@objectstack/cli 7.5.0 → 7.7.0

package/dist/commands/plugin/publish.js

@@ -0,0 +1,211 @@
+// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
+/**
+ * `os plugin publish` — upload a signed `.osplugin` to ObjectStack Cloud
+ * (ADR-0025 §3.4 step 3). Completes the build → sign → publish pipeline.
+ *
+ * Flow:
+ *   1. Read the `.osplugin` bytes + the detached `.sig` (publisher signature).
+ *   2. Extract the compiled `objectstack.plugin.json` from inside the
+ *      artifact (id / version / name / runtime / permissions / integrity).
+ *   3. POST /cloud/packages          — ensure the sys_package row exists.
+ *   4. POST /cloud/packages/:id/versions with `artifact_kind: 'plugin'`,
+ *      the base64 artifact, the declared manifest, the signature, and the
+ *      whole-artifact sha256 checksum. The cloud verifies the signature,
+ *      audits permissions/runtime tier, stores the blob, and sets
+ *      listing_status=pending_review (or approved with --auto-approve).
+ *
+ * The platform counter-signature is written by the marketplace review/approve
+ * flow, not here.
+ */
+import { readFile, readdir } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { resolve as resolvePath, basename } from 'node:path';
+import { Args, Command, Flags } from '@oclif/core';
+import { printHeader, printKV, printSuccess, printError, printStep } from '../../utils/format.js';
+import { DEFAULT_CLOUD_URL, tryReadCloudConfig } from '../../utils/cloud-config.js';
+import { OSPLUGIN_EXT, sha256Hex, readOspluginManifest } from '../../utils/osplugin.js';
+export default class PluginPublish extends Command {
+    static description = 'Publish a signed .osplugin to ObjectStack Cloud (ADR-0025 §3.4)';
+    static examples = [
+        '$ os plugin publish ./com.acme.stripe-1.0.0.osplugin --visibility marketplace --submit',
+        '$ os plugin publish ./x.osplugin --sig ./x.osplugin.sig --org org_123',
+        '$ OS_CLOUD_URL=http://localhost:4000 os plugin publish ./x.osplugin --auto-approve',
+    ];
+    static args = {
+        artifact: Args.string({ description: 'Path to the .osplugin (default: the single .osplugin in cwd)', required: false }),
+    };
+    static flags = {
+        server: Flags.string({ char: 's', description: 'Cloud control-plane URL', env: 'OS_CLOUD_URL', default: DEFAULT_CLOUD_URL }),
+        token: Flags.string({ char: 't', description: 'Cloud API key (bearer)', env: 'OS_CLOUD_API_KEY' }),
+        sig: Flags.string({ description: 'Path to the detached signature (default: <artifact>.sig)' }),
+        'manifest-id': Flags.string({ description: 'Override package id (default: from the manifest)' }),
+        'display-name': Flags.string({ description: 'Marketplace display name (default: manifest.name)' }),
+        visibility: Flags.string({ description: 'Who can see/install', options: ['private', 'org', 'marketplace'], default: 'private' }),
+        org: Flags.string({ description: 'owner_org_id (service mode)', env: 'OS_ORG_ID' }),
+        note: Flags.string({ char: 'n', description: 'Release notes (markdown ok)' }),
+        'pre-release': Flags.boolean({ description: 'Mark as a pre-release', default: false }),
+        submit: Flags.boolean({ description: 'Submit for marketplace review after publish', default: false }),
+        'auto-approve': Flags.boolean({ description: 'Platform admin only: skip review queue', default: false }),
+        timeout: Flags.integer({ description: 'HTTP timeout (ms, 0 disables)', env: 'OS_CLOUD_TIMEOUT_MS', default: 120_000 }),
+    };
+    async run() {
+        const { args, flags } = await this.parse(PluginPublish);
+        printHeader('Publish Plugin');
+        // 1. Resolve the artifact path. ────────────────────────────────────
+        let artifactPath;
+        if (args.artifact) {
+            artifactPath = resolvePath(process.cwd(), args.artifact);
+        }
+        else {
+            const here = (await readdir(process.cwd())).filter((f) => f.endsWith(OSPLUGIN_EXT));
+            if (here.length === 0) {
+                printError(`No ${OSPLUGIN_EXT} found in cwd. Run \`os plugin build\` first, or pass a path.`);
+                this.exit(1);
+                return;
+            }
+            if (here.length > 1) {
+                printError(`Multiple ${OSPLUGIN_EXT} files found — pass one explicitly.`);
+                this.exit(1);
+                return;
+            }
+            artifactPath = resolvePath(process.cwd(), here[0]);
+        }
+        if (!existsSync(artifactPath)) {
+            printError(`Artifact not found: ${artifactPath}`);
+            this.exit(1);
+            return;
+        }
+        const bytes = new Uint8Array(await readFile(artifactPath));
+        const checksum = sha256Hex(bytes);
+        const base64 = Buffer.from(bytes).toString('base64');
+        // 2. Extract the compiled manifest from inside the artifact. ────────
+        let manifest;
+        try {
+            manifest = readOspluginManifest(bytes);
+        }
+        catch (err) {
+            printError(`Cannot read manifest from artifact: ${err?.message ?? err}`);
+            this.exit(1);
+            return;
+        }
+        const id = String(flags['manifest-id'] ?? manifest.id ?? '').trim();
+        const version = String(manifest.version ?? '').trim();
+        const displayName = String(flags['display-name'] ?? manifest.name ?? id).trim();
+        if (!id || !version) {
+            printError('Artifact manifest is missing id or version.');
+            this.exit(1);
+            return;
+        }
+        printStep(`${id}@${version} (${(bytes.byteLength / 1024).toFixed(1)} KB, runtime: ${manifest.runtime ?? 'unset'})`);
+        // 3. Detached publisher signature. ─────────────────────────────────
+        const sigPath = resolvePath(process.cwd(), flags.sig ?? `${artifactPath}.sig`);
+        let signature;
+        if (existsSync(sigPath)) {
+            signature = (await readFile(sigPath, 'utf-8')).trim();
+            printKV('  Signature', signature.length > 48 ? signature.slice(0, 48) + '…' : signature);
+        }
+        else {
+            printStep(`No signature sidecar at ${basename(sigPath)} — publishing UNSIGNED (a "node"-tier plugin will be rejected by the server unless the publisher is verified). Run \`os plugin sign\` first.`);
+        }
+        // 4. Auth + server URL (same precedence as `os package publish`). ───
+        let token = flags.token ?? process.env.OS_TOKEN ?? undefined;
+        let baseUrl = flags.server.replace(/\/+$/, '');
+        const serverFlagWasDefault = !process.env.OS_CLOUD_URL && baseUrl === DEFAULT_CLOUD_URL;
+        if (!token || serverFlagWasDefault) {
+            const stored = await tryReadCloudConfig();
+            if (!token && stored?.token)
+                token = stored.token;
+            if (serverFlagWasDefault && stored?.url)
+                baseUrl = stored.url.replace(/\/+$/, '');
+        }
+        if (!token) {
+            printError('Not logged in. Run `os cloud login`, or pass --token / set $OS_CLOUD_API_KEY.');
+            this.exit(1);
+            return;
+        }
+        // 5. Register the package row. ──────────────────────────────────────
+        printStep(`Registering package '${id}'...`);
+        const pkgBody = { manifest_id: id, display_name: displayName, visibility: flags.visibility };
+        if (flags.org)
+            pkgBody.owner_org_id = flags.org;
+        if (typeof manifest.description === 'string')
+            pkgBody.description = manifest.description;
+        const pkgRes = await this.postJson(`${baseUrl}/api/v1/cloud/packages`, pkgBody, token, flags.timeout);
+        if (!pkgRes.ok) {
+            printError(`Register package failed (${pkgRes.status}): ${pkgRes.error}`);
+            this.exit(1);
+            return;
+        }
+        const pkg = pkgRes.body?.data ?? pkgRes.body;
+        printSuccess(`${pkg?.created ? 'Created' : 'Updated'} sys_package ${pkg?.id} (${id})`);
+        // 6. Publish the plugin version. ────────────────────────────────────
+        printStep(`Publishing version ${version}...`);
+        const verBody = {
+            version,
+            artifact_kind: 'plugin',
+            osplugin: base64,
+            plugin_manifest: manifest,
+            artifact_checksum: checksum,
+            is_pre_release: flags['pre-release'] || /-(alpha|beta|rc|dev|preview|staging|pr)/i.test(version),
+        };
+        if (signature)
+            verBody.signature = signature;
+        if (flags.note)
+            verBody.release_notes = flags.note;
+        if (flags.submit)
+            verBody.submit_for_review = true;
+        if (flags['auto-approve'])
+            verBody.auto_approve = true;
+        const verRes = await this.postJson(`${baseUrl}/api/v1/cloud/packages/${encodeURIComponent(pkg.id)}/versions`, verBody, token, flags.timeout);
+        if (!verRes.ok) {
+            printError(`Publish version failed (${verRes.status}): ${verRes.error}`);
+            const violations = Array.isArray(verRes.body?.violations) ? verRes.body.violations : [];
+            if (violations.length > 0) {
+                console.log('\n  Violations:');
+                for (const v of violations)
+                    console.log(`    • ${v}`);
+            }
+            this.exit(1);
+            return;
+        }
+        const ver = verRes.body?.data ?? verRes.body;
+        printSuccess('Plugin version published');
+        printKV('  Version', String(ver?.version ?? version));
+        printKV('  Listing status', String(ver?.listing_status ?? (flags.submit ? 'pending_review' : 'draft')));
+        printKV('  Artifact sha256', checksum);
+        if (!flags.submit && !flags['auto-approve'] && flags.visibility === 'marketplace') {
+            printStep('Re-run with --submit to send this version for marketplace review.');
+        }
+    }
+    /** Tiny fetch wrapper returning a normalized envelope; honours a timeout. */
+    async postJson(url, body, token, timeoutMs) {
+        const controller = new AbortController();
+        const timer = timeoutMs > 0 ? setTimeout(() => controller.abort(), timeoutMs) : undefined;
+        try {
+            const response = await fetch(url, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${token}` },
+                body: JSON.stringify(body),
+                signal: controller.signal,
+            });
+            let parsed = null;
+            try {
+                parsed = await response.json();
+            }
+            catch { /* empty body */ }
+            if (!response.ok) {
+                const errMsg = parsed?.error?.message ?? parsed?.error ?? response.statusText;
+                return { ok: false, status: response.status, body: parsed, error: String(errMsg) };
+            }
+            return { ok: true, status: response.status, body: parsed };
+        }
+        catch (err) {
+            return { ok: false, status: 0, body: null, error: err?.message ?? String(err) };
+        }
+        finally {
+            if (timer)
+                clearTimeout(timer);
+        }
+    }
+}
+//# sourceMappingURL=publish.js.map

package/dist/commands/plugin/publish.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish.js","sourceRoot":"","sources":["../../../src/commands/plugin/publish.ts"],"names":[],"mappings":"AAAA,yEAAyE;AAEzE;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClG,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACpF,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAIxF,MAAM,CAAC,OAAO,OAAO,aAAc,SAAQ,OAAO;IAChD,MAAM,CAAU,WAAW,GACzB,iEAAiE,CAAC;IAEpE,MAAM,CAAU,QAAQ,GAAG;QACzB,wFAAwF;QACxF,uEAAuE;QACvE,oFAAoF;KACrF,CAAC;IAEF,MAAM,CAAU,IAAI,GAAG;QACrB,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,8DAA8D,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;KACxH,CAAC;IAEF,MAAM,CAAU,KAAK,GAAG;QACtB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,yBAAyB,EAAE,GAAG,EAAE,cAAc,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;QAC5H,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,wBAAwB,EAAE,GAAG,EAAE,kBAAkB,EAAE,CAAC;QAClG,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,0DAA0D,EAAE,CAAC;QAC9F,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,kDAAkD,EAAE,CAAC;QAChG,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,mDAAmD,EAAE,CAAC;QAClG,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,qBAAqB,EAAE,OAAO,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,aAAa,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QAChI,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,6BAA6B,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC;QACnF,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,6BAA6B,EAAE,CAAC;QAC7E,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,uBAAuB,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACtF,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,6CAA6C,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACrG,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,wCAAwC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACxG,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,+BAA+B,EAAE,GAAG,EAAE,qBAAqB,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;KACvH,CAAC;IAEF,KAAK,CAAC,GAAG;QACP,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACxD,WAAW,CAAC,gBAAgB,CAAC,CAAC;QAE9B,qEAAqE;QACrE,IAAI,YAAoB,CAAC;QACzB,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,YAAY,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3D,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;YACpF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAAC,UAAU,CAAC,MAAM,YAAY,+DAA+D,CAAC,CAAC;gBAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YAC/I,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAAC,UAAU,CAAC,YAAY,YAAY,qCAAqC,CAAC,CAAC;gBAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YACzH,YAAY,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAAC,UAAU,CAAC,uBAAuB,YAAY,EAAE,CAAC,CAAC;YAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAE3G,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;QAC3D,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAErD,sEAAsE;QACtE,IAAI,QAA6B,CAAC;QAClC,IAAI,CAAC;YACH,QAAQ,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,UAAU,CAAC,uCAAuC,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,CAAC,CAAC;YACzE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACb,OAAO;QACT,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACpE,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACtD,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAChF,IAAI,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;YAAC,UAAU,CAAC,6CAA6C,CAAC,CAAC;YAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACzG,SAAS,CAAC,GAAG,EAAE,IAAI,OAAO,KAAK,CAAC,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,iBAAiB,QAAQ,CAAC,OAAO,IAAI,OAAO,GAAG,CAAC,CAAC;QAEpH,qEAAqE;QACrE,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,GAAG,IAAI,GAAG,YAAY,MAAM,CAAC,CAAC;QAC/E,IAAI,SAA6B,CAAC;QAClC,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACxB,SAAS,GAAG,CAAC,MAAM,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACtD,OAAO,CAAC,aAAa,EAAE,SAAS,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC3F,CAAC;aAAM,CAAC;YACN,SAAS,CAAC,2BAA2B,QAAQ,CAAC,OAAO,CAAC,8IAA8I,CAAC,CAAC;QACxM,CAAC;QAED,sEAAsE;QACtE,IAAI,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,SAAS,CAAC;QAC7D,IAAI,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC/C,MAAM,oBAAoB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,OAAO,KAAK,iBAAiB,CAAC;QACxF,IAAI,CAAC,KAAK,IAAI,oBAAoB,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,MAAM,kBAAkB,EAAE,CAAC;YAC1C,IAAI,CAAC,KAAK,IAAI,MAAM,EAAE,KAAK;gBAAE,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;YAClD,IAAI,oBAAoB,IAAI,MAAM,EAAE,GAAG;gBAAE,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;YAAC,UAAU,CAAC,+EAA+E,CAAC,CAAC;YAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAElI,sEAAsE;QACtE,SAAS,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAwB,EAAE,WAAW,EAAE,EAAE,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;QAClH,IAAI,KAAK,CAAC,GAAG;YAAE,OAAO,CAAC,YAAY,GAAG,KAAK,CAAC,GAAG,CAAC;QAChD,IAAI,OAAO,QAAQ,CAAC,WAAW,KAAK,QAAQ;YAAE,OAAO,CAAC,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAC;QACzF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,OAAO,wBAAwB,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QACtG,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YAAC,UAAU,CAAC,4BAA4B,MAAM,CAAC,MAAM,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;YAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACpH,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC;QAC7C,YAAY,CAAC,GAAG,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,gBAAgB,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;QAEvF,sEAAsE;QACtE,SAAS,CAAC,sBAAsB,OAAO,KAAK,CAAC,CAAC;QAC9C,MAAM,OAAO,GAAwB;YACnC,OAAO;YACP,aAAa,EAAE,QAAQ;YACvB,QAAQ,EAAE,MAAM;YAChB,eAAe,EAAE,QAAQ;YACzB,iBAAiB,EAAE,QAAQ;YAC3B,cAAc,EAAE,KAAK,CAAC,aAAa,CAAC,IAAI,0CAA0C,CAAC,IAAI,CAAC,OAAO,CAAC;SACjG,CAAC;QACF,IAAI,SAAS;YAAE,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC;QAC7C,IAAI,KAAK,CAAC,IAAI;YAAE,OAAO,CAAC,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC;QACnD,IAAI,KAAK,CAAC,MAAM;YAAE,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;QACnD,IAAI,KAAK,CAAC,cAAc,CAAC;YAAE,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;QAEvD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAChC,GAAG,OAAO,0BAA0B,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CACzG,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,UAAU,CAAC,2BAA2B,MAAM,CAAC,MAAM,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;YACzE,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;YACxF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1B,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;gBAC/B,KAAK,MAAM,CAAC,IAAI,UAAU;oBAAE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YACxD,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACb,OAAO;QACT,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC;QAC7C,YAAY,CAAC,0BAA0B,CAAC,CAAC;QACzC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,GAAG,EAAE,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC;QACtD,OAAO,CAAC,kBAAkB,EAAE,MAAM,CAAC,GAAG,EAAE,cAAc,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACxG,OAAO,CAAC,mBAAmB,EAAE,QAAQ,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,KAAK,CAAC,UAAU,KAAK,aAAa,EAAE,CAAC;YAClF,SAAS,CAAC,mEAAmE,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IAED,6EAA6E;IACrE,KAAK,CAAC,QAAQ,CAAC,GAAW,EAAE,IAAa,EAAE,KAAa,EAAE,SAAiB;QACjF,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1F,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBAChC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;gBACjF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBAC1B,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YACH,IAAI,MAAM,GAAQ,IAAI,CAAC;YACvB,IAAI,CAAC;gBAAC,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,gBAAgB,CAAC,CAAC;YAClE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,MAAM,GAAG,MAAM,EAAE,KAAK,EAAE,OAAO,IAAI,MAAM,EAAE,KAAK,IAAI,QAAQ,CAAC,UAAU,CAAC;gBAC9E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YACrF,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC7D,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAClF,CAAC;gBAAS,CAAC;YACT,IAAI,KAAK;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;IACH,CAAC"}

package/dist/commands/plugin/sign.d.ts

@@ -0,0 +1,15 @@
+import { Command } from '@oclif/core';
+export default class PluginSign extends Command {
+    static description: string;
+    static examples: string[];
+    static args: {
+        artifact: import("@oclif/core/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        key: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        'key-id': import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        out: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+    };
+    run(): Promise<void>;
+}
+//# sourceMappingURL=sign.d.ts.map

package/dist/commands/plugin/sign.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign.d.ts","sourceRoot":"","sources":["../../../src/commands/plugin/sign.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAQ,OAAO,EAAS,MAAM,aAAa,CAAC;AAKnD,MAAM,CAAC,OAAO,OAAO,UAAW,SAAQ,OAAO;IAC7C,OAAgB,WAAW,SAC6C;IAExE,OAAgB,QAAQ,WAGtB;IAEF,OAAgB,IAAI;;MAElB;IAEF,OAAgB,KAAK;;;;MAcnB;IAEI,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CA2D3B"}

package/dist/commands/plugin/sign.js

@@ -0,0 +1,102 @@
+// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
+/**
+ * `os plugin sign` — produce a publisher signature over a built `.osplugin`
+ * (ADR-0025 §3.4 step 2, framework F3).
+ *
+ * The signature is DETACHED and computed over the exact artifact bytes that
+ * will be uploaded — the same bytes the cloud control plane verifies at
+ * publish time (`verifyPublisherSignature`) and the runtime re-verifies at
+ * materialize time. It is emitted as `ed25519:<keyId>:<base64url>` and
+ * written to a `<artifact>.sig` sidecar (and printed), to be passed as the
+ * `signature` field when publishing. The artifact itself is NOT modified, so
+ * signing is idempotent and the signed bytes are exactly the built bytes.
+ */
+import { readFile, writeFile } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { createPrivateKey, createPublicKey } from 'node:crypto';
+import { resolve as resolvePath } from 'node:path';
+import { Args, Command, Flags } from '@oclif/core';
+import { parseSignature, signPayload, verifyPayload } from '@objectstack/core';
+import { printError, printHeader, printKV, printStep, printSuccess } from '../../utils/format.js';
+import { OSPLUGIN_EXT } from '../../utils/osplugin.js';
+export default class PluginSign extends Command {
+    static description = 'Sign a built .osplugin with a publisher Ed25519 key (ADR-0025 §3.4)';
+    static examples = [
+        '$ os plugin sign my-plugin-1.0.0.osplugin --key ./publisher.key.pem',
+        '$ os plugin sign my-plugin-1.0.0.osplugin --key ./publisher.key.pem --key-id acme-2026',
+    ];
+    static args = {
+        artifact: Args.string({ description: 'Path to the .osplugin artifact', required: true }),
+    };
+    static flags = {
+        key: Flags.string({
+            char: 'k',
+            description: 'Path to the publisher Ed25519 private key (PKCS#8 PEM)',
+            required: true,
+        }),
+        'key-id': Flags.string({
+            description: 'Key identifier embedded in the signature (rotation handle)',
+            default: 'default',
+        }),
+        out: Flags.string({
+            char: 'o',
+            description: 'Output path for the detached signature (defaults to <artifact>.sig)',
+        }),
+    };
+    async run() {
+        const { args, flags } = await this.parse(PluginSign);
+        printHeader('Sign Plugin');
+        const artifactPath = resolvePath(process.cwd(), args.artifact);
+        if (!existsSync(artifactPath)) {
+            printError(`Artifact not found: ${args.artifact}`);
+            this.exit(1);
+            return;
+        }
+        if (!artifactPath.endsWith(OSPLUGIN_EXT)) {
+            printStep(`Warning: ${args.artifact} does not have a ${OSPLUGIN_EXT} extension`);
+        }
+        let privateKeyPem;
+        try {
+            privateKeyPem = await readFile(resolvePath(process.cwd(), flags.key), 'utf-8');
+        }
+        catch (err) {
+            printError(`Cannot read private key: ${err.message}`);
+            this.exit(1);
+            return;
+        }
+        const artifact = new Uint8Array(await readFile(artifactPath));
+        const keyId = flags['key-id'];
+        let signature;
+        try {
+            signature = signPayload(artifact, privateKeyPem, keyId);
+        }
+        catch (err) {
+            printError(`Signing failed: ${err.message}`);
+            this.exit(1);
+            return;
+        }
+        // Self-check: verify the freshly produced signature against the public
+        // half so a bad key / wrong format never ships silently.
+        try {
+            const pub = createPublicKey(createPrivateKey(privateKeyPem));
+            if (!verifyPayload(artifact, signature, pub)) {
+                printError('Self-verification of the produced signature failed.');
+                this.exit(1);
+                return;
+            }
+        }
+        catch (err) {
+            printError(`Self-verification error: ${err.message}`);
+            this.exit(1);
+            return;
+        }
+        const outPath = resolvePath(process.cwd(), flags.out ?? `${args.artifact}.sig`);
+        await writeFile(outPath, signature + '\n', 'utf-8');
+        printSuccess('Plugin signed');
+        printKV('  Artifact', args.artifact);
+        printKV('  Key ID', parseSignature(signature)?.keyId ?? keyId);
+        printKV('  Signature', signature);
+        printKV('  Sidecar', flags.out ?? `${args.artifact}.sig`);
+    }
+}
+//# sourceMappingURL=sign.js.map

package/dist/commands/plugin/sign.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign.js","sourceRoot":"","sources":["../../../src/commands/plugin/sign.ts"],"names":[],"mappings":"AAAA,yEAAyE;AAEzE;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAC/E,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAClG,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAEvD,MAAM,CAAC,OAAO,OAAO,UAAW,SAAQ,OAAO;IAC7C,MAAM,CAAU,WAAW,GACzB,qEAAqE,CAAC;IAExE,MAAM,CAAU,QAAQ,GAAG;QACzB,qEAAqE;QACrE,wFAAwF;KACzF,CAAC;IAEF,MAAM,CAAU,IAAI,GAAG;QACrB,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,gCAAgC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;KACzF,CAAC;IAEF,MAAM,CAAU,KAAK,GAAG;QACtB,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC;YAChB,IAAI,EAAE,GAAG;YACT,WAAW,EAAE,wDAAwD;YACrE,QAAQ,EAAE,IAAI;SACf,CAAC;QACF,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC;YACrB,WAAW,EAAE,4DAA4D;YACzE,OAAO,EAAE,SAAS;SACnB,CAAC;QACF,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC;YAChB,IAAI,EAAE,GAAG;YACT,WAAW,EAAE,qEAAqE;SACnF,CAAC;KACH,CAAC;IAEF,KAAK,CAAC,GAAG;QACP,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACrD,WAAW,CAAC,aAAa,CAAC,CAAC;QAE3B,MAAM,YAAY,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/D,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC9B,UAAU,CAAC,uBAAuB,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YACnD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACb,OAAO;QACT,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACzC,SAAS,CAAC,YAAY,IAAI,CAAC,QAAQ,oBAAoB,YAAY,YAAY,CAAC,CAAC;QACnF,CAAC;QAED,IAAI,aAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,aAAa,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;QACjF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,UAAU,CAAC,4BAA6B,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YACjE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACb,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,MAAM,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;QAC9D,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;QAE9B,IAAI,SAAiB,CAAC;QACtB,IAAI,CAAC;YACH,SAAS,GAAG,WAAW,CAAC,QAAQ,EAAE,aAAa,EAAE,KAAK,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,UAAU,CAAC,mBAAoB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YACxD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACb,OAAO;QACT,CAAC;QAED,uEAAuE;QACvE,yDAAyD;QACzD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,eAAe,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC,CAAC;YAC7D,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC;gBAC7C,UAAU,CAAC,qDAAqD,CAAC,CAAC;gBAClE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACb,OAAO;YACT,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,UAAU,CAAC,4BAA6B,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YACjE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACb,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,QAAQ,MAAM,CAAC,CAAC;QAChF,MAAM,SAAS,CAAC,OAAO,EAAE,SAAS,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;QAEpD,YAAY,CAAC,eAAe,CAAC,CAAC;QAC9B,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrC,OAAO,CAAC,UAAU,EAAE,cAAc,CAAC,SAAS,CAAC,EAAE,KAAK,IAAI,KAAK,CAAC,CAAC;QAC/D,OAAO,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;QAClC,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,QAAQ,MAAM,CAAC,CAAC;IAC5D,CAAC"}

package/dist/commands/serve.d.ts

@@ -12,6 +12,8 @@ export default class Serve extends Command {
         server: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         prebuilt: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         preset: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        'log-level': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
     };
     /**
      * Capabilities auto-added to every app's `requires` for every preset

package/dist/commands/serve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../src/commands/serve.ts"],"names":[],"mappings":"AAEA,OAAO,EAAQ,OAAO,EAAS,MAAM,aAAa,CAAC;AAuInD,MAAM,CAAC,OAAO,OAAO,KAAM,SAAQ,OAAO;IACxC,OAAgB,WAAW,SAAkM;IAE7N,OAAgB,IAAI;;MAElB;IAEF,OAAgB,KAAK;;;;;;;;MAenB;IAEF;;;;;;;;;;;;;;;;;OAiBG;IACH,MAAM,CAAC,QAAQ,CAAC,sBAAsB,EAAE,SAAS,MAAM,EAAE,CAEtD;IAEH;;;;OAIG;IACH,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAIpD;IAEI,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CAkjD3B"}
+{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../src/commands/serve.ts"],"names":[],"mappings":"AAEA,OAAO,EAAQ,OAAO,EAAS,MAAM,aAAa,CAAC;AAyInD,MAAM,CAAC,OAAO,OAAO,KAAM,SAAQ,OAAO;IACxC,OAAgB,WAAW,SAAkM;IAE7N,OAAgB,IAAI;;MAElB;IAEF,OAAgB,KAAK;;;;;;;;;;MAoBnB;IAEF;;;;;;;;;;;;;;;;;OAiBG;IACH,MAAM,CAAC,QAAQ,CAAC,sBAAsB,EAAE,SAAS,MAAM,EAAE,CAEtD;IAEH;;;;OAIG;IACH,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAIpD;IAEI,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CAwuD3B"}