@objectstack/cli 3.0.7 → 3.0.9

package/src/commands/plugin/publish.ts

@@ -0,0 +1,176 @@
+// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
+
+import { Args, Command, Flags } from '@oclif/core';
+import chalk from 'chalk';
+import path from 'path';
+import fs from 'fs';
+import crypto from 'crypto';
+import { createTimer, printHeader, printKV, printStep, printSuccess, printError, printWarning, printInfo } from '../../utils/format.js';
+
+/**
+ * Publish a plugin artifact to the ObjectStack marketplace.
+ *
+ * Validates the artifact locally (unless --skipValidation), computes the
+ * SHA-256 checksum, and uploads to the marketplace REST API.
+ *
+ * Architecture alignment: `npm publish`, `helm push`, `vsce publish`.
+ */
+export default class PluginPublish extends Command {
+  static override description = 'Publish a plugin artifact to the marketplace';
+
+  static override args = {
+    artifact: Args.string({ description: 'Path to the artifact file', required: true }),
+  };
+
+  static override flags = {
+    registryUrl: Flags.string({ char: 'r', description: 'Marketplace API base URL', default: 'https://marketplace.objectstack.com/api/v1' }),
+    token: Flags.string({ char: 't', description: 'Authentication token', env: 'OBJECTSTACK_MARKETPLACE_TOKEN' }),
+    releaseNotes: Flags.string({ description: 'Release notes for this version' }),
+    preRelease: Flags.boolean({ description: 'Mark as a pre-release', default: false }),
+    skipValidation: Flags.boolean({ description: 'Skip local validation before publish', default: false }),
+    access: Flags.string({ description: 'Access level (public | restricted)', default: 'public', options: ['public', 'restricted'] }),
+    tags: Flags.string({ description: 'Comma-separated tags', multiple: true }),
+    json: Flags.boolean({ description: 'Output result as JSON' }),
+  };
+
+  async run(): Promise<void> {
+    const { args, flags } = await this.parse(PluginPublish);
+    const timer = createTimer();
+
+    if (!flags.json) {
+      printHeader('Plugin Publish');
+    }
+
+    try {
+      const artifactPath = path.resolve(process.cwd(), args.artifact);
+
+      if (!fs.existsSync(artifactPath)) {
+        throw new Error(`Artifact not found: ${artifactPath}`);
+      }
+
+      if (!flags.token) {
+        throw new Error('Authentication token required. Set --token or OBJECTSTACK_MARKETPLACE_TOKEN environment variable.');
+      }
+
+      if (!flags.json) {
+        printKV('Artifact', path.relative(process.cwd(), artifactPath));
+        printKV('Registry', flags.registryUrl);
+      }
+
+      // 1. Read artifact
+      const artifactBuffer = fs.readFileSync(artifactPath);
+      const sha256 = crypto.createHash('sha256').update(artifactBuffer).digest('hex');
+
+      // 2. Extract manifest info
+      let manifest: Record<string, unknown> | undefined;
+      try {
+        manifest = JSON.parse(artifactBuffer.toString('utf-8'));
+      } catch {
+        throw new Error('Artifact does not contain a valid JSON manifest');
+      }
+
+      const name = (manifest as any).manifest?.name || (manifest as any).name || 'unknown';
+      const version = (manifest as any).manifest?.version || (manifest as any).version || '0.0.0';
+
+      if (!flags.json) {
+        printKV('Package', `${name}@${version}`);
+      }
+
+      // 3. Local validation (unless skipped)
+      if (!flags.skipValidation) {
+        if (!flags.json) printStep('Running local validation...');
+
+        if (artifactBuffer.length === 0) {
+          throw new Error('Artifact is empty — cannot publish');
+        }
+
+        const checksumFile = artifactPath + '.sha256';
+        if (fs.existsSync(checksumFile)) {
+          const expectedHash = fs.readFileSync(checksumFile, 'utf-8').trim().split(/\s+/)[0];
+          if (expectedHash !== sha256) {
+            throw new Error(`SHA-256 mismatch: artifact has changed since build`);
+          }
+        }
+
+        if (!flags.json) printSuccess('Local validation passed');
+      }
+
+      // 4. Upload to marketplace
+      if (!flags.json) printStep('Uploading to marketplace...');
+
+      const uploadUrl = `${flags.registryUrl}/packages/upload`;
+      const tags = flags.tags?.flatMap(t => t.split(',')) || [];
+
+      const uploadPayload = {
+        packageName: name,
+        version,
+        sha256,
+        size: artifactBuffer.length,
+        preRelease: flags.preRelease,
+        access: flags.access,
+        releaseNotes: flags.releaseNotes,
+        tags,
+      };
+
+      // Perform HTTP upload
+      const response = await fetch(uploadUrl, {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+          'Authorization': `Bearer ${flags.token}`,
+        },
+        body: JSON.stringify(uploadPayload),
+      });
+
+      if (!response.ok) {
+        const errorBody = await response.text().catch(() => 'Unknown error');
+        throw new Error(`Marketplace upload failed (${response.status}): ${errorBody}`);
+      }
+
+      const responseData = await response.json().catch(() => ({})) as Record<string, unknown>;
+
+      const result = {
+        success: true,
+        packageId: (responseData.packageId as string) || name,
+        version,
+        artifactUrl: responseData.artifactUrl as string | undefined,
+        sha256,
+        submissionId: responseData.submissionId as string | undefined,
+        message: `Published ${name}@${version} to marketplace`,
+      };
+
+      if (flags.json) {
+        console.log(JSON.stringify(result, null, 2));
+        return;
+      }
+
+      console.log('');
+      printSuccess(`Published ${chalk.cyan(`${name}@${version}`)}`);
+      console.log('');
+      printKV('SHA-256', sha256.slice(0, 16) + '...');
+      printKV('Size', `${(artifactBuffer.length / 1024).toFixed(1)} KB`);
+
+      if (result.artifactUrl) {
+        printKV('URL', result.artifactUrl);
+      }
+      if (result.submissionId) {
+        printKV('Submission', result.submissionId);
+      }
+
+      if (flags.preRelease) {
+        printWarning('Published as pre-release');
+      }
+
+      console.log('');
+      printInfo(`Duration: ${timer.display()}`);
+      console.log('');
+    } catch (error: any) {
+      if (flags.json) {
+        console.log(JSON.stringify({ success: false, errorMessage: error.message }));
+        this.exit(1);
+      }
+      printError(error.message || String(error));
+      this.exit(1);
+    }
+  }
+}

package/src/commands/plugin/validate.ts

@@ -0,0 +1,268 @@
+// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
+
+import { Args, Command, Flags } from '@oclif/core';
+import chalk from 'chalk';
+import path from 'path';
+import fs from 'fs';
+import crypto from 'crypto';
+import { createTimer, printHeader, printKV, printStep, printSuccess, printError, printWarning, printInfo } from '../../utils/format.js';
+
+/**
+ * Validate a plugin artifact (.tgz) for structural integrity, checksum
+ * correctness, digital signature, and platform compatibility.
+ *
+ * Architecture alignment: `npm pack --dry-run`, `helm lint`, `vsce ls`.
+ */
+export default class PluginValidate extends Command {
+  static override description = 'Validate a plugin artifact for integrity and compliance';
+
+  static override args = {
+    artifact: Args.string({ description: 'Path to the artifact file', required: true }),
+  };
+
+  static override flags = {
+    verifySignature: Flags.boolean({ description: 'Verify digital signature', default: true, allowNo: true }),
+    publicKeyPath: Flags.string({ description: 'Path to public key for signature verification' }),
+    verifyChecksums: Flags.boolean({ description: 'Verify SHA-256 checksums', default: true, allowNo: true }),
+    validateMetadata: Flags.boolean({ description: 'Validate metadata schema compliance', default: true, allowNo: true }),
+    platformVersion: Flags.string({ description: 'Target platform version for compatibility check' }),
+    json: Flags.boolean({ description: 'Output result as JSON' }),
+  };
+
+  async run(): Promise<void> {
+    const { args, flags } = await this.parse(PluginValidate);
+    const timer = createTimer();
+
+    if (!flags.json) {
+      printHeader('Plugin Validate');
+    }
+
+    try {
+      const artifactPath = path.resolve(process.cwd(), args.artifact);
+
+      if (!fs.existsSync(artifactPath)) {
+        throw new Error(`Artifact not found: ${artifactPath}`);
+      }
+
+      if (!flags.json) {
+        printKV('Artifact', path.relative(process.cwd(), artifactPath));
+        printStep('Reading artifact...');
+      }
+
+      const artifactBuffer = fs.readFileSync(artifactPath);
+      const findings: Array<{ severity: string; rule: string; message: string; path?: string }> = [];
+
+      // 1. Verify file existence and basic structure
+      if (artifactBuffer.length === 0) {
+        findings.push({ severity: 'error', rule: 'artifact.empty', message: 'Artifact file is empty' });
+      }
+
+      // 2. Try to parse as JSON manifest
+      let manifest: Record<string, unknown> | undefined;
+      try {
+        manifest = JSON.parse(artifactBuffer.toString('utf-8'));
+        findings.push({ severity: 'info', rule: 'manifest.parsed', message: 'Manifest parsed successfully' });
+      } catch {
+        findings.push({ severity: 'error', rule: 'manifest.invalid', message: 'Artifact does not contain valid JSON manifest' });
+      }
+
+      // 3. Validate required manifest fields
+      if (manifest) {
+        if (!flags.json) printStep('Validating manifest fields...');
+
+        if (!(manifest as any).manifest && !(manifest as any).name) {
+          findings.push({ severity: 'warning', rule: 'manifest.name', message: 'No package name found in manifest' });
+        }
+        if (!(manifest as any).manifest?.version && !(manifest as any).version) {
+          findings.push({ severity: 'warning', rule: 'manifest.version', message: 'No version found in manifest' });
+        }
+      }
+
+      // 4. Checksum verification
+      let checksumResult: { passed: boolean; mismatches?: string[] } | undefined;
+      if (flags.verifyChecksums) {
+        if (!flags.json) printStep('Verifying checksums...');
+        const checksumFile = artifactPath + '.sha256';
+        if (fs.existsSync(checksumFile)) {
+          const checksumContent = fs.readFileSync(checksumFile, 'utf-8').trim();
+          const expectedHash = checksumContent.split(/\s+/)[0];
+          const actualHash = crypto.createHash('sha256').update(artifactBuffer).digest('hex');
+          if (expectedHash === actualHash) {
+            checksumResult = { passed: true };
+            findings.push({ severity: 'info', rule: 'checksum.sha256', message: 'SHA-256 checksum verified' });
+          } else {
+            checksumResult = { passed: false, mismatches: ['artifact'] };
+            findings.push({ severity: 'error', rule: 'checksum.sha256', message: `SHA-256 mismatch: expected ${expectedHash.slice(0, 16)}..., got ${actualHash.slice(0, 16)}...` });
+          }
+        } else {
+          findings.push({ severity: 'warning', rule: 'checksum.missing', message: 'No .sha256 checksum file found alongside artifact' });
+        }
+      }
+
+      // 5. Signature verification
+      let signatureResult: { passed: boolean; failureReason?: string } | undefined;
+      if (flags.verifySignature) {
+        if (!flags.json) printStep('Verifying signature...');
+        const sigFile = artifactPath + '.sig';
+        if (fs.existsSync(sigFile) && flags.publicKeyPath && fs.existsSync(flags.publicKeyPath)) {
+          try {
+            const publicKey = fs.readFileSync(flags.publicKeyPath, 'utf-8');
+            const signature = fs.readFileSync(sigFile, 'utf-8');
+            const verifier = crypto.createVerify('RSA-SHA256');
+            verifier.update(artifactBuffer);
+            const valid = verifier.verify(publicKey, signature, 'base64');
+            signatureResult = { passed: valid, failureReason: valid ? undefined : 'Signature does not match' };
+            findings.push({
+              severity: valid ? 'info' : 'error',
+              rule: 'signature.verify',
+              message: valid ? 'Digital signature verified' : 'Digital signature verification failed',
+            });
+          } catch (e: any) {
+            signatureResult = { passed: false, failureReason: e.message };
+            findings.push({ severity: 'error', rule: 'signature.verify', message: `Signature verification error: ${e.message}` });
+          }
+        } else if (fs.existsSync(sigFile) && !flags.publicKeyPath) {
+          findings.push({ severity: 'warning', rule: 'signature.nokey', message: 'Signature file found but no --publicKeyPath provided' });
+        } else if (!fs.existsSync(sigFile)) {
+          findings.push({ severity: 'info', rule: 'signature.absent', message: 'No signature file found (unsigned artifact)' });
+        }
+      }
+
+      // 6. Platform compatibility check
+      let platformResult: { compatible: boolean; requiredRange?: string; targetVersion?: string } | undefined;
+      if (flags.platformVersion && manifest) {
+        if (!flags.json) printStep('Checking platform compatibility...');
+        const engine = (manifest as any).manifest?.engine || (manifest as any).engine;
+        const required = engine?.objectstack as string | undefined;
+        if (required) {
+          // Semver range check supporting >=, >, ^, ~, and exact versions
+          const parseSemver = (v: string) => {
+            const parts = v.replace(/^v/, '').split('.').map(p => parseInt(p, 10));
+            return { major: parts[0] || 0, minor: parts[1] || 0, patch: parts[2] || 0 };
+          };
+
+          const target = parseSemver(flags.platformVersion);
+          let compatible = false;
+          let matched = false;
+
+          // >=X.Y.Z — greater than or equal
+          const gteMatch = required.match(/^>=\s*([\d.]+)/);
+          if (gteMatch) {
+            const req = parseSemver(gteMatch[1]);
+            compatible = (target.major > req.major) ||
+              (target.major === req.major && target.minor > req.minor) ||
+              (target.major === req.major && target.minor === req.minor && target.patch >= req.patch);
+            matched = true;
+          }
+
+          // >X.Y.Z — strictly greater than
+          if (!matched) {
+            const gtMatch = required.match(/^>\s*([\d.]+)/);
+            if (gtMatch) {
+              const req = parseSemver(gtMatch[1]);
+              compatible = (target.major > req.major) ||
+                (target.major === req.major && target.minor > req.minor) ||
+                (target.major === req.major && target.minor === req.minor && target.patch > req.patch);
+              matched = true;
+            }
+          }
+
+          // ^X.Y.Z — caret range (same major, >= minor.patch)
+          if (!matched) {
+            const caretMatch = required.match(/^\^\s*([\d.]+)/);
+            if (caretMatch) {
+              const req = parseSemver(caretMatch[1]);
+              compatible = target.major === req.major &&
+                ((target.minor > req.minor) ||
+                  (target.minor === req.minor && target.patch >= req.patch));
+              matched = true;
+            }
+          }
+
+          // ~X.Y.Z — tilde range (same major.minor, >= patch)
+          if (!matched) {
+            const tildeMatch = required.match(/^~\s*([\d.]+)/);
+            if (tildeMatch) {
+              const req = parseSemver(tildeMatch[1]);
+              compatible = target.major === req.major && target.minor === req.minor && target.patch >= req.patch;
+              matched = true;
+            }
+          }
+
+          // Exact version match
+          if (!matched && /^\d+\.\d+\.\d+$/.test(required)) {
+            const req = parseSemver(required);
+            compatible = target.major === req.major && target.minor === req.minor && target.patch === req.patch;
+            matched = true;
+          }
+
+          if (matched) {
+            platformResult = { compatible, requiredRange: required, targetVersion: flags.platformVersion };
+            findings.push({
+              severity: compatible ? 'info' : 'error',
+              rule: 'platform.compatibility',
+              message: compatible
+                ? `Compatible with platform v${flags.platformVersion}`
+                : `Requires platform ${required}, but target is v${flags.platformVersion}`,
+            });
+          }
+        } else {
+          platformResult = { compatible: true, targetVersion: flags.platformVersion };
+          findings.push({ severity: 'info', rule: 'platform.noreq', message: 'No platform version requirement specified — assumed compatible' });
+        }
+      }
+
+      // 7. Summary
+      const errors = findings.filter(f => f.severity === 'error').length;
+      const warns = findings.filter(f => f.severity === 'warning').length;
+      const infos = findings.filter(f => f.severity === 'info').length;
+      const valid = errors === 0;
+
+      const result = {
+        valid,
+        checksumVerification: checksumResult,
+        signatureVerification: signatureResult,
+        platformCompatibility: platformResult,
+        findings,
+        summary: { errors, warnings: warns, infos },
+      };
+
+      if (flags.json) {
+        console.log(JSON.stringify(result, null, 2));
+        return;
+      }
+
+      console.log('');
+      if (valid) {
+        printSuccess(`Validation passed ${chalk.dim(`(${timer.display()})`)}`);
+      } else {
+        printError(`Validation failed ${chalk.dim(`(${timer.display()})`)}`);
+      }
+
+      console.log('');
+      for (const finding of findings) {
+        const icon = finding.severity === 'error' ? chalk.red('✗')
+          : finding.severity === 'warning' ? chalk.yellow('⚠')
+            : chalk.blue('ℹ');
+        console.log(`  ${icon} ${chalk.dim(`[${finding.rule}]`)} ${finding.message}`);
+      }
+
+      console.log('');
+      printKV('Errors', errors);
+      printKV('Warnings', warns);
+      printKV('Info', infos);
+      console.log('');
+
+      if (!valid) {
+        this.exit(1);
+      }
+    } catch (error: any) {
+      if (flags.json) {
+        console.log(JSON.stringify({ valid: false, findings: [{ severity: 'error', rule: 'system', message: error.message }], summary: { errors: 1, warnings: 0, infos: 0 } }));
+        this.exit(1);
+      }
+      printError(error.message || String(error));
+      this.exit(1);
+    }
+  }
+}

package/test/commands.test.ts

@@ -17,6 +17,9 @@ import PluginList from '../src/commands/plugin/list';
 import PluginInfo from '../src/commands/plugin/info';
 import PluginAdd from '../src/commands/plugin/add';
 import PluginRemove from '../src/commands/plugin/remove';
+import PluginBuild from '../src/commands/plugin/build';
+import PluginValidate from '../src/commands/plugin/validate';
+import PluginPublish from '../src/commands/plugin/publish';
 import V2ToV3 from '../src/commands/codemod/v2-to-v3';
 
 describe('CLI Commands (oclif)', () => {
@@ -105,5 +108,21 @@ describe('CLI Commands (oclif)', () => {
     it('should have plugin list alias', () => {
       expect(PluginList.aliases).toContain('plugin ls');
     });
+
+    it('should have plugin build command', () => {
+      expect(PluginBuild.description).toContain('Build');
+    });
+
+    it('should have plugin build alias', () => {
+      expect(PluginBuild.aliases).toContain('plugin pack');
+    });
+
+    it('should have plugin validate command', () => {
+      expect(PluginValidate.description).toContain('Validate');
+    });
+
+    it('should have plugin publish command', () => {
+      expect(PluginPublish.description).toContain('Publish');
+    });
   });
 });