@canra/cli 0.5.0 → 0.7.0

package/README.md

@@ -24,8 +24,8 @@ canra search json
 | `canra search <query>` | Search the registry |
 | `canra info <owner>/<name>` | Show a spec's metadata |
 | `canra fetch <owner>/<name>[@version]` | Download a spec (latest or a pinned version), verify its SHA-256, and save it to `.canra/specs/<owner>/<name>/` |
-| `canra outdated [--json]` | Check fetched specs for newer versions; exits 1 if any is outdated |
-| `canra update [<owner>/<name>]` | Re-fetch the latest version of every outdated spec (or the named one) |
+| `canra outdated [--json]` | Check fetched specs for newer versions; exits 1 if any is outdated or quarantined |
+| `canra update [<owner>/<name>]` | Re-fetch the latest version of every outdated spec (or the named one); exits 1 if any spec is quarantined or fails to update |
 | `canra remove <owner>/<name>` | Delete a fetched spec from `.canra/specs/` |
 | `canra login` | Save a registry URL and API token |
 | `canra whoami` | Show which account your saved token belongs to |
@@ -34,6 +34,8 @@ canra search json
 | `canra logout` | Remove saved credentials |
 | `canra version` / `canra help` | Version and usage |
 
+`<owner>` is a user or organization name in any case: `Canra/json` and `canra/json` are the same spec, saved under the lowercase owner in `.canra/specs/`.
+
 ## Vendoring specs
 
 Commit `.canra/` to source control. The saved specs are the record of which spec versions your project implemented (a version is exact and immutable). After `canra update`, `git diff .canra/` shows what changed in each spec.

package/canra.js

@@ -89,11 +89,11 @@ async function fetchRegistry(url, opts) {
 
 // --- Spec references ---
 
-// Mirror the server's naming rules (route-utils.js USERNAME_RE, specs-api.js
+// Mirror the server's naming rules (username.js USERNAME_RE and grandfathered names, specs-api.js
 // NAME_RE). Owner and name become local path segments under .canra/specs/, so
 // anything path-like ("..", ".", backslashes) must be rejected here — the CLI is
 // meant to be driven by agents whose arguments may come from untrusted content.
-const OWNER_RE = /^[a-z][a-z0-9_-]{1,38}[a-z0-9]$/;
+const OWNER_RE = /^(?:(?=.{1,39}$)[a-z0-9]+(?:-[a-z0-9]+)*|[a-z][a-z0-9_-]{1,38}[a-z0-9])$/i;
 const NAME_RE = /^[a-z][a-z0-9-]*$/;
 const SUGGESTION_ID_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
 
@@ -197,7 +197,7 @@ function refuseSymlinks(paths) {
 
 function localSpecPaths(owner, name) {
   const specsDir = path.join(LOCAL_DIR, "specs");
-  const ownerDir = path.join(specsDir, owner);
+  const ownerDir = path.join(specsDir, owner.toLowerCase());
   return [LOCAL_DIR, specsDir, ownerDir, path.join(ownerDir, name)];
 }
 
@@ -207,8 +207,10 @@ function frontmatterFunctionCount(text) {
   return list ? (list[1].match(/"(?:[^"\\]|\\.)*"/g) || []).length : 0;
 }
 
+// Owner directories are lowercased everywhere (here, localSpecPaths, deleteLocalSpec) so Canra/json and
+// canra/json are one local spec on case-sensitive and case-insensitive filesystems alike.
 function localSpecDir(owner, name) {
-  return path.join(LOCAL_DIR, "specs", owner, name);
+  return path.join(LOCAL_DIR, "specs", owner.toLowerCase(), name);
 }
 
 async function downloadSpec(registry, { owner, name, version }) {
@@ -643,6 +645,20 @@ function needsUpdate(row) {
   return row.status === "outdated" || (row.status === "current" && Boolean(row.moved_to));
 }
 
+function isQuarantined(row) {
+  return row.status === "quarantined";
+}
+
+function warnQuarantined(results) {
+  const quarantined = results.filter(isQuarantined);
+  for (const r of quarantined) {
+    console.warn(
+      `Warning: ${printable(r.owner)}/${printable(r.name)} is quarantined on the registry and cannot be updated. Remove it with canra remove, or wait for the registry to restore it.`,
+    );
+  }
+  return quarantined.length;
+}
+
 async function cmdOutdated(args) {
   const asJson = args.includes("--json");
   const refs = scanLocalSpecs();
@@ -653,19 +669,22 @@ async function cmdOutdated(args) {
 
   const results = await checkRemote(getRegistry(), refs);
   const outdated = results.filter(needsUpdate).length;
+  const quarantined = results.filter(isQuarantined).length;
 
+  // --json prints no warnings, so the output stays machine-readable; the exit code carries the quarantine signal.
   if (asJson) {
     console.log(JSON.stringify(results, null, 2));
   } else {
     printOutdatedTable(results);
-    if (results.some(needsUpdate)) {
+    warnQuarantined(results);
+    if (outdated > 0) {
       console.log(`\n${outdated} outdated spec${outdated !== 1 ? "s" : ""}.`);
       console.log("Run canra update, then git diff .canra/ to review the changes.");
-    } else {
+    } else if (quarantined === 0) {
       console.log("\nAll specs are up to date.");
     }
   }
-  if (outdated > 0) process.exitCode = 1;
+  if (outdated > 0 || quarantined > 0) process.exitCode = 1;
 }
 
 function deleteLocalSpec(owner, name) {
@@ -674,7 +693,7 @@ function deleteLocalSpec(owner, name) {
   if (!dir.startsWith(specsRoot + path.sep)) throw new Error(`unexpected local path for ${owner}/${name}`);
   refuseSymlinks(localSpecPaths(owner, name));
   fs.rmSync(dir, { recursive: true, force: true });
-  const ownerDir = path.join(LOCAL_DIR, "specs", owner);
+  const ownerDir = path.join(LOCAL_DIR, "specs", owner.toLowerCase());
   if (fs.readdirSync(ownerDir).length === 0) fs.rmdirSync(ownerDir);
 }
 
@@ -710,7 +729,7 @@ async function cmdUpdate(specArg) {
 
   let refs = scanLocalSpecs();
   if (only) {
-    refs = refs.filter((r) => r.owner === only.owner && r.name === only.name);
+    refs = refs.filter((r) => r.owner.toLowerCase() === only.owner.toLowerCase() && r.name === only.name);
     if (refs.length === 0) {
       console.error(`Error: ${only.owner}/${only.name} is not fetched locally. Run \`canra fetch\` first.`);
       process.exit(1);
@@ -722,9 +741,12 @@ async function cmdUpdate(specArg) {
   }
 
   const registry = getRegistry();
-  const targets = (await checkRemote(registry, refs)).filter(needsUpdate);
+  const results = await checkRemote(registry, refs);
+  const quarantined = warnQuarantined(results);
+  const targets = results.filter(needsUpdate);
   if (targets.length === 0) {
-    console.log("All specs are up to date.");
+    if (quarantined === 0) console.log("All specs are up to date.");
+    else process.exitCode = 1;
     return;
   }
 
@@ -741,7 +763,7 @@ async function cmdUpdate(specArg) {
       if (!OWNER_RE.test(toOwner) || (target && target[2] !== row.name)) {
         throw new Error(`unexpected move target '${printable(row.moved_to)}'`);
       }
-      const moving = toOwner !== row.owner;
+      const moving = toOwner.toLowerCase() !== row.owner.toLowerCase();
       if (moving && fs.existsSync(localSpecDir(toOwner, row.name))) {
         throw new Error(`${toOwner}/${row.name} is already fetched locally; remove one of the two copies`);
       }
@@ -759,7 +781,7 @@ async function cmdUpdate(specArg) {
     }
   }
   if (updated > 0) console.log("\nRun git diff .canra/ to review the changes.");
-  if (failed > 0) process.exitCode = 1;
+  if (failed > 0 || quarantined > 0) process.exitCode = 1;
 }
 
 function cmdHelp() {
@@ -784,9 +806,11 @@ Commands:
   whoami                   Print the user your saved token authenticates as
   info <owner>/<name>      Print spec metadata
   outdated [--json]        Check .canra/specs/ for newer versions; exits 1 if
-                           any spec is outdated; --json prints the results
+                           any spec is outdated or quarantined; --json prints
+                           the results
   update [<owner>/<name>]  Re-fetch the latest version of every outdated spec
-                           (or just the named one); review with git diff .canra/
+                           (or just the named one); review with git diff .canra/;
+                           exits 1 if any spec is quarantined or fails
   remove <owner>/<name>    Delete a fetched spec from .canra/specs/
   help                     Print this help message
   version                  Print CLI version

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@canra/cli",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "description": "CLI for Canra, the registry of machine-readable specs: fetch, search, and publish specs.",
   "keywords": [
     "canra",