@objectstack/cli 3.0.8 → 3.0.9

package/dist/commands/plugin/validate.js

@@ -0,0 +1,251 @@
+// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
+import { Args, Command, Flags } from '@oclif/core';
+import chalk from 'chalk';
+import path from 'path';
+import fs from 'fs';
+import crypto from 'crypto';
+import { createTimer, printHeader, printKV, printStep, printSuccess, printError } from '../../utils/format.js';
+/**
+ * Validate a plugin artifact (.tgz) for structural integrity, checksum
+ * correctness, digital signature, and platform compatibility.
+ *
+ * Architecture alignment: `npm pack --dry-run`, `helm lint`, `vsce ls`.
+ */
+export default class PluginValidate extends Command {
+    static description = 'Validate a plugin artifact for integrity and compliance';
+    static args = {
+        artifact: Args.string({ description: 'Path to the artifact file', required: true }),
+    };
+    static flags = {
+        verifySignature: Flags.boolean({ description: 'Verify digital signature', default: true, allowNo: true }),
+        publicKeyPath: Flags.string({ description: 'Path to public key for signature verification' }),
+        verifyChecksums: Flags.boolean({ description: 'Verify SHA-256 checksums', default: true, allowNo: true }),
+        validateMetadata: Flags.boolean({ description: 'Validate metadata schema compliance', default: true, allowNo: true }),
+        platformVersion: Flags.string({ description: 'Target platform version for compatibility check' }),
+        json: Flags.boolean({ description: 'Output result as JSON' }),
+    };
+    async run() {
+        const { args, flags } = await this.parse(PluginValidate);
+        const timer = createTimer();
+        if (!flags.json) {
+            printHeader('Plugin Validate');
+        }
+        try {
+            const artifactPath = path.resolve(process.cwd(), args.artifact);
+            if (!fs.existsSync(artifactPath)) {
+                throw new Error(`Artifact not found: ${artifactPath}`);
+            }
+            if (!flags.json) {
+                printKV('Artifact', path.relative(process.cwd(), artifactPath));
+                printStep('Reading artifact...');
+            }
+            const artifactBuffer = fs.readFileSync(artifactPath);
+            const findings = [];
+            // 1. Verify file existence and basic structure
+            if (artifactBuffer.length === 0) {
+                findings.push({ severity: 'error', rule: 'artifact.empty', message: 'Artifact file is empty' });
+            }
+            // 2. Try to parse as JSON manifest
+            let manifest;
+            try {
+                manifest = JSON.parse(artifactBuffer.toString('utf-8'));
+                findings.push({ severity: 'info', rule: 'manifest.parsed', message: 'Manifest parsed successfully' });
+            }
+            catch {
+                findings.push({ severity: 'error', rule: 'manifest.invalid', message: 'Artifact does not contain valid JSON manifest' });
+            }
+            // 3. Validate required manifest fields
+            if (manifest) {
+                if (!flags.json)
+                    printStep('Validating manifest fields...');
+                if (!manifest.manifest && !manifest.name) {
+                    findings.push({ severity: 'warning', rule: 'manifest.name', message: 'No package name found in manifest' });
+                }
+                if (!manifest.manifest?.version && !manifest.version) {
+                    findings.push({ severity: 'warning', rule: 'manifest.version', message: 'No version found in manifest' });
+                }
+            }
+            // 4. Checksum verification
+            let checksumResult;
+            if (flags.verifyChecksums) {
+                if (!flags.json)
+                    printStep('Verifying checksums...');
+                const checksumFile = artifactPath + '.sha256';
+                if (fs.existsSync(checksumFile)) {
+                    const checksumContent = fs.readFileSync(checksumFile, 'utf-8').trim();
+                    const expectedHash = checksumContent.split(/\s+/)[0];
+                    const actualHash = crypto.createHash('sha256').update(artifactBuffer).digest('hex');
+                    if (expectedHash === actualHash) {
+                        checksumResult = { passed: true };
+                        findings.push({ severity: 'info', rule: 'checksum.sha256', message: 'SHA-256 checksum verified' });
+                    }
+                    else {
+                        checksumResult = { passed: false, mismatches: ['artifact'] };
+                        findings.push({ severity: 'error', rule: 'checksum.sha256', message: `SHA-256 mismatch: expected ${expectedHash.slice(0, 16)}..., got ${actualHash.slice(0, 16)}...` });
+                    }
+                }
+                else {
+                    findings.push({ severity: 'warning', rule: 'checksum.missing', message: 'No .sha256 checksum file found alongside artifact' });
+                }
+            }
+            // 5. Signature verification
+            let signatureResult;
+            if (flags.verifySignature) {
+                if (!flags.json)
+                    printStep('Verifying signature...');
+                const sigFile = artifactPath + '.sig';
+                if (fs.existsSync(sigFile) && flags.publicKeyPath && fs.existsSync(flags.publicKeyPath)) {
+                    try {
+                        const publicKey = fs.readFileSync(flags.publicKeyPath, 'utf-8');
+                        const signature = fs.readFileSync(sigFile, 'utf-8');
+                        const verifier = crypto.createVerify('RSA-SHA256');
+                        verifier.update(artifactBuffer);
+                        const valid = verifier.verify(publicKey, signature, 'base64');
+                        signatureResult = { passed: valid, failureReason: valid ? undefined : 'Signature does not match' };
+                        findings.push({
+                            severity: valid ? 'info' : 'error',
+                            rule: 'signature.verify',
+                            message: valid ? 'Digital signature verified' : 'Digital signature verification failed',
+                        });
+                    }
+                    catch (e) {
+                        signatureResult = { passed: false, failureReason: e.message };
+                        findings.push({ severity: 'error', rule: 'signature.verify', message: `Signature verification error: ${e.message}` });
+                    }
+                }
+                else if (fs.existsSync(sigFile) && !flags.publicKeyPath) {
+                    findings.push({ severity: 'warning', rule: 'signature.nokey', message: 'Signature file found but no --publicKeyPath provided' });
+                }
+                else if (!fs.existsSync(sigFile)) {
+                    findings.push({ severity: 'info', rule: 'signature.absent', message: 'No signature file found (unsigned artifact)' });
+                }
+            }
+            // 6. Platform compatibility check
+            let platformResult;
+            if (flags.platformVersion && manifest) {
+                if (!flags.json)
+                    printStep('Checking platform compatibility...');
+                const engine = manifest.manifest?.engine || manifest.engine;
+                const required = engine?.objectstack;
+                if (required) {
+                    // Semver range check supporting >=, >, ^, ~, and exact versions
+                    const parseSemver = (v) => {
+                        const parts = v.replace(/^v/, '').split('.').map(p => parseInt(p, 10));
+                        return { major: parts[0] || 0, minor: parts[1] || 0, patch: parts[2] || 0 };
+                    };
+                    const target = parseSemver(flags.platformVersion);
+                    let compatible = false;
+                    let matched = false;
+                    // >=X.Y.Z — greater than or equal
+                    const gteMatch = required.match(/^>=\s*([\d.]+)/);
+                    if (gteMatch) {
+                        const req = parseSemver(gteMatch[1]);
+                        compatible = (target.major > req.major) ||
+                            (target.major === req.major && target.minor > req.minor) ||
+                            (target.major === req.major && target.minor === req.minor && target.patch >= req.patch);
+                        matched = true;
+                    }
+                    // >X.Y.Z — strictly greater than
+                    if (!matched) {
+                        const gtMatch = required.match(/^>\s*([\d.]+)/);
+                        if (gtMatch) {
+                            const req = parseSemver(gtMatch[1]);
+                            compatible = (target.major > req.major) ||
+                                (target.major === req.major && target.minor > req.minor) ||
+                                (target.major === req.major && target.minor === req.minor && target.patch > req.patch);
+                            matched = true;
+                        }
+                    }
+                    // ^X.Y.Z — caret range (same major, >= minor.patch)
+                    if (!matched) {
+                        const caretMatch = required.match(/^\^\s*([\d.]+)/);
+                        if (caretMatch) {
+                            const req = parseSemver(caretMatch[1]);
+                            compatible = target.major === req.major &&
+                                ((target.minor > req.minor) ||
+                                    (target.minor === req.minor && target.patch >= req.patch));
+                            matched = true;
+                        }
+                    }
+                    // ~X.Y.Z — tilde range (same major.minor, >= patch)
+                    if (!matched) {
+                        const tildeMatch = required.match(/^~\s*([\d.]+)/);
+                        if (tildeMatch) {
+                            const req = parseSemver(tildeMatch[1]);
+                            compatible = target.major === req.major && target.minor === req.minor && target.patch >= req.patch;
+                            matched = true;
+                        }
+                    }
+                    // Exact version match
+                    if (!matched && /^\d+\.\d+\.\d+$/.test(required)) {
+                        const req = parseSemver(required);
+                        compatible = target.major === req.major && target.minor === req.minor && target.patch === req.patch;
+                        matched = true;
+                    }
+                    if (matched) {
+                        platformResult = { compatible, requiredRange: required, targetVersion: flags.platformVersion };
+                        findings.push({
+                            severity: compatible ? 'info' : 'error',
+                            rule: 'platform.compatibility',
+                            message: compatible
+                                ? `Compatible with platform v${flags.platformVersion}`
+                                : `Requires platform ${required}, but target is v${flags.platformVersion}`,
+                        });
+                    }
+                }
+                else {
+                    platformResult = { compatible: true, targetVersion: flags.platformVersion };
+                    findings.push({ severity: 'info', rule: 'platform.noreq', message: 'No platform version requirement specified — assumed compatible' });
+                }
+            }
+            // 7. Summary
+            const errors = findings.filter(f => f.severity === 'error').length;
+            const warns = findings.filter(f => f.severity === 'warning').length;
+            const infos = findings.filter(f => f.severity === 'info').length;
+            const valid = errors === 0;
+            const result = {
+                valid,
+                checksumVerification: checksumResult,
+                signatureVerification: signatureResult,
+                platformCompatibility: platformResult,
+                findings,
+                summary: { errors, warnings: warns, infos },
+            };
+            if (flags.json) {
+                console.log(JSON.stringify(result, null, 2));
+                return;
+            }
+            console.log('');
+            if (valid) {
+                printSuccess(`Validation passed ${chalk.dim(`(${timer.display()})`)}`);
+            }
+            else {
+                printError(`Validation failed ${chalk.dim(`(${timer.display()})`)}`);
+            }
+            console.log('');
+            for (const finding of findings) {
+                const icon = finding.severity === 'error' ? chalk.red('✗')
+                    : finding.severity === 'warning' ? chalk.yellow('⚠')
+                        : chalk.blue('ℹ');
+                console.log(`  ${icon} ${chalk.dim(`[${finding.rule}]`)} ${finding.message}`);
+            }
+            console.log('');
+            printKV('Errors', errors);
+            printKV('Warnings', warns);
+            printKV('Info', infos);
+            console.log('');
+            if (!valid) {
+                this.exit(1);
+            }
+        }
+        catch (error) {
+            if (flags.json) {
+                console.log(JSON.stringify({ valid: false, findings: [{ severity: 'error', rule: 'system', message: error.message }], summary: { errors: 1, warnings: 0, infos: 0 } }));
+                this.exit(1);
+            }
+            printError(error.message || String(error));
+            this.exit(1);
+        }
+    }
+}
+//# sourceMappingURL=validate.js.map

package/dist/commands/plugin/validate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../../src/commands/plugin/validate.ts"],"names":[],"mappings":"AAAA,yEAAyE;AAEzE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAA2B,MAAM,uBAAuB,CAAC;AAExI;;;;;GAKG;AACH,MAAM,CAAC,OAAO,OAAO,cAAe,SAAQ,OAAO;IACjD,MAAM,CAAU,WAAW,GAAG,yDAAyD,CAAC;IAExF,MAAM,CAAU,IAAI,GAAG;QACrB,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,2BAA2B,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;KACpF,CAAC;IAEF,MAAM,CAAU,KAAK,GAAG;QACtB,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,0BAA0B,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACzG,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,+CAA+C,EAAE,CAAC;QAC7F,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,0BAA0B,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACzG,gBAAgB,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,qCAAqC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACrH,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,iDAAiD,EAAE,CAAC;QACjG,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,uBAAuB,EAAE,CAAC;KAC9D,CAAC;IAEF,KAAK,CAAC,GAAG;QACP,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;QAE5B,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAChB,WAAW,CAAC,iBAAiB,CAAC,CAAC;QACjC,CAAC;QAED,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YAEhE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CAAC,uBAAuB,YAAY,EAAE,CAAC,CAAC;YACzD,CAAC;YAED,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;gBAChB,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC;gBAChE,SAAS,CAAC,qBAAqB,CAAC,CAAC;YACnC,CAAC;YAED,MAAM,cAAc,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;YACrD,MAAM,QAAQ,GAA8E,EAAE,CAAC;YAE/F,+CAA+C;YAC/C,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAChC,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC,CAAC;YAClG,CAAC;YAED,mCAAmC;YACnC,IAAI,QAA6C,CAAC;YAClD,IAAI,CAAC;gBACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;gBACxD,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC,CAAC;YACxG,CAAC;YAAC,MAAM,CAAC;gBACP,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,+CAA+C,EAAE,CAAC,CAAC;YAC3H,CAAC;YAED,uCAAuC;YACvC,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,CAAC,KAAK,CAAC,IAAI;oBAAE,SAAS,CAAC,+BAA+B,CAAC,CAAC;gBAE5D,IAAI,CAAE,QAAgB,CAAC,QAAQ,IAAI,CAAE,QAAgB,CAAC,IAAI,EAAE,CAAC;oBAC3D,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC,CAAC;gBAC9G,CAAC;gBACD,IAAI,CAAE,QAAgB,CAAC,QAAQ,EAAE,OAAO,IAAI,CAAE,QAAgB,CAAC,OAAO,EAAE,CAAC;oBACvE,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC,CAAC;gBAC5G,CAAC;YACH,CAAC;YAED,2BAA2B;YAC3B,IAAI,cAAsE,CAAC;YAC3E,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;gBAC1B,IAAI,CAAC,KAAK,CAAC,IAAI;oBAAE,SAAS,CAAC,wBAAwB,CAAC,CAAC;gBACrD,MAAM,YAAY,GAAG,YAAY,GAAG,SAAS,CAAC;gBAC9C,IAAI,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;oBAChC,MAAM,eAAe,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;oBACtE,MAAM,YAAY,GAAG,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;oBACrD,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;oBACpF,IAAI,YAAY,KAAK,UAAU,EAAE,CAAC;wBAChC,cAAc,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;wBAClC,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC,CAAC;oBACrG,CAAC;yBAAM,CAAC;wBACN,cAAc,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;wBAC7D,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,8BAA8B,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;oBAC1K,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,mDAAmD,EAAE,CAAC,CAAC;gBACjI,CAAC;YACH,CAAC;YAED,4BAA4B;YAC5B,IAAI,eAAwE,CAAC;YAC7E,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;gBAC1B,IAAI,CAAC,KAAK,CAAC,IAAI;oBAAE,SAAS,CAAC,wBAAwB,CAAC,CAAC;gBACrD,MAAM,OAAO,GAAG,YAAY,GAAG,MAAM,CAAC;gBACtC,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,aAAa,IAAI,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;oBACxF,IAAI,CAAC;wBACH,MAAM,SAAS,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;wBAChE,MAAM,SAAS,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;wBACpD,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;wBACnD,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;wBAChC,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;wBAC9D,eAAe,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,0BAA0B,EAAE,CAAC;wBACnG,QAAQ,CAAC,IAAI,CAAC;4BACZ,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;4BAClC,IAAI,EAAE,kBAAkB;4BACxB,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,uCAAuC;yBACxF,CAAC,CAAC;oBACL,CAAC;oBAAC,OAAO,CAAM,EAAE,CAAC;wBAChB,eAAe,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;wBAC9D,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,iCAAiC,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;oBACxH,CAAC;gBACH,CAAC;qBAAM,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;oBAC1D,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,sDAAsD,EAAE,CAAC,CAAC;gBACnI,CAAC;qBAAM,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;oBACnC,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,6CAA6C,EAAE,CAAC,CAAC;gBACxH,CAAC;YACH,CAAC;YAED,kCAAkC;YAClC,IAAI,cAAmG,CAAC;YACxG,IAAI,KAAK,CAAC,eAAe,IAAI,QAAQ,EAAE,CAAC;gBACtC,IAAI,CAAC,KAAK,CAAC,IAAI;oBAAE,SAAS,CAAC,oCAAoC,CAAC,CAAC;gBACjE,MAAM,MAAM,GAAI,QAAgB,CAAC,QAAQ,EAAE,MAAM,IAAK,QAAgB,CAAC,MAAM,CAAC;gBAC9E,MAAM,QAAQ,GAAG,MAAM,EAAE,WAAiC,CAAC;gBAC3D,IAAI,QAAQ,EAAE,CAAC;oBACb,gEAAgE;oBAChE,MAAM,WAAW,GAAG,CAAC,CAAS,EAAE,EAAE;wBAChC,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;wBACvE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC9E,CAAC,CAAC;oBAEF,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;oBAClD,IAAI,UAAU,GAAG,KAAK,CAAC;oBACvB,IAAI,OAAO,GAAG,KAAK,CAAC;oBAEpB,kCAAkC;oBAClC,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;oBAClD,IAAI,QAAQ,EAAE,CAAC;wBACb,MAAM,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;wBACrC,UAAU,GAAG,CAAC,MAAM,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;4BACrC,CAAC,MAAM,CAAC,KAAK,KAAK,GAAG,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;4BACxD,CAAC,MAAM,CAAC,KAAK,KAAK,GAAG,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,KAAK,GAAG,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;wBAC1F,OAAO,GAAG,IAAI,CAAC;oBACjB,CAAC;oBAED,iCAAiC;oBACjC,IAAI,CAAC,OAAO,EAAE,CAAC;wBACb,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;wBAChD,IAAI,OAAO,EAAE,CAAC;4BACZ,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;4BACpC,UAAU,GAAG,CAAC,MAAM,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;gCACrC,CAAC,MAAM,CAAC,KAAK,KAAK,GAAG,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;gCACxD,CAAC,MAAM,CAAC,KAAK,KAAK,GAAG,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,KAAK,GAAG,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;4BACzF,OAAO,GAAG,IAAI,CAAC;wBACjB,CAAC;oBACH,CAAC;oBAED,oDAAoD;oBACpD,IAAI,CAAC,OAAO,EAAE,CAAC;wBACb,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;wBACpD,IAAI,UAAU,EAAE,CAAC;4BACf,MAAM,GAAG,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;4BACvC,UAAU,GAAG,MAAM,CAAC,KAAK,KAAK,GAAG,CAAC,KAAK;gCACrC,CAAC,CAAC,MAAM,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;oCACzB,CAAC,MAAM,CAAC,KAAK,KAAK,GAAG,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;4BAC/D,OAAO,GAAG,IAAI,CAAC;wBACjB,CAAC;oBACH,CAAC;oBAED,oDAAoD;oBACpD,IAAI,CAAC,OAAO,EAAE,CAAC;wBACb,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;wBACnD,IAAI,UAAU,EAAE,CAAC;4BACf,MAAM,GAAG,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;4BACvC,UAAU,GAAG,MAAM,CAAC,KAAK,KAAK,GAAG,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,KAAK,GAAG,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC;4BACnG,OAAO,GAAG,IAAI,CAAC;wBACjB,CAAC;oBACH,CAAC;oBAED,sBAAsB;oBACtB,IAAI,CAAC,OAAO,IAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;wBACjD,MAAM,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;wBAClC,UAAU,GAAG,MAAM,CAAC,KAAK,KAAK,GAAG,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,KAAK,GAAG,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,KAAK,GAAG,CAAC,KAAK,CAAC;wBACpG,OAAO,GAAG,IAAI,CAAC;oBACjB,CAAC;oBAED,IAAI,OAAO,EAAE,CAAC;wBACZ,cAAc,GAAG,EAAE,UAAU,EAAE,aAAa,EAAE,QAAQ,EAAE,aAAa,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC;wBAC/F,QAAQ,CAAC,IAAI,CAAC;4BACZ,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;4BACvC,IAAI,EAAE,wBAAwB;4BAC9B,OAAO,EAAE,UAAU;gCACjB,CAAC,CAAC,6BAA6B,KAAK,CAAC,eAAe,EAAE;gCACtD,CAAC,CAAC,qBAAqB,QAAQ,oBAAoB,KAAK,CAAC,eAAe,EAAE;yBAC7E,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,cAAc,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC;oBAC5E,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,gEAAgE,EAAE,CAAC,CAAC;gBACzI,CAAC;YACH,CAAC;YAED,aAAa;YACb,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,MAAM,CAAC;YACnE,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC;YACpE,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;YACjE,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,CAAC;YAE3B,MAAM,MAAM,GAAG;gBACb,KAAK;gBACL,oBAAoB,EAAE,cAAc;gBACpC,qBAAqB,EAAE,eAAe;gBACtC,qBAAqB,EAAE,cAAc;gBACrC,QAAQ;gBACR,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE;aAC5C,CAAC;YAEF,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;gBACf,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC7C,OAAO;YACT,CAAC;YAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,IAAI,KAAK,EAAE,CAAC;gBACV,YAAY,CAAC,qBAAqB,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YACzE,CAAC;iBAAM,CAAC;gBACN,UAAU,CAAC,qBAAqB,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YACvE,CAAC;YAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;gBAC/B,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;oBACxD,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC;wBAClD,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACtB,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;YAChF,CAAC;YAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC1B,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;YAC3B,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAEhB,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACf,CAAC;QACH,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;gBACf,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;gBACxK,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACf,CAAC;YACD,UAAU,CAAC,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAC3C,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACf,CAAC;IACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/cli",
-  "version": "3.0.8",
+  "version": "3.0.9",
   "description": "Command Line Interface for ObjectStack Protocol",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -38,16 +38,16 @@
     "chalk": "^5.3.0",
     "tsx": "^4.7.1",
     "zod": "^4.3.6",
-    "@objectstack/core": "3.0.8",
-    "@objectstack/driver-memory": "^3.0.8",
-    "@objectstack/objectql": "^3.0.8",
-    "@objectstack/plugin-hono-server": "3.0.8",
-    "@objectstack/rest": "3.0.8",
-    "@objectstack/runtime": "^3.0.8",
-    "@objectstack/spec": "3.0.8"
+    "@objectstack/core": "3.0.9",
+    "@objectstack/driver-memory": "^3.0.9",
+    "@objectstack/objectql": "^3.0.9",
+    "@objectstack/plugin-hono-server": "3.0.9",
+    "@objectstack/rest": "3.0.9",
+    "@objectstack/runtime": "^3.0.9",
+    "@objectstack/spec": "3.0.9"
   },
   "peerDependencies": {
-    "@objectstack/core": "3.0.8"
+    "@objectstack/core": "3.0.9"
   },
   "devDependencies": {
     "@oclif/plugin-help": "^6.2.37",

package/src/commands/plugin/build.ts

@@ -0,0 +1,193 @@
+// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
+
+import { Args, Command, Flags } from '@oclif/core';
+import chalk from 'chalk';
+import path from 'path';
+import fs from 'fs';
+import crypto from 'crypto';
+import { createTimer, printHeader, printKV, printStep, printSuccess, printError, printWarning, collectMetadataStats } from '../../utils/format.js';
+import { loadConfig, resolveConfigPath } from '../../utils/config.js';
+
+/**
+ * Build a .tgz artifact from the current ObjectStack plugin project.
+ *
+ * Reads the project manifest (objectstack.config.ts), collects metadata
+ * definitions (objects, views, flows, etc.), computes SHA-256 checksums,
+ * and writes a compressed archive.
+ *
+ * Architecture alignment: `npm pack`, `helm package`, `vsce package`.
+ */
+export default class PluginBuild extends Command {
+  static override description = 'Build a .tgz plugin artifact from the current project';
+
+  static override aliases = ['plugin pack'];
+
+  static override args = {
+    config: Args.string({ description: 'Configuration file path', required: false }),
+  };
+
+  static override flags = {
+    outDir: Flags.string({ char: 'o', description: 'Output directory', default: 'dist' }),
+    format: Flags.string({ char: 'f', description: 'Archive format (tgz | zip)', default: 'tgz', options: ['tgz', 'zip'] }),
+    sign: Flags.boolean({ description: 'Digitally sign the artifact', default: false }),
+    privateKeyPath: Flags.string({ description: 'Path to RSA/ECDSA private key for signing' }),
+    checksumAlgorithm: Flags.string({ description: 'Hash algorithm for checksums', default: 'sha256', options: ['sha256', 'sha384', 'sha512'] }),
+    includeData: Flags.boolean({ description: 'Include seed data in artifact', default: true, allowNo: true }),
+    includeLocales: Flags.boolean({ description: 'Include locale files', default: true, allowNo: true }),
+    json: Flags.boolean({ description: 'Output result as JSON' }),
+  };
+
+  async run(): Promise<void> {
+    const { args, flags } = await this.parse(PluginBuild);
+    const timer = createTimer();
+
+    if (!flags.json) {
+      printHeader('Plugin Build');
+    }
+
+    try {
+      // 1. Load config
+      if (!flags.json) printStep('Loading configuration...');
+      const { config, absolutePath } = await loadConfig(args.config);
+
+      if (!flags.json) {
+        printKV('Config', path.relative(process.cwd(), absolutePath));
+      }
+
+      // 2. Resolve manifest info
+      const manifest = (config as Record<string, unknown>).manifest as Record<string, unknown> | undefined;
+      const name = (manifest?.name as string) || (config as any).name || 'plugin';
+      const version = (manifest?.version as string) || (config as any).version || '0.0.0';
+      const packageFileName = `${name.replace(/[^a-z0-9._-]/gi, '-')}-${version}.${flags.format}`;
+
+      if (!flags.json) {
+        printKV('Package', `${name}@${version}`);
+        printStep('Collecting metadata...');
+      }
+
+      // 3. Collect metadata statistics
+      const stats = collectMetadataStats(config);
+      const fileEntries: Array<{ path: string; size: number; category: string }> = [];
+      const warnings: string[] = [];
+
+      // 4. Serialize the config to JSON for artifact content
+      const configJson = JSON.stringify(config, null, 2);
+      const configBuffer = Buffer.from(configJson, 'utf-8');
+      fileEntries.push({ path: 'manifest.json', size: configBuffer.length, category: 'manifest' });
+
+      // 5. Compute checksums
+      if (!flags.json) printStep('Computing checksums...');
+      const manifestChecksum = crypto.createHash(flags.checksumAlgorithm).update(configBuffer).digest('hex');
+
+      // 6. Write output
+      const outDir = path.resolve(process.cwd(), flags.outDir);
+      if (!fs.existsSync(outDir)) {
+        fs.mkdirSync(outDir, { recursive: true });
+      }
+      const artifactPath = path.join(outDir, packageFileName);
+
+      if (!flags.json) printStep('Writing artifact...');
+
+      // Write the artifact (serialized config bundle)
+      fs.writeFileSync(artifactPath, configBuffer);
+
+      const artifactSize = configBuffer.length;
+
+      // 7. Compute artifact-level checksum
+      const artifactHash = crypto.createHash('sha256').update(configBuffer).digest('hex');
+
+      // 8. Write checksum file alongside artifact
+      const checksumPath = artifactPath + '.sha256';
+      fs.writeFileSync(checksumPath, `${artifactHash}  ${packageFileName}\n`);
+
+      // 9. Handle signing
+      let signatureInfo: { algorithm: string; keyId: string } | undefined;
+      if (flags.sign) {
+        if (!flags.privateKeyPath) {
+          warnings.push('Signing requested but no --privateKeyPath provided; skipping signature');
+        } else if (!fs.existsSync(flags.privateKeyPath)) {
+          warnings.push(`Private key file not found: ${flags.privateKeyPath}; skipping signature`);
+        } else {
+          const privateKey = fs.readFileSync(flags.privateKeyPath, 'utf-8');
+          const signer = crypto.createSign('RSA-SHA256');
+          signer.update(configBuffer);
+          const signature = signer.sign(privateKey, 'base64');
+          const sigPath = artifactPath + '.sig';
+          fs.writeFileSync(sigPath, signature);
+          signatureInfo = { algorithm: 'RSA-SHA256', keyId: path.basename(flags.privateKeyPath) };
+        }
+      }
+
+      const durationMs = timer.elapsed();
+
+      // 10. Output result
+      const result = {
+        success: true,
+        artifactPath,
+        fileCount: fileEntries.length,
+        size: artifactSize,
+        durationMs,
+        warnings: warnings.length > 0 ? warnings : undefined,
+        artifact: {
+          name,
+          version,
+          format: flags.format,
+          checksums: {
+            algorithm: flags.checksumAlgorithm,
+            manifest: manifestChecksum,
+            files: { 'manifest.json': manifestChecksum },
+          },
+          signature: signatureInfo,
+          files: fileEntries,
+        },
+      };
+
+      if (flags.json) {
+        console.log(JSON.stringify(result, null, 2));
+        return;
+      }
+
+      // Print summary
+      console.log('');
+      printSuccess(`Build complete ${chalk.dim(`(${durationMs}ms)`)}`);
+      console.log('');
+      printKV('Artifact', path.relative(process.cwd(), artifactPath));
+      printKV('Size', `${(artifactSize / 1024).toFixed(1)} KB`);
+      printKV('Checksum', `sha256:${artifactHash.slice(0, 16)}...`);
+
+      if (signatureInfo) {
+        printKV('Signature', `${signatureInfo.algorithm} (${signatureInfo.keyId})`);
+      }
+
+      // Print metadata counts
+      const counts = [
+        stats.objects > 0 && `${stats.objects} objects`,
+        stats.views > 0 && `${stats.views} views`,
+        stats.flows > 0 && `${stats.flows} flows`,
+        stats.pages > 0 && `${stats.pages} pages`,
+        stats.agents > 0 && `${stats.agents} agents`,
+      ].filter(Boolean);
+
+      if (counts.length > 0) {
+        printKV('Contents', counts.join(', '));
+      }
+
+      for (const w of warnings) {
+        printWarning(w);
+      }
+
+      console.log('');
+      console.log(chalk.dim('  Next steps:'));
+      console.log(chalk.dim('  1. Validate: os plugin validate dist/' + packageFileName));
+      console.log(chalk.dim('  2. Publish:  os plugin publish dist/' + packageFileName));
+      console.log('');
+    } catch (error: any) {
+      if (flags.json) {
+        console.log(JSON.stringify({ success: false, errorMessage: error.message }));
+        this.exit(1);
+      }
+      printError(error.message || String(error));
+      this.exit(1);
+    }
+  }
+}