shipscreens 0.1.0

package/cli/auth.js

@@ -0,0 +1,454 @@
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import http from 'node:http';
+import { spawn } from 'node:child_process';
+
+const DEFAULT_API_BASE = process.env.SHIPSCREENS_API_ENDPOINT || 'https://api.shipscreens.com';
+const DEFAULT_CLIENT_ID = process.env.SHIPSCREENS_CLIENT_ID || '5artdh0ut5agvmc1oa8kpbm02s';
+const DEFAULT_DOMAIN =
+  process.env.SHIPSCREENS_COGNITO_DOMAIN ||
+  process.env.VITE_COGNITO_DOMAIN ||
+  'auth.shipscreens.com';
+const DEFAULT_SCOPES = ['openid', 'email', 'profile'];
+const TOKEN_SKEW_MS = 60 * 1000;
+
+const authDir = () => path.join(os.homedir(), '.shipscreens');
+const authFile = () => path.join(authDir(), 'auth.json');
+const authPendingFile = () => path.join(authDir(), 'auth-pending.json');
+
+const normalizeDomain = (input) => {
+  if (!input) return '';
+  const trimmed = String(input).trim().replace(/\/+$/, '');
+  if (!trimmed) return '';
+  if (trimmed.startsWith('http://') || trimmed.startsWith('https://')) {
+    try {
+      return new URL(trimmed).host;
+    } catch {
+      return trimmed.replace(/^https?:\/\//, '');
+    }
+  }
+  return trimmed;
+};
+
+const base64Url = (input) =>
+  Buffer.from(input)
+    .toString('base64')
+    .replace(/=/g, '')
+    .replace(/\+/g, '-')
+    .replace(/\//g, '_');
+
+const openBrowser = (url) => {
+  const platform = process.platform;
+  const command =
+    platform === 'win32'
+      ? ['cmd', ['/c', 'start', '', url]]
+      : platform === 'darwin'
+        ? ['open', [url]]
+        : ['xdg-open', [url]];
+  const [bin, args] = command;
+  const child = spawn(bin, args, { detached: true, stdio: 'ignore' });
+  child.unref();
+};
+
+async function readAuth() {
+  try {
+    const raw = await fs.readFile(authFile(), 'utf8');
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+
+async function writeAuth(payload) {
+  await fs.mkdir(authDir(), { recursive: true });
+  await fs.writeFile(authFile(), JSON.stringify(payload, null, 2), 'utf8');
+}
+
+async function writePendingAuth(payload) {
+  await fs.mkdir(authDir(), { recursive: true });
+  await fs.writeFile(authPendingFile(), JSON.stringify(payload, null, 2), 'utf8');
+}
+
+async function readPendingAuth() {
+  try {
+    const raw = await fs.readFile(authPendingFile(), 'utf8');
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+
+async function clearPendingAuth() {
+  try {
+    await fs.unlink(authPendingFile());
+  } catch {
+    // ignore
+  }
+}
+
+export async function clearAuth() {
+  try {
+    await fs.unlink(authFile());
+  } catch {
+    // ignore
+  }
+}
+
+function createPkcePair() {
+  const codeVerifier = base64Url(crypto.randomBytes(32));
+  const codeChallenge = base64Url(crypto.createHash('sha256').update(codeVerifier).digest());
+  return { codeVerifier, codeChallenge };
+}
+
+function buildAuthorizeUrl({ domain, clientId, redirectUri, scopes, state, codeChallenge }) {
+  const host = normalizeDomain(domain);
+  const params = new URLSearchParams({
+    response_type: 'code',
+    client_id: clientId,
+    redirect_uri: redirectUri,
+    scope: scopes.join(' '),
+    state,
+    code_challenge: codeChallenge,
+    code_challenge_method: 'S256',
+  });
+  return `https://${host}/oauth2/authorize?${params.toString()}`;
+}
+
+async function waitForAuthCode({ port, state, timeoutMs }) {
+  return new Promise((resolve, reject) => {
+    const timeout = setTimeout(() => {
+      reject(new Error('Timed out waiting for OAuth callback. Please try again.'));
+    }, timeoutMs);
+
+    const server = http.createServer((req, res) => {
+      const url = new URL(req.url || '/', `http://127.0.0.1:${port}`);
+      if (url.pathname !== '/callback') {
+        res.writeHead(404);
+        res.end('Not Found');
+        return;
+      }
+      const code = url.searchParams.get('code');
+      const returnedState = url.searchParams.get('state');
+      const error = url.searchParams.get('error');
+      res.writeHead(200, { 'Content-Type': 'text/html' });
+      res.end('<html><body><h3>ShipScreens CLI</h3><p>Login completed. You can close this window.</p></body></html>');
+
+      clearTimeout(timeout);
+      server.close();
+
+      if (error) {
+        reject(new Error(`OAuth error: ${error}`));
+        return;
+      }
+      if (!code || returnedState !== state) {
+        reject(new Error('OAuth callback did not include a valid code.'));
+        return;
+      }
+      resolve(code);
+    });
+
+    server.on('error', (err) => {
+      clearTimeout(timeout);
+      reject(err);
+    });
+
+    server.listen(port, '127.0.0.1');
+  });
+}
+
+async function exchangeCodeForToken({ domain, clientId, code, redirectUri, codeVerifier }) {
+  const host = normalizeDomain(domain);
+  const body = new URLSearchParams({
+    grant_type: 'authorization_code',
+    client_id: clientId,
+    code,
+    redirect_uri: redirectUri,
+    code_verifier: codeVerifier,
+  });
+  const resp = await fetch(`https://${host}/oauth2/token`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+    body: body.toString(),
+  });
+  if (!resp.ok) {
+    const text = await resp.text();
+    throw new Error(`Token exchange failed (${resp.status}). ${text}`);
+  }
+  return resp.json();
+}
+
+async function refreshTokens({ domain, clientId, refreshToken }) {
+  const host = normalizeDomain(domain);
+  const body = new URLSearchParams({
+    grant_type: 'refresh_token',
+    client_id: clientId,
+    refresh_token: refreshToken,
+  });
+  const resp = await fetch(`https://${host}/oauth2/token`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+    body: body.toString(),
+  });
+  if (!resp.ok) {
+    const text = await resp.text();
+    throw new Error(`Token refresh failed (${resp.status}). ${text}`);
+  }
+  return resp.json();
+}
+
+async function fetchProfile({ apiBase, token }) {
+  if (!token) return null;
+  const resp = await fetch(`${apiBase}/me`, {
+    method: 'GET',
+    headers: { Authorization: `Bearer ${token}` },
+  });
+  if (!resp.ok) return null;
+  return resp.json();
+}
+
+function resolveExpiry(expiresIn) {
+  if (!expiresIn || Number.isNaN(Number(expiresIn))) return null;
+  return Date.now() + Number(expiresIn) * 1000;
+}
+
+function isExpired(expiresAt) {
+  if (!expiresAt) return true;
+  return Date.now() >= expiresAt - TOKEN_SKEW_MS;
+}
+
+export async function loginWithBrowser({
+  domain = DEFAULT_DOMAIN,
+  clientId = DEFAULT_CLIENT_ID,
+  apiBase = DEFAULT_API_BASE,
+  port = 53682,
+  scopes = DEFAULT_SCOPES,
+  timeoutMs = 5 * 60 * 1000,
+} = {}) {
+  const normalizedDomain = normalizeDomain(domain);
+  if (!normalizedDomain) {
+    throw new Error('Missing Cognito domain. Set SHIPSCREENS_COGNITO_DOMAIN or pass --domain.');
+  }
+
+  const state = base64Url(crypto.randomBytes(16));
+  const { codeVerifier, codeChallenge } = createPkcePair();
+  const redirectUri = `http://127.0.0.1:${port}/callback`;
+
+  const authorizeUrl = buildAuthorizeUrl({
+    domain: normalizedDomain,
+    clientId,
+    redirectUri,
+    scopes,
+    state,
+    codeChallenge,
+  });
+
+  console.log('ShipScreens CLI login');
+  console.log(`- Open this URL to sign in:\n  ${authorizeUrl}`);
+  console.log(`- Waiting for redirect to ${redirectUri}`);
+
+  const codePromise = waitForAuthCode({ port, state, timeoutMs });
+  try {
+    openBrowser(authorizeUrl);
+  } catch (err) {
+    console.warn('Failed to open a browser automatically. Please open the URL above manually.');
+  }
+  const code = await codePromise;
+  const tokens = await exchangeCodeForToken({
+    domain: normalizedDomain,
+    clientId,
+    code,
+    redirectUri,
+    codeVerifier,
+  });
+
+  const expiresAt = resolveExpiry(tokens.expires_in);
+  const payload = {
+    version: 1,
+    obtained_at: new Date().toISOString(),
+    domain: normalizedDomain,
+    client_id: clientId,
+    api_base: apiBase,
+    scope: tokens.scope,
+    id_token: tokens.id_token,
+    access_token: tokens.access_token,
+    refresh_token: tokens.refresh_token,
+    expires_at: expiresAt,
+  };
+
+  await writeAuth(payload);
+  const profile = await fetchProfile({ apiBase, token: tokens.id_token }).catch(() => null);
+  return { profile, session: payload };
+}
+
+export async function beginManualLogin({
+  domain = DEFAULT_DOMAIN,
+  clientId = DEFAULT_CLIENT_ID,
+  apiBase = DEFAULT_API_BASE,
+  port = 53682,
+  scopes = DEFAULT_SCOPES,
+} = {}) {
+  const normalizedDomain = normalizeDomain(domain);
+  if (!normalizedDomain) {
+    throw new Error('Missing Cognito domain. Set SHIPSCREENS_COGNITO_DOMAIN or pass --domain.');
+  }
+
+  const state = base64Url(crypto.randomBytes(16));
+  const { codeVerifier, codeChallenge } = createPkcePair();
+  const redirectUri = `http://127.0.0.1:${port}/callback`;
+  const authorizeUrl = buildAuthorizeUrl({
+    domain: normalizedDomain,
+    clientId,
+    redirectUri,
+    scopes,
+    state,
+    codeChallenge,
+  });
+
+  await writePendingAuth({
+    version: 1,
+    created_at: new Date().toISOString(),
+    domain: normalizedDomain,
+    client_id: clientId,
+    api_base: apiBase,
+    scopes,
+    redirect_uri: redirectUri,
+    state,
+    code_verifier: codeVerifier,
+  });
+
+  return { authorizeUrl, redirectUri };
+}
+
+export async function finishManualLogin({ redirectUrl, code, state } = {}) {
+  const pending = await readPendingAuth();
+  if (!pending?.state || !pending?.code_verifier || !pending?.domain || !pending?.client_id) {
+    throw new Error('No pending login found. Run shipscreens auth login --manual first.');
+  }
+
+  let authCode = code;
+  let returnedState = state;
+  if (redirectUrl) {
+    let parsed;
+    try {
+      parsed = new URL(redirectUrl);
+    } catch {
+      throw new Error('Invalid redirect URL.');
+    }
+    authCode = parsed.searchParams.get('code') || authCode;
+    returnedState = parsed.searchParams.get('state') || returnedState;
+  }
+
+  if (!authCode || !returnedState) {
+    throw new Error('Missing code/state. Provide --redirect-url or both --code and --state.');
+  }
+  if (returnedState !== pending.state) {
+    throw new Error('State mismatch. Please restart login.');
+  }
+
+  const tokens = await exchangeCodeForToken({
+    domain: pending.domain,
+    clientId: pending.client_id,
+    code: authCode,
+    redirectUri: pending.redirect_uri,
+    codeVerifier: pending.code_verifier,
+  });
+
+  const expiresAt = resolveExpiry(tokens.expires_in);
+  const payload = {
+    version: 1,
+    obtained_at: new Date().toISOString(),
+    domain: pending.domain,
+    client_id: pending.client_id,
+    api_base: pending.api_base || DEFAULT_API_BASE,
+    scope: tokens.scope,
+    id_token: tokens.id_token,
+    access_token: tokens.access_token,
+    refresh_token: tokens.refresh_token,
+    expires_at: expiresAt,
+  };
+
+  await writeAuth(payload);
+  await clearPendingAuth();
+  const profile = await fetchProfile({ apiBase: payload.api_base, token: tokens.id_token }).catch(() => null);
+  return { profile, session: payload };
+}
+
+export async function resolveCliAuth({ requirePro = false } = {}) {
+  const envToken = process.env.SHIPSCREENS_TOKEN || process.env.SHIPSCREENS_ID_TOKEN;
+  if (envToken) {
+    const profile = await fetchProfile({ apiBase: DEFAULT_API_BASE, token: envToken }).catch(() => null);
+    if (requirePro && !profile?.isPro) {
+      throw new Error('Pro access required. Provide a Pro token or run shipscreens auth login.');
+    }
+    return { token: envToken, profile, source: 'env_token' };
+  }
+
+  const envRefresh = process.env.SHIPSCREENS_REFRESH_TOKEN;
+  if (envRefresh) {
+    const domain = process.env.SHIPSCREENS_COGNITO_DOMAIN || DEFAULT_DOMAIN;
+    if (!domain) {
+      throw new Error('SHIPSCREENS_COGNITO_DOMAIN is required when using SHIPSCREENS_REFRESH_TOKEN.');
+    }
+    const clientId = process.env.SHIPSCREENS_CLIENT_ID || DEFAULT_CLIENT_ID;
+    const tokens = await refreshTokens({ domain, clientId, refreshToken: envRefresh });
+    const token = tokens.id_token;
+    const profile = await fetchProfile({ apiBase: DEFAULT_API_BASE, token }).catch(() => null);
+    if (requirePro && !profile?.isPro) {
+      throw new Error('Pro access required. Provide a Pro token or run shipscreens auth login.');
+    }
+    return { token, profile, source: 'env_refresh' };
+  }
+
+  const session = await readAuth();
+  if (!session?.id_token) {
+    if (requirePro) {
+      throw new Error('Pro access required. Run shipscreens auth login first.');
+    }
+    return { token: null, profile: null, source: 'none' };
+  }
+
+  let token = session.id_token;
+  let updated = false;
+  if (isExpired(session.expires_at)) {
+    if (session.refresh_token && session.domain && session.client_id) {
+      const tokens = await refreshTokens({
+        domain: session.domain,
+        clientId: session.client_id,
+        refreshToken: session.refresh_token,
+      });
+      token = tokens.id_token;
+      session.id_token = tokens.id_token;
+      session.access_token = tokens.access_token;
+      session.expires_at = resolveExpiry(tokens.expires_in);
+      updated = true;
+    } else {
+      token = null;
+    }
+  }
+
+  if (updated) {
+    await writeAuth(session);
+  }
+
+  const profile = await fetchProfile({ apiBase: session.api_base || DEFAULT_API_BASE, token }).catch(() => null);
+  if (requirePro && !profile?.isPro) {
+    throw new Error('Pro access required. Sign in with a Pro account.');
+  }
+  return { token, profile, source: 'stored', session };
+}
+
+export async function getAuthStatus() {
+  const session = await readAuth();
+  if (!session) {
+    return { signedIn: false };
+  }
+  return {
+    signedIn: true,
+    expiresAt: session.expires_at,
+    domain: session.domain,
+    clientId: session.client_id,
+    apiBase: session.api_base,
+  };
+}

package/cli/buildOutputs.js

@@ -0,0 +1,146 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+
+function compareStrings(a, b) {
+  if (a === b) return 0;
+  return a < b ? -1 : 1;
+}
+
+function escapeRegExp(value) {
+  return String(value).replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
+function toDeviceSlug(deviceId) {
+  return String(deviceId).toLowerCase();
+}
+
+export function getScreenshotIndexWidth(slideCount) {
+  const digits = String(slideCount).length;
+  return Math.max(2, digits);
+}
+
+export function formatScreenshotIndex(index, width) {
+  return String(index).padStart(width, '0');
+}
+
+async function ensureDir(dirPath) {
+  await fs.mkdir(dirPath, { recursive: true });
+}
+
+async function isFile(filePath) {
+  try {
+    const stat = await fs.stat(filePath);
+    return stat.isFile();
+  } catch {
+    return false;
+  }
+}
+
+async function readDirSafe(dirPath) {
+  try {
+    return await fs.readdir(dirPath, { withFileTypes: true });
+  } catch (err) {
+    if (err?.code === 'ENOENT') return [];
+    throw err;
+  }
+}
+
+async function removeFileSafe(filePath) {
+  try {
+    await fs.unlink(filePath);
+  } catch (err) {
+    if (err?.code === 'ENOENT') return;
+    throw err;
+  }
+}
+
+export async function cleanBuildOutputs({ iosDir, androidDir, locales, iosDevices, androidBuckets }) {
+  const iosDeviceRegexes = (iosDevices || []).map((d) => new RegExp(`^${escapeRegExp(toDeviceSlug(d.id))}_(\\d+)\\.png$`, 'i'));
+  const numericPng = /^(\d+)\.png$/i;
+
+  for (const localeId of locales || []) {
+    const iosLocaleDir = iosDir ? path.join(iosDir, localeId) : null;
+    if (iosLocaleDir && iosDeviceRegexes.length) {
+      const entries = await readDirSafe(iosLocaleDir);
+      for (const entry of entries) {
+        if (!entry.isFile()) continue;
+        if (!iosDeviceRegexes.some((re) => re.test(entry.name))) continue;
+        await removeFileSafe(path.join(iosLocaleDir, entry.name));
+      }
+    }
+
+    for (const { bucket } of androidBuckets || []) {
+      const bucketDir = androidDir ? path.join(androidDir, localeId, 'images', bucket) : null;
+      if (!bucketDir) continue;
+      const entries = await readDirSafe(bucketDir);
+      for (const entry of entries) {
+        if (!entry.isFile()) continue;
+        if (!numericPng.test(entry.name)) continue;
+        await removeFileSafe(path.join(bucketDir, entry.name));
+      }
+    }
+  }
+}
+
+export async function materializeOutputsFromExport({
+  exportedScreenshotsDir,
+  iosDir,
+  androidDir,
+  locales,
+  iosDevices,
+  androidBuckets,
+  slideCount,
+  clean = false,
+}) {
+  const width = getScreenshotIndexWidth(slideCount);
+
+  const ops = [];
+
+  for (const localeId of locales || []) {
+    for (const device of iosDevices || []) {
+      const deviceSlug = toDeviceSlug(device.id);
+      for (let i = 1; i <= slideCount; i++) {
+        const src = path.join(exportedScreenshotsDir, localeId, `${deviceSlug}_${i}.png`);
+        const dest = path.join(iosDir, localeId, `${deviceSlug}_${formatScreenshotIndex(i, width)}.png`);
+        ops.push({ src, dest });
+      }
+    }
+  }
+
+  for (const localeId of locales || []) {
+    for (const { bucket, device } of androidBuckets || []) {
+      const deviceSlug = toDeviceSlug(device.id);
+      for (let i = 1; i <= slideCount; i++) {
+        const src = path.join(exportedScreenshotsDir, localeId, `${deviceSlug}_${i}.png`);
+        const dest = path.join(androidDir, localeId, 'images', bucket, `${formatScreenshotIndex(i, width)}.png`);
+        ops.push({ src, dest });
+      }
+    }
+  }
+
+  const missing = [];
+  for (const op of ops) {
+    if (await isFile(op.src)) continue;
+    missing.push(op.src);
+  }
+  if (missing.length) {
+    missing.sort(compareStrings);
+    const lines = [`Missing exported screenshot(s): ${missing.length}`];
+    const max = 10;
+    missing.slice(0, max).forEach((p) => lines.push(`- ${p}`));
+    if (missing.length > max) lines.push('(truncated)');
+    throw new Error(lines.join('\n'));
+  }
+
+  if (clean) {
+    await cleanBuildOutputs({ iosDir, androidDir, locales, iosDevices, androidBuckets });
+  }
+
+  for (const op of ops) {
+    await ensureDir(path.dirname(op.dest));
+    await fs.copyFile(op.src, op.dest);
+  }
+
+  return { written: ops.length, indexWidth: width };
+}
+

package/cli/commands/auth.js

@@ -0,0 +1,65 @@
+import {
+  beginManualLogin,
+  clearAuth,
+  finishManualLogin,
+  getAuthStatus,
+  loginWithBrowser,
+  resolveCliAuth,
+} from '../auth.js';
+
+export async function runAuth({ subcommand, values }) {
+  const command = subcommand || 'status';
+
+  if (command === 'login') {
+    const domain = values?.domain;
+    const clientId = values?.['client-id'];
+    const apiBase = values?.['api-base'];
+    const port = values?.port ? Number(values.port) : undefined;
+    if (values?.manual) {
+      const { authorizeUrl, redirectUri } = await beginManualLogin({ domain, clientId, apiBase, port });
+      console.log('Manual login started.');
+      console.log(`- Open this URL to sign in:\n  ${authorizeUrl}`);
+      console.log(`- After login, copy the full redirect URL (starts with ${redirectUri})`);
+      console.log('Then run: shipscreens auth finish --redirect-url "<URL>"');
+      return;
+    }
+
+    const { profile } = await loginWithBrowser({ domain, clientId, apiBase, port });
+    const plan = profile?.isPro ? 'Pro' : 'Free';
+    const email = profile?.email || profile?.userId || '';
+    console.log(`OK: signed in (${plan}${email ? `, ${email}` : ''})`);
+    return;
+  }
+
+  if (command === 'finish' || command === 'complete') {
+    const redirectUrl = values?.['redirect-url'];
+    const code = values?.code;
+    const state = values?.state;
+    const { profile } = await finishManualLogin({ redirectUrl, code, state });
+    const plan = profile?.isPro ? 'Pro' : 'Free';
+    const email = profile?.email || profile?.userId || '';
+    console.log(`OK: signed in (${plan}${email ? `, ${email}` : ''})`);
+    return;
+  }
+
+  if (command === 'logout') {
+    await clearAuth();
+    console.log('OK: signed out');
+    return;
+  }
+
+  if (command === 'status') {
+    const status = await getAuthStatus();
+    if (!status.signedIn) {
+      console.log('Signed out');
+      return;
+    }
+    const auth = await resolveCliAuth().catch(() => null);
+    const plan = auth?.profile?.isPro ? 'Pro' : 'Free';
+    const expiry = status.expiresAt ? new Date(status.expiresAt).toISOString() : 'unknown';
+    console.log(`Signed in (${plan}), token expires: ${expiry}`);
+    return;
+  }
+
+  throw new Error(`Unknown auth command: ${command}`);
+}