@airongrong/plugin-cli 0.0.0-stage → 1.0.0-beta.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 AiToEarn
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,59 @@
-# Temporary Holding Version
+# @airongrong/plugin-cli
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+AiToEarn 插件开发 CLI：脚手架、校验、打包、签名一条龙。面向插件作者，运行时不进宿主沙箱。
+
+插件产物（`.aitpkg`）刻意不经过 npm：零依赖、可离线安装、签名校验。本工具只是帮你生产合格的产物。
+
+## 使用
+
+无需安装，npx 直接用（也可以全局安装 `npm i -g @airongrong/plugin-cli`，命令名同为 `aitoearn-plugin`）：
+
+```bash
+# 脚手架
+npx @airongrong/plugin-cli new channel.acme --type adapter
+
+# 校验（清单 schema + 产物哈希 + 单文件 ESM 约束 + 路径穿越检查）
+npx @airongrong/plugin-cli verify ./channel.acme
+# 被拒绝的 entry 源码示例（报 AIT-PL-001）：
+#   import axios from 'axios'              —— 非允许依赖
+#   const m = await import('node:' + 'fs') —— 计算型动态 import
+# 被拒绝的 entry.module 示例：
+#   "dist/../../evil.mjs"                  —— 路径穿越（AIT-PL-001）
+
+# 打包 .aitpkg（store-only zip，无第三方依赖）
+npx @airongrong/plugin-cli pack ./channel.acme
+
+# 开发签名（adapter 必需）
+npx @airongrong/plugin-cli keygen --out ~/.aitoearn
+npx @airongrong/plugin-cli sign ./channel.acme --key ~/.aitoearn/dev.pem
+```
+
+## 命令
+
+| 命令 | 说明 |
+| --- | --- |
+| `new <id> --type skill\|hook\|adapter` | 生成插件脚手架 |
+| `verify [dir]` | 清单与产物校验（AIT-PL-001/002，恒时哈希比较 + 路径穿越检查） |
+| `pack [dir]` | 产出 `<id>-<version>.aitpkg` |
+| `sign [dir] --key <pem>` | ed25519 签名 entry 产物 |
+| `keygen --out <dir>` | 生成开发用 ed25519 密钥对（私钥权限 0600） |
+| `dev` / `test` | 本地热重载 / 回放测试（M1 提供） |
+
+## 本地开发
+
+本仓库（aitoearn-sdk）是独立 pnpm workspace，与私有后端仓库解耦：
+
+```bash
+pnpm install
+pnpm build       # 全量 tsc 构建
+pnpm test        # vitest
+pnpm typecheck
+```
+
+## 发布（维护者）
+
+走 changesets：改完代码执行 `pnpm changeset` 写变更说明，合入 main 后 CI 开 Version PR，
+合并 Version PR 即自动 `changeset publish` 到 npm（需仓库 secret `NPM_TOKEN`）。
+
+注意版本联动：`plugin-cli` 对 `@airongrong/plugin-api` / `@airongrong/capability` 是 workspace 依赖，
+changesets 发版时会自动转成精确版本号并联动 bump。

package/dist/cli-output.d.ts

@@ -0,0 +1,3 @@
+/** CLI 输出：仓库 lint 禁止 console，这里统一走 process 标准流 */
+export declare function printLine(text: string): void;
+export declare function printErrorLine(text: string): void;

package/dist/cli-output.js

@@ -0,0 +1,11 @@
+"use strict";
+/** CLI 输出：仓库 lint 禁止 console，这里统一走 process 标准流 */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.printLine = printLine;
+exports.printErrorLine = printErrorLine;
+function printLine(text) {
+    process.stdout.write(`${text}\n`);
+}
+function printErrorLine(text) {
+    process.stderr.write(`${text}\n`);
+}

package/dist/main.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/main.js

@@ -0,0 +1,120 @@
+#!/usr/bin/env node
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const promises_1 = require("node:fs/promises");
+const node_path_1 = require("node:path");
+const plugin_api_1 = require("@airongrong/plugin-api");
+const commander_1 = require("commander");
+const cli_output_1 = require("./cli-output");
+const package_files_1 = require("./package-files");
+const scaffold_1 = require("./scaffold");
+const sign_1 = require("./sign");
+const zip_1 = require("./zip");
+const program = new commander_1.Command();
+program.name('aitoearn-plugin').description('AiToEarn 插件开发 CLI');
+program
+    .command('new')
+    .argument('<id>', '插件 id，如 channel.acme / hook.media-spec / skill.xhs-copywriting')
+    .requiredOption('--type <type>', 'skill | hook | adapter')
+    .option('--dir <dir>', '父目录', process.cwd())
+    .action(async (id, options) => {
+    const type = options.type;
+    if (!Object.values(plugin_api_1.PluginType).includes(type)) {
+        throw new Error(`--type 必须是 ${Object.values(plugin_api_1.PluginType).join(' | ')}`);
+    }
+    const dir = await (0, scaffold_1.scaffoldPlugin)((0, node_path_1.resolve)(options.dir), id, type);
+    (0, cli_output_1.printLine)(`已创建插件脚手架: ${dir}`);
+    (0, cli_output_1.printLine)('下一步: 实现 dist/index.mjs，回填 plugin.json entry.sha256，然后运行 verify');
+});
+program
+    .command('verify')
+    .argument('[dir]', '插件目录', process.cwd())
+    .action(async (dir) => {
+    const manifest = await (0, package_files_1.verifyPluginPackage)((0, node_path_1.resolve)(dir));
+    (0, cli_output_1.printLine)(`✓ ${manifest.id}@${manifest.version} 校验通过`);
+});
+program
+    .command('pack')
+    .argument('[dir]', '插件目录', process.cwd())
+    .action(async (dir) => {
+    const pkgDir = (0, node_path_1.resolve)(dir);
+    const manifest = await (0, package_files_1.verifyPluginPackage)(pkgDir);
+    const files = await (0, package_files_1.collectPackageFiles)(pkgDir);
+    const outPath = (0, node_path_1.join)(pkgDir, '..', `${manifest.id}-${manifest.version}.aitpkg`);
+    await (0, promises_1.writeFile)(outPath, (0, zip_1.buildZip)(files));
+    (0, cli_output_1.printLine)(`✓ 已打包 ${files.length} 个文件: ${outPath}`);
+});
+program
+    .command('sign')
+    .argument('[dir]', '插件目录', process.cwd())
+    .requiredOption('--key <path>', 'ed25519 私钥 PEM 路径')
+    .action(async (dir, options) => {
+    const { signature, modulePath } = await (0, sign_1.signPluginPackage)((0, node_path_1.resolve)(dir), (0, node_path_1.resolve)(options.key));
+    (0, cli_output_1.printLine)(`✓ 已签名: ${modulePath}.sig`);
+    (0, cli_output_1.printLine)(`  signature: ${signature}`);
+});
+program
+    .command('keygen')
+    .requiredOption('--out <dir>', '输出目录', (0, node_path_1.join)(process.env['HOME'] ?? '~', '.aitoearn'))
+    .action(async (options) => {
+    const keys = await (0, sign_1.generateDevKeys)((0, node_path_1.resolve)(options.out));
+    (0, cli_output_1.printLine)(`✓ 开发密钥已生成: ${keys.privateKeyPath}`);
+    (0, cli_output_1.printLine)(`  公钥（加入宿主 trustedKeys）: ${keys.publicKeyPath}`);
+});
+program
+    .command('cap')
+    .description('从 capability.yaml 派生五种产物（mcp / ui / openapi / sdk / validation）')
+    .requiredOption('--from <file>', 'capability.yaml 路径')
+    .option('--out <dir>', '输出目录', (0, node_path_1.join)(process.cwd(), 'generated'))
+    .option('--surface <surfaces>', '逗号分隔: mcp,ui,openapi,sdk,validation,all', 'all')
+    .action(async (options) => {
+    const { loadCapabilityManifest } = await import('@airongrong/capability');
+    const { generateAllSurfaces } = await import('@airongrong/capability');
+    const { mkdir, writeFile } = await import('node:fs/promises');
+    const manifest = await loadCapabilityManifest((0, node_path_1.resolve)(options.from));
+    const surfaces = generateAllSurfaces(manifest);
+    const wanted = options.surface.split(',').map(item => item.trim());
+    const all = wanted.includes('all');
+    await mkdir((0, node_path_1.resolve)(options.out), { recursive: true });
+    const written = [];
+    const dump = async (name, data, ext = 'json') => {
+        const file = (0, node_path_1.join)((0, node_path_1.resolve)(options.out), `${name}.${ext}`);
+        await writeFile(file, typeof data === 'string' ? data : `${JSON.stringify(data, null, 2)}\n`);
+        written.push(file);
+    };
+    if (all || wanted.includes('mcp')) {
+        await dump('mcp-tools', surfaces.mcp);
+    }
+    if (all || wanted.includes('ui')) {
+        await dump('ui-forms', surfaces.ui);
+    }
+    if (all || wanted.includes('openapi')) {
+        await dump('openapi', surfaces.openapi);
+    }
+    if (all || wanted.includes('sdk')) {
+        await dump('capability-client', surfaces.sdk, 'ts');
+    }
+    if (all || wanted.includes('validation')) {
+        await dump('validation-rules', surfaces.validation);
+    }
+    (0, cli_output_1.printLine)(`✓ 已从 capability.yaml v${manifest.version} 生成 ${written.length} 个产物 (${Object.keys(manifest.actions).length} 个能力)`);
+    for (const file of written) {
+        (0, cli_output_1.printLine)(`  ${file}`);
+    }
+});
+program
+    .command('dev')
+    .description('本地热重载 + 宿主连接（M1 提供）')
+    .action(() => {
+    (0, cli_output_1.printLine)('plugin dev 将在 M1（渠道插件化阶段）提供');
+});
+program
+    .command('test')
+    .description('回放式测试（M1 提供）')
+    .action(() => {
+    (0, cli_output_1.printLine)('plugin test 将在 M1（渠道插件化阶段）提供');
+});
+program.parseAsync(process.argv).catch((error) => {
+    (0, cli_output_1.printErrorLine)(`✗ ${error.message}`);
+    process.exitCode = 1;
+});

package/dist/package-files.d.ts

@@ -0,0 +1,14 @@
+import type { PluginManifest } from '@airongrong/plugin-api';
+export interface PluginPackageFiles {
+    dir: string;
+    manifest: PluginManifest;
+    entrySource?: string;
+    entryBytes?: Buffer;
+}
+export declare function readPluginPackage(dir: string): Promise<PluginPackageFiles>;
+export declare function verifyPluginPackage(dir: string): Promise<PluginManifest>;
+/** 收集打包文件：plugin.json + dist + skills + README/CHANGELOG */
+export declare function collectPackageFiles(dir: string): Promise<Array<{
+    name: string;
+    data: Buffer;
+}>>;

package/dist/package-files.js

@@ -0,0 +1,72 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readPluginPackage = readPluginPackage;
+exports.verifyPluginPackage = verifyPluginPackage;
+exports.collectPackageFiles = collectPackageFiles;
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const promises_1 = require("node:fs/promises");
+const node_path_1 = require("node:path");
+const plugin_api_1 = require("@airongrong/plugin-api");
+async function readPluginPackage(dir) {
+    const manifestPath = (0, node_path_1.join)(dir, 'plugin.json');
+    if (!(0, node_fs_1.existsSync)(manifestPath)) {
+        throw new plugin_api_1.PluginError(plugin_api_1.PluginErrorCode.InvalidManifest, `plugin.json 不存在: ${manifestPath}`);
+    }
+    const manifest = (0, plugin_api_1.verifyManifest)(JSON.parse(await (0, promises_1.readFile)(manifestPath, 'utf8')));
+    const pkg = { dir, manifest };
+    if (manifest.entry) {
+        const entryPath = (0, node_path_1.join)(dir, manifest.entry.module.replace(/^\.\//, ''));
+        pkg.entryBytes = await (0, promises_1.readFile)(entryPath);
+        pkg.entrySource = pkg.entryBytes.toString('utf8');
+    }
+    return pkg;
+}
+async function verifyPluginPackage(dir) {
+    const pkg = await readPluginPackage(dir);
+    const { manifest } = pkg;
+    if (pkg.entryBytes && pkg.entrySource !== undefined) {
+        const actual = (0, node_crypto_1.createHash)('sha256').update(pkg.entryBytes).digest('hex');
+        if (actual !== manifest.entry.sha256) {
+            throw new plugin_api_1.PluginError(plugin_api_1.PluginErrorCode.HashMismatch, `产物哈希不匹配（AIT-PL-002）: 期望 ${manifest.entry.sha256}，实际 ${actual}，请重新打包`);
+        }
+        (0, plugin_api_1.assertPluginEntrySource)(pkg.entrySource, manifest.entry.module);
+    }
+    if ((0, node_fs_1.existsSync)((0, node_path_1.join)(dir, 'node_modules'))) {
+        throw new plugin_api_1.PluginError(plugin_api_1.PluginErrorCode.InvalidManifest, '插件禁止携带 node_modules（AIT-PL-001）');
+    }
+    return manifest;
+}
+/** 收集打包文件：plugin.json + dist + skills + README/CHANGELOG */
+async function collectPackageFiles(dir) {
+    const files = [];
+    const includeDirs = ['dist', 'skills'];
+    for (const sub of includeDirs) {
+        const subDir = (0, node_path_1.join)(dir, sub);
+        if (!(0, node_fs_1.existsSync)(subDir)) {
+            continue;
+        }
+        const stack = [subDir];
+        while (stack.length > 0) {
+            const current = stack.pop();
+            const entries = await (0, promises_1.readdir)(current, { withFileTypes: true });
+            for (const entry of entries) {
+                const full = (0, node_path_1.join)(current, entry.name);
+                if (entry.isDirectory()) {
+                    stack.push(full);
+                }
+                else {
+                    files.push({ name: (0, node_path_1.relative)(dir, full), data: await (0, promises_1.readFile)(full) });
+                }
+            }
+        }
+    }
+    for (const doc of ['README.md', 'CHANGELOG.md']) {
+        const docPath = (0, node_path_1.join)(dir, doc);
+        if ((0, node_fs_1.existsSync)(docPath)) {
+            files.push({ name: doc, data: await (0, promises_1.readFile)(docPath) });
+        }
+    }
+    files.push({ name: 'plugin.json', data: await (0, promises_1.readFile)((0, node_path_1.join)(dir, 'plugin.json')) });
+    return files;
+}

package/dist/scaffold.d.ts

@@ -0,0 +1,2 @@
+import { PluginType } from '@airongrong/plugin-api';
+export declare function scaffoldPlugin(parentDir: string, id: string, type: PluginType): Promise<string>;

package/dist/scaffold.js

@@ -0,0 +1,96 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.scaffoldPlugin = scaffoldPlugin;
+const node_fs_1 = require("node:fs");
+const promises_1 = require("node:fs/promises");
+const node_path_1 = require("node:path");
+const plugin_api_1 = require("@airongrong/plugin-api");
+const TEMPLATES = {
+    [plugin_api_1.PluginType.Hook]: {
+        entry: `export async function activate() {
+  return {
+    hooks: {
+      async beforePublish(draft) {
+        if (!draft.text.trim()) {
+          throw new Error('正文不能为空')
+        }
+      },
+    },
+  }
+}
+`,
+        manifest: id => ({
+            id,
+            version: '0.1.0',
+            apiVersion: '^1.0.0',
+            type: 'hook',
+            description: 'TODO: 一句话描述钩子用途',
+            entry: { module: './dist/index.mjs', sha256: 'TODO: pnpm aitoearn-plugin verify 前用实际产物哈希替换' },
+            contributes: { hooks: ['beforePublish'] },
+            permissions: { network: [] },
+            engines: { aitoearn: '>=1.8.0 <3' },
+            license: 'MIT',
+        }),
+    },
+    [plugin_api_1.PluginType.Adapter]: {
+        entry: `export async function activate(host) {
+  return {
+    adapter: {
+      meta: { id: 'acme', label: 'Acme', capabilities: ['publish.text'] },
+      async authorize() { throw new Error('TODO') },
+      validate(draft) { return draft.text ? [] : [{ severity: 'error', message: '正文不能为空' }] },
+      async publish(draft) {
+        // const res = await host.http.request({ url: 'https://api.example.com/posts', method: 'POST', body: JSON.stringify({ text: draft.text }) })
+        return { externalId: draft.draftId, url: 'https://example.com/' + draft.draftId, publishedAt: new Date().toISOString() }
+      },
+    },
+  }
+}
+`,
+        manifest: id => ({
+            id,
+            version: '0.1.0',
+            apiVersion: '^1.0.0',
+            type: 'adapter',
+            description: 'TODO: 一句话描述渠道用途',
+            entry: { module: './dist/index.mjs', sha256: 'TODO: 用实际产物哈希替换' },
+            contributes: { channels: [{ id: 'acme', label: 'Acme', capabilities: ['publish.text'] }] },
+            permissions: { network: ['api.example.com'], secrets: ['oauth.access_token'] },
+            engines: { aitoearn: '>=1.8.0 <3' },
+            license: 'MIT',
+        }),
+    },
+    [plugin_api_1.PluginType.Skill]: {
+        entry: '',
+        manifest: id => ({
+            id,
+            version: '0.1.0',
+            apiVersion: '^1.0.0',
+            type: 'skill',
+            description: 'TODO: 一句话描述技能用途',
+            contributes: { skills: [id.split('.')[1]] },
+            permissions: { network: [] },
+            engines: { aitoearn: '>=1.8.0 <3' },
+            license: 'MIT',
+        }),
+    },
+};
+async function scaffoldPlugin(parentDir, id, type) {
+    if (!plugin_api_1.PLUGIN_ID_PATTERN.test(id)) {
+        throw new plugin_api_1.PluginError(plugin_api_1.PluginErrorCode.InvalidManifest, `插件 id 非法: ${id}（必须匹配 ${plugin_api_1.PLUGIN_ID_PATTERN.source}，如 hook.media-spec / channel.acme / skill.xhs-copywriting）`);
+    }
+    const dir = (0, node_path_1.join)(parentDir, id);
+    if ((0, node_fs_1.existsSync)(dir)) {
+        throw new plugin_api_1.PluginError(plugin_api_1.PluginErrorCode.InvalidManifest, `目录已存在: ${dir}`);
+    }
+    const template = TEMPLATES[type];
+    await (0, promises_1.mkdir)((0, node_path_1.join)(dir, 'tests', 'fixtures'), { recursive: true });
+    await (0, promises_1.mkdir)((0, node_path_1.join)(dir, 'dist'), { recursive: true });
+    await (0, promises_1.writeFile)((0, node_path_1.join)(dir, 'plugin.json'), `${JSON.stringify(template.manifest(id), null, 2)}\n`);
+    if (template.entry) {
+        await (0, promises_1.writeFile)((0, node_path_1.join)(dir, 'dist', 'index.mjs'), template.entry);
+    }
+    await (0, promises_1.writeFile)((0, node_path_1.join)(dir, 'README.md'), `# ${id}\n\nTODO: 插件说明\n`);
+    await (0, promises_1.writeFile)((0, node_path_1.join)(dir, 'CHANGELOG.md'), `# 0.1.0\n\n- 初始版本\n`);
+    return dir;
+}

package/dist/sign.d.ts

@@ -0,0 +1,9 @@
+/** 签名对象：entry 产物的 sha256 十六进制字符串（与宿主 loader 校验口径一致） */
+export declare function signPluginPackage(dir: string, keyPath: string): Promise<{
+    signature: string;
+    modulePath: string;
+}>;
+export declare function generateDevKeys(outDir: string): Promise<{
+    privateKeyPath: string;
+    publicKeyPath: string;
+}>;

package/dist/sign.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.signPluginPackage = signPluginPackage;
+exports.generateDevKeys = generateDevKeys;
+const node_crypto_1 = require("node:crypto");
+const promises_1 = require("node:fs/promises");
+const node_path_1 = require("node:path");
+const plugin_api_1 = require("@airongrong/plugin-api");
+const package_files_1 = require("./package-files");
+/** 签名对象：entry 产物的 sha256 十六进制字符串（与宿主 loader 校验口径一致） */
+async function signPluginPackage(dir, keyPath) {
+    const pkg = await (0, package_files_1.readPluginPackage)(dir);
+    if (!pkg.entryBytes || !pkg.manifest.entry) {
+        throw new plugin_api_1.PluginError(plugin_api_1.PluginErrorCode.InvalidManifest, '技能插件没有可签名的产物');
+    }
+    const privateKey = await (0, promises_1.readFile)(keyPath, 'utf8');
+    const digestHex = (0, node_crypto_1.createHash)('sha256').update(pkg.entryBytes).digest('hex');
+    const signature = (0, node_crypto_1.sign)(null, Buffer.from(digestHex), privateKey).toString('base64');
+    const modulePath = (0, node_path_1.join)(dir, pkg.manifest.entry.module.replace(/^\.\//, ''));
+    await (0, promises_1.writeFile)(`${modulePath}.sig`, signature);
+    return { signature, modulePath };
+}
+async function generateDevKeys(outDir) {
+    const { privateKey, publicKey } = (0, node_crypto_1.generateKeyPairSync)('ed25519');
+    const privateKeyPath = (0, node_path_1.join)(outDir, 'dev.pem');
+    const publicKeyPath = (0, node_path_1.join)(outDir, 'dev.pub');
+    await (0, promises_1.mkdir)((0, node_path_1.dirname)(privateKeyPath), { recursive: true });
+    await (0, promises_1.writeFile)(privateKeyPath, privateKey.export({ type: 'pkcs8', format: 'pem' }));
+    await (0, promises_1.writeFile)(publicKeyPath, publicKey.export({ type: 'spki', format: 'pem' }));
+    return { privateKeyPath, publicKeyPath };
+}

package/dist/zip.d.ts

@@ -0,0 +1,10 @@
+/**
+ * .aitpkg 格式：zip（store-only，无压缩）+ CRC32。
+ * 刻意不引入第三方 zip 依赖：插件分发生态零 npm 依赖是方案底线。
+ */
+export declare function crc32(buffer: Buffer): number;
+export interface ZipEntryInput {
+    name: string;
+    data: Buffer;
+}
+export declare function buildZip(entries: ZipEntryInput[]): Buffer;

package/dist/zip.js

@@ -0,0 +1,88 @@
+"use strict";
+/**
+ * .aitpkg 格式：zip（store-only，无压缩）+ CRC32。
+ * 刻意不引入第三方 zip 依赖：插件分发生态零 npm 依赖是方案底线。
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.crc32 = crc32;
+exports.buildZip = buildZip;
+const CRC_TABLE = (() => {
+    const table = new Uint32Array(256);
+    for (let index = 0; index < 256; index += 1) {
+        let crc = index;
+        for (let bit = 0; bit < 8; bit += 1) {
+            crc = crc & 1 ? 0xEDB88320 ^ (crc >>> 1) : crc >>> 1;
+        }
+        table[index] = crc >>> 0;
+    }
+    return table;
+})();
+function crc32(buffer) {
+    let crc = 0xFFFFFFFF;
+    for (const byte of buffer) {
+        crc = CRC_TABLE[(crc ^ byte) & 0xFF] ^ (crc >>> 8);
+    }
+    return (crc ^ 0xFFFFFFFF) >>> 0;
+}
+function dosDateTime(date) {
+    return {
+        date: ((date.getFullYear() - 1980) << 9) | ((date.getMonth() + 1) << 5) | date.getDate(),
+        time: (date.getHours() << 11) | (date.getMinutes() << 5) | (date.getSeconds() >> 1),
+    };
+}
+function buildZip(entries) {
+    const chunks = [];
+    const central = [];
+    let offset = 0;
+    for (const entry of entries) {
+        const name = Buffer.from(entry.name, 'utf8');
+        const crc = crc32(entry.data);
+        const { date, time } = dosDateTime(new Date());
+        const local = Buffer.alloc(30);
+        local.writeUInt32LE(0x04034B50, 0);
+        local.writeUInt16LE(20, 4);
+        local.writeUInt16LE(0x0800, 6); // UTF-8 文件名
+        local.writeUInt16LE(0, 8); // store-only
+        local.writeUInt16LE(time, 10);
+        local.writeUInt16LE(date, 12);
+        local.writeUInt32LE(crc, 14);
+        local.writeUInt32LE(entry.data.length, 18);
+        local.writeUInt32LE(entry.data.length, 22);
+        local.writeUInt16LE(name.length, 26);
+        local.writeUInt16LE(0, 28);
+        chunks.push(local, name, entry.data);
+        central.push({ name, crc, size: entry.data.length, offset });
+        offset += local.length + name.length + entry.data.length;
+    }
+    const centralStart = offset;
+    for (const entry of central) {
+        const { date, time } = dosDateTime(new Date());
+        const header = Buffer.alloc(46);
+        header.writeUInt32LE(0x02014B50, 0);
+        header.writeUInt16LE(20, 4);
+        header.writeUInt16LE(20, 6);
+        header.writeUInt16LE(0x0800, 8);
+        header.writeUInt16LE(0, 10);
+        header.writeUInt16LE(time, 12);
+        header.writeUInt16LE(date, 14);
+        header.writeUInt32LE(entry.crc, 16);
+        header.writeUInt32LE(entry.size, 20);
+        header.writeUInt32LE(entry.size, 24);
+        header.writeUInt16LE(entry.name.length, 28);
+        header.writeUInt32LE(0, 30); // extra + comment
+        header.writeUInt16LE(0, 34);
+        header.writeUInt16LE(0, 36);
+        header.writeUInt32LE(0, 38);
+        header.writeUInt32LE(entry.offset, 42);
+        chunks.push(header, entry.name);
+        offset += header.length + entry.name.length;
+    }
+    const end = Buffer.alloc(22);
+    end.writeUInt32LE(0x06054B50, 0);
+    end.writeUInt16LE(central.length, 8);
+    end.writeUInt16LE(central.length, 10);
+    end.writeUInt32LE(offset - centralStart, 12);
+    end.writeUInt32LE(centralStart, 16);
+    chunks.push(end);
+    return Buffer.concat(chunks);
+}

package/package.json

@@ -1,6 +1,52 @@
 {
   "name": "@airongrong/plugin-cli",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "1.0.0-beta.0",
+  "description": "AiToEarn plugin developer CLI: scaffold, verify, pack, sign channel adapters / hooks / skills and generate surfaces from capability.yaml",
+  "license": "MIT",
+  "type": "commonjs",
+  "main": "./dist/main.js",
+  "types": "./dist/main.d.ts",
+  "bin": {
+    "aitoearn-plugin": "./dist/main.js"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/yikart/aitoearn-sdk.git",
+    "directory": "packages/plugin-cli"
+  },
+  "homepage": "https://github.com/yikart/aitoearn-sdk/tree/main/packages/plugin-cli#readme",
+  "bugs": {
+    "url": "https://github.com/yikart/aitoearn-sdk/issues"
+  },
+  "keywords": [
+    "aitoearn",
+    "plugin",
+    "cli",
+    "channel-adapter",
+    "capability",
+    "content-publish"
+  ],
+  "scripts": {
+    "build": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\" && tsc -p tsconfig.build.json && node scripts/postbuild.mjs",
+    "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\"",
+    "test": "vitest run",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "prepublishOnly": "node ../../scripts/prepublish-guard.mjs"
+  },
+  "dependencies": {
+    "@airongrong/capability": "1.0.0-beta.0",
+    "@airongrong/plugin-api": "1.0.0-beta.0",
+    "commander": "^14.0.3"
+  }
+}