npm - uniweb - Versions diffs - 0.12.26 → 0.12.28 - Mend

uniweb 0.12.26 → 0.12.28

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (25) hide show

package/package.json +6 -6
package/partials/agents.md +3 -0
package/src/backend/client.js +339 -0
package/src/commands/clone.js +18 -32
package/src/commands/deploy.js +218 -1783
package/src/commands/handoff.js +9 -246
package/src/commands/invite.js +10 -318
package/src/commands/org.js +6 -8
package/src/commands/publish.js +128 -1153
package/src/commands/pull.js +22 -36
package/src/commands/push.js +43 -101
package/src/commands/register.js +184 -39
package/src/commands/runtime.js +141 -0
package/src/commands/template.js +13 -221
package/src/framework-index.json +18 -7
package/src/index.js +74 -100
package/src/utils/asset-upload.js +162 -0
package/src/utils/code-upload.js +245 -0
package/src/utils/config.js +11 -44
package/src/utils/registry-auth.js +35 -1
package/src/utils/registry-orgs.js +141 -73
package/src/utils/runtime-upload.js +163 -0
package/src/commands/login.js +0 -230
package/src/utils/auth.js +0 -212
package/src/utils/registry.js +0 -466

package/src/commands/login.js DELETED Viewed

@@ -1,230 +0,0 @@
-/**
- * Login Command
- *
- * Authenticates with the Uniweb platform. Stores credentials at ~/.uniweb/auth.json.
- *
- * Flow:
- *   1. Start a temporary HTTP server on a random port
- *   2. Open the browser to {backend}/cli-auth.php?action=login&callback=http://localhost:{port}/callback
- *   3. PHP authenticates the user, signs a JWT, redirects to the callback
- *   4. CLI receives the token and stores it at ~/.uniweb/auth.json
- *   5. Falls back to token-paste if browser fails
- *
- * Usage:
- *   uniweb login
- *   uniweb login --token-paste    # Skip browser, use token paste
- */
-import { createServer } from 'node:http'
-import { writeAuth, readAuth, isExpired } from '../utils/auth.js'
-import { getBackendUrl } from '../utils/config.js'
-// Colors for terminal output
-const colors = {
-  reset: '\x1b[0m',
-  bright: '\x1b[1m',
-  dim: '\x1b[2m',
-  cyan: '\x1b[36m',
-  green: '\x1b[32m',
-  yellow: '\x1b[33m',
-  red: '\x1b[31m',
-}
-function success(message) {
-  console.log(`${colors.green}✓${colors.reset} ${message}`)
-}
-function error(message) {
-  console.error(`${colors.red}✗${colors.reset} ${message}`)
-}
-/**
- * Try to open a URL in the default browser.
- * @param {string} url
- * @returns {Promise<boolean>} Whether the browser was opened
- */
-async function openBrowser(url) {
-  try {
-    const { exec } = await import('node:child_process')
-    const cmd = process.platform === 'darwin'
-      ? `open "${url}"`
-      : process.platform === 'win32'
-        ? `start "" "${url}"`
-        : `xdg-open "${url}"`
-    return new Promise((resolve) => {
-      exec(cmd, (err) => resolve(!err))
-    })
-  } catch {
-    return false
-  }
-}
-/**
- * Browser-based login flow.
- *
- * Starts a temp HTTP server, opens the browser to the PHP login page,
- * waits for the callback with the JWT token.
- *
- * @param {string} backendUrl - PHP backend URL
- * @param {number} [timeoutMs=120000] - Timeout in ms
- * @returns {Promise<{ token: string, email: string } | null>}
- */
-function browserLogin(backendUrl, timeoutMs = 120000) {
-  return new Promise((resolve) => {
-    const server = createServer((req, res) => {
-      const url = new URL(req.url, `http://localhost`)
-      if (url.pathname !== '/callback') {
-        res.writeHead(404)
-        res.end('Not found')
-        return
-      }
-      const token = url.searchParams.get('token')
-      const email = url.searchParams.get('email')
-      if (!token) {
-        res.writeHead(400, { 'Content-Type': 'text/html' })
-        res.end('<h2>Login failed</h2><p>No token received. Please try again.</p>')
-        cleanup()
-        resolve(null)
-        return
-      }
-      res.writeHead(200, { 'Content-Type': 'text/html' })
-      res.end(`
-        <html>
-          <body style="font-family: system-ui, sans-serif; text-align: center; padding: 60px;">
-            <h2 style="color: #16a34a;">Login successful!</h2>
-            <p>You can close this window and return to your terminal.</p>
-          </body>
-        </html>
-      `)
-      cleanup()
-      resolve({ token, email: email || '' })
-    })
-    let timeout
-    function cleanup() {
-      clearTimeout(timeout)
-      server.close()
-    }
-    // Listen on a random port
-    server.listen(0, '127.0.0.1', async () => {
-      const port = server.address().port
-      const callbackUrl = `http://localhost:${port}/callback`
-      const loginUrl = `${backendUrl}/cli-auth.php?action=login&callback=${encodeURIComponent(callbackUrl)}`
-      console.log(`${colors.cyan}→${colors.reset} Opening browser for login...`)
-      console.log(`  ${colors.dim}${loginUrl}${colors.reset}`)
-      console.log('')
-      const opened = await openBrowser(loginUrl)
-      if (!opened) {
-        console.log(`${colors.yellow}⚠${colors.reset} Could not open browser.`)
-        console.log(`  Open this URL manually: ${colors.cyan}${loginUrl}${colors.reset}`)
-      }
-      console.log(`${colors.dim}Waiting for login... (${timeoutMs / 1000}s timeout)${colors.reset}`)
-    })
-    // Timeout
-    timeout = setTimeout(() => {
-      server.close()
-      resolve(null)
-    }, timeoutMs)
-    server.on('error', () => {
-      resolve(null)
-    })
-  })
-}
-/**
- * Token-paste login flow (fallback).
- * @returns {Promise<{ token: string, email: string } | null>}
- */
-async function tokenPasteLogin() {
-  const prompts = (await import('prompts')).default
-  console.log('Paste your token from the Uniweb login page.')
-  console.log('')
-  const response = await prompts([
-    {
-      type: 'text',
-      name: 'email',
-      message: 'Email:',
-      validate: (v) => (v && v.includes('@') ? true : 'Enter a valid email'),
-    },
-    {
-      type: 'password',
-      name: 'token',
-      message: 'Token:',
-      validate: (v) => (v ? true : 'Token is required'),
-    },
-  ], {
-    onCancel: () => {
-      console.log('\nLogin cancelled.')
-      process.exit(0)
-    },
-  })
-  if (!response.email || !response.token) {
-    return null
-  }
-  return { token: response.token, email: response.email }
-}
-/**
- * Main login command handler
- */
-export async function login(args = []) {
-  const forceTokenPaste = args.includes('--token-paste')
-  // Check if already logged in
-  const existing = await readAuth()
-  if (existing && !isExpired(existing)) {
-    console.log(`Already logged in as ${colors.bright}${existing.email}${colors.reset}`)
-    console.log(`${colors.dim}Continuing will replace the existing session.${colors.reset}`)
-    console.log('')
-  }
-  const backendUrl = getBackendUrl()
-  let result = null
-  if (!forceTokenPaste) {
-    // Try browser-based login
-    result = await browserLogin(backendUrl)
-    if (!result) {
-      console.log('')
-      console.log(`${colors.yellow}⚠${colors.reset} Browser login timed out or failed.`)
-      console.log(`  Falling back to token paste...`)
-      console.log('')
-      result = await tokenPasteLogin()
-    }
-  } else {
-    result = await tokenPasteLogin()
-  }
-  if (!result) {
-    error('Login cancelled.')
-    process.exit(1)
-  }
-  // Store credentials (JWT has 30-day expiry)
-  await writeAuth({
-    token: result.token,
-    email: result.email,
-    expiresAt: new Date(Date.now() + 30 * 24 * 60 * 60 * 1000).toISOString(),
-  })
-  console.log('')
-  success(`Logged in as ${colors.bright}${result.email}${colors.reset}`)
-}
-export default login

package/src/utils/auth.js DELETED Viewed

@@ -1,212 +0,0 @@
-/**
- * Credential Storage
- *
- * Manages authentication credentials at ~/.uniweb/auth.json.
- * User-global (not workspace-local) — you publish as yourself, not as a project.
- *
- * Used by `login`, `publish`, and `deploy` commands.
- *
- * Stored shape (auth.json):
- *   {
- *     token: string,           // bearer JWT, sent in Authorization: Bearer <token>
- *     email: string,           // signup_email; permanent, deliverable
- *     loginName?: string,      // PHP session login_name; immutable per session model
- *     sub?: string,            // memberId from JWT; permanent, numeric
- *     namespaces?: string[],   // org handles the user can publish under
- *     expiresAt?: string       // ISO timestamp; JWT exp claim
- *   }
- *
- * The extra identity fields (loginName, sub, namespaces) are decoded from
- * the JWT at write time and persisted alongside the token. They're cheap
- * to derive (HS256 payload is base64url-encoded JSON), but persisting them
- * means callers don't need to decode the JWT themselves to ask
- * "who is the user?" — they just `readAuth()`.
- */
-import { existsSync } from 'node:fs'
-import { readFile, writeFile, mkdir, unlink } from 'node:fs/promises'
-import { join } from 'node:path'
-import { homedir } from 'node:os'
-/**
- * Get the ~/.uniweb/ directory path.
- * @returns {string}
- */
-export function getAuthDir() {
-  return join(homedir(), '.uniweb')
-}
-/**
- * Get the ~/.uniweb/auth.json file path.
- * @returns {string}
- */
-export function getAuthPath() {
-  return join(getAuthDir(), 'auth.json')
-}
-/**
- * Decode the payload of a JWT. Returns `null` for malformed tokens.
- * No signature verification — that's the server's job; we just want to
- * read the claims locally.
- *
- * @param {string} token
- * @returns {Object|null}
- */
-export function decodeJwtPayload(token) {
-  if (typeof token !== 'string') return null
-  const parts = token.split('.')
-  if (parts.length < 2) return null
-  try {
-    // base64url → base64
-    const b64 = parts[1].replace(/-/g, '+').replace(/_/g, '/')
-    return JSON.parse(Buffer.from(b64, 'base64').toString('utf8'))
-  } catch {
-    return null
-  }
-}
-/**
- * Read stored credentials. If the persisted record predates the
- * identity-fields plumbing (no loginName/sub/namespaces) but has a
- * token, derive the missing fields from the JWT in memory so callers
- * see a consistent shape regardless of write generation.
- *
- * @returns {Promise<{ token: string, email: string, loginName?: string, sub?: string, namespaces?: string[], expiresAt?: string } | null>}
- */
-export async function readAuth() {
-  const authPath = getAuthPath()
-  if (!existsSync(authPath)) return null
-  let auth
-  try {
-    auth = JSON.parse(await readFile(authPath, 'utf8'))
-  } catch {
-    return null
-  }
-  // Backfill identity fields from the JWT for older auth.json files
-  // that were written before this plumbing existed. Read-only — the
-  // file isn't rewritten until the next login.
-  if (auth?.token && (auth.loginName === undefined || auth.sub === undefined || auth.namespaces === undefined)) {
-    const payload = decodeJwtPayload(auth.token)
-    if (payload) {
-      if (auth.loginName === undefined && typeof payload.loginName === 'string') {
-        auth.loginName = payload.loginName
-      }
-      if (auth.sub === undefined && typeof payload.sub === 'string') {
-        auth.sub = payload.sub
-      }
-      if (auth.namespaces === undefined && Array.isArray(payload.namespaces)) {
-        auth.namespaces = payload.namespaces
-      }
-    }
-  }
-  return auth
-}
-/**
- * Write credentials to storage. Decodes the JWT and persists the
- * identity claims (loginName, sub, namespaces) alongside the token,
- * so future `readAuth()` calls don't have to decode it themselves.
- *
- * @param {{ token: string, email: string, expiresAt?: string }} auth - Caller passes the basics; identity fields are derived.
- */
-export async function writeAuth(auth) {
-  const record = { ...auth }
-  if (record.token) {
-    const payload = decodeJwtPayload(record.token)
-    if (payload) {
-      if (typeof payload.loginName === 'string') record.loginName = payload.loginName
-      if (typeof payload.sub === 'string') record.sub = payload.sub
-      if (Array.isArray(payload.namespaces)) record.namespaces = payload.namespaces
-    }
-  }
-  const dir = getAuthDir()
-  await mkdir(dir, { recursive: true })
-  await writeFile(join(dir, 'auth.json'), JSON.stringify(record, null, 2))
-}
-/**
- * Remove stored credentials.
- */
-export async function clearAuth() {
-  const authPath = getAuthPath()
-  if (existsSync(authPath)) {
-    await unlink(authPath)
-  }
-}
-/**
- * Check if credentials are expired.
- * @param {{ expiresAt?: string }} auth
- * @returns {boolean}
- */
-export function isExpired(auth) {
-  if (!auth?.expiresAt) return false
-  return new Date(auth.expiresAt) < new Date()
-}
-/**
- * Ensure the user is authenticated. If not, prompt inline login.
- * Returns the auth token on success, exits the process on cancel.
- *
- * In non-interactive mode (CI, no TTY, or --non-interactive in args),
- * bails with an actionable error instead of opening a browser. The browser
- * login flow waits 120 seconds for a callback that can never arrive without
- * a user, then drops to a token-paste prompt that pipes can't answer —
- * silently burning two minutes per invocation. CI / agent / piped callers
- * must set `UNIWEB_TOKEN`, run `uniweb login` interactively first, or use
- * `--local` for the unicloud mock (see workspace root CLAUDE.md).
- *
- * @param {Object} options
- * @param {string} options.command - The command that needs auth (for messaging)
- * @param {string[]} [options.args] - Argv slice; checked for --non-interactive
- * @returns {Promise<string>} Bearer token
- */
-export async function ensureAuth({ command = 'This command', args = [] } = {}) {
-  // Honor explicit token from env — useful for CI and agents.
-  if (process.env.UNIWEB_TOKEN) {
-    return process.env.UNIWEB_TOKEN
-  }
-  const auth = await readAuth()
-  if (auth?.token && !isExpired(auth)) {
-    return auth.token
-  }
-  // Non-interactive bail: don't open a browser, don't wait 120s, don't
-  // prompt for a token paste. Print an actionable error and exit.
-  const { isNonInteractive, getCliPrefix } = await import('./interactive.js')
-  if (isNonInteractive(args)) {
-    const prefix = getCliPrefix()
-    const reason = auth && isExpired(auth) ? 'Session expired.' : 'Not logged in.'
-    console.error(`\x1b[31m✗\x1b[0m ${reason} ${command} requires a Uniweb account, and the CLI is in non-interactive mode (CI / no TTY / --non-interactive).`)
-    console.error(`  Options:`)
-    console.error(`    • Run \`${prefix} login\` interactively first, then re-run.`)
-    console.error(`    • Set the \`UNIWEB_TOKEN\` env var to a bearer token.`)
-    console.error(`    • Use \`--local\` to target the unicloud mock (internal testing only — see workspace root CLAUDE.md).`)
-    process.exit(1)
-  }
-  // Need to log in — delegate to the login command
-  if (auth && isExpired(auth)) {
-    console.log(`\x1b[33mSession expired.\x1b[0m ${command} requires a Uniweb account.\n`)
-  } else {
-    console.log(`${command} requires a Uniweb account.\n`)
-  }
-  const { login } = await import('../commands/login.js')
-  await login([])
-  // Re-read auth after login
-  const newAuth = await readAuth()
-  if (!newAuth?.token) {
-    process.exit(1)
-  }
-  return newAuth.token
-}