@morit/cli 1.6.0 → 1.9.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@morit/cli",
-  "version": "1.6.0",
+  "version": "1.9.1",
   "description": "Official Morit Developer CLI for Cloud Projects, validation, builds, and deployments",
   "type": "module",
   "bin": {
@@ -20,7 +20,8 @@
     "README.md"
   ],
   "scripts": {
-    "build": "node scripts/sync-contract.mjs",
+    "build": "node scripts/sync-contract.mjs && node scripts/sync-script-contract.mjs",
+    "check:contract": "node scripts/sync-contract.mjs --check",
     "test": "node --test",
     "prepack": "npm run build && npm test"
   },

package/src/cli.js

@@ -11,6 +11,9 @@ import {
   readProjectDirectory,
   scaffoldProjectDirectory,
   validateProjectDirectory,
+  verifyPackageFile,
+  runtimeTestProjectDirectory,
+  compileProjectDirectory,
 } from "./workspace.js";
 
 const DEFAULT_API_URL = "https://developers.moring.co";
@@ -20,9 +23,11 @@ Usage:
   morit login [--token <access-token>] [--api-url <origin>]
   morit logout
   morit docs
-  morit plugin setup [directory] --id <plugin.id> --name <name> --publisher <publisher>
+  morit plugin setup [directory] --id <plugin.id> --name <name> --publisher <publisher> [--ui-schema 2|3]
   morit plugin add [directory]
+  morit plugin runtime-test [directory] [--module <id> --export <name>] [--fixture <fixtures/file.json>]
   morit plugin validate [directory]
+  morit plugin verify <file.mplg>
   morit plugin preview [directory] [--output <file.html>]
   morit plugin build [directory] [--output <file.mplg>]
   morit plugin sync [directory] [--pull] [--force]
@@ -177,6 +182,7 @@ async function setupPlugin(root, flags) {
       publisher: flags.publisher,
       description: flags.description || "",
       advanced: true,
+      ui_schema: Number(flags.ui_schema ?? flags["ui-schema"] ?? 3),
     });
     project = await readProjectDirectory(root);
   }
@@ -362,10 +368,22 @@ export async function runCli(argv, options = {}) {
       output(stdout, await setupPlugin(root, parsed.flags), json);
       return 0;
     }
+    if (action === "compile") {
+      output(stdout, await compileProjectDirectory(root), true);
+      return 0;
+    }
+    if (action === "runtime-test") {
+      output(stdout, await runtimeTestProjectDirectory(root, parsed.flags), json);
+      return 0;
+    }
     if (action === "validate") {
       output(stdout, await validateProjectDirectory(root), json);
       return 0;
     }
+    if (action === "verify") {
+      output(stdout, await verifyPackageFile(root), json);
+      return 0;
+    }
     if (action === "preview") {
       output(stdout, await previewProjectDirectory(
         root,

package/src/morit-script.js

@@ -0,0 +1,174 @@
+import { validateAst } from './script-contract.js';
+import { createHash } from 'node:crypto';
+
+// Morit source is parsed, never passed to JavaScript eval/Function/vm.
+export class ScriptError extends Error {
+  constructor(code, message, span) {
+    super(message); this.name = 'ScriptError'; this.code = code; this.span = span;
+  }
+  toJSON() { return { code: this.code, message: this.message, span: this.span }; }
+}
+const denied = new Set(['__proto__', 'prototype', 'constructor', 'eval', 'Function', 'globalThis', 'process', 'require', 'import', 'while', 'class', 'new', 'this', 'async', 'await', 'delete']);
+const precedence = { '??': 1, '||': 2, '&&': 3, '==': 4, '!=': 4, '===': 4, '!==': 4, '<': 5, '>': 5, '<=': 5, '>=': 5, '+': 6, '-': 6, '*': 7, '/': 7, '%': 7 };
+const bytes = value => Buffer.byteLength(value, 'utf8');
+const fail = (code, message, span) => { throw new ScriptError(code, message, span); };
+
+class Parser {
+  constructor(source, path, inline) {
+    this.source = source; this.path = path; this.inline = inline; this.tokens = []; this.cursor = 0; this.nodes = 0; this.depth = 0;
+    const pattern = /\s+|\/\/[^\n]*|\/\*[\s\S]*?\*\/|(?:"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*')|(?:\d+(?:\.\d+)?(?:[eE][+-]?\d+)?)|[A-Za-z_$][A-Za-z0-9_$]*|===|!==|=>|==|!=|<=|>=|&&|\|\||\?\?|[{}()[\].,;:?+*/%!=<>-]/gy;
+    let offset = 0;
+    while (offset < source.length) {
+      pattern.lastIndex = offset; const match = pattern.exec(source);
+      if (!match) this.error('Invalid token', offset);
+      const value = match[0]; offset = pattern.lastIndex;
+      if (/^\s|^\/\//.test(value) || value.startsWith('/*')) continue;
+      if (denied.has(value)) this.error(`Forbidden identifier: ${value}`, match.index);
+      this.tokens.push({ value, offset: match.index });
+    }
+    this.tokens.push({ value: '<eof>', offset });
+  }
+  span(offset = this.peek().offset) {
+    const lines = this.source.slice(0, offset).split('\n');
+    return { file: this.path, line: lines.length, column: lines.at(-1).length + 1, offset };
+  }
+  error(message, offset) { fail('SYNTAX', message, this.span(offset)); }
+  peek(n = 0) { return this.tokens[this.cursor + n] || this.tokens.at(-1); }
+  take(value) { if (this.peek().value !== value) return false; this.cursor++; return true; }
+  need(value) { if (!this.take(value)) this.error(`Expected ${value}, got ${this.peek().value}`); }
+  identifier() {
+    const token = this.peek();
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(token.value) || denied.has(token.value)) this.error('Expected identifier');
+    this.cursor++; return token.value;
+  }
+  node(type, fields, offset) {
+    if (++this.nodes > (this.inline ? 64 : 2048)) fail('AST_LIMIT', 'AST node limit exceeded', this.span(offset));
+    return { type, ...fields, span: this.span(offset) };
+  }
+  module() {
+    const functions = []; const names = new Set();
+    while (this.peek().value !== '<eof>') {
+      const offset = this.peek().offset; const exported = this.take('export');
+      this.need('function'); const name = this.identifier();
+      if (names.has(name)) this.error(`Duplicate function ${name}`); names.add(name);
+      const params = this.parameters(); const body = this.block();
+      functions.push(this.node('function', { name, params, body, exported }, offset));
+    }
+    return { type: 'module', version: 1, functions };
+  }
+  parameters() {
+    this.need('('); const params = [];
+    if (!this.take(')')) { do { params.push(this.identifier()); } while (this.take(',')); this.need(')'); }
+    if (new Set(params).size !== params.length || params.length > 16) this.error('Invalid function parameters');
+    return params;
+  }
+  block() {
+    if (++this.depth > 32) fail('AST_LIMIT', 'Nesting limit exceeded');
+    this.need('{'); const body = [];
+    while (!this.take('}')) {
+      if (this.peek().value === '<eof>') this.error('Unterminated block');
+      body.push(this.statement());
+    }
+    this.depth--; return body;
+  }
+  statement() {
+    const offset = this.peek().offset;
+    if (this.take('const') || this.take('let')) {
+      const mutable = this.tokens[this.cursor - 1].value === 'let'; const name = this.identifier();
+      this.need('='); const value = this.expression(); this.take(';');
+      return this.node('declare', { name, mutable, value }, offset);
+    }
+    if (this.take('return')) { const value = this.expression(); this.take(';'); return this.node('return', { value }, offset); }
+    if (this.take('if')) {
+      this.need('('); const condition = this.expression(); this.need(')'); const then = this.block();
+      const otherwise = this.take('else') ? (this.peek().value === 'if' ? [this.statement()] : this.block()) : [];
+      return this.node('if', { condition, then, else: otherwise }, offset);
+    }
+    if (this.take('for')) {
+      this.need('('); this.need('const'); const name = this.identifier(); this.need('of'); const items = this.expression(); this.need(')');
+      return this.node('for', { name, items, body: this.block() }, offset);
+    }
+    if (this.peek(1).value === '=') {
+      const name = this.identifier(); this.need('='); const value = this.expression(); this.take(';');
+      return this.node('assign', { name, value }, offset);
+    }
+    const value = this.expression(); this.take(';'); return this.node('expression', { value }, offset);
+  }
+  expression(min = 0) {
+    if (++this.depth > 32) fail('AST_LIMIT', 'Expression nesting limit exceeded');
+    const offset = this.peek().offset; let left = this.primary();
+    while (true) {
+      const op = this.peek().value; const rank = precedence[op];
+      if (rank === undefined || rank < min) break;
+      this.cursor++; left = this.node('binary', { op, left, right: this.expression(rank + 1) }, offset);
+    }
+    if (min === 0 && this.take('?')) {
+      const then = this.expression(); this.need(':'); const otherwise = this.expression();
+      left = this.node('conditional', { condition: left, then, else: otherwise }, offset);
+    }
+    this.depth--; return left;
+  }
+  primary() {
+    const { value, offset } = this.peek(); let result;
+    if (['!', '-', '+'].includes(value)) { this.cursor++; return this.node('unary', { op: value, value: this.expression(8) }, offset); }
+    if (/^\d/.test(value)) {
+      this.cursor++; const number = Number(value); if (!Number.isFinite(number)) this.error('Non-finite number');
+      result = this.node('literal', { value: number }, offset);
+    } else if (/^["']/.test(value)) {
+      this.cursor++;
+      try { result = this.node('literal', { value: JSON.parse(value[0] === '"' ? value : '"' + value.slice(1, -1).replace(/\\'/g, "'").replace(/(?<!\\)"/g, '\\"') + '"') }, offset); }
+      catch { this.error('Invalid string escape', offset); }
+    } else if (['true', 'false', 'null'].includes(value)) {
+      this.cursor++; result = this.node('literal', { value: JSON.parse(value) }, offset);
+    } else if (this.take('[')) {
+      const items = []; if (!this.take(']')) { do { items.push(this.expression()); } while (this.take(',') && this.peek().value !== ']'); this.need(']'); }
+      result = this.node('array', { items }, offset);
+    } else if (this.take('{')) {
+      const entries = []; const keys = new Set();
+      if (!this.take('}')) {
+        do {
+          let key = this.peek().value;
+          if (/^["']/.test(key)) { const literal = this.primary(); if (literal.type !== 'literal') this.error('Expected literal key'); key = literal.value; }
+          else key = this.identifier();
+          if (denied.has(key) || keys.has(key)) this.error('Forbidden or duplicate object key'); keys.add(key);
+          this.need(':'); entries.push({ key, value: this.expression() });
+        } while (this.take(',') && this.peek().value !== '}'); this.need('}');
+      }
+      result = this.node('object', { entries }, offset);
+    } else if (value === '(') {
+      let end = this.cursor + 1;
+      while (/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(this.tokens[end]?.value || '') || this.tokens[end]?.value === ',') end++;
+      if (this.tokens[end]?.value === ')' && this.tokens[end + 1]?.value === '=>') {
+        if (this.inline) this.error('Functions belong in logic/*.morit');
+        const params = this.parameters(); this.need('=>');
+        result = this.node('lambda', { params, body: this.peek().value === '{' ? this.block() : [this.node('return', { value: this.expression() }, offset)] }, offset);
+      } else { this.need('('); result = this.expression(); this.need(')'); }
+    } else {
+      const name = this.identifier();
+      if (this.take('=>')) {
+        if (this.inline) this.error('Functions belong in logic/*.morit');
+        result = this.node('lambda', { params: [name], body: this.peek().value === '{' ? this.block() : [this.node('return', { value: this.expression() }, offset)] }, offset);
+      } else result = this.node('identifier', { name }, offset);
+    }
+    while (true) {
+      if (this.take('.')) result = this.node('member', { target: result, key: this.node('literal', { value: this.identifier() }, offset) }, offset);
+      else if (this.take('[')) { const key = this.expression(); this.need(']'); result = this.node('member', { target: result, key }, offset); }
+      else if (this.take('(')) {
+        const args = []; if (!this.take(')')) { do { args.push(this.expression()); } while (this.take(',')); this.need(')'); }
+        if (this.inline && result.type === 'member' && ['map', 'filter', 'reduce'].includes(result.key.value)) this.error('Collection transforms belong in logic/*.morit');
+        result = this.node('call', { target: result, args }, offset);
+      } else break;
+    }
+    return result;
+  }
+}
+
+export function compileExpression(source, path = '<inline>') {
+  if (typeof source !== 'string' || bytes(source) > 256) fail('SOURCE_LIMIT', 'Inline expression exceeds 256 UTF-8 bytes');
+  const parser = new Parser(source, path, true); const ast = parser.expression(); parser.need('<eof>'); return validateAst(ast, {inline: true});
+}
+export function compileModule(source, path = 'logic/main.morit') {
+  if (typeof source !== 'string' || bytes(source) > 32768) fail('SOURCE_LIMIT', 'Module exceeds 32 KiB');
+  const ast = validateAst(new Parser(source, path, false).module());
+  return { version: 1, source_sha256: createHash('sha256').update(source).digest('hex'), ast };
+}

package/src/preview-v3.js

@@ -0,0 +1,83 @@
+import {readFileSync} from 'node:fs';
+import {createHash} from 'node:crypto';
+
+export function renderV3PreviewHtml(manifest, files={}) {
+  const configs=manifest.ui_extensions.filter(e=>e.config?.ui_schema===3);
+  const bindings={};
+  const scan=value=>{if(typeof value==='string'){for(const m of value.matchAll(/\{\{=([\s\S]*?)\}\}/g)){const source=m[1].trim();bindings[source]=createHash('sha256').update(source).digest('hex');}}else if(Array.isArray(value))value.forEach(scan);else if(value&&typeof value==='object')for(const [k,v]of Object.entries(value))if(k!=='compiled')scan(v);};
+  configs.forEach(scan);
+  let fixture={};try{fixture=JSON.parse(files['fixtures/live.json']??files['fixtures/day.json']??'{}');}catch{}
+  const redact=value=>Array.isArray(value)?value.map(redact):value&&typeof value==='object'?Object.fromEntries(Object.entries(value).map(([key,item])=>[key,/secret|token|authorization|password|api[_-]?key/i.test(key)?'[REDACTED]':redact(item)])):value;
+  fixture=redact(fixture);
+  const code=['script-spec.js','script-contract.js','script-schema.js','script-runtime.js','script-data.js'].map(file=>readFileSync(new URL(file,import.meta.url),'utf8').replace(/^import .*;\s*$/gm,'').replace(/^export \{[^}]*\};\s*$/gm,'').replace(/\bexport (?=(const|function|class))/g,'')).join('\n');
+  const json=JSON.stringify({configs,bindings,fixture}).replaceAll('<','\\u003c');
+  return `<!doctype html><html lang="ko"><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Morit Runtime v3 Preview</title><style>
+  :root{font:16px system-ui;color-scheme:light dark;--surface:light-dark(#f5faf7,#141b18);--card:light-dark(#e9f1ec,#25342c);--ink:light-dark(#142b21,#e2eee6);--accent:light-dark(#006b58,#6cdbb5)}*{box-sizing:border-box}body{margin:0;background:var(--surface);color:var(--ink)}header,main{padding:16px;max-width:1280px;margin:auto}button,input,select{font:inherit;padding:10px 16px;border-radius:18px;border:1px solid var(--accent);background:var(--surface);color:var(--ink)}button{cursor:pointer}p{margin:0;overflow-wrap:anywhere}.stack{display:flex;flex-direction:column;gap:8px;min-width:0}.row{display:flex;gap:8px;flex-wrap:wrap}.row>*{min-width:0;flex:1}.card{padding:12px;background:var(--card);border-radius:20px}.grid{display:grid;gap:12px;grid-template-columns:repeat(auto-fit,minmax(min(100%,260px),1fr))}.skeleton{background:var(--card);height:40px;border-radius:12px}dialog{max-width:min(90vw,600px);max-height:85vh;border:0;border-radius:24px;padding:24px;background:var(--surface);color:var(--ink)}dialog::backdrop{background:#0007}pre{white-space:pre-wrap;overflow-wrap:anywhere;font-size:12px}details{margin:16px}.sheet{margin: auto auto 0;width:100%;max-width:800px}@media(prefers-reduced-motion:no-preference){.animated{animation:appear .2s}@keyframes appear{from{opacity:0;transform:translateY(8px)}to{opacity:1;transform:none}}}</style><header><h1>Morit Runtime v3</h1><label>API response fixture <input id="fixture" type="file" accept="application/json"></label><button id="reload">Refresh</button></header><main id="screens"></main><script>${code}\n(${browser.toString()})(${json});</script></html>`;
+}
+
+function browser({configs,bindings,fixture}) {
+  const screens=document.querySelector('#screens');
+  function element(tag,text){const e=document.createElement(tag);if(text!=null)e.textContent=String(text);return e;}
+  function clean(value){return Array.isArray(value)?value.map(clean):value&&typeof value==='object'?Object.fromEntries(Object.entries(value).map(([k,v])=>[k,/secret|token|authorization|password|api[_-]?key/i.test(k)?'[REDACTED]':clean(v)])):value;}
+  fixture=clean(fixture);
+  const surfaces=[];
+  for(const extension of configs){
+    const c=extension.config,modules=c.compiled.modules, state={},computed={},data={},raw={},errors={},locals={},trace={},timeline=[];let count=0;
+    let runtime=screenRuntime();
+    const host=element('section');screens.append(host);
+    function screenRuntime(){const width=innerWidth,height=innerHeight;return runtimeSnapshot({platform:'preview',screen:{width,height,orientation:width>=height?'landscape':'portrait',size_class:width<600?'compact':width<840?'medium':'expanded',text_scale:1,platform:'preview'}});}
+    const scope=lexical=>({state,computed,data,runtime,context:{platform:'preview'},...lexical});
+    function evalValue(value,lexical={}){
+      if(typeof value==='string'){
+        const matches=[...value.matchAll(/\{\{=([\s\S]*?)\}\}/g)];
+        const run=m=>{const ast=c.compiled.expressions[bindings[m[1].trim()]];const result=new ScriptRuntime({modules,profile:'inline'}).evaluate(ast,scope(lexical));trace[bindings[m[1].trim()]]=result.diagnostics;return result.value;};
+        if(matches.length===1&&matches[0][0]===value)return run(matches[0]);
+        return value.replace(/\{\{=([\s\S]*?)\}\}/g,(whole,source)=>run([whole,source])??'');
+      }
+      if(Array.isArray(value))return value.map(v=>evalValue(v,lexical));
+      if(value&&typeof value==='object')return Object.fromEntries(Object.entries(value).map(([k,v])=>[k,evalValue(v,lexical)]));
+      return value;
+    }
+    for(const[k,v]of Object.entries(c.initial_state??{}))state[k]=evalValue(v);
+    function compute(){for(const k of c.compiled.computed_order??[]){const def=c.computed_state[k];computed[k]=def?.module?new ScriptRuntime({modules}).invoke(def.module,def.export,evalValue(def.input),scope({})).value:evalValue(def?.expression??def);}}
+    function load(){for(const id of c.compiled.source_order??[]){const s=c.data_sources.find(s=>s.id===id);if(s.when!==undefined&&!evalValue(s.when))continue;try{let value=fixture&&typeof fixture==='object'&&Object.hasOwn(fixture,id)?fixture[id]:fixture;raw[id]=clean(value);const steps=[];for(const t of Array.isArray(s.transform)?s.transform:s.transform?[s.transform]:[]){const input=clean(value),result=new ScriptRuntime({modules}).invoke(t.module,t.export,value,scope({}));value=result.value;steps.push({module:t.module,export:t.export,input,output:clean(value),diagnostics:result.diagnostics});}trace[id]=steps;data[id]=value;delete errors[id];timeline.push({type:'source_completed',source:id});}catch(e){errors[id]=e.message;timeline.push({type:'source_failed',source:id,error:e.message});}}render();}
+    function action(a,lexical){if(!a)return;const resolved=evalValue(a,lexical);if(a.type==='emit'){const handler=lexical._events?.[resolved.event];if(handler)action(handler,{...(lexical._parent??lexical),event:resolved.payload??{}});}if(a.type==='set_state')Object.assign(a.scope==='root'?state:lexical.state??state,resolved.values);if(a.type==='refresh'){load();return;}if(a.type==='flow'){for(const child of a.actions??[])action(child,lexical);}compute();render();}
+    function slot(value,lexical){const e=element('div');e.className='stack';for(const n of Array.isArray(value)?value:value?[value]:[])e.append(node(n,lexical));return e;}
+    function node(n,lexical={}){
+      if(++count>2000)throw Error('Rendered node budget exceeded');
+      if(n.visible_when!=null&&!evalValue(n.visible_when,lexical))return element('span');
+      const raw=n.props??{},p=evalValue(Object.fromEntries(Object.entries(raw).filter(([k])=>!(n.type==='repeat'&&k==='key'))),lexical),slots=n.slots??{};
+      const breakpoint=innerWidth<600?'compact':innerWidth<840?'medium':'expanded';
+      for(const[k,v]of Object.entries(p))if(v&&typeof v==='object'&&['compact','medium','expanded'].some(k=>k in v))p[k]=v[breakpoint]??v.compact??Object.values(v)[0];
+      if(n.type==='if')return slot(slots[p.condition?'then':'else'],lexical);
+      if(n.type==='repeat'){const e=element('div');e.className=p.layout==='grid'?'grid':'stack';if(p.layout==='grid')e.style.gridTemplateColumns=`repeat(${Math.max(1,Math.min(12,Number(p.columns??1)))},minmax(0,1fr))`;for(const[item,index]of (Array.isArray(p.items)?p.items:[]).slice(0,200).map((v,i)=>[v,i])){const next={...lexical,[raw.as]:item,[raw.index_as??'index']:index};e.append(slot(slots.item??n.children,{...next,_key:evalValue(raw.key,next)}));}return e;}
+      if(n.type==='component'){const def=c.components[p.component],key=`${p.component}:${p.key??lexical._key??n.id??''}`;const local=locals[key]??=(def.initial_state?evalValue(def.initial_state,lexical):{});const localComputed={};const next={...lexical,props:{...evalValue(def.default_props??{},lexical),...(p.props??{})},state:local,root:{state},computed:localComputed,_slots:slots,_events:p.events??{},_parent:lexical};for(const[k,v]of Object.entries(def.computed_state??{}))localComputed[k]=evalValue(v,next);return node(def.view,next);}
+      if(n.type==='slot')return slot(lexical._slots?.[p.name],lexical._parent??lexical);
+      if(n.type==='data_state'){const status=errors[p.source]?'error':data[p.source]==null?'loading':p.empty_when===true||(Array.isArray(data[p.source])&&!data[p.source].length)?'empty':'content';return slot(slots[status]??{type:'text',props:{text:errors[p.source]??''}},{...lexical,error:errors[p.source]??null});}
+      if(['date_field','time_field','field','switch','select'].includes(n.type)){
+        const label=element('label',p.label??'');const input=element(n.type==='select'?'select':'input');const target=lexical.state??state;
+        input.type=n.type==='date_field'?'date':n.type==='time_field'?'time':n.type==='switch'?'checkbox':p.input_type??'text';
+        if(n.type==='select')for(const opt of p.options??[]){const o=element('option',opt.label??opt);o.value=opt.value??opt;input.append(o);}
+        input.value=target[p.state_key]??'';input.checked=target[p.state_key]===true;input.disabled=p.enabled===false;input.required=p.required===true;
+        if(p.minimum!=null)input.min=p.minimum;if(p.maximum!=null)input.max=p.maximum;if(p.semantic_label)input.setAttribute('aria-label',p.semantic_label);
+        input.onchange=()=>{target[p.state_key]=input.type==='checkbox'?input.checked:input.value;load();};label.append(input);if(p.error_text||p.helper_text)label.append(element('small',p.error_text??p.helper_text));return label;
+      }
+      if(n.type==='button'||n.type==='chip'){const e=element('button',p.label??'');e.onclick=()=>action(n.action,lexical);return e;}
+      if(n.type==='dialog'||n.type==='sheet'){const button=element('button',p.label??p.title??'Open');button.onclick=()=>{const dialog=element('dialog');if(n.type==='sheet')dialog.className='sheet';dialog.append(element('h2',p.title??''),slot(n.children,lexical));const close=element('button','닫기');close.onclick=()=>dialog.close();dialog.append(close);host.append(dialog);dialog.showModal();dialog.onclose=()=>dialog.remove();};return button;}
+      if(n.type==='text'||n.type==='metric'||n.type==='empty')return element('p',p.text??p.value??p.title??'');
+      const e=element('div');e.className=n.type==='grid'?'grid':['row','wrap','flex'].includes(n.type)?'row':['card','surface','section'].includes(n.type)?'card stack':n.type==='skeleton'?'skeleton':n.type==='animated'?'animated stack':'stack';
+      if(p.title)e.append(element('h3',p.title));if(p.subtitle)e.append(element('p',p.subtitle));
+      if(p.semantic_label)e.setAttribute('aria-label',p.semantic_label);if(p.tooltip)e.title=p.tooltip;if(p.opacity!=null)e.style.opacity=p.opacity;
+      for(const [name,css] of [['width','width'],['height','height'],['min_width','minWidth'],['max_width','maxWidth'],['min_height','minHeight'],['max_height','maxHeight']])if(typeof p[name]==='number')e.style[css]=`${p[name]}px`;
+      if(p.padding!=null)e.style.padding=typeof p.padding==='number'?`${p.padding}px`:p.padding;if(p.margin!=null)e.style.margin=typeof p.margin==='number'?`${p.margin}px`:p.margin;
+      if(p.background_color)e.style.backgroundColor=p.background_color;if(p.foreground_color)e.style.color=p.foreground_color;if(p.border_radius!=null)e.style.borderRadius=`${p.border_radius}px`;
+      if(n.type==='grid'&&p.columns)e.style.gridTemplateColumns=`repeat(${Math.max(1,Math.min(12,Number(p.columns)))},minmax(0,1fr))`;
+      for(const child of n.children??[])e.append(node(child,lexical));return e;
+    }
+    function render(){runtime=screenRuntime();count=0;host.replaceChildren(element('h2',extension.title));try{compute();host.append(node(c.view));}catch(e){host.append(element('p',`${e.code??'UI'}: ${e.message}`));}const details=element('details');details.append(element('summary','Runtime Inspector'));details.append(element('pre',JSON.stringify(clean({root_state:state,computed_state:computed,raw_data:raw,data,local_state:locals,runtime,errors,transform_steps:trace,request_timeline:timeline.slice(-200),component_instances:Object.keys(locals),layout:{screen:runtime.screen,overflow:[]}}),null,2)));host.append(details);}
+    surfaces.push(load);load();
+  }
+  document.querySelector('#reload').onclick=()=>surfaces.forEach(load=>load());
+  document.querySelector('#fixture').onchange=async e=>{const f=e.target.files[0];if(f&&f.size<=262144){fixture=clean(JSON.parse(await f.text()));surfaces.forEach(load=>load());}};
+  addEventListener('resize',()=>surfaces.forEach(load=>load()),{passive:true});
+}

package/src/script-contract.js

@@ -0,0 +1,62 @@
+import { SCRIPT_CONTRACT } from './script-spec.js';
+export { SCRIPT_CONTRACT };
+const fields = SCRIPT_CONTRACT.nodes;
+const expressions = new Set(['literal', 'ref', 'identifier', 'array', 'object', 'member', 'binary', 'unary', 'conditional', 'call']);
+const statements = new Set(['declare', 'assign', 'return', 'expression', 'if', 'for']);
+const deny = new Set(['__proto__', 'prototype', 'constructor', 'eval', 'Function', 'globalThis', 'process', 'require']);
+export function validateAst(ast, { inline = false } = {}) {
+  let count = 0;
+  const error = message => { const err = new Error(message); err.code = 'AST'; throw err; };
+  const name = value => { if (typeof value !== 'string' || !/^[A-Za-z_][A-Za-z0-9_]*$/.test(value) || deny.has(value)) error('Invalid AST identifier'); };
+  function visit(node, kinds, depth = 0) {
+    if (++count > (inline ? 64 : 2048) || depth > 64) error('AST budget exceeded');
+    if (!node || typeof node !== 'object' || Array.isArray(node) || !kinds.has(node.type)) error('Invalid AST node');
+    const expected = fields[node.type];
+    if (Object.keys(node).some(key => !['type', 'span', ...expected].includes(key)) || expected.some(key => !Object.hasOwn(node, key))) error('Invalid AST fields');
+    const expr = child => visit(child, expressions, depth + 1);
+    const list = (values, kinds) => {
+      if (!Array.isArray(values) || values.length > 2048) error('Invalid AST array');
+      for (const value of values) visit(value, kinds, depth + 1);
+    };
+    if (node.name !== undefined) name(node.name);
+    if (node.params !== undefined) {
+      if (!Array.isArray(node.params) || node.params.length > 16 || new Set(node.params).size !== node.params.length) error('Invalid parameters');
+      node.params.forEach(name);
+    }
+    if (node.span !== undefined && (!node.span || typeof node.span.file !== 'string' || node.span.file.length > 512 || !['line', 'column', 'offset'].every(k => Number.isInteger(node.span[k]) && node.span[k] >= 0))) error('Invalid source span');
+    switch (node.type) {
+      case 'module':
+        if (node.version !== 1) error('Unknown AST version');
+        list(node.functions, new Set(['function']));
+        if (new Set(node.functions.map(fn => fn.name)).size !== node.functions.length) error('Duplicate function');
+        break;
+      case 'function': if (typeof node.exported !== 'boolean') error('Invalid export'); list(node.body, statements); break;
+      case 'lambda': if (inline) error('Inline callback forbidden'); list(node.body, statements); break;
+      case 'literal': if (node.value !== null && !['string', 'number', 'boolean'].includes(typeof node.value)) error('Literal must be scalar'); if (typeof node.value === 'number' && !Number.isFinite(node.value)) error('Invalid number'); break;
+      case 'ref': if (typeof node.path !== 'string' || !node.path.startsWith('/') || node.path.length > 256) error('Invalid reference'); break;
+      case 'identifier': break;
+      case 'array': list(node.items, expressions); break;
+      case 'object':
+        if (!Array.isArray(node.entries) || node.entries.length > 512) error('Invalid object');
+        const keys = new Set();
+        for (const entry of node.entries) {
+          if (!entry || typeof entry.key !== 'string' || deny.has(entry.key) || keys.has(entry.key) || Object.keys(entry).sort().join(',') !== 'key,value') error('Invalid object entry');
+          keys.add(entry.key); expr(entry.value);
+        }
+        break;
+      case 'member': expr(node.target); expr(node.key); break;
+      case 'binary': if (!['??','||','&&','==','!=','===','!==','<','>','<=','>=','+','-','*','/','%'].includes(node.op)) error('Invalid operator'); expr(node.left); expr(node.right); break;
+      case 'unary': if (!['!','-','+'].includes(node.op)) error('Invalid unary operator'); expr(node.value); break;
+      case 'conditional': expr(node.condition); expr(node.then); expr(node.else); break;
+      case 'call':
+        if (inline && node.target?.type === 'member' && ['map','filter','reduce'].includes(node.target.key?.value)) error('Inline collection transform forbidden');
+        expr(node.target); list(node.args, new Set([...expressions, 'lambda'])); break;
+      case 'declare': if (typeof node.mutable !== 'boolean') error('Invalid declaration'); expr(node.value); break;
+      case 'assign': case 'return': case 'expression': expr(node.value); break;
+      case 'if': expr(node.condition); list(node.then, statements); list(node.else, statements); break;
+      case 'for': expr(node.items); list(node.body, statements); break;
+    }
+  }
+  visit(ast, ast?.type === 'module' && !inline ? new Set(['module']) : expressions);
+  return ast;
+}

package/src/script-data.js

@@ -0,0 +1,41 @@
+/** JSONPath subset: property, quoted property, integer index and wildcard. */
+export function selectJson(value, path) {
+  if (typeof path !== 'string' || path.length > 512 || !path.startsWith('$')) throw new Error('Invalid JSON path');
+  const pattern = /\.([A-Za-z_][A-Za-z0-9_-]*)|\['([^'\\]*)'\]|\[(\d+|\*)\]/gy;
+  let offset = 1, values = [value], wildcard = false, segments = 0;
+  while (offset < path.length) {
+    if (++segments > 20) throw new Error('JSON path exceeds 20 segments');
+    pattern.lastIndex = offset; const match = pattern.exec(path);
+    if (!match) throw new Error('Unsupported JSON path syntax');
+    offset = pattern.lastIndex;
+    const key = match[1] ?? match[2] ?? (match[3] === '*' ? '*' : Number(match[3]));
+    if (['__proto__','constructor','prototype'].includes(key)) throw new Error('Forbidden JSON path property');
+    if (key === '*' && match[3] === '*') {
+      wildcard = true;
+      values = values.flatMap(item => Array.isArray(item) ? item : item && typeof item === 'object' ? Object.keys(item).sort().map(k => item[k]) : []);
+    } else values = values.map(item => item != null && typeof item === 'object' && Object.hasOwn(item,key) ? item[key] : null);
+    if (values.length > 1000) throw new Error('JSON path result exceeds 1000 items');
+  }
+  return wildcard ? values : values[0];
+}
+
+export function runtimeSnapshot({now = new Date(), timezone = Intl.DateTimeFormat().resolvedOptions().timeZone, locale = 'en-US', platform = 'preview', screen = {}} = {}) {
+  const instant = now instanceof Date ? now : new Date(now);
+  if (!Number.isFinite(instant.valueOf())) throw new Error('Invalid runtime clock');
+  const parts = Object.fromEntries(new Intl.DateTimeFormat('en-US', {timeZone: timezone, year:'numeric',month:'2-digit',day:'2-digit'}).formatToParts(instant).map(p => [p.type,p.value]));
+  return Object.freeze({now: instant.toISOString(), today:`${parts.year}-${parts.month}-${parts.day}`, timezone, locale, platform, screen: {...screen}});
+}
+
+export function dependencyOrder(graph) {
+  const complete = new Set(), active = new Set(), result = [];
+  function visit(id) {
+    if (active.has(id)) throw new Error(`Dependency cycle: ${[...active,id].join(' -> ')}`);
+    if (complete.has(id)) return;
+    if (!Object.hasOwn(graph,id)) throw new Error(`Unknown dependency ${id}`);
+    active.add(id);
+    for (const dependency of graph[id]) visit(dependency);
+    active.delete(id); complete.add(id); result.push(id);
+  }
+  for (const id of Object.keys(graph)) visit(id);
+  return result;
+}

package/src/script-project.js

@@ -0,0 +1,60 @@
+import { isDeepStrictEqual } from 'node:util';
+import { validateValueSchema } from './script-schema.js';
+export { validateValueSchema, assertSchema } from './script-schema.js';
+import { createHash } from 'node:crypto';
+import { compileExpression, compileModule } from './morit-script.js';
+import { validateAst, SCRIPT_CONTRACT } from './script-contract.js';
+
+const hash = source => createHash('sha256').update(source).digest('hex');
+const fail = message => { throw new Error(`Morit Script: ${message}`); };
+
+/** Compile source modules and inline expressions without mutating source files. */
+export function compileScriptProject(config, files) {
+  const declarations = config.logic_modules ?? [];
+  if (!Array.isArray(declarations) || declarations.length > SCRIPT_CONTRACT.limits.modules) fail('at most 16 modules are allowed');
+  const modules = Object.create(null), artifacts = Object.create(null), expressions = Object.create(null), warnings = [];
+  let total = 0;
+  for (const declaration of declarations) {
+    if (!declaration || typeof declaration !== 'object' || Object.keys(declaration).some(key => !['id','path','exports'].includes(key))) fail('invalid module declaration');
+    const {id, path, exports} = declaration;
+    if (typeof id !== 'string' || !/^[a-z][a-z0-9_]{0,63}$/.test(id) || ['state','computed','data','props','runtime','context','html','date','string','object','array','number'].includes(id) || Object.hasOwn(modules,id)) fail('invalid or duplicate module id');
+    if (typeof path !== 'string' || !/^logic\/[A-Za-z0-9_-]+(?:\/[A-Za-z0-9_-]+)*\.morit$/.test(path)) fail('module path must be logic/*.morit');
+    const source = files[path]; if (typeof source !== 'string') fail(`missing source ${path}`);
+    total += Buffer.byteLength(source);
+    if (total > SCRIPT_CONTRACT.limits.source_bytes) fail('total source exceeds 128 KiB');
+    if (!exports || typeof exports !== 'object' || Array.isArray(exports) || !Object.keys(exports).length) fail('module exports require typed input/output');
+    const compiled = compileModule(source, path);
+    if (compiled.ast.functions.some(fn => fn.exported && fn.params.length !== 1)) fail('exports require exactly one typed input');
+    const actual = compiled.ast.functions.filter(fn => fn.exported).map(fn => fn.name).sort();
+    if (JSON.stringify(actual) !== JSON.stringify(Object.keys(exports).sort())) fail(`declared exports do not match ${path}`);
+    for (const [name, schema] of Object.entries(exports)) {
+      if (!schema || typeof schema !== 'object' || Object.keys(schema).sort().join(',') !== 'input_schema,output_schema') fail(`${id}.${name} requires input_schema and output_schema`);
+      validateValueSchema(schema.input_schema); validateValueSchema(schema.output_schema);
+    }
+    modules[id] = {...compiled, exports, source};
+    artifacts[path.replace(/\.morit$/, '.ast.json')] = JSON.stringify(compiled);
+  }
+  const counts = new Map();
+  function visit(value, path = 'config', depth = 0) {
+    if (depth > 40) fail('configuration nesting exceeds 40');
+    if (typeof value === 'string') {
+      for (const match of value.matchAll(/\{\{=([\s\S]*?)\}\}/g)) {
+        const source = match[1].trim(); const id = hash(source);
+        expressions[id] ??= compileExpression(source, path);
+        counts.set(source, (counts.get(source) ?? 0) + 1);
+      }
+    } else if (Array.isArray(value)) value.forEach((item,index) => visit(item, `${path}[${index}]`, depth+1));
+    else if (value && typeof value === 'object') for (const [key,item] of Object.entries(value)) visit(item, `${path}.${key}`,depth+1);
+  }
+  visit(config);
+  for (const [source,count] of counts) if (count > 1) warnings.push({code:'REPEATED_INLINE',message:'Extract repeated expression to computed_state or a module',expression:source,count});
+  return {version:1, modules, expressions, artifacts, warnings};
+}
+
+export function verifyCompiledModule(source, compiled) {
+  if (!compiled || compiled.version !== 1 || compiled.source_sha256 !== hash(source)) fail('source hash mismatch');
+  validateAst(compiled.ast);
+  const expected = compileModule(source, compiled.ast.functions[0]?.span?.file ?? 'logic/main.morit');
+  if (!isDeepStrictEqual(expected.ast, compiled.ast)) fail('compiled AST does not match source');
+}
+