@restforgejs/platform 4.2.8 → 4.3.2

package/scripts/generate-integrity-manifest.js

@@ -1,124 +0,0 @@
-/**
- * Generate Integrity Manifest - FIX-004
- *
- * Generate SHA-256 hashes untuk file critical sebagai bagian dari
- * code integrity verification system.
- *
- * File ini dipanggil saat build process untuk generate manifest yang
- * kemudian diverifikasi saat server startup.
- */
-
-const crypto = require('crypto');
-const fs = require('fs');
-const path = require('path');
-
-// ========================================
-// CRITICAL FILES (Protected Files)
-// ========================================
-
-/**
- * Daftar file yang harus di-protect dengan integrity verification.
- *
- * CRITICAL: File-file ini adalah target utama bypass attack.
- * Semua file di-hash SETELAH strip shebang line dan normalisasi line endings,
- * sehingga perubahan yang dilakukan npm saat install tidak mempengaruhi hash.
- */
-const CRITICAL_FILES = [
-  'server.js',
-  'src/utils/license-client.js',
-  'src/utils/trusted-keys.js',
-  'cli/consumer.js',
-  'src/utils/security-checks.js',
-  'scripts/verify-integrity.js'
-];
-
-// ========================================
-// HASH GENERATION
-// ========================================
-
-/**
- * Generate SHA-256 hash untuk single file
- *
- * PENTING: Line endings dinormalisasi ke LF sebelum hashing untuk
- * memastikan hash konsisten di semua platform. Shebang line (#!/usr/bin/env node)
- * juga di-strip sebelum hashing karena npm dapat memodifikasi shebang
- * pada bin entry files saat install di Windows.
- *
- * @param {string} filePath - Absolute path ke file
- * @returns {string} SHA-256 hash (hex format)
- */
-function generateHash(filePath) {
-  // Baca sebagai text dan normalize line endings ke LF
-  const content = fs.readFileSync(filePath, 'utf8');
-  let normalized = content.replace(/\r\n/g, '\n').replace(/\r/g, '\n');
-
-  // Strip shebang line jika ada — npm dapat memodifikasi shebang saat install
-  // sehingga hash harus dihitung TANPA shebang agar konsisten lintas platform
-  if (normalized.startsWith('#!')) {
-    const firstNewline = normalized.indexOf('\n');
-    if (firstNewline !== -1) {
-      normalized = normalized.substring(firstNewline + 1);
-    }
-  }
-
-  return crypto.createHash('sha256').update(normalized, 'utf8').digest('hex');
-}
-
-// ========================================
-// MANIFEST GENERATION
-// ========================================
-
-/**
- * Generate integrity manifest untuk semua critical files
- *
- * @param {string} baseDir - Base directory (biasanya DIST_DIR)
- * @returns {object} Manifest object dengan file hashes
- */
-function generateManifest(baseDir) {
-  const packageJson = require(path.join(baseDir, 'package.json'));
-
-  const manifest = {
-    version: packageJson.version,
-    generated: new Date().toISOString(),
-    generator: 'restforge-build-system',
-    algorithm: 'sha256',
-    files: {}
-  };
-
-  let protectedCount = 0;
-  let missingCount = 0;
-
-  for (const file of CRITICAL_FILES) {
-    const fullPath = path.join(baseDir, file);
-
-    if (fs.existsSync(fullPath)) {
-      manifest.files[file] = generateHash(fullPath);
-      protectedCount++;
-    } else {
-      console.warn(`[Integrity] Warning: Critical file not found: ${file}`);
-      missingCount++;
-    }
-  }
-
-  // Metadata
-  manifest.stats = {
-    totalFiles: CRITICAL_FILES.length,
-    protectedFiles: protectedCount,
-    missingFiles: missingCount
-  };
-
-  return manifest;
-}
-
-// ========================================
-// EXPORT
-// ========================================
-
-module.exports = {
-  generateManifest,
-  generateHash,
-  CRITICAL_FILES
-};
-
-// CLI USAGE dihapus dari distribusi.
-// Manifest hanya bisa di-generate melalui build system internal.

package/scripts/snapshot-cli-contracts.js

@@ -1,194 +0,0 @@
-#!/usr/bin/env node
-'use strict';
-
-// Suppress dev-mode noise dari modul seperti config-reader yang print
-// "Working directory" / "Is Bun" ke stderr saat NODE_ENV !== 'production'.
-// Snapshot tool tujuannya capture state, bukan run dev tooling.
-process.env.NODE_ENV = 'production';
-
-/**
- * Snapshot CLI Contracts
- *
- * Scan seluruh contract di generators/cli/**, extract flag definitions per
- * command, lalu tulis hasil ke tests/snapshots/cli-contracts.json.
- *
- * Fungsi: catch regression saat inline migration v4.0.0. Bila inline tidak
- * sengaja menghilangkan / mengubah flag definition, diff snapshot akan
- * gagal di test contract-snapshot.test.js.
- *
- * Usage:
- *   node scripts/snapshot-cli-contracts.js          # generate / overwrite
- *   node scripts/snapshot-cli-contracts.js --check  # bandingkan dengan file existing, exit 1 jika beda
- *
- * Output JSON shape:
- *   {
- *     "meta": { "version": "<pkg version>", "generated": "<iso>" },
- *     "contracts": {
- *       "<resource>/<verb>": { resource, verb, category, flags, positional },
- *       "<global-verb>":     { resource: null, verb, category, flags, positional }
- *     }
- *   }
- */
-
-const fs = require('node:fs');
-const path = require('node:path');
-const { discoverCommands, loadCommand } = require('../generators/lib/command-discovery');
-
-const ROOT = path.resolve(__dirname, '..');
-const CLI_DIR = path.join(ROOT, 'generators', 'cli');
-const SNAPSHOT_PATH = path.join(ROOT, 'tests', 'snapshots', 'cli-contracts.json');
-const PKG_PATH = path.join(ROOT, 'package.json');
-
-function loadPackageVersion() {
-    try {
-        const pkg = JSON.parse(fs.readFileSync(PKG_PATH, 'utf8'));
-        return pkg.version || 'unknown';
-    } catch (_err) {
-        return 'unknown';
-    }
-}
-
-function normalizeFlag(flagDef) {
-    const out = {
-        type: flagDef.type,
-        required: flagDef.required,
-        description: flagDef.description
-    };
-    if (Object.prototype.hasOwnProperty.call(flagDef, 'default')) {
-        out.default = flagDef.default;
-    }
-    return out;
-}
-
-function normalizePositional(posDef) {
-    return {
-        name: posDef.name,
-        type: posDef.type,
-        required: posDef.required,
-        description: posDef.description
-    };
-}
-
-function buildEntry(contract) {
-    const entry = {
-        resource: contract.resource || null,
-        verb: contract.verb,
-        category: contract.category,
-        flags: {}
-    };
-
-    const flagNames = Object.keys(contract.flags || {}).sort();
-    for (const name of flagNames) {
-        entry.flags[name] = normalizeFlag(contract.flags[name]);
-    }
-
-    if (Array.isArray(contract.positional) && contract.positional.length > 0) {
-        entry.positional = contract.positional.map(normalizePositional);
-    }
-
-    return entry;
-}
-
-function collectContracts() {
-    const manifest = discoverCommands(CLI_DIR);
-    const contracts = {};
-    const keys = [];
-
-    if (manifest.resources) {
-        for (const resource of Object.keys(manifest.resources)) {
-            for (const verb of Object.keys(manifest.resources[resource])) {
-                const filePath = manifest.resources[resource][verb];
-                const contract = loadCommand(filePath);
-                const key = `${resource}/${verb}`;
-                contracts[key] = buildEntry(contract);
-                keys.push(key);
-            }
-        }
-    }
-
-    if (manifest.globalVerbs) {
-        for (const verb of Object.keys(manifest.globalVerbs)) {
-            const filePath = manifest.globalVerbs[verb];
-            const contract = loadCommand(filePath);
-            contracts[verb] = buildEntry(contract);
-            keys.push(verb);
-        }
-    }
-
-    keys.sort();
-    const sorted = {};
-    for (const k of keys) sorted[k] = contracts[k];
-    return sorted;
-}
-
-function buildSnapshot() {
-    return {
-        meta: {
-            version: loadPackageVersion(),
-            generated: new Date().toISOString()
-        },
-        contracts: collectContracts()
-    };
-}
-
-function writeSnapshot(snapshot) {
-    fs.mkdirSync(path.dirname(SNAPSHOT_PATH), { recursive: true });
-    fs.writeFileSync(SNAPSHOT_PATH, JSON.stringify(snapshot, null, 2) + '\n', 'utf8');
-}
-
-function readExistingSnapshot() {
-    if (!fs.existsSync(SNAPSHOT_PATH)) return null;
-    try {
-        return JSON.parse(fs.readFileSync(SNAPSHOT_PATH, 'utf8'));
-    } catch (_err) {
-        return null;
-    }
-}
-
-function main() {
-    const argv = process.argv.slice(2);
-    const isCheck = argv.includes('--check');
-
-    const snapshot = buildSnapshot();
-
-    if (isCheck) {
-        const existing = readExistingSnapshot();
-        if (!existing) {
-            console.error(`Snapshot file not found: ${SNAPSHOT_PATH}`);
-            process.exit(1);
-        }
-        const existingContracts = JSON.stringify(existing.contracts, null, 2);
-        const currentContracts = JSON.stringify(snapshot.contracts, null, 2);
-        if (existingContracts !== currentContracts) {
-            console.error('Snapshot drift detected.');
-            console.error(`Run: node scripts/snapshot-cli-contracts.js`);
-            process.exit(1);
-        }
-        console.log(`Snapshot OK — ${Object.keys(snapshot.contracts).length} contract(s)`);
-        return;
-    }
-
-    writeSnapshot(snapshot);
-    const count = Object.keys(snapshot.contracts).length;
-    console.log(`Snapshot written: ${SNAPSHOT_PATH}`);
-    console.log(`Contracts captured: ${count}`);
-    console.log(`Version: ${snapshot.meta.version}`);
-}
-
-if (require.main === module) {
-    try {
-        main();
-    } catch (err) {
-        console.error(`Fatal: ${err && err.message ? err.message : String(err)}`);
-        if (process.env.DEBUG && err && err.stack) {
-            console.error(err.stack);
-        }
-        process.exit(1);
-    }
-}
-
-module.exports = {
-    buildSnapshot,
-    collectContracts,
-    SNAPSHOT_PATH
-};

package/scripts/verify-publish.js

@@ -1,56 +0,0 @@
-#!/usr/bin/env node
-
-/**
- * Pre-publish safety check.
- * Memastikan npm publish hanya dijalankan dari DIST directory (bukan source).
- *
- * Validasi:
- * 1. build-info.json harus ada dan memiliki field `version`
- * 2. File development (CLAUDE.md, build-npm.js, tests/) TIDAK boleh ada
- */
-
-const fs = require('fs');
-const path = require('path');
-
-const ROOT = path.resolve(__dirname, '..');
-
-// === Check 1: build-info.json ===
-const buildInfoPath = path.join(ROOT, 'build-info.json');
-if (!fs.existsSync(buildInfoPath)) {
-  console.error('[BLOCKED] build-info.json not found.');
-  console.error('          Publish is only allowed from DIST directory, not from source.');
-  process.exit(1);
-}
-
-try {
-  const buildInfo = JSON.parse(fs.readFileSync(buildInfoPath, 'utf8'));
-  if (!buildInfo.version) {
-    console.error('[BLOCKED] build-info.json is not valid (field "version" is empty).');
-    process.exit(1);
-  }
-} catch (e) {
-  console.error('[BLOCKED] build-info.json cannot be read: ' + e.message);
-  process.exit(1);
-}
-
-// === Check 2: File development tidak boleh ada ===
-const forbidden = [
-  'CLAUDE.md',
-  'build-npm.js',
-  'build-final.bat',
-  'build-test.bat',
-  'obfuscator-strong.json',
-  'obfuscator-moderate.json',
-  'tests',
-];
-
-const found = forbidden.filter(f => fs.existsSync(path.join(ROOT, f)));
-if (found.length > 0) {
-  console.error('[BLOCKED] Development files found in publish directory:');
-  found.forEach(f => console.error('          - ' + f));
-  console.error('          Publish is only allowed from DIST directory, not from source.');
-  process.exit(1);
-}
-
-// === All checks passed ===
-console.log('[OK] Publish safety check passed.');