morph-embed 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Mandar Wagh
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,152 @@
+# morph-embed
+
+**Let your users build the features you haven't shipped yet.**
+
+Morph Embed adds a prompt bar to your web product. Your users type what they're
+missing — *"add a box showing how much we lost in the last 15 days"* — and get a
+real, working widget computed from **your** data, rendered safely, saved for
+them, and reapplied on every visit. No ticket, no sprint, no code deployed.
+
+```
+User types a sentence  →  a real feature appears  →  it persists
+```
+
+Three capabilities, in increasing order of integration effort:
+
+| Capability | What users can do | What you provide |
+|---|---|---|
+| **Reshape** | Restyle, rearrange, declutter your UI by prompt | Nothing — works out of the box |
+| **Data widgets** | Generate stat boxes and charts over live data ("lost deals this month", "signups per week") | Registered *data sources* (a fetch function + a field schema) |
+| **Actions** | Generated buttons that do things ("add a follow-up task") — always user-clicked, always confirmable | Registered *actions* (a callback + an argument schema) |
+
+## Why it's safe to put in your product
+
+Most teams can't let an LLM touch their UI because model output might execute.
+Morph is built so it **can't**:
+
+1. **The model never returns code.** It answers only in a fixed, declarative
+   JSON DSL (`hide`, `injectCSS`, `move`, `addElement`, `renderData`, …).
+   Every op is validated and sanitized in the browser: HTML is
+   whitelist-sanitized, CSS is neutralized, and there is no execution op to
+   reach for. This is the architecture, not a filter.
+2. **Your data never leaves the page.** The model only ever sees your source
+   *names and field schemas*. When it wants numbers, it emits a *query
+   description*; trusted SDK code validates that query against your schema,
+   runs **your** fetch function in the browser (under your existing auth),
+   aggregates client-side, and renders the numbers itself via `createElementNS`.
+   Morph's servers never see a record — and the model never emits a number.
+3. **Actions are allowlisted by construction.** Unknown action names and
+   off-schema arguments are dropped before anything renders. A registered
+   action runs only on a real user click, behind a confirm dialog if you say
+   so. Nothing is scheduled; nothing fires on its own.
+4. **Keys are publishable.** Like a Stripe `pk_` key, your key appears in page
+   source by design. It's bound to your origins server-side and rate-limited
+   per vendor. It gates cost, not data — there is no data behind it.
+5. **Generated features live client-side** — in `localStorage`, or in your own
+   backend via a three-method storage adapter. Morph stores nothing per-user.
+
+## Install
+
+**npm:**
+
+```bash
+npm install morph-embed
+```
+
+```js
+import { init } from 'morph-embed';
+```
+
+**Or one script tag** (IIFE build, exposes `window.Morph`):
+
+```html
+<script src="https://unpkg.com/morph-embed/dist/morph-embed.js"></script>
+```
+
+## Integrate
+
+This is the complete integration surface — a CRM registering one data source
+and one action:
+
+```js
+Morph.init({
+  key: 'pk_...',                                  // your publishable key
+
+  sources: {
+    deals: {
+      fetch: async (query) => api.deals(),        // your API, your auth, your data
+      schema: {                                   // field name -> string|number|date|boolean
+        name: 'string',
+        stage: 'string',
+        amount: 'number',
+        closedAt: 'date',
+      },
+      description: 'All CRM deals (stage: won|lost|open)',
+    },
+  },
+
+  actions: {
+    createTask: {
+      run: async (args) => api.tasks.create(args), // your callback
+      argsSchema: { note: 'string' },              // string|number args only
+      description: 'Create a follow-up task',
+      confirm: true,                               // user must approve every run
+    },
+  },
+
+  // Optional:
+  storage: { get, set, remove },   // persist users' features in YOUR backend
+                                   // (omit for localStorage)
+  trigger: 'alt+m',                // hotkey, or 'none' + call Morph.open()
+                                   // from your own button
+  backend: 'https://...',          // override the Morph API endpoint
+});
+```
+
+Your users press **Alt+M** and describe what they want. That's the whole thing.
+
+### What the model can ask of your sources
+
+The query language is deliberately tiny — enough for "show me X", small enough
+to audit:
+
+- `filter` — equality or IN over your fields
+- `dateField` + `since` / `until` — durations like `'15d'`, `'24h'`, or ISO dates
+- `groupBy` — one row per group
+- `aggregate` — `sum` | `count` | `avg` | `min` | `max`
+- `limit`
+
+Every referenced field must exist in your declared schema — a hallucinated
+field is a hard error, never a silent zero. If a question needs more than this
+language expresses, expose it as a purpose-built source instead.
+
+### Widgets your users can generate
+
+`stat` (big number + caption), `bar`, and `line` charts — all rendered by
+trusted code as SVG from the query result. Layout reshapes and added elements
+use the same sanitized DSL as the rest of Morph.
+
+## Try it
+
+The repository ships a fake CRM with Morph embedded —
+[`sdk/demo-crm/`](https://github.com/mandarwagh9/morph/tree/master/sdk/demo-crm)
+— seeded with deals data. Its `app.js` is the reference integration; the golden
+path ("add a box showing how much we lost in the last 15 days" → real widget →
+survives reload) is documented in its README.
+
+## Status & keys
+
+Morph Embed is in **early access**. Publishable keys are provisioned manually
+while we onboard the first integrations — open an issue on
+[GitHub](https://github.com/mandarwagh9/morph/issues) or reach out via
+[usemorph.xyz](https://usemorph.xyz) and we'll set you up (origins allowlist +
+rate limits included).
+
+Morph is also a [browser extension](https://usemorph.xyz) that reshapes any
+website the same way — same engine, same security model.
+
+## License
+
+MIT © Mandar Wagh — see [LICENSE](./LICENSE). (The `morph-embed` package is
+MIT-licensed; the Morph backend service and the wider repository are licensed
+separately.)