@qomicex/cli 0.1.2 → 0.1.4

package/dist/commands/pack.js

@@ -48,21 +48,26 @@ export async function packCommand(opts = {}) {
     if (!id)
         fail('manifest.json 缺少 id');
     let entries = buildPackageEntries(root, manifest);
-    // 可选签名（仅 signature.json；需要证书链请用 publish）
+    // 可选签名（signature.json + signature.cert.json；无商店证书时生成自签证书）
     if (opts.key) {
         const keyContent = await readKeyInput(opts.key);
         const priv = parsePrivateKey(keyContent);
-        const { derivePublicKey } = await import("../lib/signature.js");
+        const { derivePublicKey, makeSelfSignedCert } = await import("../lib/signature.js");
         const pub = await derivePublicKey(priv);
         const keyId = `ed25519:${pub.slice(0, 8)}`;
         const localCert = join(root, 'signature.cert.json');
         let certJson;
-        if (existsSync(localCert))
+        if (existsSync(localCert)) {
             certJson = readFileSync(localCert, 'utf8');
+        }
+        else {
+            const name = String(manifest.name ?? '');
+            certJson = await makeSelfSignedCert(priv, keyId, name);
+            writeFileSync(localCert, certJson);
+            warn('未找到本地签名证书，已生成自签证书并写入 signature.cert.json；上传商店需先在开发者中心注册对应公钥');
+        }
         const sig = await signPackage(entries, priv, keyId, certJson);
         entries = { ...entries, ...sig };
-        if (!certJson)
-            warn('缺少本地 signature.cert.json，商店上传仍需证书；建议改用 qomicex publish 走完整签名');
     }
     const outDir = resolve(root, opts.outDir ?? 'release');
     mkdirSync(outDir, { recursive: true });

package/dist/commands/publish.js

@@ -40,18 +40,25 @@ export async function publishCommand(opts = {}) {
     // 清掉旧签名文件，避免脏残留
     for (const k of ['signature.json', 'signature.cert.json'])
         delete entries[k];
-    // 3) 设备流登录
+    // 3) 认证：QOMICEX_API_KEY 存在则跳过设备流（CI 场景），否则设备流登录
     const api = opts.api ?? process.env.QOMICEX_STORE_API ?? DEFAULT_API_BASE;
-    info('==> 设备流登录');
-    const code = await requestDeviceCode(api);
-    info(`  请在浏览器打开（或扫码）并登录确认：`);
-    info(`  ${code.verificationUriComplete}`);
-    info(`  授权码: ${code.userCode}`);
-    const login = await pollDeviceLogin(api, code);
-    info(`✔ 登录成功：${login.user.username}`);
+    let token = '';
+    if (process.env.QOMICEX_API_KEY) {
+        info('==> 使用 API Key 认证（CI 模式）');
+    }
+    else {
+        info('==> 设备流登录');
+        const code = await requestDeviceCode(api);
+        info(`  请在浏览器打开（或扫码）并登录确认：`);
+        info(`  ${code.verificationUriComplete}`);
+        info(`  授权码: ${code.userCode}`);
+        const login = await pollDeviceLogin(api, code);
+        token = login.accessToken;
+        info(`✔ 登录成功：${login.user.username}`);
+    }
     // 4) 注册/刷新签名公钥，获取商店根钥签发的证书
     info('==> 注册签名公钥');
-    const keyRes = await registerDevKey(api, login.accessToken, publicKey);
+    const keyRes = await registerDevKey(api, token, publicKey);
     const certJson = JSON.stringify(keyRes.cert);
     info(`✔ 签名证书就绪（keyId: ${keyRes.keyId}）`);
     // 5) 签名
@@ -61,7 +68,7 @@ export async function publishCommand(opts = {}) {
     // 6) 查找/创建插件记录
     info('==> 确认插件记录');
     let pluginId = '';
-    const mine = await fetchMinePlugins(api, login.accessToken);
+    const mine = await fetchMinePlugins(api, token);
     const existing = mine.find((p) => p.slug === slug);
     if (existing) {
         pluginId = existing.id;
@@ -69,7 +76,7 @@ export async function publishCommand(opts = {}) {
     }
     else {
         try {
-            const created = await createPlugin(api, login.accessToken, {
+            const created = await createPlugin(api, token, {
                 slug,
                 name: String(manifest.name ?? slug),
                 description: String(manifest.description ?? ''),
@@ -80,7 +87,7 @@ export async function publishCommand(opts = {}) {
         }
         catch (e) {
             if (e instanceof StoreApiError && e.status === 409) {
-                const again = await fetchMinePlugins(api, login.accessToken);
+                const again = await fetchMinePlugins(api, token);
                 const found = again.find((p) => p.slug === slug);
                 if (!found)
                     throw e;
@@ -98,13 +105,13 @@ export async function publishCommand(opts = {}) {
     info(`  插件: ${slug}  v${version}`);
     info(`  keyId: ${keyRes.keyId}`);
     info(`  包体: ${signedBytes.length} 字节（已签名）`);
-    const ok = await confirm('确认发布到商店？', opts.yes ?? false);
+    const ok = await confirm('确认发布到商店？', opts.yes ?? !!process.env.QOMICEX_API_KEY);
     if (!ok) {
         warn('已取消发布');
         return;
     }
     info('==> 上传版本');
-    const result = await uploadVersion(api, login.accessToken, pluginId, signedBytes, opts.changelog);
+    const result = await uploadVersion(api, token, pluginId, signedBytes, opts.changelog);
     info(`✔ 上传完成：${slug} v${version}`);
     info(`  商店地址: ${api.replace('/api/v1', '')}`);
     if (typeof result === 'object' && result && 'status' in result) {

package/dist/index.js

@@ -61,6 +61,7 @@ qomicex v${VERSION} — Qomicex 插件生态 CLI
 
 环境变量:
   QOMICEX_SIGN_KEY   签名私钥（PKCS#8 PEM 或 raw base64 seed），publish 必填
+  QOMICEX_API_KEY    商店 API Key（CI 模式下跳过设备流登录，自动确认上传）
   QOMICEX_STORE_API  商店 API base（默认 https://plugins.qomicex.top/api/v1）
 `;
 }

package/dist/lib/signature.js

@@ -98,10 +98,34 @@ async function signBytes(privDer, msg) {
     const sig = await crypto.subtle.sign({ name: ALG }, key, msg);
     return bytesToBase64(new Uint8Array(sig));
 }
+/** 自签开发者证书（开发者私钥签证书体）：未注册商店密钥时的离线打包/本地验证用，商店上传需对应公钥已注册。 */
+export async function makeSelfSignedCert(privDer, keyId, developerName = '') {
+    const { derivePublicKey } = await import("./signature.js");
+    const publicKey = await derivePublicKey(privDer);
+    const body = {
+        alg: ALG,
+        keyId,
+        developerId: '',
+        developerName,
+        publicKey,
+        issuedAt: new Date().toISOString(),
+        signature: '',
+    };
+    const certBody = canonicalJson({
+        alg: body.alg,
+        keyId: body.keyId,
+        developerId: body.developerId,
+        developerName: body.developerName,
+        publicKey: body.publicKey,
+        issuedAt: body.issuedAt,
+    });
+    body.signature = await signBytes(privDer, new TextEncoder().encode(certBody));
+    return JSON.stringify(body);
+}
 /**
  * 对包内全部条目生成签名文件。
  * @param certJson 商店根钥签发的开发者证书 JSON（POST /developer/keys 返回值），
- *                 无 cert 时仅生成 signature.json（pack 场景，publish 会走完整证书链）。
+ *                 省略时仅生成 signature.json（publish 场景由调用方传证书）。
  */
 export async function signPackage(entries, privDer, keyId, certJson) {
     const payload = await signedPayloadBytes(entries);

package/dist/lib/store.js

@@ -13,7 +13,10 @@ export class StoreApiError extends Error {
 }
 async function request(base, path, init, token) {
     const headers = new Headers(init?.headers);
-    if (token)
+    const apiKey = process.env.QOMICEX_API_KEY;
+    if (apiKey)
+        headers.set('X-API-Key', apiKey);
+    else if (token)
         headers.set('Authorization', `Bearer ${token}`);
     let res;
     try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@qomicex/cli",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "publishConfig": {
     "access": "public"
   },