ply-ui-cli 1.1.118

package/dist/registry.js

@@ -0,0 +1,278 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/registry.ts
+var registry_exports = {};
+__export(registry_exports, {
+  FREE_REGISTRY_URL: () => FREE_REGISTRY_URL,
+  PRO_REGISTRY_URL: () => PRO_REGISTRY_URL,
+  SITE_URL: () => SITE_URL,
+  fetchIndex: () => fetchIndex,
+  fetchItem: () => fetchItem,
+  getLicenseKey: () => getLicenseKey,
+  isSafeItemName: () => isSafeItemName,
+  itemHaystack: () => itemHaystack,
+  registryIndexSchema: () => registryIndexSchema,
+  registryItemSchema: () => registryItemSchema,
+  suggestNames: () => suggestNames
+});
+module.exports = __toCommonJS(registry_exports);
+var import_vendor = require("./vendor");
+
+// src/integrity.ts
+var import_crypto = __toESM(require("crypto"));
+var TRUSTED_SIGNING_KEYS = [];
+function computeItemDigest(item) {
+  const hash = import_crypto.default.createHash("sha256");
+  hash.update(item.name, "utf8");
+  hash.update("\0");
+  const sorted = [...item.files].sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
+  for (const file of sorted) {
+    hash.update(file.name, "utf8");
+    hash.update("\0");
+    hash.update(file.content, "utf8");
+    hash.update("\0");
+  }
+  return hash.digest("hex");
+}
+function isIndexSignature(value) {
+  if (!value || typeof value !== "object") return false;
+  const v = value;
+  return typeof v.alg === "string" && typeof v.keyId === "string" && typeof v.sha256 === "string" && typeof v.signature === "string";
+}
+function verifyIndexSignature(rawIndex, signature) {
+  if (!TRUSTED_SIGNING_KEYS.length) {
+    return { status: "unsigned", reason: "this CLI build ships no trusted signing key" };
+  }
+  if (signature === void 0 || signature === null) {
+    return { status: "unsigned", reason: "the registry published no index signature" };
+  }
+  if (!isIndexSignature(signature)) {
+    return { status: "invalid", reason: "the index signature is malformed" };
+  }
+  if (signature.alg !== "ed25519") {
+    return { status: "invalid", reason: `unsupported signature algorithm '${signature.alg}'` };
+  }
+  const key = TRUSTED_SIGNING_KEYS.find((k) => k.keyId === signature.keyId);
+  if (!key) {
+    return { status: "invalid", reason: `index was signed with an untrusted key '${signature.keyId}'` };
+  }
+  const actualSha = import_crypto.default.createHash("sha256").update(rawIndex, "utf8").digest("hex");
+  if (actualSha !== signature.sha256) {
+    return { status: "invalid", reason: "the index contents do not match the signed digest" };
+  }
+  try {
+    const publicKey = import_crypto.default.createPublicKey({
+      key: Buffer.from(key.publicKey, "base64"),
+      format: "der",
+      type: "spki"
+    });
+    const ok = import_crypto.default.verify(
+      null,
+      Buffer.from(rawIndex, "utf8"),
+      publicKey,
+      Buffer.from(signature.signature, "base64")
+    );
+    return ok ? { status: "verified", keyId: signature.keyId } : { status: "invalid", reason: "the index signature failed verification" };
+  } catch (err) {
+    return { status: "invalid", reason: `could not verify the index signature (${err.message})` };
+  }
+}
+
+// src/registry.ts
+var SITE_URL = "https://ply-ui.com";
+function firstEnv(...names) {
+  for (const name of names) {
+    const v = process.env[name]?.trim();
+    if (v) return v;
+  }
+}
+function requireSignature() {
+  return process.env.PLY_REQUIRE_SIGNATURE === "1" || process.env.BASE_UI_REQUIRE_SIGNATURE === "1";
+}
+var FREE_REGISTRY_URL = firstEnv("PLY_REGISTRY_URL", "BASE_UI_REGISTRY_URL") || `${SITE_URL}/registry`;
+var PRO_REGISTRY_URL = firstEnv("PLY_PRO_REGISTRY_URL", "BASE_UI_PRO_REGISTRY_URL") || "https://pro.ply-ui.com/registry";
+var registryFileSchema = import_vendor.z.object({
+  name: import_vendor.z.string(),
+  content: import_vendor.z.string()
+});
+var registryItemSchema = import_vendor.z.object({
+  name: import_vendor.z.string(),
+  tier: import_vendor.z.enum(["free", "pro"]),
+  category: import_vendor.z.enum(["application", "page-layout", "block", "widget", "shell", "component"]).optional().default("component"),
+  dependencies: import_vendor.z.array(import_vendor.z.string()).default([]),
+  registryDependencies: import_vendor.z.array(import_vendor.z.string()).default([]),
+  description: import_vendor.z.string().optional().default(""),
+  usage: import_vendor.z.string().optional().default(""),
+  keywords: import_vendor.z.array(import_vendor.z.string()).optional().default([]),
+  files: import_vendor.z.array(registryFileSchema),
+  type: import_vendor.z.string().optional()
+});
+var registryIndexSchema = import_vendor.z.array(
+  registryItemSchema.omit({ files: true }).extend({
+    /** sha256 of the item payload, published by the build. Optional so a CLI
+     * newer than the deployed registry keeps working. */
+    digest: import_vendor.z.string().optional()
+  })
+);
+function itemHaystack(item) {
+  return [item.name, item.description, ...item.keywords ?? []].filter(Boolean).join(" ").toLowerCase();
+}
+function isSafeItemName(name) {
+  return /^[a-z0-9][a-z0-9-.]*$/i.test(name) && !name.includes("..");
+}
+function getLicenseKey() {
+  return firstEnv("PLY_LICENSE_KEY", "BASE_UI_LICENSE_KEY");
+}
+async function fetchText(url, headers = {}) {
+  let res;
+  try {
+    res = await fetch(url, { headers });
+  } catch (err) {
+    throw new Error(`Network error while contacting the registry (${err.message}). Check your connection and try again.`);
+  }
+  if (res.status === 401 || res.status === 403) {
+    throw new Error(`Your license key was rejected (HTTP ${res.status}). Check PLY_LICENSE_KEY, or contact support via ${SITE_URL}.`);
+  }
+  if (res.status === 404) {
+    const e = new Error("Not found");
+    e.code = "NOT_FOUND";
+    throw e;
+  }
+  if (!res.ok) {
+    throw new Error(`Registry request failed (HTTP ${res.status}) for ${url}.`);
+  }
+  return res.text();
+}
+async function fetchJson(url, headers = {}) {
+  return JSON.parse(await fetchText(url, headers));
+}
+async function fetchIndexSignature() {
+  try {
+    return await fetchJson(`${FREE_REGISTRY_URL}/index.json.sig`);
+  } catch {
+    return void 0;
+  }
+}
+async function fetchIndex() {
+  const raw = await fetchText(`${FREE_REGISTRY_URL}/index.json`);
+  const verdict = verifyIndexSignature(raw, await fetchIndexSignature());
+  if (verdict.status === "invalid") {
+    throw new Error(
+      `Registry index integrity check failed: ${verdict.reason}.
+Nothing was written. Report this at ${SITE_URL} \u2014 do not bypass this error.`
+    );
+  }
+  if (verdict.status === "unsigned" && requireSignature()) {
+    throw new Error(
+      `PLY_REQUIRE_SIGNATURE=1 but the registry index could not be verified: ${verdict.reason}.`
+    );
+  }
+  return registryIndexSchema.parse(JSON.parse(raw));
+}
+async function fetchItem(name, tier, expectedDigest) {
+  if (!isSafeItemName(name)) {
+    throw new Error(`Invalid component name: '${name}'.`);
+  }
+  let data;
+  if (tier === "pro") {
+    const key = getLicenseKey();
+    if (!key) {
+      throw new Error(
+        `'${name}' is a Pro component. Set the PLY_LICENSE_KEY environment variable to your license key.
+Get a license at ${SITE_URL}/pricing.`
+      );
+    }
+    data = await fetchJson(`${PRO_REGISTRY_URL}/styles/default/${name}.json`, {
+      authorization: `Bearer ${key}`
+    });
+  } else {
+    data = await fetchJson(`${FREE_REGISTRY_URL}/styles/default/${name}.json`);
+  }
+  const item = registryItemSchema.parse(data);
+  if (expectedDigest) {
+    const actual = computeItemDigest(item);
+    if (actual !== expectedDigest) {
+      throw new Error(
+        `Integrity check failed for '${name}': the downloaded files do not match the digest published in the registry index (expected ${expectedDigest.slice(0, 12)}\u2026, got ${actual.slice(0, 12)}\u2026). Nothing was written.`
+      );
+    }
+  } else if (requireSignature()) {
+    throw new Error(
+      `PLY_REQUIRE_SIGNATURE=1 but the registry index publishes no digest for '${name}'.`
+    );
+  }
+  return item;
+}
+function suggestNames(query, names, limit = 5) {
+  const q = query.toLowerCase();
+  const scored = names.map((name) => {
+    const n = name.toLowerCase();
+    let score;
+    if (n === q) score = 0;
+    else if (n.startsWith(q) || q.startsWith(n)) score = 1;
+    else if (n.includes(q) || q.includes(n)) score = 2;
+    else score = 3 + levenshtein(q, n);
+    return { name, score };
+  }).filter((s) => s.score <= 6).sort((a, b) => a.score - b.score);
+  return scored.slice(0, limit).map((s) => s.name);
+}
+function levenshtein(a, b) {
+  const m = a.length;
+  const n = b.length;
+  if (!m) return n;
+  if (!n) return m;
+  let prev = Array.from({ length: n + 1 }, (_, i) => i);
+  for (let i = 1; i <= m; i++) {
+    const curr = [i];
+    for (let j = 1; j <= n; j++) {
+      curr[j] = Math.min(
+        prev[j] + 1,
+        curr[j - 1] + 1,
+        prev[j - 1] + (a[i - 1] === b[j - 1] ? 0 : 1)
+      );
+    }
+    prev = curr;
+  }
+  return prev[n];
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  FREE_REGISTRY_URL,
+  PRO_REGISTRY_URL,
+  SITE_URL,
+  fetchIndex,
+  fetchItem,
+  getLicenseKey,
+  isSafeItemName,
+  itemHaystack,
+  registryIndexSchema,
+  registryItemSchema,
+  suggestNames
+});

package/dist/sync.js

@@ -0,0 +1,170 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/sync.ts
+var sync_exports = {};
+__export(sync_exports, {
+  classifyFileStatus: () => classifyFileStatus,
+  computeComponentDiff: () => computeComponentDiff,
+  hasChanges: () => hasChanges,
+  hasConflicts: () => hasConflicts,
+  renderDiff: () => renderDiff,
+  statusLabel: () => statusLabel
+});
+module.exports = __toCommonJS(sync_exports);
+var import_fs2 = __toESM(require("fs"));
+var import_path2 = __toESM(require("path"));
+var import_vendor = require("./vendor");
+var import_registry = require("./registry");
+
+// src/lockfile.ts
+var import_crypto = __toESM(require("crypto"));
+function hashContent(content) {
+  return import_crypto.default.createHash("sha256").update(content, "utf8").digest("hex");
+}
+
+// src/snapshot.ts
+var import_fs = __toESM(require("fs"));
+var import_path = __toESM(require("path"));
+var SNAPSHOT_ROOT = ".base-ui/snapshots";
+function snapshotPath(component, file) {
+  return import_path.default.resolve(process.cwd(), SNAPSHOT_ROOT, component, file);
+}
+function readSnapshot(component, file, expectedHash) {
+  const dest = snapshotPath(component, file);
+  if (!import_fs.default.existsSync(dest)) return void 0;
+  const content = import_fs.default.readFileSync(dest, "utf8");
+  if (expectedHash && hashContent(content) !== expectedHash) return void 0;
+  return content;
+}
+
+// src/brand.ts
+var CLI_BIN = "ply-ui-cli";
+var CLI_NPX = `npx ${CLI_BIN}`;
+var MCP_PACKAGE = "ply-ui-mcp";
+var MCP_NPX = `npx -y ${MCP_PACKAGE}`;
+
+// src/sync.ts
+function hasChanges(diff) {
+  return diff.files.some((f) => f.status !== "unchanged");
+}
+function hasConflicts(diff) {
+  return diff.files.some((f) => f.status === "conflict");
+}
+function classifyFileStatus(args) {
+  const { installedHash, localHash, upstreamHash } = args;
+  if (installedHash === void 0) {
+    if (localHash === void 0) return "new-upstream";
+    if (localHash === upstreamHash) {
+      return "unchanged";
+    }
+    return "conflict";
+  }
+  if (upstreamHash === void 0) return "removed-upstream";
+  if (localHash === void 0) return "missing-locally";
+  if (localHash === installedHash && upstreamHash === installedHash) return "unchanged";
+  if (localHash === installedHash) return "upstream-changed";
+  if (upstreamHash === installedHash) return "locally-modified";
+  if (localHash === upstreamHash) return "unchanged";
+  return "conflict";
+}
+async function computeComponentDiff(name, componentsRoot, lock, index) {
+  const lockEntry = lock.components[name];
+  if (!lockEntry) {
+    return {
+      name,
+      files: [],
+      error: `not tracked in ${import_path2.default.basename("base-ui-lock.json")} \u2014 run "${CLI_NPX} add ${name} --overwrite" to start tracking it.`
+    };
+  }
+  const indexEntry = index.find((i) => i.name === name);
+  if (!indexEntry) {
+    return { name, tier: lockEntry.tier, files: [], error: "no longer available upstream (removed from the registry)." };
+  }
+  let upstream;
+  try {
+    upstream = await (0, import_registry.fetchItem)(name, indexEntry.tier, indexEntry.digest);
+  } catch (err) {
+    return { name, tier: indexEntry.tier, files: [], error: err.message };
+  }
+  const upstreamFiles = new Map(upstream.files.map((f) => [f.name, f.content]));
+  const paths = /* @__PURE__ */ new Set([...Object.keys(lockEntry.files), ...upstreamFiles.keys()]);
+  const files = [];
+  for (const relPath of paths) {
+    const localPath = import_path2.default.join(componentsRoot, name, relPath);
+    const localExists = import_fs2.default.existsSync(localPath);
+    const localContent = localExists ? import_fs2.default.readFileSync(localPath, "utf8") : void 0;
+    const localHash = localContent !== void 0 ? hashContent(localContent) : void 0;
+    const installedHash = lockEntry.files[relPath];
+    const upstreamContent = upstreamFiles.get(relPath);
+    const upstreamHash = upstreamContent !== void 0 ? hashContent(upstreamContent) : void 0;
+    const status = classifyFileStatus({ installedHash, localHash, upstreamHash });
+    const ancestorContent = status === "conflict" ? readSnapshot(name, relPath, installedHash) : void 0;
+    files.push({ path: relPath, status, localContent, upstreamContent, ancestorContent });
+  }
+  files.sort((a, b) => a.path.localeCompare(b.path));
+  return { name, tier: indexEntry.tier, files };
+}
+var STATUS_LABEL = {
+  unchanged: "unchanged",
+  "upstream-changed": "updated upstream",
+  "locally-modified": "locally modified (no upstream change)",
+  conflict: "CONFLICT \u2014 both changed",
+  "new-upstream": "new upstream file",
+  "removed-upstream": "removed upstream",
+  "missing-locally": "upstream changed, but your local file is missing"
+};
+function statusLabel(status) {
+  return STATUS_LABEL[status];
+}
+var RED = (s) => `\x1B[31m${s}\x1B[0m`;
+var GREEN = (s) => `\x1B[32m${s}\x1B[0m`;
+var DIM = (s) => `\x1B[2m${s}\x1B[0m`;
+function renderDiff(oldContent, newContent) {
+  const parts = (0, import_vendor.diffLines)(oldContent ?? "", newContent ?? "");
+  const lines = [];
+  for (const part of parts) {
+    const prefix = part.added ? "+" : part.removed ? "-" : " ";
+    const color = part.added ? GREEN : part.removed ? RED : DIM;
+    const partLines = part.value.replace(/\n$/, "").split("\n");
+    for (const line of partLines) {
+      lines.push(color(`${prefix} ${line}`));
+    }
+  }
+  return lines.join("\n");
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  classifyFileStatus,
+  computeComponentDiff,
+  hasChanges,
+  hasConflicts,
+  renderDiff,
+  statusLabel
+});