Description

Adds a new cloudsmith metadata command group for managing metadata entries attached to packages.

The command group supports:

• cloudsmith metadata list / ls to list metadata for a package, with optional
  --source-kind and --classification filters.
• cloudsmith metadata list OWNER/REPO/PACKAGE METADATA_SLUG_PERM to retrieve a
  single metadata entry.
• cloudsmith metadata add to attach metadata from inline JSON, a JSON file, or
  stdin.
• cloudsmith metadata update to patch metadata content and/or source identity.
• cloudsmith metadata remove / rm to delete metadata, guarded by the standard
  destructive action confirmation flow and -y/--yes.

Example: list metadata for a package

cloudsmith metadata list your-org/awesome-repo/better-pkg

Example response:

Listing metadata for the 'better-pkg' package ... OK

Slug       | Content Type                            | Classification | Source Kind | Source Identity
abc123     | application/json                        | generic        | customer    | cloudsmith-cli@1.16.0
sbom456    | application/vnd.cyclonedx+json           | sbom           | customer    | ci:sbom

Results: 2 metadata entries visible

Example: add inline metadata

cloudsmith metadata add your-org/awesome-repo/better-pkg \
  --content-type application/json \
  --source-identity ci:release-42 \
  --content '{"release":"2026.05","commit":"abc123"}'

Example response:

Attaching metadata to the 'better-pkg' package ... OK

Slug       | Content Type     | Classification | Source Kind | Source Identity
meta789    | application/json | generic        | customer    | ci:release-42

Content:
{
  "commit": "abc123",
  "release": "2026.05"
}

Example: add build-info or SBOM metadata from a file

cloudsmith metadata add your-org/awesome-repo/better-pkg \
  --content-type application/vnd.jfrog.buildinfo+json \
  --source-identity ci:build-info \
  --file buildinfo.json

cloudsmith metadata add your-org/awesome-repo/better-pkg \
  --content-type application/vnd.cyclonedx+json \
  --source-identity ci:sbom \
  --file sbom.json

Example: invalid JSON returns a usage error before calling the API

cloudsmith metadata add your-org/awesome-repo/better-pkg \
  --content-type application/json \
  --content '{not json'

Example response:

Error: Invalid JSON in --content: Expecting property name enclosed in double quotes: line 1 column 2 (char 1)

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Refactoring
• Other (please describe)

Additional Notes

CLI tests cover help text, list pagination and filters, JSON output, single-entry retrieval, inline/file/stdin content loading, invalid JSON handling, update argument validation, and remove confirmation behavior.

Local checks and testing completed.