digest !== null && value.source_digest !== undefined
+      && !/^[a-f0-9]{64}$/.test(value.source_digest))
+  ) {
+    throw new Error("morit-plugin.json has an unsupported format");
+  }
+  if (value.api_url !== undefined) value.api_url = normalizeApiOrigin(value.api_url);
+  return value;
+}
+
+export async function writeProjectConfig(root, value) {
+  const directory = resolve(root);
+  const path = join(directory, PROJECT_CONFIG);
+  await mkdir(directory, { recursive: true });
+  const temporary = `${path}.tmp`;
+  const normalized = {
+    version: 1,
+    ...value,
+    api_url: normalizeApiOrigin(value.api_url),
+  };
+  await writeFile(temporary, `${JSON.stringify(normalized, null, 2)}\n`, {
+    encoding: "utf8",
+    mode: 0o600,
+  });
+  await rename(temporary, path);
+  await chmod(path, 0o600).catch(() => undefined);
+  return path;
+}
+
+export function filesDigest(files) {
+  const digest = createHash("sha256");
+  for (const name of Object.keys(files).sort()) {
+    digest.update(name);
+    digest.update("\0");
+    digest.update(files[name]);
+    digest.update("\0");
+  }
+  return digest.digest("hex");
+}