@unbound-app/cli 0.7.1 → 0.7.2

package/dist/index.mjs

@@ -1,21 +1,17 @@
 #!/usr/bin/env node
 import { cli, command } from "cleye";
 import { z } from "zod";
-import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, watch, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, openAsBlob, readFileSync, readdirSync, rmSync, watch, writeFileSync } from "node:fs";
 import { basename, dirname, join, relative, resolve, sep } from "node:path";
 import { ControllerClient } from "@unbound-app/debugger-protocol/controller";
 import { CONTROLLER_ENDPOINT_MARKER, DEFAULT_BRIDGE_PORT } from "@unbound-app/debugger-protocol";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import { API_KEY_HEADER, ApiRequestError, CLI_CLIENT_ID, createApiClient } from "@unbound-app/web/client";
-import toError from "@unbound-app/utils/to-error";
 import { glob } from "node:fs/promises";
 import { spawn, spawnSync } from "node:child_process";
-import { addonManifestSchema } from "@unbound-app/contracts/manifest";
-import { publishArtifact } from "@unbound-app/web/publish";
-import { apiUrlSchema } from "@unbound-app/contracts/api";
 import { homedir } from "node:os";
 import { cancel, confirm, intro, isCancel, note, outro, select, text } from "@clack/prompts";
+import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import { deviceAuthorizationClient } from "better-auth/client/plugins";
 import { createAuthClient } from "better-auth/client";
 import pc from "picocolors";
@@ -259,6 +255,111 @@ function toMcpTool(server, definition, context) {
 	});
 }
 //#endregion
+//#region ../contracts/src/errors.ts
+const apiErrorCodeSchema = z.enum([
+	"invalid_request",
+	"invalid_manifest",
+	"unauthorized",
+	"forbidden",
+	"not_found",
+	"rate_limited",
+	"addon_id_taken",
+	"not_maintainer",
+	"version_exists",
+	"pending_update_exists",
+	"pending_listing_cap",
+	"account_too_new",
+	"artifact_too_large",
+	"upload_missing",
+	"upload_expired",
+	"upload_size_mismatch",
+	"submission_not_awaiting_upload",
+	"submission_not_pending",
+	"self_review",
+	"artifact_mismatch",
+	"last_owner",
+	"github_not_linked",
+	"github_no_push_access",
+	"internal_error"
+]);
+/** The body of every non-2xx JSON response from `/api/v1/*`. */
+const apiErrorResponseSchema = z.object({ error: z.object({
+	code: apiErrorCodeSchema,
+	message: z.string()
+}) });
+//#endregion
+//#region ../../apps/web/src/api/client.ts
+/** The header `ubd publish` sends an API key in, for CI publishing. */
+const API_KEY_HEADER = "x-api-key";
+/** A non-2xx response from the API, carrying the contract error code. */
+var ApiRequestError = class extends Error {
+	code;
+	status;
+	constructor(code, status, message) {
+		super(message);
+		this.code = code;
+		this.status = status;
+		this.name = "ApiRequestError";
+	}
+};
+function buildUrl(baseUrl, path, params, query) {
+	const url = new URL(buildPath(path, params), baseUrl);
+	for (const [name, value] of Object.entries(query ?? {})) {
+		if (value === void 0) continue;
+		url.searchParams.set(name, value);
+	}
+	return url;
+}
+function buildPath(path, params) {
+	return path.replaceAll(/\$(\w+)/g, (_, name) => {
+		const value = params?.[name];
+		if (value === void 0) throw new Error(`Missing path parameter ${name} for ${path}.`);
+		return encodeURIComponent(value);
+	});
+}
+async function toRequestError(response) {
+	const parsed = apiErrorResponseSchema.safeParse(await response.json().catch(() => null));
+	if (!parsed.success) return new ApiRequestError("internal_error", response.status, `Unexpected ${response.status} response without an error body.`);
+	return new ApiRequestError(parsed.data.error.code, response.status, parsed.data.error.message);
+}
+/**
+* @description Creates a typed client for the Unbound web API. Routes, bodies and responses are
+* checked against the API map exported by `@unbound-app/web/api`; responses are parsed with the
+* route's contract schema and `{ error: { code, message } }` bodies are thrown as
+* {@link ApiRequestError}.
+* @template Api The API map, `Api` from `@unbound-app/web/api`.
+* @param options The API origin and headers sent with every request (e.g. credentials).
+* @returns A `request(route, options)` function.
+*/
+function createApiClient(options) {
+	return async function request(route, init) {
+		const separator = route.indexOf(" ");
+		const method = route.slice(0, separator);
+		const path = route.slice(separator + 1);
+		const headers = new Headers(options.headers);
+		for (const [name, value] of new Headers(init.headers)) headers.set(name, value);
+		if (init.body !== void 0) headers.set("content-type", "application/json");
+		const url = buildUrl(options.baseUrl, path, init.params, init.query);
+		const response = await fetch(url, {
+			method,
+			headers,
+			body: init.body === void 0 ? void 0 : JSON.stringify(init.body)
+		});
+		if (!response.ok) throw await toRequestError(response);
+		return init.response.parse(await response.json());
+	};
+}
+//#endregion
+//#region ../utils/src/to-error.ts
+/**
+* @description Normalises a thrown value into an `Error`, wrapping anything that is not one.
+* @param error The thrown value.
+* @returns The value itself when it is an `Error`, otherwise an `Error` carrying its string form.
+*/
+function toError(error) {
+	return error instanceof Error ? error : new Error(String(error));
+}
+//#endregion
 //#region src/lib/discovery.ts
 /**
 * @description Discovers every addon reachable through the config's `addons` globs. A directory is an
@@ -341,6 +442,155 @@ function buildAddon(addon, buildCommand) {
 	});
 }
 //#endregion
+//#region ../types/typings/native.ts
+const NATIVE_PLUGIN_CAPABILITIES = [
+	"native.objc.classes",
+	"native.objc.invoke",
+	"native.objc.ivars",
+	"native.objc.associations",
+	"native.objc.hooks",
+	"native.ffi.symbols",
+	"native.ffi.call",
+	"native.fabric.mount"
+];
+//#endregion
+//#region ../types/typings/addons.ts
+/** The kinds of addon a manifest can declare. */
+const ADDON_TYPES = [
+	"plugin",
+	"theme",
+	"icon-pack",
+	"font"
+];
+//#endregion
+//#region ../contracts/src/manifest.ts
+/**
+* A strict SemVer 2.0.0 version (the specification's own pattern): no `v` prefix, no leading zeros.
+* Versions become object-storage path segments and are ordered by the server, so loose forms are refused.
+*/
+const semverSchema = z.string().max(64).regex(/^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$/, "Must be a semver version.");
+/**
+* Addon ids become object-storage path segments (`addons/{id}/{version}/...`), so they are limited to
+* path-safe characters: alphanumeric runs joined by single `.`, `_` or `-`.
+*/
+const addonIdSchema = z.string().max(100).regex(/^[A-Za-z0-9]+(?:[._-][A-Za-z0-9]+)*$/, "Must be alphanumeric segments joined by \".\", \"_\" or \"-\".");
+const addonAuthorSchema = z.object({
+	name: z.string().min(1),
+	id: z.templateLiteral([z.int().nonnegative()])
+});
+/**
+* The manifest an author publishes. Unknown keys pass through untouched so the stored manifest is
+* exactly what the author shipped; only the fields the platform relies on are validated.
+*/
+const addonManifestSchema = z.looseObject({
+	id: addonIdSchema,
+	type: z.enum(ADDON_TYPES).optional(),
+	name: z.string().min(1),
+	description: z.string(),
+	authors: z.array(addonAuthorSchema).min(1),
+	icon: z.union([z.string(), z.object({ uri: z.string() })]).optional(),
+	main: z.string().regex(/^(?:[\w-][\w.-]*\/)*[\w-][\w.-]*$/, "Must be a relative path inside the addon."),
+	version: semverSchema,
+	capabilities: z.array(z.enum(NATIVE_PLUGIN_CAPABILITIES)).optional(),
+	minNativePluginApi: z.string().optional(),
+	unbound: z.object({ min: semverSchema.optional() }).optional()
+});
+//#endregion
+//#region ../contracts/src/publish.ts
+/** `listing` claims a new addon id; `update` publishes a new version of an addon the caller maintains. */
+const submissionKindSchema = z.enum(["listing", "update"]);
+const submissionStatusSchema = z.enum([
+	"awaiting_upload",
+	"pending_review",
+	"changes_requested",
+	"approved",
+	"rejected",
+	"superseded",
+	"expired",
+	"cancelled"
+]);
+submissionStatusSchema.extract([
+	"awaiting_upload",
+	"pending_review",
+	"changes_requested"
+]);
+/** A GitHub repository as `owner/name`. */
+const repositorySchema = z.string().regex(/^[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?\/[A-Za-z0-9._-]+$/, "Must be a GitHub owner/name.");
+/** The statuses a reviewer's decision moves a pending submission to. */
+const reviewDecisionSchema = submissionStatusSchema.extract([
+	"approved",
+	"rejected",
+	"changes_requested"
+]);
+const submissionReviewSchema = z.object({
+	decision: reviewDecisionSchema,
+	/** The rejection reason or requested changes; optional only on approval. */
+	note: z.string().nullable(),
+	reviewedAt: z.iso.datetime()
+});
+const submissionSchema = z.object({
+	id: z.string().min(1),
+	addonId: addonIdSchema,
+	version: z.string(),
+	kind: submissionKindSchema,
+	status: submissionStatusSchema,
+	repository: repositorySchema.nullable(),
+	/** No repository was named, so reviewers cannot tie the artifact to source the author controls. */
+	unverifiedSource: z.boolean(),
+	/** The reviewer's decision, once one was made. */
+	review: submissionReviewSchema.nullable()
+});
+z.object({
+	manifest: addonManifestSchema,
+	bundleSize: z.int().positive(),
+	repository: repositorySchema.optional(),
+	changelog: z.string().max(1e4).optional()
+});
+/** A presigned upload for the bundle; send exactly `bundleSize` bytes with `headers` before `expiresAt`. */
+const submissionUploadSchema = z.object({
+	url: z.url(),
+	method: z.literal("PUT"),
+	headers: z.record(z.string(), z.string()),
+	expiresAt: z.iso.datetime()
+});
+const createSubmissionResponseSchema = z.object({
+	submission: submissionSchema,
+	upload: submissionUploadSchema
+});
+z.object({});
+const finalizeSubmissionResponseSchema = z.object({ submission: submissionSchema });
+//#endregion
+//#region ../../apps/web/src/api/publish.ts
+/**
+* @description Publishes a built addon for review: opens a submission (the server refuses it, before
+* anything is uploaded, when the bundle is over its size limit or a spam gate applies), uploads the
+* bundle to the presigned URL and finalizes the submission.
+* @param request The typed API client, authenticated as the publisher.
+* @param artifact The manifest, bundle and submission details.
+* @returns The submission, pending review.
+*/
+async function publishArtifact(request, { manifest, bundle, repository, changelog }) {
+	const { submission, upload } = await request("POST /api/v1/submissions", {
+		body: {
+			manifest,
+			bundleSize: bundle.size,
+			repository,
+			changelog
+		},
+		response: createSubmissionResponseSchema
+	});
+	const uploaded = await fetch(upload.url, {
+		method: upload.method,
+		headers: upload.headers,
+		body: bundle
+	});
+	if (!uploaded.ok) throw new Error(`Uploading the bundle of submission ${submission.id} failed with ${uploaded.status}: ${await uploaded.text()}`);
+	return (await request("POST /api/v1/submissions/$id/finalize", {
+		params: { id: submission.id },
+		response: finalizeSubmissionResponseSchema
+	})).submission;
+}
+//#endregion
 //#region src/lib/bundle-name.ts
 /**
 * @description Names an addon's bundle inside its output directory. A static addon ships the file
@@ -353,6 +603,10 @@ function getBundleName(addon, main) {
 	return addon.static ? main : basename(main).replace(/\.\w+$/, ".js");
 }
 //#endregion
+//#region ../contracts/src/api.ts
+/** The origin of the Unbound web API, reduced from any http(s) URL; production when unset. */
+const apiUrlSchema = z.url({ protocol: /^https?$/ }).transform((url) => new URL(url).origin).default("https://unbound.rip");
+//#endregion
 //#region src/lib/env.ts
 const schema$1 = z.object({
 	/** The origin of the Unbound web API that `ubd login` and `ubd publish` talk to. */
@@ -461,7 +715,7 @@ function readArtifact(addon) {
 			...parsed.data,
 			main
 		},
-		bundle: Bun.file(join(addon.output, main))
+		bundlePath: join(addon.output, main)
 	};
 }
 /**
@@ -472,8 +726,9 @@ function readArtifact(addon) {
 * @returns The submission, pending review.
 */
 async function publish({ env, addon, repository, changelog }) {
-	const { manifest, bundle } = readArtifact(addon);
-	if (!await bundle.exists()) throw new Error(`Built bundle not found at ${bundle.name}. Build ${addon.id} first.`);
+	const { manifest, bundlePath } = readArtifact(addon);
+	if (!existsSync(bundlePath)) throw new Error(`Built bundle not found at ${bundlePath}. Build ${addon.id} first.`);
+	const bundle = await openAsBlob(bundlePath);
 	return publishArtifact(createClient(env), {
 		manifest,
 		bundle,
@@ -973,7 +1228,7 @@ async function login({ env, delay, prompt }) {
 		baseURL: env.UNBOUND_API_URL,
 		plugins: [deviceAuthorizationClient()]
 	});
-	const code = await auth.device.code({ client_id: CLI_CLIENT_ID });
+	const code = await auth.device.code({ client_id: "ubd" });
 	if (code.error) throw new Error(`Could not start the login: ${code.error.error_description} (${code.error.error}).`);
 	prompt({
 		userCode: code.data.user_code,
@@ -986,7 +1241,7 @@ async function login({ env, delay, prompt }) {
 		const token = await auth.device.token({
 			grant_type: DEVICE_CODE_GRANT,
 			device_code: code.data.device_code,
-			client_id: CLI_CLIENT_ID
+			client_id: "ubd"
 		});
 		if (token.data) {
 			const path = getCredentialsPath(env);
@@ -1025,7 +1280,7 @@ const loginCommand = {
 				ok: true,
 				text: `Logged in. Credentials stored in ${await login({
 					env,
-					delay: Bun.sleep,
+					delay: setTimeout$1,
 					prompt: printCode
 				})}.`
 			};

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@unbound-app/cli",
-	"version": "0.7.1",
+	"version": "0.7.2",
 	"description": "The `ubd` command line for the Unbound client: evaluate on-device code and serve the debugger as an MCP.",
 	"author": {
 		"name": "Mario P.",
@@ -28,11 +28,7 @@
 	"dependencies": {
 		"@clack/prompts": "^1.7.0",
 		"@modelcontextprotocol/sdk": "^1.29.0",
-		"@unbound-app/contracts": "0.7.1",
-		"@unbound-app/debugger-protocol": "0.7.0",
-		"@unbound-app/types": "0.7.0",
-		"@unbound-app/utils": "0.7.0",
-		"@unbound-app/web": "0.7.1",
+		"@unbound-app/debugger-protocol": "0.7.2",
 		"better-auth": "1.7.10",
 		"cleye": "^1.3.4",
 		"picocolors": "^1.1.1",