@johnhenry/objectify-cli 0.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 objectify contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,82 @@
+# @johnhenry/objectify-cli
+
+[![npm version](https://img.shields.io/npm/v/%40johnhenry%2Fobjectify-cli.svg)](https://www.npmjs.com/package/@johnhenry/objectify-cli)
+
+`objectify` — persistent, versioned JSON objects backed by SQLite. A stateful,
+agent-friendly CLI: `create` an object, `use` it to read/write state, `log` /
+`diff` / `rewind` through its version history, `fork` an independent copy.
+
+Full CLI reference, architecture notes, and "designed for agents" docs live at
+**https://opensource.johnhenry.me/objectify/**.
+
+> **This is the first npm distribution of the `objectify` CLI.** The CLI has
+> existed as a `cargo build --release` / GitHub-release binary before now —
+> this package (and its five per-platform siblings) is a new packaging story,
+> not an import of a previously-published npm package. Versioning starts at
+> `0.0.0`, matching this project's usual convention for a package's first
+> appearance under the `@johnhenry` scope, extended here to cover "first npm
+> appearance at all," since there's no prior npm version to restart from.
+> Named `objectify-cli` rather than plain `objectify` because
+> [`@johnhenry/objectify`](https://www.npmjs.com/package/@johnhenry/objectify)
+> is this project's TypeScript adapter package — the CLI command you actually
+> run is still `objectify`, only the npm package name differs.
+
+## Install
+
+```sh
+npm install -g @johnhenry/objectify-cli
+```
+
+or run it without installing:
+
+```sh
+npx @johnhenry/objectify-cli --help
+```
+
+## How this works
+
+This package is a thin ~100-line Node.js shim (`bin/objectify.js`). It ships
+no compiled code itself — it detects your OS/architecture at runtime and
+delegates to the real binary, which lives in one of five tiny per-platform
+packages:
+
+| Package | Platform |
+|---|---|
+| `@johnhenry/objectify-cli-darwin-arm64` | macOS, Apple Silicon |
+| `@johnhenry/objectify-cli-darwin-x64` | macOS, Intel |
+| `@johnhenry/objectify-cli-linux-x64` | Linux, x64 (glibc) |
+| `@johnhenry/objectify-cli-linux-arm64` | Linux, arm64 (glibc) |
+| `@johnhenry/objectify-cli-win32-x64` | Windows, x64 |
+
+`npm install` only downloads the one matching your machine — it's listed as
+an `optionalDependency` with `os`/`cpu` fields, which is how npm decides which
+optional dependencies to actually fetch. This is the same pattern used by
+`esbuild`, `@swc/core`, and `turbo`. No postinstall script runs and no network
+request happens beyond npm's own package resolution — see
+[`bin/objectify.js`](./bin/objectify.js) for the full resolution logic and
+error messages if the right platform package didn't get installed.
+
+## Platform support
+
+Linux `x64`/`arm64` builds target glibc; there is currently no separate
+`musl` build (e.g. for Alpine-based Docker images). If you need one, please
+open an issue.
+
+## Integrity
+
+Every package published from CI carries an [npm provenance
+attestation](https://docs.npmjs.com/generating-provenance-statements)
+(Sigstore-backed, tying the published package back to the exact GitHub
+Actions run, commit, and source repo that built it) — check with
+`npm audit signatures` after installing.
+
+On top of that, this package ships a `checksums.json` manifest pinning the
+expected SHA-256 of each platform binary for this version. Before executing
+anything, `bin/objectify.js` hashes the resolved binary and compares it
+against the pinned value, refusing to run on a mismatch. This is
+defense-in-depth on top of provenance, not a replacement for it — see
+[`bin/objectify.js`](./bin/objectify.js) (`verifyChecksum`) for details.
+
+## License
+
+MIT — see [LICENSE](./LICENSE).

package/bin/objectify.js

@@ -0,0 +1,182 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * Platform-detection shim for the `objectify` CLI.
+ *
+ * The real compiled binary lives in one of five tiny per-platform npm
+ * packages (each published from CI, one per Rust build target) and is
+ * installed via `optionalDependencies` — npm only installs the ones whose
+ * `os`/`cpu` fields match the current machine, so exactly one (usually)
+ * ends up on disk. This script finds it, verifies its checksum against the
+ * value pinned in this package's checksums.json (see verifyChecksum below),
+ * and execs it, passing through argv/stdio/exit code unchanged.
+ *
+ * Deliberately does NOT do what esbuild's install.js / turbo's bin/turbo do:
+ * no postinstall network download, no automatic "npm install" repair
+ * attempt if the optional dependency didn't land. If the right platform
+ * package is missing, this prints a clear, actionable error instead of
+ * silently reaching out to the network. See objectify's npm/README (or
+ * LESSONS.md in the adopt-library skill) for why that's a first-pass
+ * simplification, not a permanent design decision.
+ */
+
+const { spawnSync } = require('child_process');
+const { createHash } = require('crypto');
+const fs = require('fs');
+const path = require('path');
+
+// Escape hatch for local development / testing against a freshly-built
+// binary without publishing a platform package first.
+const OBJECTIFY_BINARY_PATH = process.env.OBJECTIFY_BINARY_PATH;
+
+const PACKAGES = {
+  'darwin arm64': '@johnhenry/objectify-cli-darwin-arm64',
+  'darwin x64': '@johnhenry/objectify-cli-darwin-x64',
+  'linux arm64': '@johnhenry/objectify-cli-linux-arm64',
+  'linux x64': '@johnhenry/objectify-cli-linux-x64',
+  'win32 x64': '@johnhenry/objectify-cli-win32-x64',
+};
+
+function binSubpath(platform) {
+  return platform === 'win32' ? 'bin/objectify.exe' : 'bin/objectify';
+}
+
+// Resolves to { binaryPath, platformName } where platformName is the
+// hyphenated platform identifier (e.g. "darwin-arm64") used as the key into
+// checksums.json — or platformName: null when OBJECTIFY_BINARY_PATH is used,
+// since a locally-built binary has no pinned checksum to verify against.
+function resolveBinaryPath() {
+  if (OBJECTIFY_BINARY_PATH) {
+    return { binaryPath: OBJECTIFY_BINARY_PATH, platformName: null };
+  }
+
+  const platform = process.platform;
+  const arch = process.arch;
+  const key = `${platform} ${arch}`;
+  const pkg = PACKAGES[key];
+
+  if (!pkg) {
+    fail(
+      `Unsupported platform: ${key}\n\n` +
+        `objectify currently ships prebuilt binaries for:\n` +
+        Object.keys(PACKAGES)
+          .map((k) => `  - ${k}`)
+          .join('\n') +
+        `\n\nIf you're on a platform not listed here, please open an issue:\n` +
+        `  https://github.com/johnhenry/objectify/issues`,
+    );
+  }
+
+  const platformName = pkg.replace('@johnhenry/objectify-cli-', '');
+
+  try {
+    const binaryPath = require.resolve(`${pkg}/${binSubpath(platform)}`);
+    return { binaryPath, platformName };
+  } catch (e) {
+    fail(
+      `Could not find the objectify binary for your platform (${key}).\n\n` +
+        `Expected it in the optional dependency "${pkg}", which npm should\n` +
+        `have installed automatically alongside "@johnhenry/objectify-cli".\n\n` +
+        `This usually means the optional dependency failed to install or was\n` +
+        `skipped. Try:\n\n` +
+        `  npm install --include=optional @johnhenry/objectify-cli\n\n` +
+        `If you're using a package manager other than npm, make sure it\n` +
+        `doesn't skip optional dependencies (some configurations of pnpm/\n` +
+        `Yarn need "supportedArchitectures" set explicitly).\n\n` +
+        `Underlying error: ${e && e.message}`,
+    );
+  }
+}
+
+// checksums.json (published as part of this package, see .github/workflows/
+// release.yml) pins the expected sha256 of each platform's binary at the
+// version this package was published with. Verifying it here means a
+// compromised npm token, CI runner, or registry mirror can't silently swap
+// in a different binary for one of the five platform packages without also
+// tripping this check (short of also compromising the main package's
+// checksums.json in the same way, which `npm publish --provenance` in the
+// release workflow independently guards against).
+function loadChecksums() {
+  const checksumsPath = path.join(__dirname, '..', 'checksums.json');
+  try {
+    return JSON.parse(fs.readFileSync(checksumsPath, 'utf8'));
+  } catch (e) {
+    if (e && e.code === 'ENOENT') {
+      // Published before checksums.json existed, or a non-npm install layout.
+      // Fail open rather than breaking installs — this is a defense-in-depth
+      // check, not the primary integrity mechanism (that's --provenance).
+      return null;
+    }
+    fail(`Failed to read checksums.json: ${e && e.message}`);
+  }
+}
+
+function sha256File(filePath) {
+  const hash = createHash('sha256');
+  hash.update(fs.readFileSync(filePath));
+  return hash.digest('hex');
+}
+
+function verifyChecksum(binaryPath, platformName) {
+  if (platformName === null) {
+    return; // OBJECTIFY_BINARY_PATH escape hatch — nothing pinned to check.
+  }
+
+  const checksums = loadChecksums();
+  if (!checksums) {
+    return;
+  }
+
+  const expected = checksums[platformName];
+  if (!expected) {
+    // checksums.json exists but doesn't cover this platform — don't block
+    // execution over a manifest gap, but don't pretend we verified it either.
+    return;
+  }
+
+  const actual = sha256File(binaryPath);
+  if (actual !== expected) {
+    fail(
+      `Checksum mismatch for the objectify binary (${platformName}).\n\n` +
+        `  expected: ${expected}\n` +
+        `  actual:   ${actual}\n\n` +
+        `This means the installed binary does not match the one published by\n` +
+        `objectify's release CI for this version. It may have been tampered\n` +
+        `with, corrupted, or come from an untrusted registry mirror. Refusing\n` +
+        `to execute it.\n\n` +
+        `Try reinstalling: npm install --include=optional @johnhenry/objectify-cli\n` +
+        `If the mismatch persists, please open an issue:\n` +
+        `  https://github.com/johnhenry/objectify/issues`,
+    );
+  }
+}
+
+function fail(message) {
+  console.error(`[objectify] ${message}`);
+  process.exit(1);
+}
+
+function main() {
+  const { binaryPath, platformName } = resolveBinaryPath();
+  verifyChecksum(binaryPath, platformName);
+
+  const result = spawnSync(binaryPath, process.argv.slice(2), {
+    stdio: 'inherit',
+  });
+
+  if (result.error) {
+    fail(`Failed to run "${path.basename(binaryPath)}": ${result.error.message}`);
+  }
+
+  if (result.signal) {
+    // Re-raise the same signal so the parent shell sees the expected
+    // "killed by signal" behavior rather than a plain exit code.
+    process.kill(process.pid, result.signal);
+    return;
+  }
+
+  process.exit(result.status === null ? 1 : result.status);
+}
+
+main();

package/checksums.json

@@ -0,0 +1,5 @@
+{
+  "linux-arm64": "05836ebdd234e42c5ca98b19f0a8fd266852975b7c00eb93f8b233bce80e7a77",
+  "linux-x64": "46467922b9fb2293398986f54e499cdd88384949dc75e131a653ed78b307f24a",
+  "win32-x64": "df1a4c7ab8b9bda2270ff8f8a6d450271a027efe7323ec79ed5cd268dbadeec2"
+}

package/package.json

@@ -0,0 +1,40 @@
+{
+  "name": "@johnhenry/objectify-cli",
+  "version": "0.0.0",
+  "description": "Persistent, versioned JSON objects backed by SQLite — a stateful, agent-friendly CLI.",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/johnhenry/objectify.git",
+    "directory": "npm/objectify-cli"
+  },
+  "homepage": "https://opensource.johnhenry.me/objectify/",
+  "bugs": "https://github.com/johnhenry/objectify/issues",
+  "license": "MIT",
+  "keywords": [
+    "cli",
+    "sqlite",
+    "versioning",
+    "state",
+    "json",
+    "agents",
+    "rust"
+  ],
+  "bin": {
+    "objectify": "bin/objectify.js"
+  },
+  "files": ["bin", "checksums.json"],
+  "os": ["darwin", "linux", "win32"],
+  "engines": {
+    "node": ">=26.0.0"
+  },
+  "optionalDependencies": {
+    "@johnhenry/objectify-cli-darwin-arm64": "0.0.0",
+    "@johnhenry/objectify-cli-darwin-x64": "0.0.0",
+    "@johnhenry/objectify-cli-linux-x64": "0.0.0",
+    "@johnhenry/objectify-cli-linux-arm64": "0.0.0",
+    "@johnhenry/objectify-cli-win32-x64": "0.0.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}