capsium 0.1.2 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e2b954beb33b36d3300f8ff418f643a9afbbf688fad4e8333b195ccb76b38b41
-  data.tar.gz: b2ef9e049b70ce3eb111ef0c136befaaf7a2f6a4d233ed9fb41a9d27d9c39e2c
+  metadata.gz: 9746224c88e5a4a3b2aabe9609af2348235d6efe09dcd37fa71c710f08594829
+  data.tar.gz: fcbf1c6857f12bede912bb25d32dc83ddb84cd97757425dcf642af9e785e9478
 SHA512:
-  metadata.gz: e3c75b5ab47ef3b7fe5a8f20571a300c15b960951c032d9c8d01e3eff295a237c294288613449ed090c73e38df718986f412573deeafd0f33acd7a43ead76c41
-  data.tar.gz: 8bdb432b2b7efb4987d211608e8cb13828e2bf49d49cf921c3d9a7f7cc74f5a775ed6454e5bfd3e91a539a36fa0beb28395ff7910682d9d791f8c44db3eebe26
+  metadata.gz: fce42689914eda35768a2dfa4dfa74b5c00e8b760ddb50cb6b44b810a20b1423e0a31392eaefff1270408c6ed83d4b56c10a895a54f609ff71afd117b6950194
+  data.tar.gz: a45f5ea52966810c8ab183f0ec3407287eb7c87b34f82555242372d08b944edea2c372fdabe836f5e8ef0ff7ee793bed10fcc0a6ca21e486acd2466f7fbb1b93

data/.gitignore

@@ -6,6 +6,7 @@
 /pkg/
 /spec/reports/
 /tmp/
+/Gemfile.lock
 
 # rspec failure tracking
 .rspec_status

data/.rubocop.yml

@@ -1,12 +1,39 @@
-inherit_from:
-  - https://raw.githubusercontent.com/riboseinc/oss-guides/master/ci/rubocop.yml
-
-# local repo-specific modifications
-# ...
+plugins:
+  - rubocop-performance
 
 AllCops:
-  TargetRubyVersion: 2.6
+  TargetRubyVersion: 3.2
   NewCops: enable
+  SuggestExtensions: false
   Exclude:
-    - 'lib/sts/mapper.rb'
     - 'vendor/**/*'
+
+Layout/LineLength:
+  Max: 100
+
+# Project convention: double-quoted string literals.
+Style/StringLiterals:
+  EnforcedStyle: double_quotes
+
+# Classes are intentionally undocumented for now; API docs land with a
+# later phase together with the RBS signatures.
+Style/Documentation:
+  Enabled: false
+
+# RSpec example groups and the gemspec are block-heavy by nature.
+Metrics/BlockLength:
+  Exclude:
+    - 'spec/**/*'
+    - 'capsium.gemspec'
+
+Metrics/ClassLength:
+  Max: 120
+
+Metrics/MethodLength:
+  Max: 25
+
+Metrics/AbcSize:
+  Max: 30
+
+Metrics/CyclomaticComplexity:
+  Max: 8

data/CHANGELOG.md

@@ -0,0 +1,58 @@
+# Changelog
+
+## 0.2.0
+
+### Changed
+
+- Migrated all package configuration models from shale to lutaml-model.
+- All configuration files now follow the canonical schemas
+  (ARCHITECTURE.md sections 2-6):
+  - `metadata.json`: `dependencies` is an object of `guid -> semver range`;
+    `name`/`version`/`description`/`guid`/`uuid` are the required fields.
+  - `manifest.json`: a `resources` object keyed by package-relative path
+    (`type`, `visibility`, optional `version`).
+  - `routes.json`: optional top-level `index` plus a `routes` array with
+    discriminated kinds (`resource` / `dataset` / handler).
+  - `storage.json`: `storage.dataSets` object; dataset `source` and
+    `schemaFile` are package-relative paths.
+- Legacy (pre-0.2) configuration files are accepted on read and normalized
+  to the canonical forms; writers emit only the canonical forms.
+- Manifest and routes auto-generation is deterministic (sorted); HTML files
+  get dual routes, the index HTML gets `/`, datasets get
+  `/api/v1/data/<id>`.
+- The reactor serves dataset routes as JSON, sets `Cache-Control: public,
+  max-age=31536000` on static resources (configurable), responds 501 to
+  handler routes, and rejects packages that fail integrity verification.
+- The CLI exits nonzero on errors.
+
+### Added
+
+- `security.json` with SHA-256 checksums over every package file, generated
+  at pack time; verified automatically on load (`Package#verify_integrity`,
+  `Capsium::Package::Security::IntegrityError` on mismatch).
+- `capsium package validate <path|cap>`: per-check validation report
+  (metadata formats, on-disk existence of manifest resources, route targets
+  and dataset sources, dataset JSON-schema validation, checksums, external
+  http(s) references in content), exit status 1 on any failure.
+- `capsium package unpack <cap> [-o dir]`.
+- `Capsium::Package::Validator` and `Capsium::Package::Security`.
+- Reactor introspection HTTP API (ARCHITECTURE.md section 7):
+  `GET /api/v1/introspect/metadata`, `/routes`, `/content-hashes` and
+  `/content-validity`, served as JSON by `Capsium::Reactor::Introspection`.
+  `content-hashes` is the SHA-256 of the `.cap` blob, or of the canonical
+  JSON serialization of the content checksums for directory sources;
+  `content-validity` re-verifies integrity live.
+- Zip-slip protection on `.cap` extraction: entries escaping the
+  destination (absolute paths, drive letters, `..` segments) raise
+  `Capsium::Packager::UnsafeEntryError`.
+- RBS signatures for the public API (`sig/`), kept green by the
+  `rbs:validate` rake task (part of the default rake task).
+- `Capsium::Package#cap_file_path`.
+
+### Removed
+
+- `Capsium::Protector` (bit-rotted, insecure; encryption/signing is
+  deferred to a later phase).
+- shale dependency (replaced by lutaml-model); base64 dependency.
+- Unused constants `Package::PACKAGING_FILE`, `Package::SIGNATURE_FILE`,
+  `Package::ENCRYPTED_PACKAGING_FILE`, `Routes::DEFAULT_INDEX_TARGET`.

data/Gemfile

@@ -4,3 +4,9 @@ source "https://rubygems.org"
 
 # Specify your gem's dependencies in capsium.gemspec
 gemspec
+
+gem "rake", "~> 13.0"
+gem "rbs", "~> 4.0"
+gem "rspec", "~> 3.11"
+gem "rubocop", "~> 1.88"
+gem "rubocop-performance", "~> 1.26"

data/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024 Ribose Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/README.adoc

@@ -9,27 +9,14 @@ content packages with ease.
 This gem provides a structured way to handle content, data, and metadata for
 various applications.
 
-
-== Testing out how it works
-
-Download the mn-samples-iso built site: https://github.com/metanorma/mn-samples-iso/actions/runs/8862815829/artifacts/1453746303[mn-samples-iso-Linux].
-
-Then run these commands:
+== Test it out!
 
 [source,bash]
 ----
-$ unzip mn-samples-iso-Linux.zip
-$ cd mn-samples-iso-Linux
-$ mkdir content
-$ mv index.html documents.xml documents content
-$ echo '{"name": "mn-samples-iso","version":"0.1.0"}' > metadata.json
-$ cd ..
-$ bundle exec capsium package pack -f mn-samples-iso-Linux
-Package created: mn-samples-iso-0.1.0.cap
-$ bundle exec capsium reactor serve mn-samples-iso-0.1.0.cap
-Starting server on http://localhost:8864
-[2024-06-05 14:56:41] INFO  WEBrick::HTTPServer#start: pid=8234 port=8864
-...
+$ wget https://github.com/capsiums/cap-story/releases/download/v0.9.0/story_of_claire-0.9.0.cap
+$ capsium reactor serve story_of_claire-0.9.0.cap
+$ open http://localhost:8864
+# => Read the story!
 ----
 
 == Installation
@@ -57,184 +44,231 @@ gem install capsium
 
 == What is a Capsium package?
 
-A Capsium package is a structured collection of content, data, metadata, and routing information. It is designed to encapsulate all resources needed for a particular application or service in a well-organized format. A package typically includes:
+A Capsium package is a structured collection of content, data, metadata, and
+routing information, distributed as a single `.cap` file (a ZIP archive, MIME
+`application/vnd.capsium.package`). The canonical layout:
 
-* **Content**: Static files like HTML, CSS, and JavaScript.
-* **Data**: Structured data files, such as YAML or JSON.
-* **Metadata**: Descriptive information about the package, such as its name, version, and dependencies.
-* **Routes**: Mapping of URLs to content or data endpoints.
-* **Storage**: Definitions for datasets and their sources, formats, and schemas.
+[source]
+----
+metadata.json     # REQUIRED, hand-authored
+manifest.json     # auto-generated at load/pack time when absent
+routes.json       # auto-generated when absent
+storage.json      # optional (only when datasets exist)
+security.json     # generated at pack time (SHA-256 checksums)
+content/          # served content root (URL space mirrors paths below it)
+data/             # datasets (optional)
+----
+
+Paths inside the configuration files are package-relative POSIX paths.
+
+* **metadata.json**: name (kebab-case), version (semver), description, guid
+  (URI) and uuid are required; author, license, repository, dependencies
+  (an object of `guid -> semver range`) are optional.
+* **manifest.json**: an object keyed by package-relative resource path, e.g.
+  `"content/index.html": { "type": "text/html", "visibility": "exported" }`.
+  Generated by scanning `content/` (MIME types via marcel) when absent.
+* **routes.json**: an optional top-level `index` plus a `routes` array. Route
+  kinds: `{path, resource}` for static files, `{path, dataset}` for datasets
+  (served under `/api/v1/data/<id>`). HTML files get two routes (basename and
+  full filename); the index HTML additionally gets `/`.
+* **storage.json**: dataset definitions under `storage.dataSets`, either
+  schema-backed files (`source`, `schemaFile`, `schemaType: json-schema`)
+  or SQLite (`databaseFile`, `table`).
+* **security.json**: `security.integrityChecks.checksums` holds a SHA-256 hex
+  digest for every file in the package except `security.json` itself.
+
+Legacy (pre-0.2) configuration files are still accepted on read and
+normalized to the canonical forms; writers emit only the canonical forms.
 
 == What is a Capsium reactor?
 
-A Capsium reactor is a runtime environment that serves Capsium packages. It reads the package configuration and starts a server that can handle HTTP requests according to the routes defined in the package. The reactor ensures that the content and data within the package are served correctly, allowing for easy integration and deployment of packaged applications.
+A Capsium reactor is a runtime environment that serves Capsium packages. It
+reads the package configuration and starts a server that can handle HTTP
+requests according to the routes defined in the package. The reactor verifies
+the package against `security.json` when present and rejects tampered
+packages. Dataset routes are served as JSON; static resources are served with
+`Cache-Control: public, max-age=31536000` (configurable). While serving, the
+reactor also answers the introspection endpoints described below.
 
 == CLI: Package
 
-To pack a package, you need to define the content, data, metadata, routes, and storage configurations. Once defined, you can use the Capsium command-line interface (CLI) to create and manage your packages.
+Capsium provides a CLI to help you pack and manage your packages.
 
-Capsium provides a CLI to help you pack and manage your packages. Here are some common commands:
+=== Packing a package
 
 [source,bash]
 ----
-# TODO: Create a new package
-# Full command
-capsium package new my_package
-# Shorthand
-capsium package my_package
-
-# TODO: Add content to the package
-capsium package add content example.html example.css example.js
+capsium package pack [--force/-f] path-to-package
+----
 
-# TODO: Add data to the package
-capsium package add data animals.yaml
+This command generates `manifest.json`/`routes.json` when absent, writes
+`security.json` with SHA-256 checksums of every package file, and packs the
+directory into `{package-name}-{package-version}.cap` (name and version from
+`metadata.json`).
 
-# TODO: Add metadata to the package
-capsium package add metadata name=sample_package version=0.1.0
+.Sample `pack` command
+====
+[source,bash]
+----
+capsium package pack -f spec/fixtures/bare-package
+----
+====
 
-# TODO: Define routes for the package
-capsium package add route /=example.html /index=index.html /api/v1/data/animals={type:dataset,name:animals}
+=== Unpacking a package
 
-# TODO: Define storage for the package
-capsium package add storage datasets=[{name:animals,source:data/animals.yaml,format:yaml,schema:data/animals_schema.yaml}]
+[source,bash]
+----
+capsium package unpack bare-package-0.1.0.cap [-o/--output my_bare_package]
 ----
 
-=== Packing a package
+When `-o` is omitted, the package is unpacked into a directory named after
+the `.cap` file.
 
-To pack an existing Capsium package directory, use the following command:
+Extraction is zip-slip safe: entries whose names would escape the
+destination (absolute paths, drive letters, `..` segments) are rejected
+with `Capsium::Packager::UnsafeEntryError`.
+
+=== Validating a package
 
 [source,bash]
 ----
-capsium package pack [--force/-f] path-to-package
+capsium package validate path-to-package-or-cap
 ----
 
-This command will pack your package into a single file with the
-filename:
+Runs a per-check report and exits with status 1 on any failure:
 
-* `{package-name}-{package-version}.cap`
-* where the name and version both come from `{package-path}/metadata.json`
+* metadata: required fields present and well-formed (kebab-case name, semver
+  version, URI guid, UUID)
+* manifest: every resource exists on disk
+* routes: route targets exist; dataset routes live under `/api/v1/data/`;
+  the index resolves to an existing HTML file
+* storage: dataset sources (and schemas) exist; dataset data passes
+  JSON-schema validation
+* security: checksums match when `security.json` is present
+* content: no external `http(s)` references in `content/` files
+
+=== Inspecting a package
 
-.Sample `pack` command
-====
 [source,bash]
 ----
-capsium package pack -f spec/fixtures/bare_package
+capsium package info|manifest|routes|metadata|storage path-to-package
 ----
-====
-
-
 
 == CLI: Reactor
 
 === Starting a reactor on your package
 
-To start a Capsium reactor on your package, use the following command:
-
 [source,bash]
 ----
-capsium reactor serve my_package.cap
+capsium reactor serve my_package.cap [--port 8864]
 ----
 
+The reactor takes a local package directory or `.cap` file; serving
+directly from a URL is not supported.
+
+=== Reactor introspection API
+
+While serving, the reactor answers the Monitoring HTTP API
+(ARCHITECTURE.md section 7) as `application/json`:
+
+[source]
+----
+GET /api/v1/introspect/metadata         # => {"packages": [{"name", "version", "author", "description"}]}
+GET /api/v1/introspect/routes           # => {"routes": [{"package", "routes": [{"method", "path"}]}]}
+GET /api/v1/introspect/content-hashes   # => {"contentHashes": [{"package", "hash"}]}
+GET /api/v1/introspect/content-validity # => {"contentValidity": [{"package", "valid", "lastChecked", "reason"?}]}
+----
+
+Non-GET methods on these paths are answered `405 Method Not Allowed`.
+
+`content-hashes` is the SHA-256 of the `.cap` blob when the package was
+served from one. For a directory source there is no blob, so the hash
+covers the canonical (sorted-key) JSON serialization of the package
+content checksums — the same data `security.json` integrityChecks carry.
+
+`content-validity` re-verifies the package against `security.json` on
+every request and reports the outcome with a UTC `lastChecked`
+timestamp; `reason` lists the integrity errors when `valid` is false.
 
 == Programmatically managing packages
 
-You can also create, load, and use packages programmatically within your Ruby application.
+The public API below ships with RBS signatures in `sig/`
+(`bundle exec rbs -I sig validate`).
 
-=== Creating packages
+=== Loading packages
 
 [source,ruby]
 ----
 require 'capsium'
 
-package = Capsium::Package.new(
-  name: 'sample_package',
-  version: '0.1.0',
-  content: {
-    'example.html' => 'text/html',
-    'example.css' => 'text/css',
-    'example.js' => 'application/javascript'
-  },
-  data: {
-    'animals.yaml' => {
-      'animals' => [
-        { 'name' => 'Lion', 'type' => 'Mammal', 'habitat' => 'Savannah' },
-        { 'name' => 'Eagle', 'type' => 'Bird', 'habitat' => 'Mountains' },
-        { 'name' => 'Shark', 'type' => 'Fish', 'habitat' => 'Ocean' }
-      ]
-    }
-  },
-  metadata: {
-    'name' => 'sample_package',
-    'version' => '0.1.0',
-    'dependencies' => []
-  },
-  routes: {
-    '/' => 'example.html',
-    '/index' => 'index.html',
-    '/index.html' => 'index.html',
-    '/example.css' => 'example.css',
-    '/example.js' => 'example.js',
-    '/api/v1/data/animals' => { 'type' => 'dataset', 'name' => 'animals' }
-  },
-  storage: {
-    'datasets' => [
-      {
-        'name' => 'animals',
-        'source' => 'data/animals.yaml',
-        'format' => 'yaml',
-        'schema' => 'data/animals_schema.yaml'
-      }
-    ]
-  }
-)
-
-# Save the package to a file
-File.write('my_package.json', package.to_json(pretty: true))
+# Read a package directory or a .cap file
+package = Capsium::Package.new(path)
 ----
 
-=== Loading packages
+When `security.json` is present, the package is verified on load and
+`Capsium::Package::Security::IntegrityError` is raised on mismatch.
 
-To load an existing package from a JSON file, you can use the `Capsium::Package.new(path)` method:
+=== Using packages in your program
 
 [source,ruby]
 ----
-require 'capsium'
+# Accessing package metadata
+puts "Package Name: #{package.metadata.name}"
+puts "Package Version: #{package.metadata.version}"
 
-# Read the package file or folder
-package = Capsium::Package.new(path)
+# Accessing manifest resources
+package.manifest.resources.each do |path, resource|
+  puts "Resource: #{path}, Type: #{resource.type}"
+end
 
-# Inspect the loaded package
-puts package.inspect
-----
+# Accessing routes
+route = package.routes.resolve('/')
+puts route.resource
 
-=== Using packages in your program
+# Accessing datasets
+animals = package.storage.dataset('animals')
+puts animals.data.inspect
+
+# Verifying integrity (returns a list of typed errors, empty when valid)
+errors = package.verify_integrity
+----
 
-Once you have created or loaded a package, you can use it within your Ruby application to access its content, data, and other properties.
+=== Packing and unpacking programmatically
 
 [source,ruby]
 ----
-# Accessing package metadata
-puts "Package Name: #{package.metadata['name']}"
-puts "Package Version: #{package.metadata['version']}"
+packager = Capsium::Packager.new
+cap_file = packager.pack(package, force: true)
+packager.unpack(cap_file, 'output-directory')
+----
 
-# Accessing content
-package.content.each do |filename, content_type|
-  puts "Content File: #{filename}, Content Type: #{content_type}"
-end
+== Building the mn-samples-iso cap package
 
-# Accessing data
-animals_data = package.data['animals.yaml']
-puts "Animals Data: #{animals_data.inspect}"
+Download the mn-samples-iso built site: https://github.com/metanorma/mn-samples-iso/actions/runs/8862815829/artifacts/1453746303[mn-samples-iso-Linux].
 
-# Accessing routes
-package.routes.each do |route, destination|
-  puts "Route: #{route}, Destination: #{destination}"
-end
+Then run these commands:
 
-# Accessing storage definitions
-package.storage['datasets'].each do |dataset|
-  puts "Dataset Name: #{dataset['name']}, Source: #{dataset['source']}, Format: #{dataset['format']}"
-end
+[source,bash]
+----
+$ unzip mn-samples-iso-Linux.zip
+$ cd mn-samples-iso-Linux
+$ mkdir content
+$ mv index.html documents.xml documents content
+$ cat > metadata.json <<'JSON'
+{
+  "name": "mn-samples-iso",
+  "version": "0.1.0",
+  "description": "Metanorma ISO sample documents",
+  "guid": "https://github.com/metanorma/mn-samples-iso",
+  "uuid": "123e4567-e89b-12d3-a456-426614174000"
+}
+JSON
+$ cd ..
+$ bundle exec capsium package pack -f mn-samples-iso-Linux
+Package created: mn-samples-iso-0.1.0.cap
+$ bundle exec capsium reactor serve mn-samples-iso-0.1.0.cap
+Starting server on http://localhost:8864
+...
 ----
 
 == Contributing
@@ -247,7 +281,16 @@ To run the tests, use the following command:
 
 [source,bash]
 ----
-rspec
+bundle exec rspec
+----
+
+The linter and the RBS signature validation are part of the default rake
+task (`bundle exec rake`), or run them individually:
+
+[source,bash]
+----
+bundle exec rubocop
+bundle exec rbs -I sig validate
 ----
 
 == License
@@ -255,4 +298,3 @@ rspec
 Copyright Ribose.
 
 Capsium is released under the MIT License. See the LICENSE file for more details.
-

data/Rakefile

@@ -9,4 +9,11 @@ require "rubocop/rake_task"
 
 RuboCop::RakeTask.new
 
-task default: %i[spec rubocop]
+namespace :rbs do
+  desc "Validate the RBS signatures (sig/)"
+  task :validate do
+    sh "bundle exec rbs -I sig validate"
+  end
+end
+
+task default: %i[spec rubocop rbs:validate]

data/bin/console

@@ -2,7 +2,7 @@
 # frozen_string_literal: true
 
 require "bundler/setup"
-require "capsium"
+require File.expand_path("../lib/capsium", __dir__)
 
 # You can add fixtures and/or initialization code here to make experimenting
 # with your gem easier. You can also use a different console, if you like.

data/capsium.gemspec

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require_relative "lib/capsium/version"
+require File.expand_path("lib/capsium/version", __dir__)
 
 Gem::Specification.new do |spec|
   spec.name = "capsium"
@@ -8,14 +8,19 @@ Gem::Specification.new do |spec|
   spec.authors = ["Ribose Inc."]
   spec.email = ["open.source@ribose.com"]
 
-  spec.summary = "Capsium"
-  spec.description = "Capsium"
+  spec.summary = "Packager and reactor for Capsium packages (.cap)"
+  spec.description = "Capsium facilitates the creation, management and " \
+                     "deployment of content packages with ease. This gem " \
+                     "provides a structured way to handle content, data, " \
+                     "and metadata for various applications: it packages " \
+                     "them into .cap files and serves them over HTTP."
   spec.homepage = "https://github.com/capsiums/capsium"
   spec.license = "MIT"
 
   spec.metadata["homepage_uri"] = spec.homepage
   spec.metadata["source_code_uri"] = spec.homepage
   spec.metadata["changelog_uri"] = "https://github.com/capsiums/capsium/releases"
+  spec.metadata["rubygems_mfa_required"] = "true"
 
   spec.files = Dir.chdir(File.expand_path(__dir__)) do
     `git ls-files -z`
@@ -26,30 +31,17 @@ Gem::Specification.new do |spec|
   spec.executables = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
   spec.require_paths = ["lib"]
 
-  spec.required_ruby_version = ">= 2.7.0"
+  spec.required_ruby_version = ">= 3.2.0"
 
-  spec.add_dependency "cssminify"
   spec.add_dependency "csv"
-  spec.add_dependency "htmlcompressor"
-  spec.add_dependency "html-proofer"
-  spec.add_dependency "jekyll"
   spec.add_dependency "json"
   spec.add_dependency "json-schema"
   spec.add_dependency "listen"
+  spec.add_dependency "lutaml-model", ">= 0.8", "< 1.0"
   spec.add_dependency "marcel"
-  spec.add_dependency "rubyzip", "~> 2.3.2"
-  spec.add_dependency "scss_lint"
-  spec.add_dependency "shale"
+  spec.add_dependency "rubyzip", ">= 2.3.2", "< 4.0"
   spec.add_dependency "sqlite3"
   spec.add_dependency "thor"
-  spec.add_dependency "uglifier"
   spec.add_dependency "webrick"
   spec.add_dependency "yaml"
-
-  spec.add_development_dependency "pry"
-  spec.add_development_dependency "rack-test"
-  spec.add_development_dependency "rake", "~> 13.0"
-  spec.add_development_dependency "rspec", "~> 3.11"
-  spec.add_development_dependency "rubocop", "~> 1.58"
-  spec.add_development_dependency "rubocop-performance"
 end

data/exe/capsium

@@ -1,6 +1,6 @@
 #!/usr/bin/env ruby
 # frozen_string_literal: true
 
-require "capsium/cli"
+require File.expand_path("../lib/capsium", __dir__)
 
 Capsium::Cli.start(ARGV)