@droposs/plugin-cli 0.1.0

package/bin/drop-plugin.js

@@ -0,0 +1,39 @@
+#!/usr/bin/env node
+import { signPlugin, packPlugin } from "../dist/signer.js";
+
+const command = process.argv[2];
+const args = process.argv.slice(3);
+
+async function main() {
+  switch (command) {
+    case "sign": {
+      const dir = args[0] || ".";
+      const res = await signPlugin(dir);
+      console.log(`Signed bundle at ${dir}: ${res.fileCount} files verified (signature: ${res.signed ? "yes" : "no"})`);
+      break;
+    }
+    case "pack": {
+      const dir = args[0] || ".";
+      const outDir = args[1];
+      const res = await packPlugin(dir, outDir);
+      console.log(`Packed plugin '${res.id}' v${res.version} to ${res.packagePath}`);
+      break;
+    }
+    case "help":
+    default:
+      console.log(`Drop Plugin CLI (drop-plugin)
+
+Usage:
+  drop-plugin sign [dir]         Calculate SHA-256 digests and sign drop-plugin.json
+  drop-plugin pack [dir] [out]   Verify, sign, and package bundle into .dropplugin archive
+  drop-plugin build              Compile plugin bundle
+  drop-plugin test               Run plugin tests
+`);
+      break;
+  }
+}
+
+main().catch((err) => {
+  console.error(`Error: ${err.message}`);
+  process.exit(1);
+});

package/dist/signer.d.ts

@@ -0,0 +1,10 @@
+export declare function listFiles(root: string, prefix?: string): Promise<string[]>;
+export declare function signPlugin(targetDir: string, signingKey?: string): Promise<{
+    fileCount: number;
+    signed: boolean;
+}>;
+export declare function packPlugin(targetDir: string, outputDir?: string): Promise<{
+    packagePath: string;
+    id: string;
+    version: string;
+}>;

package/dist/signer.js

@@ -0,0 +1,107 @@
+import { createHash, createHmac } from "node:crypto";
+import { readdir, readFile, realpath, stat, writeFile, mkdir } from "node:fs/promises";
+import path from "node:path";
+const MANIFEST_FILE = "drop-plugin.json";
+function isInside(base, candidate) {
+    const relative = path.relative(base, candidate);
+    return (relative !== "" && !relative.startsWith("..") && !path.isAbsolute(relative));
+}
+export async function listFiles(root, prefix = "") {
+    const results = [];
+    const entries = await readdir(path.join(root, prefix), { withFileTypes: true });
+    for (const entry of entries) {
+        const rel = prefix ? `${prefix}/${entry.name}` : entry.name;
+        if (entry.isDirectory()) {
+            if (entry.name === "node_modules" || entry.name === ".git")
+                continue;
+            results.push(...(await listFiles(root, rel)));
+        }
+        else if (entry.isFile()) {
+            if (!prefix && entry.name === MANIFEST_FILE)
+                continue;
+            results.push(rel);
+        }
+    }
+    return results.sort((a, b) => a.localeCompare(b));
+}
+export async function signPlugin(targetDir, signingKey) {
+    const resolvedPath = path.resolve(process.cwd(), targetDir);
+    const bundleDir = await realpath(resolvedPath).catch(() => null);
+    if (!bundleDir) {
+        throw new Error(`Directory not found: ${targetDir}`);
+    }
+    const manifestPath = path.join(bundleDir, MANIFEST_FILE);
+    const manifest = JSON.parse(await readFile(manifestPath, "utf-8"));
+    // Identify primary entry (v1 or v2 server/client entry)
+    const entry = manifest.entry ??
+        manifest.server?.entry ??
+        manifest.client?.entry ??
+        "index.js";
+    const entryPath = path.resolve(bundleDir, entry);
+    const entryExists = await stat(entryPath).catch(() => null);
+    if (entryExists) {
+        const entryBytes = await readFile(entryPath);
+        manifest.checksum = createHash("sha256").update(entryBytes).digest("hex");
+    }
+    const files = await listFiles(bundleDir);
+    const fileChecksums = {};
+    const aggregate = createHash("sha256");
+    for (const rel of files) {
+        const bytes = await readFile(path.join(bundleDir, rel));
+        fileChecksums[rel] = createHash("sha256").update(bytes).digest("hex");
+        aggregate.update(rel);
+        aggregate.update("\0");
+        aggregate.update(String(bytes.length));
+        aggregate.update("\0");
+        aggregate.update(bytes);
+    }
+    manifest.files = fileChecksums;
+    const key = signingKey ?? process.env.DROP_PLUGIN_SIGNING_KEY;
+    if (key) {
+        manifest.signature = createHmac("sha256", key)
+            .update(aggregate.digest("hex"))
+            .digest("hex");
+    }
+    else {
+        delete manifest.signature;
+    }
+    await writeFile(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`);
+    return { fileCount: files.length, signed: Boolean(key) };
+}
+export async function packPlugin(targetDir, outputDir) {
+    const resolvedPath = path.resolve(process.cwd(), targetDir);
+    const bundleDir = await realpath(resolvedPath).catch(() => null);
+    if (!bundleDir) {
+        throw new Error(`Directory not found: ${targetDir}`);
+    }
+    // Ensure bundle is signed and validated
+    await signPlugin(bundleDir);
+    const manifestPath = path.join(bundleDir, MANIFEST_FILE);
+    const manifest = JSON.parse(await readFile(manifestPath, "utf-8"));
+    const id = manifest.id;
+    const version = manifest.version;
+    if (!id || !version) {
+        throw new Error("Plugin manifest must specify 'id' and 'version'");
+    }
+    const outDir = outputDir
+        ? path.resolve(process.cwd(), outputDir)
+        : path.join(bundleDir, "dist-package");
+    await mkdir(outDir, { recursive: true });
+    const files = await listFiles(bundleDir);
+    const bundleMap = {};
+    for (const rel of files) {
+        const content = await readFile(path.join(bundleDir, rel));
+        bundleMap[rel] = content.toString("base64");
+    }
+    const packageObj = {
+        format: "dropplugin-v2",
+        id,
+        version,
+        manifest,
+        files: bundleMap,
+        packedAt: new Date().toISOString(),
+    };
+    const packagePath = path.join(outDir, `${id}-${version}.dropplugin`);
+    await writeFile(packagePath, JSON.stringify(packageObj, null, 2), "utf-8");
+    return { packagePath, id, version };
+}

package/package.json

@@ -0,0 +1,46 @@
+{
+  "name": "@droposs/plugin-cli",
+  "version": "0.1.0",
+  "description": "Drop Plugin build, test, signing, and packaging CLI for Drop OSS",
+  "type": "module",
+  "bin": {
+    "drop-plugin": "./bin/drop-plugin.js"
+  },
+  "main": "dist/signer.js",
+  "types": "dist/signer.d.ts",
+  "files": [
+    "bin",
+    "dist"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Heretek-Games/drop-plugin-sdk.git",
+    "directory": "packages/plugin-cli"
+  },
+  "homepage": "https://github.com/Heretek-Games/drop-plugin-sdk#readme",
+  "bugs": {
+    "url": "https://github.com/Heretek-Games/drop-plugin-sdk/issues"
+  },
+  "keywords": [
+    "drop",
+    "drop-oss",
+    "droposs",
+    "drop-plugin",
+    "plugin-cli",
+    "signer",
+    "packaging",
+    "playnite"
+  ],
+  "devDependencies": {
+    "typescript": "^5.7.0",
+    "@types/node": "^22.0.0"
+  },
+  "license": "MIT",
+  "scripts": {
+    "build": "tsc",
+    "test": "node --test"
+  }
+}