amorphous-cli 0.1.0

package/lib/config.mjs

@@ -0,0 +1,92 @@
+import { readFileSync, existsSync } from 'node:fs'
+import { homedir } from 'node:os'
+import { join } from 'node:path'
+
+export function loadDotEnv(cwd = process.cwd()) {
+  const roots = []
+  if (process.env.AMORPHOUS_ROOT) roots.push(process.env.AMORPHOUS_ROOT)
+  let dir = cwd
+  for (let i = 0; i < 8; i++) {
+    roots.push(dir)
+    const parent = join(dir, '..')
+    if (parent === dir) break
+    dir = parent
+  }
+  for (const base of roots) {
+    const path = join(base, '.env')
+    if (!existsSync(path)) continue
+    for (const line of readFileSync(path, 'utf8').split('\n')) {
+      const m = /^([^#=]+)=(.*)$/.exec(line.trim())
+      if (m && process.env[m[1]] === undefined) {
+        process.env[m[1]] = m[2]
+      }
+    }
+    return
+  }
+}
+
+/** Hosted defaults. `APP_ORIGIN` and the other env vars, including a local `.env`, override these. */
+const HOSTED = {
+  appOrigin: 'https://amorphous.one',
+  abstractsOrigin: 'https://abstracts.amorphous.one',
+  supabaseUrl: 'https://tzbimtuvddovafbfkxbl.supabase.co',
+  supabaseAnonKey:
+    'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InR6YmltdHV2ZGRvdmFmYmZreGJsIiwicm9sZSI6ImFub24iLCJpYXQiOjE3OTEyODczNTAsImV4cCI6MjEwNjg2MzM1MH0.S5HPmOmB0-JuulTEN1uUAJMOlCnPlkSm0BsSMBFCpXs',
+}
+
+export function appOrigin() {
+  return process.env.APP_ORIGIN || HOSTED.appOrigin
+}
+
+/** Local Herd HTTPS: hit Nuxt on loopback with the app Host header (no TLS). */
+export function cliAppFetchOrigin() {
+  if (process.env.AMORPHOUS_CLI_APP_URL) {
+    return process.env.AMORPHOUS_CLI_APP_URL.replace(/\/$/, '')
+  }
+  const origin = appOrigin()
+  try {
+    const u = new URL(origin)
+    if (u.protocol === 'https:' && (u.hostname.endsWith('.test') || u.hostname === 'localhost')) {
+      const port = process.env.AMORPHOUS_DEV_PORT || '3847'
+      return `http://127.0.0.1:${port}`
+    }
+  } catch {
+    /* ignore */
+  }
+  return origin.replace(/\/$/, '')
+}
+
+export function cliAppHostHeader() {
+  const origin = appOrigin()
+  const fetchOrigin = cliAppFetchOrigin()
+  if (!fetchOrigin.startsWith('http://127.0.0.1')) return {}
+  try {
+    const u = new URL(origin)
+    return { Host: u.host }
+  } catch {
+    return {}
+  }
+}
+
+export function abstractsOrigin() {
+  return process.env.ABSTRACTS_ORIGIN || HOSTED.abstractsOrigin
+}
+
+export function supabaseUrl() {
+  return process.env.SUPABASE_URL || HOSTED.supabaseUrl
+}
+
+export function supabaseAnonKey() {
+  return process.env.SUPABASE_ANON_KEY || process.env.SUPABASE_KEY || HOSTED.supabaseAnonKey
+}
+
+export function credentialsPath() {
+  return (
+    process.env.AMORPHOUS_CREDENTIALS ||
+    join(homedir(), '.config', 'amorphous', 'credentials.json')
+  )
+}
+
+export function projectMetaPath(cwd = process.cwd()) {
+  return join(cwd, '.amorphous.json')
+}

package/lib/files.mjs

@@ -0,0 +1,50 @@
+import { readFileSync, writeFileSync, existsSync } from 'node:fs'
+import { join } from 'node:path'
+
+const FILES = ['index.html', 'styles.css', 'app.js', 'data.ndjson', 'private.ndjson']
+
+export function readNdjson(path) {
+  if (!existsSync(path)) return []
+  return readFileSync(path, 'utf8')
+    .split('\n')
+    .map((l) => l.trim())
+    .filter(Boolean)
+    .map((l) => JSON.parse(l))
+}
+
+export function writeNdjson(path, rows) {
+  const body = rows.map((r) => JSON.stringify(r)).join('\n')
+  writeFileSync(path, body ? `${body}\n` : '')
+}
+
+export function readProjectFiles(cwd) {
+  return {
+    html: existsSync(join(cwd, 'index.html'))
+      ? readFileSync(join(cwd, 'index.html'), 'utf8')
+      : '',
+    css: existsSync(join(cwd, 'styles.css'))
+      ? readFileSync(join(cwd, 'styles.css'), 'utf8')
+      : '',
+    js: existsSync(join(cwd, 'app.js')) ? readFileSync(join(cwd, 'app.js'), 'utf8') : '',
+    shared: readNdjson(join(cwd, 'data.ndjson')),
+    private: readNdjson(join(cwd, 'private.ndjson')),
+  }
+}
+
+export function writeProjectFiles(cwd, payload) {
+  writeFileSync(join(cwd, 'index.html'), payload.html ?? '')
+  writeFileSync(join(cwd, 'styles.css'), payload.css ?? '')
+  writeFileSync(join(cwd, 'app.js'), payload.js ?? '')
+  writeNdjson(join(cwd, 'data.ndjson'), payload.shared ?? [])
+  writeNdjson(join(cwd, 'private.ndjson'), payload.private ?? [])
+}
+
+export function recordsFromLocal(cwd) {
+  const { shared, private: priv } = readProjectFiles(cwd)
+  return [
+    ...shared.map((r) => ({ ...r, visibility: r.visibility || 'shared' })),
+    ...priv.map((r) => ({ ...r, visibility: 'private' })),
+  ]
+}
+
+export { FILES }

package/lib/help.mjs

@@ -0,0 +1,150 @@
+export const ROOT_HELP = `Amorphous
+
+  login <email>                 Sign in
+  list                          List abstracts
+  create                        New abstract
+  open [abstract]               Open URL (the page)
+  preview [abstract]            Preview URL (draft)
+  pull                          Pull draft and records to this folder
+  push                          Push local files
+  publish [--live]              Publish a version; --live is Go live
+  live [abstract]               Make a version live
+  visibility anyone|members     Anyone can view / Members only
+  invite <email>                Invite
+  remove <email|id>             Remove
+  people [abstract]             People
+  tag / untag                   Tag
+  move --folder                 Move to folder
+  archive / restore             Archive / Restore
+  star / unstar                 Star
+  suggest-folder [--apply]      Suggest folder
+  folder new                    New folder
+  folder list                   Folders
+  folder move                   Move folder
+  folder invite                 Invite to a folder
+  folder remove                 Remove from a folder
+  folder people                 People on a folder
+  rename --name                 Rename
+
+Run amorphous <command> --help for flags. Pass --json where you need machine output.
+`
+
+export const COMMAND_HELP = {
+  login: `login <email>
+
+Sign in with a magic link sent to that email.`,
+
+  list: `list [--view recents|all|starred|archive] [--folder <name>] [--tag <name>] [--search <q>] [--json]
+
+List abstracts. Default view is all (All Abstracts).
+--folder filters to a folder. --tag filters to a tag.`,
+
+  create: `create [--name <name>] [--folder <name>] [--json]
+
+New abstract. Writes .amorphous.json in this directory.`,
+
+  open: `open [abstract] [--json]
+
+Print the Open URL (the page on Amorphous).`,
+
+  preview: `preview [abstract] [--json]
+
+Print the Preview URL (draft).`,
+
+  pull: `pull
+
+Pull the draft and records into this directory.`,
+
+  push: `push
+
+Push local index.html, styles.css, app.js, and records.`,
+
+  publish: `publish [--live]
+
+Publish a new version. --live also makes it the live version (Go live).`,
+
+  live: `live [abstract] [--version <id>]
+
+Make this the live version. Uses the latest published version if you omit --version.`,
+
+  visibility: `visibility <anyone|members> [abstract] [--version <id>]
+
+Anyone can view, or Members only. Uses the live version if you omit --version.`,
+
+  invite: `invite <email> [view|use|edit] [--abstract <id|name>]
+
+Invite someone by email. Access: view, use (Can use), or edit. Default: view.`,
+
+  remove: `remove <email|id> [--abstract <id|name>]
+
+Remove someone. Use their email or id from people.`,
+
+  people: `people [abstract] [--json]
+
+People on this abstract.`,
+
+  tag: `tag [abstract] --tag <name>
+
+Tag.`,
+
+  untag: `untag [abstract] --tag <name>
+
+Remove a tag.`,
+
+  move: `move [abstract] --folder <name|path> | --none
+
+Move to folder. --none is No folder.`,
+
+  archive: `archive [abstract]
+
+Archive.`,
+
+  restore: `restore [abstract]
+
+Restore.`,
+
+  star: `star [abstract]
+
+Star.`,
+
+  unstar: `unstar [abstract]
+
+Unstar.`,
+
+  'suggest-folder': `suggest-folder [abstract] [--apply] [--json]
+
+Suggest folder from the name. Default is a suggestion only. --apply uses it.`,
+
+  folder: `folder <new|list|move|invite|remove|people> …
+
+  folder new --name <name> [--parent <id>]
+  folder list [--json]
+  folder move <folder> --parent <id|none>
+  folder invite <folder> --email <email>
+  folder remove <folder> <email|id>
+  folder people <folder> [--json]
+
+New folder, move a folder, or invite people to a folder.`,
+
+  rename: `rename [abstract] --name <name>
+
+Rename.`,
+}
+
+export const ALIASES = {
+  grant: 'invite',
+  revoke: 'remove',
+  unarchive: 'restore',
+  organise: 'suggest-folder',
+  'auto-file': 'suggest-folder',
+  collection: 'folder',
+}
+
+export function wantsHelp(args) {
+  return args.includes('--help') || args.includes('-h')
+}
+
+export function printHelp(name) {
+  const text = name ? COMMAND_HELP[name] : ROOT_HELP
+  console.log(text.trimEnd())
+}

package/lib/login.mjs

@@ -0,0 +1,153 @@
+import { createServer } from 'node:http'
+import { createServer as createNetServer } from 'node:net'
+import { createClient } from '@supabase/supabase-js'
+import { loadDotEnv, supabaseAnonKey, supabaseUrl } from './config.mjs'
+import { mailpitBase, sessionFromVerifyUrl, waitForMagicLinkVerifyUrl } from './mailpit.mjs'
+import { saveSession } from './session.mjs'
+
+async function freePort(preferred) {
+  if (preferred) {
+    const ok = await new Promise((resolve) => {
+      const s = createNetServer()
+      s.once('error', () => resolve(false))
+      s.listen(preferred, '127.0.0.1', () => {
+        s.close(() => resolve(true))
+      })
+    })
+    if (ok) return preferred
+  }
+  return new Promise((resolve, reject) => {
+    const s = createNetServer()
+    s.listen(0, '127.0.0.1', () => {
+      const addr = s.address()
+      const port = typeof addr === 'object' && addr ? addr.port : 8765
+      s.close(() => resolve(port))
+    })
+    s.on('error', reject)
+  })
+}
+
+async function mailpitReachable() {
+  if (process.env.AMORPHOUS_AGENT_LOGIN === '0') return false
+  try {
+    const res = await fetch(`${mailpitBase()}/api/v1/messages`, {
+      signal: AbortSignal.timeout(1500),
+    })
+    return res.ok
+  } catch {
+    return false
+  }
+}
+
+async function loginViaMailpit(supabase, email, redirectTo, sinceMs) {
+  const verifyUrl = await waitForMagicLinkVerifyUrl(email, { sinceMs })
+  const prefix = redirectTo.split('?')[0]
+  const material = await sessionFromVerifyUrl(verifyUrl, prefix)
+  if (material.kind === 'code') {
+    const { data, error } = await supabase.auth.exchangeCodeForSession(material.code)
+    if (error) throw error
+    return data.session
+  }
+  return {
+    access_token: material.access_token,
+    refresh_token: material.refresh_token,
+  }
+}
+
+async function loginViaCallbackServer(supabase, email, redirectTo) {
+  const callbackPort = new URL(redirectTo).port || '8765'
+  return new Promise((resolve, reject) => {
+    const server = createServer(async (req, res) => {
+      try {
+        const url = new URL(req.url || '/', redirectTo)
+        if (url.pathname === '/callback' && url.searchParams.get('code')) {
+          const code = url.searchParams.get('code')
+          const { data, error } = await supabase.auth.exchangeCodeForSession(code)
+          if (error) throw error
+          res.writeHead(200, { 'Content-Type': 'text/html' })
+          res.end('<p>Signed in. You can close this tab and return to the terminal.</p>')
+          server.close()
+          resolve(data.session)
+          return
+        }
+        if (url.pathname === '/callback') {
+          res.writeHead(200, { 'Content-Type': 'text/html' })
+          res.end(`<!DOCTYPE html><html><body><p>Completing sign-in…</p><script>
+            const h = new URLSearchParams(location.hash.slice(1));
+            const access_token = h.get('access_token');
+            const refresh_token = h.get('refresh_token');
+            if (access_token) {
+              fetch('/token', { method:'POST', headers:{'Content-Type':'application/json'},
+                body: JSON.stringify({ access_token, refresh_token }) })
+                .then(() => { document.body.innerHTML = '<p>Signed in. Close this tab.</p>'; });
+            }
+          </script></body></html>`)
+          return
+        }
+        if (url.pathname === '/token' && req.method === 'POST') {
+          let body = ''
+          for await (const chunk of req) body += chunk
+          const parsed = JSON.parse(body)
+          res.writeHead(204)
+          res.end()
+          server.close()
+          resolve({
+            access_token: parsed.access_token,
+            refresh_token: parsed.refresh_token,
+          })
+          return
+        }
+        res.writeHead(404)
+        res.end()
+      } catch (e) {
+        reject(e)
+      }
+    })
+    server.listen(callbackPort, '127.0.0.1', async () => {
+      const { error } = await supabase.auth.signInWithOtp({
+        email,
+        options: { emailRedirectTo: redirectTo },
+      })
+      if (error) {
+        server.close()
+        reject(error)
+        return
+      }
+      console.error(`Magic link sent to ${email}. Open it (Mailpit ${mailpitBase()}).`)
+      console.error(`Waiting for callback on ${redirectTo} …`)
+    })
+    server.on('error', reject)
+    setTimeout(() => {
+      server.close()
+      reject(new Error('Login timed out after 5 minutes'))
+    }, 5 * 60 * 1000)
+  })
+}
+
+export async function loginWithMagicLink(email) {
+  loadDotEnv()
+  const preferred = Number(process.env.AMORPHOUS_CLI_CALLBACK_PORT || 8765)
+  const port = await freePort(preferred)
+  const redirectTo = `http://127.0.0.1:${port}/callback`
+  const supabase = createClient(supabaseUrl(), supabaseAnonKey())
+  const sinceMs = Date.now()
+
+  let tokens
+  if (await mailpitReachable()) {
+    const { error } = await supabase.auth.signInWithOtp({
+      email,
+      options: { emailRedirectTo: redirectTo },
+    })
+    if (error) throw error
+    console.error(`Magic link sent to ${email}. Reading Mailpit (${mailpitBase()})…`)
+    tokens = await loginViaMailpit(supabase, email, redirectTo, sinceMs)
+  } else {
+    tokens = await loginViaCallbackServer(supabase, email, redirectTo)
+  }
+
+  saveSession({
+    access_token: tokens.access_token,
+    refresh_token: tokens.refresh_token,
+  })
+  console.log('Logged in.')
+}

package/lib/mailpit.mjs

@@ -0,0 +1,99 @@
+const DEFAULT_MAILPIT = 'http://127.0.0.1:55424'
+
+export function mailpitBase() {
+  return (
+    process.env.AMORPHOUS_MAILPIT_URL ||
+    process.env.MAILPIT_URL ||
+    process.env.INBUCKET_URL ||
+    DEFAULT_MAILPIT
+  ).replace(/\/$/, '')
+}
+
+function decodeHtmlAttr(url) {
+  return url.replace(/&/g, '&').replace(/"/g, '"')
+}
+
+function extractVerifyHref(html) {
+  const re = /href="([^"]*\/auth\/v1\/verify[^"]*)"/i
+  const m = re.exec(html || '')
+  return m ? decodeHtmlAttr(m[1]) : null
+}
+
+async function listMessages(base) {
+  const res = await fetch(`${base}/api/v1/messages`)
+  if (!res.ok) throw new Error(`Mailpit list failed: ${res.status}`)
+  const data = await res.json()
+  return data.messages || []
+}
+
+async function messageHtml(base, id) {
+  const res = await fetch(`${base}/api/v1/message/${id}`)
+  if (!res.ok) throw new Error(`Mailpit read failed: ${res.status}`)
+  const data = await res.json()
+  return data.HTML || data.Text || ''
+}
+
+/**
+ * Wait for a magic-link email and return the auth verify URL (not yet followed).
+ */
+export async function waitForMagicLinkVerifyUrl(email, { sinceMs = Date.now(), timeoutMs = 120_000 } = {}) {
+  const base = mailpitBase()
+  const want = email.trim().toLowerCase()
+  const deadline = Date.now() + timeoutMs
+
+  while (Date.now() < deadline) {
+    const messages = await listMessages(base)
+    for (const msg of messages) {
+      const to = (msg.To || [])
+        .map((t) => (t.Address || '').toLowerCase())
+        .filter(Boolean)
+      if (!to.includes(want)) continue
+      const created = new Date(msg.Created).getTime()
+      if (created < sinceMs - 2000) continue
+      if (!/sign-in link/i.test(msg.Subject || '')) continue
+      const html = await messageHtml(base, msg.ID)
+      const href = extractVerifyHref(html)
+      if (href) return href
+    }
+    await new Promise((r) => setTimeout(r, 750))
+  }
+  throw new Error(`No magic-link email for ${email} in Mailpit (${base}) within ${timeoutMs / 1000}s`)
+}
+
+function sessionFromCallbackUrl(callbackUrl) {
+  const parsed = new URL(callbackUrl)
+  const queryCode = parsed.searchParams.get('code')
+  if (queryCode) return { kind: 'code', code: queryCode }
+  const hash = parsed.hash?.startsWith('#') ? parsed.hash.slice(1) : ''
+  const hp = new URLSearchParams(hash)
+  const access_token = hp.get('access_token')
+  const refresh_token = hp.get('refresh_token')
+  if (access_token) {
+    return { kind: 'tokens', access_token, refresh_token: refresh_token || undefined }
+  }
+  const err = hp.get('error_description') || hp.get('error')
+  if (err) throw new Error(`Magic link failed: ${decodeURIComponent(err)}`)
+  return null
+}
+
+/** Follow GoTrue verify redirect and read session material from the CLI callback URL. */
+export async function sessionFromVerifyUrl(verifyUrl, expectedRedirectPrefix) {
+  let url = verifyUrl
+  for (let i = 0; i < 8; i++) {
+    const res = await fetch(url, { redirect: 'manual' })
+    if (res.status >= 300 && res.status < 400) {
+      const loc = res.headers.get('location')
+      if (!loc) break
+      const next = new URL(loc, url).href
+      if (next.startsWith(expectedRedirectPrefix)) {
+        const session = sessionFromCallbackUrl(next)
+        if (session) return session
+        throw new Error('Magic link callback had no auth code')
+      }
+      url = next
+      continue
+    }
+    break
+  }
+  throw new Error('Magic link did not return an auth code for the CLI callback')
+}

package/lib/session.mjs

@@ -0,0 +1,36 @@
+import { mkdirSync, readFileSync, writeFileSync, existsSync } from 'node:fs'
+import { dirname } from 'node:path'
+import { credentialsPath } from './config.mjs'
+
+export function loadSession() {
+  const path = credentialsPath()
+  if (!existsSync(path)) return null
+  try {
+    return JSON.parse(readFileSync(path, 'utf8'))
+  } catch {
+    return null
+  }
+}
+
+export function saveSession(session) {
+  const path = credentialsPath()
+  mkdirSync(dirname(path), { recursive: true })
+  writeFileSync(path, JSON.stringify(session, null, 2))
+}
+
+export function accessToken() {
+  const session = loadSession()
+  return session?.access_token || null
+}
+
+export function authHeaders(extra = {}) {
+  const token = accessToken()
+  if (!token) {
+    throw new Error('Not signed in. Run: amorphous login <email>')
+  }
+  return {
+    Authorization: `Bearer ${token}`,
+    'Content-Type': 'application/json',
+    ...extra,
+  }
+}

package/lib/tls.mjs

@@ -0,0 +1,25 @@
+import { existsSync } from 'node:fs'
+import { homedir } from 'node:os'
+import { join } from 'node:path'
+
+/** Herd / Valet .test HTTPS needs the local CA or Node's system trust store. */
+export function ensureLocalHttpsTrust() {
+  if (process.env.NODE_OPTIONS?.includes('use-system-ca')) return
+
+  const herdCa = join(
+    homedir(),
+    '.config',
+    'herd',
+    'config',
+    'valet',
+    'CA',
+    'LaravelValetCASelfSigned.pem',
+  )
+  const valetCa = join(homedir(), '.config', 'valet', 'CA', 'LaravelValetCASelfSigned.pem')
+  const ca = [process.env.AMORPHOUS_TLS_CA, herdCa, valetCa].find(
+    (p) => p && existsSync(p),
+  )
+  if (ca && !process.env.NODE_EXTRA_CA_CERTS) {
+    process.env.NODE_EXTRA_CA_CERTS = ca
+  }
+}