@red-hat-developer-hub/cli-module-install-dynamic-plugins 0.2.0

package/dist/types.cjs.js

@@ -0,0 +1,45 @@
+'use strict';
+
+const PullPolicy = {
+  IF_NOT_PRESENT: "IfNotPresent",
+  ALWAYS: "Always"
+};
+const DOCKER_PROTO = "docker://";
+const OCI_PROTO = "oci://";
+const LATEST_TAG_MARKER = ":latest!";
+const RHDH_REGISTRY = "registry.access.redhat.com/rhdh/";
+const RHDH_FALLBACK = "quay.io/rhdh/";
+const CONFIG_HASH_FILE = "dynamic-plugin-config.hash";
+const IMAGE_HASH_FILE = "dynamic-plugin-image.hash";
+const DPDY_FILENAME = "dynamic-plugins.default.yaml";
+const LOCK_FILENAME = "install-dynamic-plugins.lock";
+const GLOBAL_CONFIG_FILENAME = "app-config.dynamic-plugins.yaml";
+const DEFAULT_MAX_ENTRY_SIZE = 4e7;
+function parseMaxEntrySize(raw = process.env.MAX_ENTRY_SIZE) {
+  if (!raw) return DEFAULT_MAX_ENTRY_SIZE;
+  const n = Number.parseInt(raw, 10);
+  return Number.isFinite(n) && n >= 1 ? n : DEFAULT_MAX_ENTRY_SIZE;
+}
+const MAX_ENTRY_SIZE = parseMaxEntrySize();
+const RECOGNIZED_ALGORITHMS = ["sha512", "sha384", "sha256"];
+function effectivePullPolicy(plugin) {
+  if (plugin.pullPolicy) return plugin.pullPolicy;
+  return plugin.package.includes(LATEST_TAG_MARKER) ? PullPolicy.ALWAYS : PullPolicy.IF_NOT_PRESENT;
+}
+
+exports.CONFIG_HASH_FILE = CONFIG_HASH_FILE;
+exports.DOCKER_PROTO = DOCKER_PROTO;
+exports.DPDY_FILENAME = DPDY_FILENAME;
+exports.GLOBAL_CONFIG_FILENAME = GLOBAL_CONFIG_FILENAME;
+exports.IMAGE_HASH_FILE = IMAGE_HASH_FILE;
+exports.LATEST_TAG_MARKER = LATEST_TAG_MARKER;
+exports.LOCK_FILENAME = LOCK_FILENAME;
+exports.MAX_ENTRY_SIZE = MAX_ENTRY_SIZE;
+exports.OCI_PROTO = OCI_PROTO;
+exports.PullPolicy = PullPolicy;
+exports.RECOGNIZED_ALGORITHMS = RECOGNIZED_ALGORITHMS;
+exports.RHDH_FALLBACK = RHDH_FALLBACK;
+exports.RHDH_REGISTRY = RHDH_REGISTRY;
+exports.effectivePullPolicy = effectivePullPolicy;
+exports.parseMaxEntrySize = parseMaxEntrySize;
+//# sourceMappingURL=types.cjs.js.map

package/dist/types.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.cjs.js","sources":["../src/types.ts"],"sourcesContent":["/*\n * Copyright Red Hat, Inc.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nexport const PullPolicy = {\n  IF_NOT_PRESENT: 'IfNotPresent',\n  ALWAYS: 'Always',\n} as const;\n\n// PullPolicy is intentionally both a const (runtime values) and a type\n// (string union) so callers can use `PullPolicy.ALWAYS` and `PullPolicy` as\n// a type. The no-redeclare rule doesn't recognise this enum-like pattern.\n// eslint-disable-next-line @typescript-eslint/no-redeclare\nexport type PullPolicy = (typeof PullPolicy)[keyof typeof PullPolicy];\n\n/**\n * External schema — the fields a user may declare in `dynamic-plugins.yaml`.\n * Keep this in sync with RHDH documentation.\n */\nexport type PluginSpec = {\n  package: string;\n  disabled?: boolean;\n  pullPolicy?: PullPolicy;\n  forceDownload?: boolean;\n  integrity?: string;\n  pluginConfig?: Record<string, unknown>;\n};\n\n/**\n * Internal plugin record. Extends the YAML schema with fields populated at\n * runtime (`version` from the package string, `plugin_hash` for change\n * detection, `last_modified_level` to track include-file precedence).\n *\n * The field name `last_modified_level` matches the Python implementation so\n * the install hashes computed by `plugin-hash.ts` stay byte-compatible\n * across the Python ↔ TS migration. Renaming it would force every existing\n * dynamic-plugins-root to be re-installed on the first TS run.\n */\nexport type Plugin = PluginSpec & {\n  version?: string;\n  plugin_hash?: string;\n  last_modified_level?: number;\n};\n\nexport type PluginMap = Record<string, Plugin>;\n\nexport type DynamicPluginsConfig = {\n  includes?: string[];\n  plugins?: PluginSpec[];\n};\n\nexport const DOCKER_PROTO = 'docker://';\nexport const OCI_PROTO = 'oci://';\n/**\n * Tag suffix that, by convention, opts an OCI plugin into `pullPolicy: Always`\n * when no explicit policy is set — mirrors the Python script's behaviour and\n * keeps the two implementations swappable. Always parsed in combination with\n * the `!plugin-path` separator so a plugin tagged `:latest` (no plugin path)\n * does not accidentally trigger.\n */\nexport const LATEST_TAG_MARKER = ':latest!';\nexport const RHDH_REGISTRY = 'registry.access.redhat.com/rhdh/';\nexport const RHDH_FALLBACK = 'quay.io/rhdh/';\nexport const CONFIG_HASH_FILE = 'dynamic-plugin-config.hash';\nexport const IMAGE_HASH_FILE = 'dynamic-plugin-image.hash';\nexport const DPDY_FILENAME = 'dynamic-plugins.default.yaml';\nexport const LOCK_FILENAME = 'install-dynamic-plugins.lock';\nexport const GLOBAL_CONFIG_FILENAME = 'app-config.dynamic-plugins.yaml';\n\nconst DEFAULT_MAX_ENTRY_SIZE = 40_000_000;\n\n/**\n * Parse the MAX_ENTRY_SIZE env var, falling back to the default when unset,\n * non-numeric, or < 1. Exported for unit tests — the `MAX_ENTRY_SIZE` constant\n * below is the module-level value used by the extractors.\n */\nexport function parseMaxEntrySize(\n  raw: string | undefined = process.env.MAX_ENTRY_SIZE,\n): number {\n  if (!raw) return DEFAULT_MAX_ENTRY_SIZE;\n  const n = Number.parseInt(raw, 10);\n  return Number.isFinite(n) && n >= 1 ? n : DEFAULT_MAX_ENTRY_SIZE;\n}\n\nexport const MAX_ENTRY_SIZE = parseMaxEntrySize();\nexport const RECOGNIZED_ALGORITHMS = ['sha512', 'sha384', 'sha256'] as const;\nexport type Algorithm = (typeof RECOGNIZED_ALGORITHMS)[number];\n\n/**\n * Resolve the effective `pullPolicy` for an OCI plugin: an explicit policy\n * wins, otherwise the convention is `Always` for `:latest!` images and\n * `IfNotPresent` for everything else. Shared by the install pipeline and the\n * \"definitely no-op\" pre-pass so the `:latest!` semantics live in one place.\n */\nexport function effectivePullPolicy(plugin: {\n  pullPolicy?: PullPolicy;\n  package: string;\n}): PullPolicy {\n  if (plugin.pullPolicy) return plugin.pullPolicy;\n  return plugin.package.includes(LATEST_TAG_MARKER)\n    ? PullPolicy.ALWAYS\n    : PullPolicy.IF_NOT_PRESENT;\n}\n"],"names":[],"mappings":";;AAeO,MAAM,UAAA,GAAa;AAAA,EACxB,cAAA,EAAgB,cAAA;AAAA,EAChB,MAAA,EAAQ;AACV;AA4CO,MAAM,YAAA,GAAe;AACrB,MAAM,SAAA,GAAY;AAQlB,MAAM,iBAAA,GAAoB;AAC1B,MAAM,aAAA,GAAgB;AACtB,MAAM,aAAA,GAAgB;AACtB,MAAM,gBAAA,GAAmB;AACzB,MAAM,eAAA,GAAkB;AACxB,MAAM,aAAA,GAAgB;AACtB,MAAM,aAAA,GAAgB;AACtB,MAAM,sBAAA,GAAyB;AAEtC,MAAM,sBAAA,GAAyB,GAAA;AAOxB,SAAS,iBAAA,CACd,GAAA,GAA0B,OAAA,CAAQ,GAAA,CAAI,cAAA,EAC9B;AACR,EAAA,IAAI,CAAC,KAAK,OAAO,sBAAA;AACjB,EAAA,MAAM,CAAA,GAAI,MAAA,CAAO,QAAA,CAAS,GAAA,EAAK,EAAE,CAAA;AACjC,EAAA,OAAO,OAAO,QAAA,CAAS,CAAC,CAAA,IAAK,CAAA,IAAK,IAAI,CAAA,GAAI,sBAAA;AAC5C;AAEO,MAAM,iBAAiB,iBAAA;AACvB,MAAM,qBAAA,GAAwB,CAAC,QAAA,EAAU,QAAA,EAAU,QAAQ;AAS3D,SAAS,oBAAoB,MAAA,EAGrB;AACb,EAAA,IAAI,MAAA,CAAO,UAAA,EAAY,OAAO,MAAA,CAAO,UAAA;AACrC,EAAA,OAAO,OAAO,OAAA,CAAQ,QAAA,CAAS,iBAAiB,CAAA,GAC5C,UAAA,CAAW,SACX,UAAA,CAAW,cAAA;AACjB;;;;;;;;;;;;;;;;;;"}

package/dist/util.cjs.js

@@ -0,0 +1,56 @@
+'use strict';
+
+var fs = require('node:fs/promises');
+var path = require('node:path');
+
+function _interopNamespaceCompat(e) {
+  if (e && typeof e === 'object' && 'default' in e) return e;
+  var n = Object.create(null);
+  if (e) {
+    Object.keys(e).forEach(function (k) {
+      if (k !== 'default') {
+        var d = Object.getOwnPropertyDescriptor(e, k);
+        Object.defineProperty(n, k, d.get ? d : {
+          enumerable: true,
+          get: function () { return e[k]; }
+        });
+      }
+    });
+  }
+  n.default = e;
+  return Object.freeze(n);
+}
+
+var fs__namespace = /*#__PURE__*/_interopNamespaceCompat(fs);
+var path__namespace = /*#__PURE__*/_interopNamespaceCompat(path);
+
+async function fileExists(filePath) {
+  try {
+    await fs__namespace.access(filePath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function isInside(childAbs, parentAbs) {
+  const normalized = parentAbs.endsWith(path__namespace.sep) ? parentAbs : parentAbs + path__namespace.sep;
+  return childAbs === parentAbs || childAbs.startsWith(normalized);
+}
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isAllowedEntryType(type) {
+  return type === "File" || type === "Directory" || type === "SymbolicLink" || type === "Link" || type === "OldFile" || type === "ContiguousFile";
+}
+function markAsFresh(installed, pluginPath) {
+  for (const [k, v] of installed) {
+    if (v === pluginPath) installed.delete(k);
+  }
+}
+
+exports.fileExists = fileExists;
+exports.isAllowedEntryType = isAllowedEntryType;
+exports.isInside = isInside;
+exports.isPlainObject = isPlainObject;
+exports.markAsFresh = markAsFresh;
+//# sourceMappingURL=util.cjs.js.map

package/dist/util.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"util.cjs.js","sources":["../src/util.ts"],"sourcesContent":["/*\n * Copyright Red Hat, Inc.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport * as fs from 'node:fs/promises';\nimport * as path from 'node:path';\nimport type * as tar from 'tar';\n\n/** Returns true when the file/directory exists; swallows all other errors. */\nexport async function fileExists(filePath: string): Promise<boolean> {\n  try {\n    await fs.access(filePath);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\n/** True when `childAbs` resolves to `parentAbs` or a path under it. */\nexport function isInside(childAbs: string, parentAbs: string): boolean {\n  const normalized = parentAbs.endsWith(path.sep)\n    ? parentAbs\n    : parentAbs + path.sep;\n  return childAbs === parentAbs || childAbs.startsWith(normalized);\n}\n\n/** Plain JS object test — excludes arrays, null, class instances with custom prototype. */\nexport function isPlainObject(\n  value: unknown,\n): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\n/**\n * Allowed `tar` entry types: regular file kinds + directory + links. Anything\n * else (character/block devices, FIFOs, unknown) is rejected by the tar filters.\n */\nexport function isAllowedEntryType(type: tar.ReadEntry['type']): boolean {\n  return (\n    type === 'File' ||\n    type === 'Directory' ||\n    type === 'SymbolicLink' ||\n    type === 'Link' ||\n    type === 'OldFile' ||\n    type === 'ContiguousFile'\n  );\n}\n\n/**\n * Drop any entries from `installed` whose value (on-disk directory) matches\n * `pluginPath`. Called after a successful install so stale hash entries for\n * the same directory are not mistakenly removed by the cleanup phase.\n */\nexport function markAsFresh(\n  installed: Map<string, string>,\n  pluginPath: string,\n): void {\n  for (const [k, v] of installed) {\n    if (v === pluginPath) installed.delete(k);\n  }\n}\n"],"names":["fs","path"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAoBA,eAAsB,WAAW,QAAA,EAAoC;AACnE,EAAA,IAAI;AACF,IAAA,MAAMA,aAAA,CAAG,OAAO,QAAQ,CAAA;AACxB,IAAA,OAAO,IAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAGO,SAAS,QAAA,CAAS,UAAkB,SAAA,EAA4B;AACrE,EAAA,MAAM,UAAA,GAAa,UAAU,QAAA,CAASC,eAAA,CAAK,GAAG,CAAA,GAC1C,SAAA,GACA,YAAYA,eAAA,CAAK,GAAA;AACrB,EAAA,OAAO,QAAA,KAAa,SAAA,IAAa,QAAA,CAAS,UAAA,CAAW,UAAU,CAAA;AACjE;AAGO,SAAS,cACd,KAAA,EACkC;AAClC,EAAA,OAAO,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,CAAC,KAAA,CAAM,QAAQ,KAAK,CAAA;AAC5E;AAMO,SAAS,mBAAmB,IAAA,EAAsC;AACvE,EAAA,OACE,IAAA,KAAS,MAAA,IACT,IAAA,KAAS,WAAA,IACT,IAAA,KAAS,kBACT,IAAA,KAAS,MAAA,IACT,IAAA,KAAS,SAAA,IACT,IAAA,KAAS,gBAAA;AAEb;AAOO,SAAS,WAAA,CACd,WACA,UAAA,EACM;AACN,EAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,CAAA,IAAK,SAAA,EAAW;AAC9B,IAAA,IAAI,CAAA,KAAM,UAAA,EAAY,SAAA,CAAU,MAAA,CAAO,CAAC,CAAA;AAAA,EAC1C;AACF;;;;;;;;"}

package/dist/which.cjs.js

@@ -0,0 +1,45 @@
+'use strict';
+
+var node_fs = require('node:fs');
+var path = require('node:path');
+
+function _interopNamespaceCompat(e) {
+  if (e && typeof e === 'object' && 'default' in e) return e;
+  var n = Object.create(null);
+  if (e) {
+    Object.keys(e).forEach(function (k) {
+      if (k !== 'default') {
+        var d = Object.getOwnPropertyDescriptor(e, k);
+        Object.defineProperty(n, k, d.get ? d : {
+          enumerable: true,
+          get: function () { return e[k]; }
+        });
+      }
+    });
+  }
+  n.default = e;
+  return Object.freeze(n);
+}
+
+var path__namespace = /*#__PURE__*/_interopNamespaceCompat(path);
+
+function which(bin) {
+  const pathEnv = process.env.PATH ?? "";
+  const sep = process.platform === "win32" ? ";" : ":";
+  const exts = process.platform === "win32" ? (process.env.PATHEXT ?? ".EXE;.CMD;.BAT;.COM").split(";") : [""];
+  for (const dir of pathEnv.split(sep)) {
+    if (!dir) continue;
+    for (const ext of exts) {
+      const full = path__namespace.join(dir, bin + ext);
+      try {
+        node_fs.accessSync(full, node_fs.constants.X_OK);
+        return full;
+      } catch {
+      }
+    }
+  }
+  return null;
+}
+
+exports.which = which;
+//# sourceMappingURL=which.cjs.js.map

package/dist/which.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"which.cjs.js","sources":["../src/which.ts"],"sourcesContent":["/*\n * Copyright Red Hat, Inc.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport { accessSync, constants } from 'node:fs';\nimport * as path from 'node:path';\n\n/**\n * Minimal `which(1)` — returns the absolute path of `bin` if found on PATH\n * and executable, otherwise `null`. Avoids a dependency on the `which` npm package.\n */\nexport function which(bin: string): string | null {\n  const pathEnv = process.env.PATH ?? '';\n  const sep = process.platform === 'win32' ? ';' : ':';\n  const exts =\n    process.platform === 'win32'\n      ? (process.env.PATHEXT ?? '.EXE;.CMD;.BAT;.COM').split(';')\n      : [''];\n  for (const dir of pathEnv.split(sep)) {\n    if (!dir) continue;\n    for (const ext of exts) {\n      const full = path.join(dir, bin + ext);\n      try {\n        accessSync(full, constants.X_OK);\n        return full;\n      } catch {\n        /* next */\n      }\n    }\n  }\n  return null;\n}\n"],"names":["path","accessSync","constants"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAsBO,SAAS,MAAM,GAAA,EAA4B;AAChD,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,GAAA,CAAI,IAAA,IAAQ,EAAA;AACpC,EAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,QAAA,KAAa,OAAA,GAAU,GAAA,GAAM,GAAA;AACjD,EAAA,MAAM,IAAA,GACJ,OAAA,CAAQ,QAAA,KAAa,OAAA,GAAA,CAChB,OAAA,CAAQ,GAAA,CAAI,OAAA,IAAW,qBAAA,EAAuB,KAAA,CAAM,GAAG,CAAA,GACxD,CAAC,EAAE,CAAA;AACT,EAAA,KAAA,MAAW,GAAA,IAAO,OAAA,CAAQ,KAAA,CAAM,GAAG,CAAA,EAAG;AACpC,IAAA,IAAI,CAAC,GAAA,EAAK;AACV,IAAA,KAAA,MAAW,OAAO,IAAA,EAAM;AACtB,MAAA,MAAM,IAAA,GAAOA,eAAA,CAAK,IAAA,CAAK,GAAA,EAAK,MAAM,GAAG,CAAA;AACrC,MAAA,IAAI;AACF,QAAAC,kBAAA,CAAW,IAAA,EAAMC,kBAAU,IAAI,CAAA;AAC/B,QAAA,OAAO,IAAA;AAAA,MACT,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AACA,EAAA,OAAO,IAAA;AACT;;;;"}

package/package.json

@@ -0,0 +1,68 @@
+{
+  "name": "@red-hat-developer-hub/cli-module-install-dynamic-plugins",
+  "version": "0.2.0",
+  "description": "Backstage CLI module that installs RHDH dynamic plugins from a dynamic-plugins.yaml config (OCI, NPM, local).",
+  "license": "Apache-2.0",
+  "backstage": {
+    "role": "cli-module"
+  },
+  "homepage": "https://github.com/redhat-developer/rhdh-plugins/tree/main/workspaces/install-dynamic-plugins#readme",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/redhat-developer/rhdh-plugins",
+    "directory": "workspaces/install-dynamic-plugins/packages/install-dynamic-plugins"
+  },
+  "bugs": "https://github.com/redhat-developer/rhdh-plugins/issues",
+  "keywords": [
+    "rhdh",
+    "backstage",
+    "dynamic-plugins",
+    "cli",
+    "cli-module",
+    "init-container"
+  ],
+  "engines": {
+    "node": "22 || 24"
+  },
+  "main": "dist/index.cjs.js",
+  "types": "dist/index.d.ts",
+  "bin": "bin/install-dynamic-plugins",
+  "files": [
+    "bin",
+    "dist"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "main": "dist/index.cjs.js",
+    "types": "dist/index.d.ts"
+  },
+  "scripts": {
+    "build": "backstage-cli package build",
+    "clean": "backstage-cli package clean",
+    "lint": "backstage-cli package lint",
+    "prepack": "backstage-cli package prepack",
+    "postpack": "backstage-cli package postpack",
+    "test": "backstage-cli package test",
+    "tsc": "tsc"
+  },
+  "dependencies": {
+    "@backstage/cli-node": "^0.3.2",
+    "cleye": "^2.6.0",
+    "tar": "^7.5.13",
+    "yaml": "^2.8.2"
+  },
+  "devDependencies": {
+    "@backstage/cli": "^0.36.0",
+    "@types/jest": "^30.0.0",
+    "@types/node": "^22.10.0",
+    "@types/tar": "^6.1.13",
+    "typescript": "~5.8.0"
+  },
+  "typesVersions": {
+    "*": {
+      "package.json": [
+        "package.json"
+      ]
+    }
+  }
+}