@kanonak-protocol/cli 1.5.0 → 1.6.0

package/dist/index.js

@@ -1,71 +1,138 @@
 #!/usr/bin/env node
-import{Command as Io}from"commander";import{readFileSync as Ko}from"fs";import{fileURLToPath as Ao}from"url";import{dirname as xo,join as Eo}from"path";import{KanonakParser as To,PublisherIndex as Oo,CredentialStore as Uo,createAuthenticatedFetch as Lo}from"@kanonak-protocol/sdk";import{readFileSync as vt,statSync as $t}from"fs";import{resolve as Rt,dirname as _t}from"path";import{KanonakParser as Ct,KanonakObjectValidator as Dt,ValidationSeverity as Se}from"@kanonak-protocol/sdk";import{readFileSync as ft,readdirSync as yt}from"fs";import{join as ht,dirname as kt,basename as we}from"path";import{InMemoryKanonakDocumentRepository as bt,FileSystemKanonakDocumentRepository as Pt,HttpKanonakDocumentRepository as wt,getGlobalCachePath as St}from"@kanonak-protocol/sdk";import{mkdirSync as lt,readFileSync as be,writeFileSync as Pe,existsSync as re,appendFileSync as pt}from"fs";import{join as dt,dirname as ut,isAbsolute as mt}from"path";import{getGlobalCachePath as gt}from"@kanonak-protocol/sdk";var C=class{constructor(e=gt()){this.cacheDir=e;this.isProjectLocal=!mt(e)}cacheDir;gitignoreChecked=!1;isProjectLocal;get(e,t,o){let r=this.getPath(e,t,o);return re(r)?be(r,"utf-8"):null}put(e,t,o,r){let s=this.getPath(e,t,o);lt(ut(s),{recursive:!0}),Pe(s,r,"utf-8"),this.isProjectLocal&&this.ensureGitignore()}has(e,t,o){return re(this.getPath(e,t,o))}ensureGitignore(){if(this.gitignoreChecked)return;this.gitignoreChecked=!0;let e=".gitignore",t=this.cacheDir;if(re(e)){if(be(e,"utf-8").split(`
-`).some(r=>r.trim()===t||r.trim()===t+"/"))return;pt(e,`
-${t}/
-`)}else Pe(e,`${t}/
-`)}getPath(e,t,o){return dt(this.cacheDir,e,`${t}@${o}.kan.yml`)}};function G(n){let e=n;for(;;){let t=kt(e);if(t===e)break;if(we(e).includes(".")||we(t).includes(".")){e=t;continue}break}return e}function J(n,e){for(let t of yt(n,{withFileTypes:!0})){let o=ht(n,t.name);t.isDirectory()&&t.name!=="node_modules"&&t.name!==".kanonak"?J(o,e):t.name.endsWith(".kan.yml")&&e.push(o)}}var se=class{repos;constructor(...e){this.repos=e}async getHighestCompatibleVersionAsync(e,t){for(let o of this.repos)try{let r=await o.getHighestCompatibleVersionAsync(e,t);if(r)return r}catch{}return null}async getAllDocumentsAsync(){let e=[];for(let t of this.repos)try{e.push(...await t.getAllDocumentsAsync())}catch{}return e}async getDocumentAsync(e){for(let t of this.repos)try{let o=await t.getDocumentAsync(e);if(o)return o}catch{}return null}async getDocumentsByNamespaceAsync(e,t){for(let o of this.repos)try{let r=await o.getDocumentsByNamespaceAsync(e,t);if(r.length>0)return r}catch{}return[]}async saveDocumentAsync(e,t){await this.repos[0].saveDocumentAsync(e,t)}async deleteDocumentAsync(e){await this.repos[0].deleteDocumentAsync(e)}async clearNamespaceAsync(e,t){await this.repos[0].clearNamespaceAsync(e,t)}async getAllDocumentReferencesAsync(){return this.repos[0].getAllDocumentReferencesAsync()}async getDocumentContentAsync(e){for(let t of this.repos)try{let o=await t.getDocumentContentAsync(e);if(o)return o}catch{}return null}async getDocumentUriAsync(e){for(let t of this.repos)try{let o=await t.getDocumentUriAsync(e);if(o)return o}catch{}return null}};async function A(n,e){let t=[];J(n,t);let o=new bt(e);for(let a of t)try{let c=ft(a,"utf-8"),l=e.parse(c),p=l.metadata.namespace_;if(p){let d=`${p.publisher}/${p.package_}@${p.version}`;await o.saveDocumentAsync(l,d)}}catch{}let r=new Pt(St(),!0,e),s=new C,i=new wt({getFromCache:(a,c,l)=>s.get(a,c,l),onFetch:(a,c,l,p)=>s.put(a,c,l,p)});return new se(o,r,i)}async function ve(n){let e=Rt(n),t=$t(e),o=t.isDirectory()?G(e):G(_t(e)),r=new Ct,s=new Dt(r),i=await A(o,r),a=[];if(t.isDirectory()?J(e,a):a.push(e),a.length===0){console.log("No .kan.yml files found.");return}let c=0,l=0;for(let p of a){let d=vt(p,"utf-8"),u=r.parseWithErrors(d);if(u.errors&&u.errors.length>0){console.log(`
-${p}:`);for(let m of u.errors)console.log(`  ERROR (parse): ${m.message} [line ${m.line}:${m.column}]`),c++;continue}let g=u.document;if(!g){console.log(`
-${p}:`),console.log("  ERROR: Failed to parse document"),c++;continue}let f=await s.validateAsync(g,i),y=f.errors.filter(m=>m.severity===Se.Error),k=f.errors.filter(m=>m.severity===Se.Warning);if(y.length>0||k.length>0){let m=g.metadata.namespace_,b=m?`${m.publisher}/${m.package_}@${m.version}`:p;console.log(`
-${b}:`);for(let h of y)console.log(`  ERROR: ${h.message}`),h.suggestion&&console.log(`    -> ${h.suggestion}`);for(let h of k)console.log(`  WARN: ${h.message}`)}c+=y.length,l+=k.length}console.log(`
-${a.length} file(s) validated. ${c} error(s), ${l} warning(s).`),c>0&&process.exit(1)}import{KanonakParser as Tt,PublisherIndex as Ot,CredentialStore as Ut,createAuthenticatedFetch as Lt}from"@kanonak-protocol/sdk";import{readFileSync as It,writeFileSync as Kt,existsSync as At}from"fs";import{createHash as xt}from"crypto";import $e from"js-yaml";var ie="kanonak.lock",Et=`# This file is generated by Kanonak CLI. Do not edit manually.
-`;function Re(){if(!At(ie))return null;let n=It(ie,"utf-8"),e=$e.load(n);return!e||typeof e!="object"||e.version!=="1"?null:{version:"1",lastUpdated:e.lastUpdated??new Date().toISOString(),packages:e.packages??{}}}function _e(n){n.lastUpdated=new Date().toISOString();let e={};for(let o of Object.keys(n.packages).sort())e[o]=n.packages[o];n.packages=e;let t=$e.dump(n,{lineWidth:-1,sortKeys:!1,quotingType:'"'});Kt(ie,Et+t,"utf-8")}function O(n){return`sha256:${xt("sha256").update(n).digest("hex")}`}function U(n){let e=n.indexOf("@"),t,o=null;e!==-1?(t=n.substring(0,e),o=n.substring(e+1)||null):t=n;let r=t.indexOf("/");if(r===-1)return null;let s=t.substring(0,r),i=t.substring(r+1);return!s||!i?null:{publisher:s,packageName:i,version:o}}async function Ce(n){let e=new C,t=new Tt,o=new Ut,r=Lt(o),s=new Ot({fetchFn:r}),i=Re()??{version:"1",lastUpdated:new Date().toISOString(),packages:{}};if(!n){Object.keys(i.packages).length===0&&(console.error("No kanonak.lock file found or lock file is empty."),console.error("Usage: kanonak install {publisher}/{package}[@{version}]"),process.exit(1)),console.log(`Installing ${Object.keys(i.packages).length} package(s) from kanonak.lock...`);for(let[g,f]of Object.entries(i.packages)){let y=g.indexOf("/"),k=g.substring(0,y),m=g.substring(y+1),b=e.get(k,m,f.version);if(b)console.log(`  ${g}@${f.version} (cached)`);else{let h=f.resolved,w=await r(h,k);if(!w.ok)throw new Error(`Failed to fetch ${h} (${w.status} ${w.statusText})`);b=await w.text(),e.put(k,m,f.version,b),console.log(`  ${g}@${f.version}`)}}console.log(`
-Installed ${Object.keys(i.packages).length} package(s) from lock file.`);return}let a=U(n);a||(console.error(`Invalid package reference: ${n}`),console.error("Expected format: {publisher}/{package}@{version} or {publisher}/{package}"),process.exit(1));let{publisher:c,packageName:l,version:p}=a,d=p??await s.getHighestVersion(c,l);d||(console.error(`Could not resolve version for ${c}/${l}`),process.exit(1)),console.log(`Installing ${c}/${l}@${d}...`);let u=new Set;await De(c,l,d,e,t,s,r,u,i),_e(i),console.log(`
-Installed ${u.size} package(s).`)}async function De(n,e,t,o,r,s,i,a,c){let l=`${n}/${e}@${t}`;if(a.has(l))return;a.add(l);let p=`${n}/${e}`,d=o.get(n,e,t),u;if(d)console.log(`  ${l} (cached)`),u=await s.getPackageUrl(n,e,t);else{u=await s.getPackageUrl(n,e,t);let y=await i(u,n);if(!y.ok)throw new Error(`Failed to fetch ${u} (${y.status} ${y.statusText})`);d=await y.text(),o.put(n,e,t,d),console.log(`  ${l}`)}let g={},f=r.parse(d);if(f.metadata.imports)for(let[y,k]of Object.entries(f.metadata.imports))for(let m of k){let b=await s.resolveVersion(y,m);b?(g[`${y}/${m.packageName}`]=b,await De(y,m.packageName,b,o,r,s,i,a,c)):console.error(`  WARNING: Could not resolve ${y}/${m.packageName} ${m.package_}`)}c.packages[p]={version:t,resolved:u,integrity:O(d),dependencies:g}}import{readFileSync as jt}from"fs";import{resolve as Nt,dirname as Ft}from"path";import{KanonakParser as Ht}from"@kanonak-protocol/sdk";async function Ie(n){let e=Nt(n),t=jt(e,"utf-8"),o=new Ht,r=o.parse(t),s=r.metadata.namespace_,i=s?`${s.publisher}/${s.package_}@${s.version}`:n;if(console.log(i),!r.metadata.imports){console.log("  (no imports)");return}let a=G(Ft(e)),c=await A(a,o),l=new Set;for(let[p,d]of Object.entries(r.metadata.imports))for(let u of d)await Ke(p,u,c,l,"  ")}async function Ke(n,e,t,o,r){let s=`${n}/${e.packageName}`;if(o.has(s)){console.log(`${r}${s} (${e.package_}) [circular]`);return}o.add(s);let i;try{i=await t.getHighestCompatibleVersionAsync(n,e)}catch{console.log(`${r}${s} (${e.package_}) [fetch failed]`);return}if(!i){console.log(`${r}${s} (${e.package_}) [not found]`);return}let a=i.metadata.namespace_?.version?.toString()??"?";if(console.log(`${r}${n}/${e.packageName}@${a}`),i.metadata.imports)for(let[c,l]of Object.entries(i.metadata.imports))for(let p of l)await Ke(c,p,t,o,r+"  ")}import{createHash as Vt,randomBytes as Ee}from"crypto";import{createServer as Bt}from"http";import{execFile as ae}from"child_process";import{CredentialStore as zt,generateDPoPKeyPair as Gt,createDPoPProof as Ae,serverSupportsDPoP as Wt}from"@kanonak-protocol/sdk";import{normalizeHost as Mt}from"@kanonak-protocol/sdk";var x=class{cache=new Map;async discover(e){let t=Mt(e);if(this.cache.has(t))return this.cache.get(t);let o=`https://${t}/.well-known/oauth-authorization-server`,r=await this.tryEndpoint(o);if(!r){let s=`https://${t}/.well-known/openid-configuration`;r=await this.tryEndpoint(s)}return this.cache.set(t,r),r}async supportsOAuth(e){return await this.discover(e)!==null}static supportsPkceS256(e){return e.codeChallengeMethodsSupported?.some(t=>t.toUpperCase()==="S256")??!1}static supportsDynamicRegistration(e){return!!e.registrationEndpoint}static supportsAuthorizationCode(e){return e.responseTypesSupported?.some(t=>t.toLowerCase()==="code")??!1}async tryEndpoint(e){let t;try{t=await fetch(e)}catch(r){let s=r instanceof Error?r.message:String(r);return s.includes("ENOTFOUND")||s.includes("ECONNREFUSED")?(console.error(`  OAuth discovery: ${e} \u2014 host unreachable (${s})`),console.error("    If the server is behind a VPN, ensure you are connected.")):s.includes("CERT")||s.includes("SSL")||s.includes("TLS")?(console.error(`  OAuth discovery: ${e} \u2014 TLS error (${s})`),console.error("    If using a custom CA certificate, set NODE_EXTRA_CA_CERTS=/path/to/ca.pem")):console.error(`  OAuth discovery: ${e} \u2014 network error: ${s}`),null}if(!t.ok)return t.status===404||(t.status===403?(console.error(`  OAuth discovery: ${e} \u2014 HTTP 403 Forbidden`),console.error("    Access may be blocked by a firewall, proxy, or WAF.")):t.status>=500&&(console.error(`  OAuth discovery: ${e} \u2014 HTTP ${t.status} server error`),console.error("    The authorization server returned an internal error. Contact your IDP administrator."))),null;let o;try{o=await t.json()}catch{return console.error(`  OAuth discovery: ${e} \u2014 response is not valid JSON`),console.error("    The endpoint may be returning HTML instead of JSON. Check IDP configuration."),null}return{issuer:W(o.issuer),authorizationEndpoint:W(o.authorization_endpoint),tokenEndpoint:W(o.token_endpoint),registrationEndpoint:W(o.registration_endpoint),revocationEndpoint:W(o.revocation_endpoint),scopesSupported:L(o.scopes_supported),responseTypesSupported:L(o.response_types_supported),grantTypesSupported:L(o.grant_types_supported),codeChallengeMethodsSupported:L(o.code_challenge_methods_supported),tokenEndpointAuthMethodsSupported:L(o.token_endpoint_auth_methods_supported),dpopSigningAlgValuesSupported:L(o.dpop_signing_alg_values_supported)}}};function W(n){return typeof n=="string"?n:null}function L(n){return Array.isArray(n)?n.filter(e=>typeof e=="string"):null}var N=class{discovery;credentialStore;constructor(e,t){this.discovery=e??new x,this.credentialStore=t??new zt}async authorize(e,t=[]){console.log(`Starting OAuth flow for ${e}...`);let o=await this.discovery.discover(e);if(!o)return $(`No OAuth discovery endpoint found for '${e}'.
+import{Command as Xi}from"commander";import{readFileSync as Ji}from"fs";import{fileURLToPath as Yi}from"url";import{dirname as Zi,join as Qi}from"path";import{KanonakParser as ea,PublisherIndex as ta,CredentialStore as na,createAuthenticatedFetch as ra}from"@kanonak-protocol/sdk";import{readFileSync as On,statSync as Ln}from"fs";import{resolve as Nn,dirname as Fn}from"path";import{KanonakParser as Mn,KanonakObjectValidator as Bn,ValidationSeverity as ot}from"@kanonak-protocol/sdk";import{readFileSync as Pn,readdirSync as En}from"fs";import{join as In,dirname as Rn,basename as rt}from"path";import{InMemoryKanonakDocumentRepository as Tn,FileSystemKanonakDocumentRepository as jn,HttpKanonakDocumentRepository as Un,getGlobalCachePath as xn}from"@kanonak-protocol/sdk";import{mkdirSync as vn,readFileSync as tt,writeFileSync as nt,existsSync as je,appendFileSync as An}from"fs";import{join as $n,dirname as Cn,isAbsolute as _n}from"path";import{getGlobalCachePath as Kn}from"@kanonak-protocol/sdk";var U=class{constructor(e=Kn()){this.cacheDir=e;this.isProjectLocal=!_n(e)}cacheDir;gitignoreChecked=!1;isProjectLocal;get(e,n,r){let o=this.getPath(e,n,r);return je(o)?tt(o,"utf-8"):null}put(e,n,r,o){let i=this.getPath(e,n,r);vn(Cn(i),{recursive:!0}),nt(i,o,"utf-8"),this.isProjectLocal&&this.ensureGitignore()}has(e,n,r){return je(this.getPath(e,n,r))}ensureGitignore(){if(this.gitignoreChecked)return;this.gitignoreChecked=!0;let e=".gitignore",n=this.cacheDir;if(je(e)){if(tt(e,"utf-8").split(`
+`).some(o=>o.trim()===n||o.trim()===n+"/"))return;An(e,`
+${n}/
+`)}else nt(e,`${n}/
+`)}getPath(e,n,r){return $n(this.cacheDir,e,`${n}@${r}.kan.yml`)}};function ie(t){let e=t;for(;;){let n=Rn(e);if(n===e)break;if(rt(e).includes(".")||rt(n).includes(".")){e=n;continue}break}return e}function pe(t,e){for(let n of En(t,{withFileTypes:!0})){let r=In(t,n.name);n.isDirectory()&&n.name!=="node_modules"&&n.name!==".kanonak"?pe(r,e):n.name.endsWith(".kan.yml")&&e.push(r)}}var Ue=class{repos;constructor(...e){this.repos=e}async getHighestCompatibleVersionAsync(e,n){for(let r of this.repos)try{let o=await r.getHighestCompatibleVersionAsync(e,n);if(o)return o}catch{}return null}async getAllDocumentsAsync(){let e=[];for(let n of this.repos)try{e.push(...await n.getAllDocumentsAsync())}catch{}return e}async getDocumentAsync(e){for(let n of this.repos)try{let r=await n.getDocumentAsync(e);if(r)return r}catch{}return null}async getDocumentsByNamespaceAsync(e,n){for(let r of this.repos)try{let o=await r.getDocumentsByNamespaceAsync(e,n);if(o.length>0)return o}catch{}return[]}async saveDocumentAsync(e,n){await this.repos[0].saveDocumentAsync(e,n)}async deleteDocumentAsync(e){await this.repos[0].deleteDocumentAsync(e)}async clearNamespaceAsync(e,n){await this.repos[0].clearNamespaceAsync(e,n)}async getAllDocumentReferencesAsync(){return this.repos[0].getAllDocumentReferencesAsync()}async getDocumentContentAsync(e){for(let n of this.repos)try{let r=await n.getDocumentContentAsync(e);if(r)return r}catch{}return null}async getDocumentUriAsync(e){for(let n of this.repos)try{let r=await n.getDocumentUriAsync(e);if(r)return r}catch{}return null}};async function L(t,e){let n=[];pe(t,n);let r=new Tn(e);for(let c of n)try{let s=Pn(c,"utf-8"),l=e.parse(s),u=l.metadata.namespace_;if(u){let p=`${u.publisher}/${u.package_}@${u.version}`;await r.saveDocumentAsync(l,p)}}catch{}let o=new jn(xn(),!0,e),i=new U,a=new Un({getFromCache:(c,s,l)=>i.get(c,s,l),onFetch:(c,s,l,u)=>i.put(c,s,l,u)});return new Ue(r,o,a)}async function it(t){let e=Nn(t),n=Ln(e),r=n.isDirectory()?ie(e):ie(Fn(e)),o=new Mn,i=new Bn(o),a=await L(r,o),c=[];if(n.isDirectory()?pe(e,c):c.push(e),c.length===0){console.log("No .kan.yml files found.");return}let s=0,l=0;for(let u of c){let p=On(u,"utf-8"),m=o.parseWithErrors(p);if(m.errors&&m.errors.length>0){console.log(`
+${u}:`);for(let y of m.errors)console.log(`  ERROR (parse): ${y.message} [line ${y.line}:${y.column}]`),s++;continue}let h=m.document;if(!h){console.log(`
+${u}:`),console.log("  ERROR: Failed to parse document"),s++;continue}let g=await i.validateAsync(h,a),k=g.errors.filter(y=>y.severity===ot.Error),S=g.errors.filter(y=>y.severity===ot.Warning);if(k.length>0||S.length>0){let y=h.metadata.namespace_,D=y?`${y.publisher}/${y.package_}@${y.version}`:u;console.log(`
+${D}:`);for(let w of k)console.log(`  ERROR: ${w.message}`),w.suggestion&&console.log(`    -> ${w.suggestion}`);for(let w of S)console.log(`  WARN: ${w.message}`)}s+=k.length,l+=S.length}console.log(`
+${c.length} file(s) validated. ${s} error(s), ${l} warning(s).`),s>0&&process.exit(1)}import{KanonakParser as Wn,PublisherIndex as Xn,CredentialStore as Jn,createAuthenticatedFetch as Yn}from"@kanonak-protocol/sdk";import{readFileSync as Vn,writeFileSync as Hn,existsSync as zn}from"fs";import{createHash as Gn}from"crypto";import at from"js-yaml";var xe="kanonak.lock",qn=`# This file is generated by Kanonak CLI. Do not edit manually.
+`;function st(){if(!zn(xe))return null;let t=Vn(xe,"utf-8"),e=at.load(t);return!e||typeof e!="object"||e.version!=="1"?null:{version:"1",lastUpdated:e.lastUpdated??new Date().toISOString(),packages:e.packages??{}}}function ct(t){t.lastUpdated=new Date().toISOString();let e={};for(let r of Object.keys(t.packages).sort())e[r]=t.packages[r];t.packages=e;let n=at.dump(t,{lineWidth:-1,sortKeys:!1,quotingType:'"'});Hn(xe,qn+n,"utf-8")}function N(t){return`sha256:${Gn("sha256").update(t).digest("hex")}`}function G(t){let e=t.indexOf("@"),n,r=null;e!==-1?(n=t.substring(0,e),r=t.substring(e+1)||null):n=t;let o=n.indexOf("/");if(o===-1)return null;let i=n.substring(0,o),a=n.substring(o+1);return!i||!a?null:{publisher:i,packageName:a,version:r}}async function lt(t){let e=new U,n=new Wn,r=new Jn,o=Yn(r),i=new Xn({fetchFn:o}),a=st()??{version:"1",lastUpdated:new Date().toISOString(),packages:{}};if(!t){Object.keys(a.packages).length===0&&(console.error("No kanonak.lock file found or lock file is empty."),console.error("Usage: kanonak install {publisher}/{package}[@{version}]"),process.exit(1)),console.log(`Installing ${Object.keys(a.packages).length} package(s) from kanonak.lock...`);for(let[h,g]of Object.entries(a.packages)){let k=h.indexOf("/"),S=h.substring(0,k),y=h.substring(k+1),D=e.get(S,y,g.version);if(D)console.log(`  ${h}@${g.version} (cached)`);else{let w=g.resolved,$=await o(w,S);if(!$.ok)throw new Error(`Failed to fetch ${w} (${$.status} ${$.statusText})`);D=await $.text(),e.put(S,y,g.version,D),console.log(`  ${h}@${g.version}`)}}console.log(`
+Installed ${Object.keys(a.packages).length} package(s) from lock file.`);return}let c=G(t);c||(console.error(`Invalid package reference: ${t}`),console.error("Expected format: {publisher}/{package}@{version} or {publisher}/{package}"),process.exit(1));let{publisher:s,packageName:l,version:u}=c,p=u??await i.getHighestVersion(s,l);p||(console.error(`Could not resolve version for ${s}/${l}`),process.exit(1)),console.log(`Installing ${s}/${l}@${p}...`);let m=new Set;await ut(s,l,p,e,n,i,o,m,a),ct(a),console.log(`
+Installed ${m.size} package(s).`)}async function ut(t,e,n,r,o,i,a,c,s){let l=`${t}/${e}@${n}`;if(c.has(l))return;c.add(l);let u=`${t}/${e}`,p=r.get(t,e,n),m;if(p)console.log(`  ${l} (cached)`),m=await i.getPackageUrl(t,e,n);else{m=await i.getPackageUrl(t,e,n);let k=await a(m,t);if(!k.ok)throw new Error(`Failed to fetch ${m} (${k.status} ${k.statusText})`);p=await k.text(),r.put(t,e,n,p),console.log(`  ${l}`)}let h={},g=o.parse(p);if(g.metadata.imports)for(let[k,S]of Object.entries(g.metadata.imports))for(let y of S){let D=await i.resolveVersion(k,y);D?(h[`${k}/${y.packageName}`]=D,await ut(k,y.packageName,D,r,o,i,a,c,s)):console.error(`  WARNING: Could not resolve ${k}/${y.packageName} ${y.package_}`)}s.packages[u]={version:n,resolved:m,integrity:N(p),dependencies:h}}import{readFileSync as Zn}from"fs";import{resolve as Qn,dirname as er}from"path";import{KanonakParser as tr}from"@kanonak-protocol/sdk";async function dt(t){let e=Qn(t),n=Zn(e,"utf-8"),r=new tr,o=r.parse(n),i=o.metadata.namespace_,a=i?`${i.publisher}/${i.package_}@${i.version}`:t;if(console.log(a),!o.metadata.imports){console.log("  (no imports)");return}let c=ie(er(e)),s=await L(c,r),l=new Set;for(let[u,p]of Object.entries(o.metadata.imports))for(let m of p)await pt(u,m,s,l,"  ")}async function pt(t,e,n,r,o){let i=`${t}/${e.packageName}`;if(r.has(i)){console.log(`${o}${i} (${e.package_}) [circular]`);return}r.add(i);let a;try{a=await n.getHighestCompatibleVersionAsync(t,e)}catch{console.log(`${o}${i} (${e.package_}) [fetch failed]`);return}if(!a){console.log(`${o}${i} (${e.package_}) [not found]`);return}let c=a.metadata.namespace_?.version?.toString()??"?";if(console.log(`${o}${t}/${e.packageName}@${c}`),a.metadata.imports)for(let[s,l]of Object.entries(a.metadata.imports))for(let u of l)await pt(s,u,n,r,o+"  ")}import{createHash as rr,randomBytes as gt}from"crypto";import{createServer as or}from"http";import{execFile as Oe}from"child_process";import{CredentialStore as ir,generateDPoPKeyPair as ar,createDPoPProof as mt,serverSupportsDPoP as sr}from"@kanonak-protocol/sdk";import{normalizeHost as nr}from"@kanonak-protocol/sdk";var F=class{cache=new Map;async discover(e){let n=nr(e);if(this.cache.has(n))return this.cache.get(n);let r=`https://${n}/.well-known/oauth-authorization-server`,o=await this.tryEndpoint(r);if(!o){let i=`https://${n}/.well-known/openid-configuration`;o=await this.tryEndpoint(i)}return this.cache.set(n,o),o}async supportsOAuth(e){return await this.discover(e)!==null}static supportsPkceS256(e){return e.codeChallengeMethodsSupported?.some(n=>n.toUpperCase()==="S256")??!1}static supportsDynamicRegistration(e){return!!e.registrationEndpoint}static supportsAuthorizationCode(e){return e.responseTypesSupported?.some(n=>n.toLowerCase()==="code")??!1}async tryEndpoint(e){let n;try{n=await fetch(e)}catch(o){let i=o instanceof Error?o.message:String(o);return i.includes("ENOTFOUND")||i.includes("ECONNREFUSED")?(console.error(`  OAuth discovery: ${e} \u2014 host unreachable (${i})`),console.error("    If the server is behind a VPN, ensure you are connected.")):i.includes("CERT")||i.includes("SSL")||i.includes("TLS")?(console.error(`  OAuth discovery: ${e} \u2014 TLS error (${i})`),console.error("    If using a custom CA certificate, set NODE_EXTRA_CA_CERTS=/path/to/ca.pem")):console.error(`  OAuth discovery: ${e} \u2014 network error: ${i}`),null}if(!n.ok)return n.status===404||(n.status===403?(console.error(`  OAuth discovery: ${e} \u2014 HTTP 403 Forbidden`),console.error("    Access may be blocked by a firewall, proxy, or WAF.")):n.status>=500&&(console.error(`  OAuth discovery: ${e} \u2014 HTTP ${n.status} server error`),console.error("    The authorization server returned an internal error. Contact your IDP administrator."))),null;let r;try{r=await n.json()}catch{return console.error(`  OAuth discovery: ${e} \u2014 response is not valid JSON`),console.error("    The endpoint may be returning HTML instead of JSON. Check IDP configuration."),null}return{issuer:ae(r.issuer),authorizationEndpoint:ae(r.authorization_endpoint),tokenEndpoint:ae(r.token_endpoint),registrationEndpoint:ae(r.registration_endpoint),revocationEndpoint:ae(r.revocation_endpoint),scopesSupported:q(r.scopes_supported),responseTypesSupported:q(r.response_types_supported),grantTypesSupported:q(r.grant_types_supported),codeChallengeMethodsSupported:q(r.code_challenge_methods_supported),tokenEndpointAuthMethodsSupported:q(r.token_endpoint_auth_methods_supported),dpopSigningAlgValuesSupported:q(r.dpop_signing_alg_values_supported)}}};function ae(t){return typeof t=="string"?t:null}function q(t){return Array.isArray(t)?t.filter(e=>typeof e=="string"):null}var X=class{discovery;credentialStore;constructor(e,n){this.discovery=e??new F,this.credentialStore=n??new ir}async authorize(e,n=[]){console.log(`Starting OAuth flow for ${e}...`);let r=await this.discovery.discover(e);if(!r)return I(`No OAuth discovery endpoint found for '${e}'.
   The server must expose one of:
     - https://${e}/.well-known/oauth-authorization-server (RFC 8414)
     - https://${e}/.well-known/openid-configuration (OpenID Connect)
   Verify the hostname is correct and HTTPS is configured.
-  If using a corporate proxy, ensure it is not blocking the discovery request.`);let r=[];if(o.authorizationEndpoint||r.push("authorization_endpoint"),o.tokenEndpoint||r.push("token_endpoint"),r.length>0)return $(`OAuth metadata for '${e}' is missing required fields: ${r.join(", ")}.
-  Contact the IDP administrator to ensure these are included in the discovery document.`);let s=Wt(o.dpopSigningAlgValuesSupported),i=null;if(s){console.log("  Server supports DPoP (RFC 9449) \u2014 generating key pair...");try{i=Gt()}catch(R){return $(`Failed to generate DPoP key pair: ${j(R)}
-  Ensure your Node.js installation supports EC P-256 curves.`)}}let{redirectUri:a,port:c,waitForCallback:l,close:p}=await en(),d=await this.credentialStore.getCredential(e),u=d?.clientId??null,g=d?.clientSecret??null;if(!u&&o.registrationEndpoint){console.log("  Registering dynamic OAuth client (RFC 7591)...");let R=await this.registerClient(o.registrationEndpoint,a);if(!R.success)return p(),$(R.error);u=R.clientId,g=R.clientSecret??null}if(!u)return p(),$(`No OAuth client credentials for '${e}' and the server does not support dynamic client registration (no registration_endpoint in metadata).
+  If using a corporate proxy, ensure it is not blocking the discovery request.`);let o=[];if(r.authorizationEndpoint||o.push("authorization_endpoint"),r.tokenEndpoint||o.push("token_endpoint"),o.length>0)return I(`OAuth metadata for '${e}' is missing required fields: ${o.join(", ")}.
+  Contact the IDP administrator to ensure these are included in the discovery document.`);let i=sr(r.dpopSigningAlgValuesSupported),a=null;if(i){console.log("  Server supports DPoP (RFC 9449) \u2014 generating key pair...");try{a=ar()}catch(R){return I(`Failed to generate DPoP key pair: ${W(R)}
+  Ensure your Node.js installation supports EC P-256 curves.`)}}let{redirectUri:c,port:s,waitForCallback:l,close:u}=await fr(),p=await this.credentialStore.getCredential(e),m=p?.clientId??null,h=p?.clientSecret??null;if(!m&&r.registrationEndpoint){console.log("  Registering dynamic OAuth client (RFC 7591)...");let R=await this.registerClient(r.registrationEndpoint,c);if(!R.success)return u(),I(R.error);m=R.clientId,h=R.clientSecret??null}if(!m)return u(),I(`No OAuth client credentials for '${e}' and the server does not support dynamic client registration (no registration_endpoint in metadata).
   You must pre-register a client with your IDP and configure the client_id.
   Ask your IDP administrator to enable dynamic client registration (RFC 7591),
-  or add a registration_endpoint to the OAuth metadata.`);let f=Yt(),y=Jt(f),k=Xt(),m=Qt(o.authorizationEndpoint,u,a,t,k,y);console.log(`  Opening browser for authorization on port ${c}...`),console.log("  If the browser doesn't open, navigate to:"),console.log(`  ${m}`),nn(m);let b=await l();if(p(),!b)return $(`Authorization timed out after 5 minutes.
+  or add a registration_endpoint to the OAuth metadata.`);let g=lr(),k=ur(g),S=dr(),y=pr(r.authorizationEndpoint,m,c,n,S,k);console.log(`  Opening browser for authorization on port ${s}...`),console.log("  If the browser doesn't open, navigate to:"),console.log(`  ${y}`),yr(y);let D=await l();if(u(),!D)return I(`Authorization timed out after 5 minutes.
   The browser authorization was not completed in time.
-  Re-run 'kanonak login ${e}' and complete the browser authorization promptly.`);if(!b.code){let R=b.error?`: ${b.error}`:"";return $(`No authorization code received${R}.
+  Re-run 'kanonak login ${e}' and complete the browser authorization promptly.`);if(!D.code){let R=D.error?`: ${D.error}`:"";return I(`No authorization code received${R}.
   The IDP may have rejected the authorization request.
-  Check the IDP admin console for error details.`)}if(b.state!==k)return $(`Authorization state mismatch \u2014 possible CSRF attack.
+  Check the IDP admin console for error details.`)}if(D.state!==S)return I(`Authorization state mismatch \u2014 possible CSRF attack.
   The response did not match the expected session.
-  Re-run 'kanonak login ${e}' to start a fresh authorization flow.`);console.log("  Exchanging authorization code for tokens...");let h=await this.exchangeCode(o.tokenEndpoint,u,g,b.code,a,f,i);if(!h.success)return $(h.error);let w={clientId:u,clientSecret:g,accessToken:h.tokens.accessToken,refreshToken:h.tokens.refreshToken,expiresAt:h.tokens.expiresIn?new Date(Date.now()+h.tokens.expiresIn*1e3).toISOString():null,tokenEndpoint:o.tokenEndpoint,dpopKeyPair:i};return await this.credentialStore.store(e,w),console.log(`  Successfully authenticated with ${e}`),s&&console.log("  DPoP proof-of-possession is active"),{success:!0,host:e}}async refresh(e){let t=await this.credentialStore.getCredential(e);if(!t)return $(`No stored credentials for '${e}'. Run 'kanonak login ${e}' to authenticate first.`);if(!t.refreshToken)return $(`No refresh token available for '${e}'.
+  Re-run 'kanonak login ${e}' to start a fresh authorization flow.`);console.log("  Exchanging authorization code for tokens...");let w=await this.exchangeCode(r.tokenEndpoint,m,h,D.code,c,g,a);if(!w.success)return I(w.error);let $={clientId:m,clientSecret:h,accessToken:w.tokens.accessToken,refreshToken:w.tokens.refreshToken,expiresAt:w.tokens.expiresIn?new Date(Date.now()+w.tokens.expiresIn*1e3).toISOString():null,tokenEndpoint:r.tokenEndpoint,dpopKeyPair:a};return await this.credentialStore.store(e,$),console.log(`  Successfully authenticated with ${e}`),i&&console.log("  DPoP proof-of-possession is active"),{success:!0,host:e}}async refresh(e){let n=await this.credentialStore.getCredential(e);if(!n)return I(`No stored credentials for '${e}'. Run 'kanonak login ${e}' to authenticate first.`);if(!n.refreshToken)return I(`No refresh token available for '${e}'.
   The authorization server may not issue refresh tokens for this client.
-  Run 'kanonak login ${e}' to re-authenticate.`);if(!t.clientId)return $(`No client ID in stored credentials for '${e}'.
-  The stored credential may be corrupted. Run 'kanonak logout ${e}' then 'kanonak login ${e}'.`);let o=t.tokenEndpoint;if(!o){let s=await this.discovery.discover(e);if(!s?.tokenEndpoint)return $(`Cannot find token endpoint for '${e}'.
+  Run 'kanonak login ${e}' to re-authenticate.`);if(!n.clientId)return I(`No client ID in stored credentials for '${e}'.
+  The stored credential may be corrupted. Run 'kanonak logout ${e}' then 'kanonak login ${e}'.`);let r=n.tokenEndpoint;if(!r){let i=await this.discovery.discover(e);if(!i?.tokenEndpoint)return I(`Cannot find token endpoint for '${e}'.
   The OAuth discovery endpoint may be unreachable.
-  Check network connectivity and run 'kanonak login ${e}' to re-authenticate.`);o=s.tokenEndpoint}let r=await this.refreshTokenRequest(o,t.clientId,t.clientSecret,t.refreshToken,t.dpopKeyPair);return r.success?(t.accessToken=r.tokens.accessToken,r.tokens.refreshToken&&(t.refreshToken=r.tokens.refreshToken),t.expiresAt=r.tokens.expiresIn?new Date(Date.now()+r.tokens.expiresIn*1e3).toISOString():null,t.tokenEndpoint=o,await this.credentialStore.store(e,t),{success:!0,host:e}):$(`${r.error}
-  The refresh token may have expired. Run 'kanonak login ${e}' to re-authenticate.`)}async logout(e){let t=await this.credentialStore.getCredential(e);if(!t)return $(`No stored credentials for '${e}'.
-  You may not be logged in, or credentials may be stored in a different backend.`);let o=await this.discovery.discover(e);if(o?.revocationEndpoint&&t.accessToken&&t.clientId)try{await this.revokeToken(o.revocationEndpoint,t.accessToken,t.clientId)}catch{console.warn(`  Warning: Token revocation failed for '${e}'. The token has been removed locally but may still be valid on the server until it expires.`)}return await this.credentialStore.remove(e),{success:!0,host:e}}async registerClient(e,t){let o;try{o=await fetch(e,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({client_name:"Kanonak CLI",redirect_uris:[t],grant_types:["authorization_code","refresh_token"],response_types:["code"],token_endpoint_auth_method:"none"})})}catch(i){return{success:!1,error:`Dynamic client registration request to ${e} failed: ${j(i)}
+  Check network connectivity and run 'kanonak login ${e}' to re-authenticate.`);r=i.tokenEndpoint}let o=await this.refreshTokenRequest(r,n.clientId,n.clientSecret,n.refreshToken,n.dpopKeyPair);return o.success?(n.accessToken=o.tokens.accessToken,o.tokens.refreshToken&&(n.refreshToken=o.tokens.refreshToken),n.expiresAt=o.tokens.expiresIn?new Date(Date.now()+o.tokens.expiresIn*1e3).toISOString():null,n.tokenEndpoint=r,await this.credentialStore.store(e,n),{success:!0,host:e}):I(`${o.error}
+  The refresh token may have expired. Run 'kanonak login ${e}' to re-authenticate.`)}async logout(e){let n=await this.credentialStore.getCredential(e);if(!n)return I(`No stored credentials for '${e}'.
+  You may not be logged in, or credentials may be stored in a different backend.`);let r=await this.discovery.discover(e);if(r?.revocationEndpoint&&n.accessToken&&n.clientId)try{await this.revokeToken(r.revocationEndpoint,n.accessToken,n.clientId)}catch{console.warn(`  Warning: Token revocation failed for '${e}'. The token has been removed locally but may still be valid on the server until it expires.`)}return await this.credentialStore.remove(e),{success:!0,host:e}}async registerClient(e,n){let r;try{r=await fetch(e,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({client_name:"Kanonak CLI",redirect_uris:[n],grant_types:["authorization_code","refresh_token"],response_types:["code"],token_endpoint_auth_method:"none"})})}catch(a){return{success:!1,error:`Dynamic client registration request to ${e} failed: ${W(a)}
   Ensure the IDP is reachable and HTTPS is properly configured.
-  If using a corporate proxy or custom CA, set NODE_EXTRA_CA_CERTS.`}}if(!o.ok){let i=await ce(o);return{success:!1,error:`Dynamic client registration (RFC 7591) failed.
+  If using a corporate proxy or custom CA, set NODE_EXTRA_CA_CERTS.`}}if(!r.ok){let a=await Le(r);return{success:!1,error:`Dynamic client registration (RFC 7591) failed.
   Endpoint: ${e}
-  HTTP ${o.status}: ${i}
+  HTTP ${r.status}: ${a}
   The IDP may not support dynamic registration for public clients.
-  Ask your IDP administrator to enable RFC 7591 support, or pre-register a client manually.`}}let r=await o.json(),s=r.client_id;return s?{success:!0,clientId:s,clientSecret:r.client_secret}:{success:!1,error:`Dynamic client registration response from ${e} did not contain a client_id.
-  The IDP response may be malformed. Contact your IDP administrator.`}}async exchangeCode(e,t,o,r,s,i,a){let c=new URLSearchParams({grant_type:"authorization_code",client_id:t,code:r,redirect_uri:s,code_verifier:i});o&&c.set("client_secret",o);let l={"Content-Type":"application/x-www-form-urlencoded"};if(a)try{l.DPoP=Ae(a.privateKey,a.publicKey,"POST",e)}catch(d){return{success:!1,error:`Failed to create DPoP proof for token exchange: ${j(d)}
-  The stored key pair may be corrupted. Run 'kanonak login' to re-authenticate.`}}let p;try{p=await fetch(e,{method:"POST",headers:l,body:c.toString()})}catch(d){return{success:!1,error:`Token exchange request to ${e} failed: ${j(d)}
-  Ensure the token endpoint is reachable.`}}if(!p.ok){let d=await ce(p),u=qt(d);return{success:!1,error:`Token exchange failed.
+  Ask your IDP administrator to enable RFC 7591 support, or pre-register a client manually.`}}let o=await r.json(),i=o.client_id;return i?{success:!0,clientId:i,clientSecret:o.client_secret}:{success:!1,error:`Dynamic client registration response from ${e} did not contain a client_id.
+  The IDP response may be malformed. Contact your IDP administrator.`}}async exchangeCode(e,n,r,o,i,a,c){let s=new URLSearchParams({grant_type:"authorization_code",client_id:n,code:o,redirect_uri:i,code_verifier:a});r&&s.set("client_secret",r);let l={"Content-Type":"application/x-www-form-urlencoded"};if(c)try{l.DPoP=mt(c.privateKey,c.publicKey,"POST",e)}catch(p){return{success:!1,error:`Failed to create DPoP proof for token exchange: ${W(p)}
+  The stored key pair may be corrupted. Run 'kanonak login' to re-authenticate.`}}let u;try{u=await fetch(e,{method:"POST",headers:l,body:s.toString()})}catch(p){return{success:!1,error:`Token exchange request to ${e} failed: ${W(p)}
+  Ensure the token endpoint is reachable.`}}if(!u.ok){let p=await Le(u),m=cr(p);return{success:!1,error:`Token exchange failed.
   Endpoint: ${e}
-  HTTP ${p.status}: ${d}`+(u?`
-  ${u}`:"")}}return{success:!0,tokens:xe(await p.json())}}async refreshTokenRequest(e,t,o,r,s){let i=new URLSearchParams({grant_type:"refresh_token",client_id:t,refresh_token:r});o&&i.set("client_secret",o);let a={"Content-Type":"application/x-www-form-urlencoded"};if(s)try{a.DPoP=Ae(s.privateKey,s.publicKey,"POST",e)}catch(l){return{success:!1,error:`Failed to create DPoP proof for token refresh: ${j(l)}`}}let c;try{c=await fetch(e,{method:"POST",headers:a,body:i.toString()})}catch(l){return{success:!1,error:`Token refresh request to ${e} failed: ${j(l)}`}}if(!c.ok){let l=await ce(c);return{success:!1,error:`Token refresh failed \u2014 HTTP ${c.status}: ${l}`}}return{success:!0,tokens:xe(await c.json())}}async revokeToken(e,t,o){await fetch(e,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({token:t,client_id:o}).toString()})}};function $(n){return{success:!1,error:n}}function xe(n){return{accessToken:n.access_token,refreshToken:n.refresh_token,expiresIn:typeof n.expires_in=="number"?n.expires_in:void 0}}function j(n){return n instanceof Error?n.message:String(n)}async function ce(n){try{return await n.text()}catch{return"(could not read response body)"}}function qt(n){try{let e=JSON.parse(n);switch(e.error){case"invalid_grant":return"Hint: The authorization code may have expired or already been used. Re-run the login flow.";case"invalid_client":return"Hint: The client credentials were rejected. The client_id may be invalid or the client_secret may be wrong.";case"redirect_uri_mismatch":return"Hint: The redirect_uri does not match what was registered with the IDP.";case"unsupported_grant_type":return"Hint: The IDP does not support authorization_code grants. Contact your IDP administrator.";case"invalid_scope":return"Hint: One or more requested scopes are not allowed. Check the scopes configured on the IDP.";case"use_dpop_nonce":return"Hint: The server requires a DPoP nonce. This should be handled automatically \u2014 please report this as a bug.";default:return e.error_description?`IDP says: ${e.error_description}`:null}}catch{return null}}function Yt(){return Ee(32).toString("base64url")}function Jt(n){return Vt("sha256").update(n).digest("base64url")}function Xt(){return Ee(16).toString("base64url")}function Qt(n,e,t,o,r,s){let i=new URLSearchParams({client_id:e,response_type:"code",redirect_uri:t,scope:o.join(" "),state:r,code_challenge:s,code_challenge_method:"S256"});return`${n}?${i}`}var Zt=300*1e3;async function en(){return new Promise(n=>{let e=Bt((r,s)=>{let i=new URL(r.url,"http://localhost"),a=i.searchParams.get("code")??void 0,c=i.searchParams.get("state")??void 0,l=i.searchParams.get("error")??i.searchParams.get("error_description")??void 0,p=l?tn(l):null,d=p?`<html><body><h1>Authorization failed</h1><p>${p}</p></body></html>`:"<html><body><h1>Authorization successful!</h1><p>You can close this window.</p></body></html>";s.writeHead(200,{"Content-Type":"text/html"}),s.end(d),t({code:a,state:c,error:l})}),t,o=new Promise(r=>{t=r,setTimeout(()=>{r(null),e.close()},Zt)});e.listen(0,"127.0.0.1",()=>{let r=e.address();n({redirectUri:`http://localhost:${r.port}/callback`,port:r.port,waitForCallback:()=>o,close:()=>e.close()})})})}function tn(n){return n.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;")}function nn(n){try{process.platform==="win32"?ae("cmd",["/c","start","",n]):process.platform==="darwin"?ae("open",[n]):ae("xdg-open",[n])}catch{console.log("  Could not open browser automatically. Please navigate to the URL above manually.")}}import{CredentialStore as on}from"@kanonak-protocol/sdk";async function Te(n){try{let e=new x,t=new on,r=await new N(e,t).authorize(n);r.success?console.log(`
-Authenticated with ${n}.`):(console.error(`
+  HTTP ${u.status}: ${p}`+(m?`
+  ${m}`:"")}}return{success:!0,tokens:ft(await u.json())}}async refreshTokenRequest(e,n,r,o,i){let a=new URLSearchParams({grant_type:"refresh_token",client_id:n,refresh_token:o});r&&a.set("client_secret",r);let c={"Content-Type":"application/x-www-form-urlencoded"};if(i)try{c.DPoP=mt(i.privateKey,i.publicKey,"POST",e)}catch(l){return{success:!1,error:`Failed to create DPoP proof for token refresh: ${W(l)}`}}let s;try{s=await fetch(e,{method:"POST",headers:c,body:a.toString()})}catch(l){return{success:!1,error:`Token refresh request to ${e} failed: ${W(l)}`}}if(!s.ok){let l=await Le(s);return{success:!1,error:`Token refresh failed \u2014 HTTP ${s.status}: ${l}`}}return{success:!0,tokens:ft(await s.json())}}async revokeToken(e,n,r){await fetch(e,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({token:n,client_id:r}).toString()})}};function I(t){return{success:!1,error:t}}function ft(t){return{accessToken:t.access_token,refreshToken:t.refresh_token,expiresIn:typeof t.expires_in=="number"?t.expires_in:void 0}}function W(t){return t instanceof Error?t.message:String(t)}async function Le(t){try{return await t.text()}catch{return"(could not read response body)"}}function cr(t){try{let e=JSON.parse(t);switch(e.error){case"invalid_grant":return"Hint: The authorization code may have expired or already been used. Re-run the login flow.";case"invalid_client":return"Hint: The client credentials were rejected. The client_id may be invalid or the client_secret may be wrong.";case"redirect_uri_mismatch":return"Hint: The redirect_uri does not match what was registered with the IDP.";case"unsupported_grant_type":return"Hint: The IDP does not support authorization_code grants. Contact your IDP administrator.";case"invalid_scope":return"Hint: One or more requested scopes are not allowed. Check the scopes configured on the IDP.";case"use_dpop_nonce":return"Hint: The server requires a DPoP nonce. This should be handled automatically \u2014 please report this as a bug.";default:return e.error_description?`IDP says: ${e.error_description}`:null}}catch{return null}}function lr(){return gt(32).toString("base64url")}function ur(t){return rr("sha256").update(t).digest("base64url")}function dr(){return gt(16).toString("base64url")}function pr(t,e,n,r,o,i){let a=new URLSearchParams({client_id:e,response_type:"code",redirect_uri:n,scope:r.join(" "),state:o,code_challenge:i,code_challenge_method:"S256"});return`${t}?${a}`}var mr=300*1e3;async function fr(){return new Promise(t=>{let e=or((o,i)=>{let a=new URL(o.url,"http://localhost"),c=a.searchParams.get("code")??void 0,s=a.searchParams.get("state")??void 0,l=a.searchParams.get("error")??a.searchParams.get("error_description")??void 0,u=l?gr(l):null,p=u?`<html><body><h1>Authorization failed</h1><p>${u}</p></body></html>`:"<html><body><h1>Authorization successful!</h1><p>You can close this window.</p></body></html>";i.writeHead(200,{"Content-Type":"text/html"}),i.end(p),n({code:c,state:s,error:l})}),n,r=new Promise(o=>{n=o,setTimeout(()=>{o(null),e.close()},mr)});e.listen(0,"127.0.0.1",()=>{let o=e.address();t({redirectUri:`http://localhost:${o.port}/callback`,port:o.port,waitForCallback:()=>r,close:()=>e.close()})})})}function gr(t){return t.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;")}function yr(t){try{process.platform==="win32"?Oe("cmd",["/c","start","",t]):process.platform==="darwin"?Oe("open",[t]):Oe("xdg-open",[t])}catch{console.log("  Could not open browser automatically. Please navigate to the URL above manually.")}}import{CredentialStore as hr}from"@kanonak-protocol/sdk";async function yt(t){try{let e=new F,n=new hr,o=await new X(e,n).authorize(t);o.success?console.log(`
+Authenticated with ${t}.`):(console.error(`
 Authentication failed:
-  ${r.error}`),process.exit(1))}catch(e){let t=e instanceof Error?e.message:String(e);console.error(`
+  ${o.error}`),process.exit(1))}catch(e){let n=e instanceof Error?e.message:String(e);console.error(`
 Authentication failed unexpectedly:
-  ${t}`),console.error(`
-If this persists, file an issue at https://github.com/kanonak-protocol/typescript/issues`),process.exit(1)}}import{CredentialStore as rn}from"@kanonak-protocol/sdk";async function Oe(n){try{let e=new x,t=new rn,r=await new N(e,t).logout(n);r.success?console.log(`Logged out from ${n}.`):(console.error(`
+  ${n}`),console.error(`
+If this persists, file an issue at https://github.com/kanonak-protocol/typescript/issues`),process.exit(1)}}import{CredentialStore as kr}from"@kanonak-protocol/sdk";async function ht(t){try{let e=new F,n=new kr,o=await new X(e,n).logout(t);o.success?console.log(`Logged out from ${t}.`):(console.error(`
 Logout failed:
-  ${r.error}`),process.exit(1))}catch(e){let t=e instanceof Error?e.message:String(e);console.error(`
+  ${o.error}`),process.exit(1))}catch(e){let n=e instanceof Error?e.message:String(e);console.error(`
 Logout failed unexpectedly:
-  ${t}`),process.exit(1)}}import{Command as xn}from"commander";import{KanonakParser as En,KanonakObjectParser as Tn,PublisherIndex as On,CredentialStore as Un,createAuthenticatedFetch as Ln}from"@kanonak-protocol/sdk";import{readFileSync as sn,writeFileSync as an,existsSync as cn}from"fs";import{join as ln}from"path";import Ue from"js-yaml";import{getGlobalCachePath as pn}from"@kanonak-protocol/sdk";var dn=`# This file is generated by Kanonak CLI. Do not edit manually.
-`;function Le(){let n=pn();return ln(n,"..","capabilities.lock")}function F(){let n=Le();if(!cn(n))return{version:"1",lastUpdated:new Date().toISOString(),capabilities:{}};let e=sn(n,"utf-8"),t=Ue.load(e);return!t||typeof t!="object"||t.version!=="1"?{version:"1",lastUpdated:new Date().toISOString(),capabilities:{}}:{version:"1",lastUpdated:t.lastUpdated??new Date().toISOString(),capabilities:t.capabilities??{}}}function le(n){n.lastUpdated=new Date().toISOString();let e={};for(let o of Object.keys(n.capabilities).sort())e[o]=n.capabilities[o];n.capabilities=e;let t=Ue.dump(n,{lineWidth:-1,sortKeys:!1,quotingType:'"'});an(Le(),dn+t,"utf-8")}var _=class{constructor(e,t){this.doc=e;this.broader=t}doc;broader;async getAllDocumentsAsync(){return[this.doc]}async getDocumentAsync(e){return this.broader.getDocumentAsync(e)}async getDocumentsByNamespaceAsync(e,t){return this.broader.getDocumentsByNamespaceAsync(e,t)}async getHighestCompatibleVersionAsync(e,t){return this.broader.getHighestCompatibleVersionAsync(e,t)}async saveDocumentAsync(){throw new Error("SingleDocumentRepository is read-only")}async deleteDocumentAsync(){throw new Error("SingleDocumentRepository is read-only")}async clearNamespaceAsync(){throw new Error("SingleDocumentRepository is read-only")}async getAllDocumentReferencesAsync(){return[]}async getDocumentContentAsync(e){return this.broader.getDocumentContentAsync(e)}async getDocumentUriAsync(e){return this.broader.getDocumentUriAsync(e)}};import{KanonakObjectParser as bn,EmbeddedKanonak as Be,ReferenceKanonak as ze}from"@kanonak-protocol/sdk";import{SubjectKanonak as je,DefinedKanonak as un,StringStatement as mn,NumberStatement as gn,BooleanStatement as fn,ReferenceStatement as Ne,EmbeddedStatement as zr,ListStatement as yn}from"@kanonak-protocol/sdk";function I(n){return`${n.publisher}/${n.package_}/${n.name}`}function pe(n,e){return n.publisher===e.publisher&&n.package_===e.package_&&n.name===e.name}function hn(n,e){if(!(n instanceof un))return!1;for(let t of n.statement)if(t.predicate?.subject?.name==="type"&&t instanceof Ne){let r=t.object;if(pe(r.subject,e))return!0}return!1}function D(n,e){let t=[];for(let o of n)o instanceof je&&hn(o,e)&&t.push(o);return t}function Fe(n,e){for(let t of n){if(!(t instanceof je)||t.name!==e.name)continue;if((t.namespace||"").startsWith(`${e.publisher}/${e.package_}@`))return t}}function de(n,e){for(let t of n.statement){let o=t.predicate;if(o?.subject&&pe(o.subject,e))return t}}function kn(n,e){let t=de(n,e);if(t&&(t instanceof mn||t instanceof gn||t instanceof fn))return t.object}function P(n,e){let t=kn(n,e);return typeof t=="string"?t:void 0}function H(n,e){let t=de(n,e);if(t instanceof Ne)return t.object.subject}function M(n,e){let t=de(n,e);return t instanceof yn?t.object??[]:[]}var S="kanonak.org",v="capabilities",ue={publisher:S,package_:v,name:"Capability"},Pn={publisher:S,package_:v,name:"commandName"},Ge={publisher:S,package_:v,name:"description"},wn={publisher:S,package_:v,name:"managesType"},Sn={publisher:S,package_:v,name:"deploymentTarget"},vn={publisher:S,package_:v,name:"hasCommand"},$n={publisher:S,package_:v,name:"subcommandName"},Rn={publisher:S,package_:v,name:"performs"},_n={publisher:S,package_:v,name:"hasArgument"},Cn={publisher:S,package_:v,name:"argumentName"},He={publisher:S,package_:v,name:"isRequired"},Me={publisher:S,package_:v,name:"isOption"},Dn={publisher:S,package_:v,name:"defaultValue"};async function We(n,e,t){let o=F(),r=new bn,s=[];for(let[i,a]of Object.entries(o.capabilities)){let c=n.get(a.publisher,a.package_,a.version);if(!c){console.error(`  WARNING: Cached content missing for capability "${i}" (${a.publisher}/${a.package_}@${a.version})`);continue}try{let l=e.parse(c),p=new _(l,t),d=await r.parseKanonaks(p),u=In(d,a.publisher,a.package_,a.version);u?s.push(u):console.error(`  WARNING: No Capability instance found in "${i}" (${a.publisher}/${a.package_}@${a.version})`)}catch(l){console.error(`  WARNING: Failed to parse capability "${i}": ${l}`)}}return s}function In(n,e,t,o){let r=D(n,ue);if(r.length===0)return;let s=r[0],i=P(s,Pn)??"",a=P(s,Ge)??"",c=H(s,wn),l=H(s,Sn),p=[];for(let d of M(s,vn)){let u=Kn(d,n);u&&p.push(u)}return{commandName:i,description:a,managesTypeKey:c?I(c):"",deploymentTargetKey:l?I(l):"",commands:p,publisher:e,package_:t,version:o}}function Kn(n,e){let t;if(n instanceof Be)t=n;else if(n instanceof ze){let c=qe(e,n.subject.publisher,n.subject.package_,n.subject.name);c&&(t=c)}if(!t)return;let o=P(t,$n)??"",r=P(t,Ge)??"",s=H(t,Rn),i=M(t,_n),a=[];for(let c of i){let l=An(c,e);l&&a.push(l)}return{subcommandName:o,description:r,arguments:a,actionKey:s?I(s):""}}function An(n,e){let t;if(n instanceof Be)t=n;else if(n instanceof ze){let c=qe(e,n.subject.publisher,n.subject.package_,n.subject.name);c&&(t=c)}if(!t)return;let o=P(t,Cn)??"",r=P(t,He)==="true"||Ve(t,He)===!0,s=P(t,Me)==="true"||Ve(t,Me)===!0,i=P(t,Dn),a={argumentName:o,required:r,isOption:s};return i!==void 0&&(a.defaultValue=i),a}function Ve(n,e){for(let t of n.statement){let o=t,r=o.predicate;if(r?.subject&&r.subject.publisher===e.publisher&&r.subject.package_===e.package_&&r.subject.name===e.name)return typeof o.object=="boolean"?o.object:void 0}}function qe(n,e,t,o){for(let r of n){if(!("name"in r)||!("namespace"in r))continue;let s=r;if(s.name===o&&!(!s.namespace||typeof s.namespace!="string")&&s.namespace.startsWith(`${e}/${t}@`))return r}}var jn={publisher:S,package_:v,name:"commandName"};function Ye(){let n=new xn("capability").description("Manage Kanonak CLI capabilities (pluggable command groups)");return n.command("add <package>").description("Install a capability from a Kanonak publisher").action(async e=>{await Nn(e)}),n.command("remove <name>").description("Remove an installed capability").action(async e=>{await Fn(e)}),n.command("list").description("List installed capabilities").action(async()=>{await Hn()}),n}async function Nn(n){let e=U(n);e||(console.error(`Invalid package reference: ${n}`),console.error("Expected format: {publisher}/{package}@{version} or {publisher}/{package}"),process.exit(1));let{publisher:t,packageName:o,version:r}=e,s=new C,i=new En,a=new Tn,c=new Un,l=Ln(c),p=new On({fetchFn:l}),d=r??await p.getHighestVersion(t,o);d||(console.error(`Could not resolve version for ${t}/${o}`),process.exit(1)),console.log(`Installing capability ${t}/${o}@${d}...`);let u=s.get(t,o,d);if(!u){let R=await p.getPackageUrl(t,o,d),Y=await l(R,t);if(!Y.ok)throw new Error(`Failed to fetch ${R} (${Y.status} ${Y.statusText})`);u=await Y.text(),s.put(t,o,d,u)}let g=i.parse(u),f=await A(process.cwd(),i),y=new _(g,f),k=await a.parseKanonaks(y),m=D(k,ue);m.length===0&&(console.error(`Package ${t}/${o}@${d} does not contain a ${S}/${v}/Capability instance.`),process.exit(1));let b=m[0],h=P(b,jn);h||(console.error(`Capability instance in ${t}/${o}@${d} has no commandName property.`),process.exit(1));let w=F();w.capabilities[h]={publisher:t,package_:o,version:d,resolved:await p.getPackageUrl(t,o,d),integrity:O(u)},le(w),console.log(`
-Installed capability "${h}".`),console.log(`Run "kanonak ${h} --help" to get started.`)}async function Fn(n){let e=F();e.capabilities[n]||(console.error(`Capability "${n}" is not installed.`),process.exit(1));let t=e.capabilities[n];delete e.capabilities[n],le(e),console.log(`Removed capability "${n}" (${t.publisher}/${t.package_}@${t.version}).`)}async function Hn(){let n=F(),e=Object.entries(n.capabilities);if(e.length===0){console.log("No capabilities installed."),console.log("Install one with: kanonak capability add {publisher}/{package}");return}console.log(`Installed capabilities:
-`);for(let[t,o]of e)console.log(`  ${t}  ${o.publisher}/${o.package_}@${o.version}`)}import{Command as Je}from"commander";function V(n){return`${S}/${v}/${n}`}var me={[V("fetchAndDeploy")]:(n,e,t,o)=>n.add(e,t[0],o),[V("removeDeployed")]:(n,e,t,o)=>n.remove(e,t[0],o),[V("listDeployed")]:(n,e,t,o)=>n.list(e,o),[V("updateDeployed")]:(n,e,t,o)=>n.update(e,t[0],o),[V("searchAvailable")]:(n,e,t,o)=>n.search(e,o),[V("showInfo")]:(n,e,t,o)=>n.info(e,t[0],o)};function Xe(n,e,t){for(let o of e){let r=new Je(o.commandName).description(o.description.trim());for(let s of o.commands){let i=r.command(Mn(s));i.description(s.description);for(let a of s.arguments)if(a.isOption){let c=a.defaultValue!=null?`--${a.argumentName} [value]`:`--${a.argumentName} <value>`;i.option(c,"",a.defaultValue)}i.action(async(...a)=>{let c=Vn(a);await Bn(t,o,s,a,c)})}n.addCommand(r)}}function Mn(n){let e=n.arguments.filter(t=>!t.isOption).map(t=>t.required?`<${t.argumentName}>`:`[${t.argumentName}]`);return[n.subcommandName,...e].join(" ")}function Vn(n){for(let e=n.length-1;e>=0;e--)if(n[e]&&typeof n[e]=="object"&&!(n[e]instanceof Je))return n[e];return{}}async function Bn(n,e,t,o,r){let s=[];for(let a of o)if(typeof a=="string")s.push(a);else break;t.actionKey||(console.error(`Capability subcommand '${t.subcommandName}' has no resolved \`performs:\` Action. Every CapabilityCommand must declare a performs value pointing at a named Action instance from the capabilities ontology. Known actions: ${Object.keys(me).join(", ")}.`),process.exit(1));let i=me[t.actionKey];i||(console.error(`Capability subcommand '${t.subcommandName}' references unknown Action '${t.actionKey}'. Known actions: ${Object.keys(me).join(", ")}.`),process.exit(1)),await i(n,e,s,r)}import{KanonakObjectParser as zn,PublisherIndex as ge,PublisherConfigResolver as Gn}from"@kanonak-protocol/sdk";var X=class{constructor(e,t,o,r,s,i){this.fileCache=e;this.parser=t;this.publisherIndex=o;this.fetchFn=r;this.handlerRegistry=s;this.repository=i}fileCache;parser;publisherIndex;fetchFn;handlerRegistry;repository;objectParser=new zn;async add(e,t,o){let r=U(t);r||(console.error(`Invalid package reference: ${t}`),console.error("Expected format: {publisher}/{package}@{version} or {publisher}/{package}"),process.exit(1));let{publisher:s,packageName:i,version:a}=r,c=a??await this.publisherIndex.getHighestVersion(s,i);c||(console.error(`Could not resolve version for ${s}/${i}`),process.exit(1));let l=this.fileCache.get(s,i,c);if(!l){let k=await this.publisherIndex.getPackageUrl(s,i,c),m=await this.fetchFn(k,s);if(!m.ok)throw new Error(`Failed to fetch ${k} (${m.status} ${m.statusText})`);l=await m.text(),this.fileCache.put(s,i,c,l)}let p=this.parser.parse(l),d=new _(p,this.repository),u=await this.objectParser.parseKanonaks(d),g=Qe(e.managesTypeKey);g||(console.error(`Capability "${e.commandName}" has no resolved managesType.`),process.exit(1));let f=D(u,g);f.length===0&&(console.error(`Package ${s}/${i}@${c} does not contain any ${I(g)} instances.`),process.exit(1));let y=this.handlerRegistry.get(e.deploymentTargetKey);y?await y.deploy({instances:f,allKanonaks:u,repository:this.repository,options:o}):console.log(`Cached ${s}/${i}@${c} (no deployment handler for "${e.deploymentTargetKey}")`)}async remove(e,t,o){await this.requireHandler(e).undeploy(t,{repository:this.repository,options:o})}async list(e,t){let r=await this.requireHandler(e).list({repository:this.repository,options:t}),s=e.managesTypeKey||"managed";if(r.length===0){console.log(`No ${s} instances installed.`);return}console.log(`Installed ${s} instances:
-`);for(let i of r){let a=i.publisher?`${i.publisher}/${i.package_}@${i.version}`:"unmanaged";console.log(`  ${i.name}  (${a})  ${i.path}`)}}async update(e,t,o){let s=await this.requireHandler(e).list({repository:this.repository,options:o}),i=t?s.filter(c=>c.name===t):s.filter(c=>c.publisher);if(i.length===0){console.log(t?`"${t}" not found.`:"No managed instances to update.");return}let a=0;for(let c of i){let l=await this.publisherIndex.getHighestVersion(c.publisher,c.package_);!l||l===c.version||(console.log(`Updating ${c.name}: ${c.version} \u2192 ${l}`),await this.add(e,`${c.publisher}/${c.package_}@${l}`,o),a++)}console.log(a===0?"All instances are up to date.":`
-Updated ${a} instance(s).`)}async search(e,t){let o=t.publisher??"kanonak.org",r=Qe(e.managesTypeKey);if(!r){console.error("Capability has no resolved managesType; nothing to search for.");return}console.log(`Searching ${o} for ${I(r)} instances...
-`);let s=new Gn,i=await s.getConfig(o),a=s.resolveIndexUrl(o,i),c=await this.fetchFn(a,o);if(!c.ok){console.error(`Failed to fetch package index from ${o}.`);return}let l=await c.text(),p=ge.parseIndex(l);if(p.size===0){console.error(`No packages found for publisher "${o}".`);return}let d=new Map;for(let[f,y]of p){let k=[...y].sort((m,b)=>{let h=ge.parseVersion(m),w=ge.parseVersion(b);return!h||!w?0:h.major!==w.major?w.major-h.major:h.minor!==w.minor?w.minor-h.minor:w.patch-h.patch});d.set(f,k[0])}let u=[],g=0;for(let[f,y]of d){let k=this.fileCache.get(o,f,y);if(!k)try{let m=await this.publisherIndex.getPackageUrl(o,f,y),b=await this.fetchFn(m,o);if(!b.ok)continue;k=await b.text(),this.fileCache.put(o,f,y,k)}catch{continue}try{let m=this.parser.parse(k),b=new _(m,this.repository),h=await this.objectParser.parseKanonaks(b),w=D(h,r);for(let R of w)u.push({publisher:o,package_:f,version:y,subject:R});g++}catch{continue}}if(u.length===0){console.log(`No ${I(r)} instances found across ${g} package(s).`);return}console.log(`Found ${u.length} ${I(r)} instance(s):
-`);for(let f of u)console.log(`  ${f.publisher}/${f.package_}@${f.version}`),console.log(`    ${f.subject.name}`),console.log()}async info(e,t,o){let i=(await this.requireHandler(e).list({repository:this.repository,options:o})).find(a=>a.name===t);i||(console.error(`"${t}" is not installed.`),process.exit(1)),console.log(`Name:      ${i.name}`),console.log(`Type:      ${e.managesTypeKey||"n/a"}`),console.log(`Publisher: ${i.publisher||"unmanaged"}`),console.log(`Package:   ${i.package_||"n/a"}`),console.log(`Version:   ${i.version||"n/a"}`),console.log(`Path:      ${i.path}`)}requireHandler(e){let t=this.handlerRegistry.get(e.deploymentTargetKey);return t||(console.error(`No deployment handler registered for "${e.deploymentTargetKey}". Ensure the capability's deploymentTarget resolves to a DeploymentTarget instance whose URI is registered in the CLI at startup.`),process.exit(1)),t}};function Qe(n){if(!n)return;let e=n.split("/");if(e.length===3)return{publisher:e[0],package_:e[1],name:e[2]}}var Q=class{handlers=new Map;register(e,t){this.handlers.set(e,t)}get(e){return this.handlers.get(e)??null}};import{mkdirSync as So,rmSync as vo,existsSync as te,readdirSync as $o,writeFileSync as Ro}from"fs";import{join as ne}from"path";import{KanonakObjectParser as _o,KanonakParser as Co}from"@kanonak-protocol/sdk";import{SubjectKanonak as Ze,EmbeddedKanonak as Wn,ReferenceKanonak as qn}from"@kanonak-protocol/sdk";var E="kanonak.org",T="agent-skills",Yn="kanonak.org",Jn="core-spdx";var Xn={publisher:E,package_:T,name:"name"},Qn={publisher:E,package_:T,name:"description"},Zn={publisher:E,package_:T,name:"license"},eo={publisher:E,package_:T,name:"compatibility"},to={publisher:E,package_:T,name:"allowedTools"},no={publisher:E,package_:T,name:"hasSection"},oo={publisher:E,package_:T,name:"title"},ro={publisher:E,package_:T,name:"body"},so={publisher:Yn,package_:Jn,name:"spdxId"};async function et(n,e,t,o,r){let s=[],i=new ye(t,o,r);for(let a of e){let c=await io(a,n,i);c&&s.push(c)}return s}async function io(n,e,t){let o=P(n,Xn),r=P(n,Qn);if(!o||!r)return;let s=[];s.push(`name: ${o}`),s.push(`description: ${fe(r)}`);let i=H(n,Zn);if(i){let u=await t.resolveSubject(i,e),g=u?P(u,so):void 0;s.push(`license: ${g??i.name}`)}let a=P(n,eo);a&&s.push(`compatibility: ${fe(a)}`);let c=M(n,to);if(c.length>0){let u=await co(c,e,t);u&&s.push(`allowed-tools: ${u}`)}let l=[];for(let u of M(n,no)){let g=ao(u);g&&l.push(g)}let p=l.join(`
+  ${n}`),process.exit(1)}}import{Command as Hr}from"commander";import{KanonakParser as zr,KanonakObjectParser as Gr,PublisherIndex as qr,CredentialStore as Wr,createAuthenticatedFetch as Xr}from"@kanonak-protocol/sdk";import{readFileSync as br,writeFileSync as wr,existsSync as Sr}from"fs";import{join as Dr}from"path";import kt from"js-yaml";import{getGlobalCachePath as vr}from"@kanonak-protocol/sdk";var Ar=`# This file is generated by Kanonak CLI. Do not edit manually.
+`;function bt(){let t=vr();return Dr(t,"..","capabilities.lock")}function J(){let t=bt();if(!Sr(t))return{version:"1",lastUpdated:new Date().toISOString(),capabilities:{}};let e=br(t,"utf-8"),n=kt.load(e);return!n||typeof n!="object"||n.version!=="1"?{version:"1",lastUpdated:new Date().toISOString(),capabilities:{}}:{version:"1",lastUpdated:n.lastUpdated??new Date().toISOString(),capabilities:n.capabilities??{}}}function Ne(t){t.lastUpdated=new Date().toISOString();let e={};for(let r of Object.keys(t.capabilities).sort())e[r]=t.capabilities[r];t.capabilities=e;let n=kt.dump(t,{lineWidth:-1,sortKeys:!1,quotingType:'"'});wr(bt(),Ar+n,"utf-8")}var C=class{constructor(e,n){this.doc=e;this.broader=n}doc;broader;async getAllDocumentsAsync(){return[this.doc]}async getDocumentAsync(e){return this.broader.getDocumentAsync(e)}async getDocumentsByNamespaceAsync(e,n){return this.broader.getDocumentsByNamespaceAsync(e,n)}async getHighestCompatibleVersionAsync(e,n){return this.broader.getHighestCompatibleVersionAsync(e,n)}async saveDocumentAsync(){throw new Error("SingleDocumentRepository is read-only")}async deleteDocumentAsync(){throw new Error("SingleDocumentRepository is read-only")}async clearNamespaceAsync(){throw new Error("SingleDocumentRepository is read-only")}async getAllDocumentReferencesAsync(){return[]}async getDocumentContentAsync(e){return this.broader.getDocumentContentAsync(e)}async getDocumentUriAsync(e){return this.broader.getDocumentUriAsync(e)}};import{KanonakObjectParser as Ir,EmbeddedKanonak as Ct,ReferenceKanonak as _t}from"@kanonak-protocol/sdk";import{SubjectKanonak as wt,DefinedKanonak as $r,StringStatement as Cr,NumberStatement as _r,BooleanStatement as Kr,ReferenceStatement as St,EmbeddedStatement as Pr,ListStatement as Er}from"@kanonak-protocol/sdk";function x(t){return`${t.publisher}/${t.package_}/${t.name}`}function M(t,e){return t.publisher===e.publisher&&t.package_===e.package_&&t.name===e.name}function Fe(t,e){if(!(t instanceof $r))return!1;for(let n of t.statement)if(n.predicate?.subject?.name==="type"&&n instanceof St){let o=n.object;if(M(o.subject,e))return!0}return!1}function _(t,e){let n=[];for(let r of t)r instanceof wt&&Fe(r,e)&&n.push(r);return n}function Dt(t,e){for(let n of t){if(!(n instanceof wt)||n.name!==e.name)continue;if((n.namespace||"").startsWith(`${e.publisher}/${e.package_}@`))return n}}function me(t,e){for(let n of t.statement){let r=n.predicate;if(r?.subject&&M(r.subject,e))return n}}function se(t,e){let n=me(t,e);if(n&&(n instanceof Cr||n instanceof _r||n instanceof Kr))return n.object}function A(t,e){let n=se(t,e);return typeof n=="string"?n:void 0}function B(t,e){let n=me(t,e);if(n instanceof St)return n.object.subject}function V(t,e){let n=me(t,e);if(n instanceof Pr)return n.object}function Y(t,e){let n=me(t,e);return n instanceof Er?n.object??[]:[]}var K="kanonak.org",P="capabilities",Me={publisher:K,package_:P,name:"Capability"},Rr={publisher:K,package_:P,name:"commandName"},Kt={publisher:K,package_:P,name:"description"},Tr={publisher:K,package_:P,name:"managesType"},jr={publisher:K,package_:P,name:"deploymentTarget"},Ur={publisher:K,package_:P,name:"hasCommand"},xr={publisher:K,package_:P,name:"subcommandName"},Or={publisher:K,package_:P,name:"performs"},Lr={publisher:K,package_:P,name:"hasArgument"},Nr={publisher:K,package_:P,name:"argumentName"},vt={publisher:K,package_:P,name:"isRequired"},At={publisher:K,package_:P,name:"isOption"},Fr={publisher:K,package_:P,name:"defaultValue"};async function Pt(t,e,n){let r=J(),o=new Ir,i=[];for(let[a,c]of Object.entries(r.capabilities)){let s=t.get(c.publisher,c.package_,c.version);if(!s){console.error(`  WARNING: Cached content missing for capability "${a}" (${c.publisher}/${c.package_}@${c.version})`);continue}try{let l=e.parse(s),u=new C(l,n),p=await o.parseKanonaks(u),m=Mr(p,c.publisher,c.package_,c.version);m?i.push(m):console.error(`  WARNING: No Capability instance found in "${a}" (${c.publisher}/${c.package_}@${c.version})`)}catch(l){console.error(`  WARNING: Failed to parse capability "${a}": ${l}`)}}return i}function Mr(t,e,n,r){let o=_(t,Me);if(o.length===0)return;let i=o[0],a=A(i,Rr)??"",c=A(i,Kt)??"",s=B(i,Tr),l=B(i,jr),u=[];for(let p of Y(i,Ur)){let m=Br(p,t);m&&u.push(m)}return{commandName:a,description:c,managesTypeKey:s?x(s):"",deploymentTargetKey:l?x(l):"",commands:u,publisher:e,package_:n,version:r}}function Br(t,e){let n;if(t instanceof Ct)n=t;else if(t instanceof _t){let s=Et(e,t.subject.publisher,t.subject.package_,t.subject.name);s&&(n=s)}if(!n)return;let r=A(n,xr)??"",o=A(n,Kt)??"",i=B(n,Or),a=Y(n,Lr),c=[];for(let s of a){let l=Vr(s,e);l&&c.push(l)}return{subcommandName:r,description:o,arguments:c,actionKey:i?x(i):""}}function Vr(t,e){let n;if(t instanceof Ct)n=t;else if(t instanceof _t){let s=Et(e,t.subject.publisher,t.subject.package_,t.subject.name);s&&(n=s)}if(!n)return;let r=A(n,Nr)??"",o=A(n,vt)==="true"||$t(n,vt)===!0,i=A(n,At)==="true"||$t(n,At)===!0,a=A(n,Fr),c={argumentName:r,required:o,isOption:i};return a!==void 0&&(c.defaultValue=a),c}function $t(t,e){for(let n of t.statement){let r=n,o=r.predicate;if(o?.subject&&o.subject.publisher===e.publisher&&o.subject.package_===e.package_&&o.subject.name===e.name)return typeof r.object=="boolean"?r.object:void 0}}function Et(t,e,n,r){for(let o of t){if(!("name"in o)||!("namespace"in o))continue;let i=o;if(i.name===r&&!(!i.namespace||typeof i.namespace!="string")&&i.namespace.startsWith(`${e}/${n}@`))return o}}var Jr={publisher:K,package_:P,name:"commandName"};function It(){let t=new Hr("capability").description("Manage Kanonak CLI capabilities (pluggable command groups)");return t.command("add <package>").description("Install a capability from a Kanonak publisher").action(async e=>{await Yr(e)}),t.command("remove <name>").description("Remove an installed capability").action(async e=>{await Zr(e)}),t.command("list").description("List installed capabilities").action(async()=>{await Qr()}),t}async function Yr(t){let e=G(t);e||(console.error(`Invalid package reference: ${t}`),console.error("Expected format: {publisher}/{package}@{version} or {publisher}/{package}"),process.exit(1));let{publisher:n,packageName:r,version:o}=e,i=new U,a=new zr,c=new Gr,s=new Wr,l=Xr(s),u=new qr({fetchFn:l}),p=o??await u.getHighestVersion(n,r);p||(console.error(`Could not resolve version for ${n}/${r}`),process.exit(1)),console.log(`Installing capability ${n}/${r}@${p}...`);let m=i.get(n,r,p);if(!m){let R=await u.getPackageUrl(n,r,p),de=await l(R,n);if(!de.ok)throw new Error(`Failed to fetch ${R} (${de.status} ${de.statusText})`);m=await de.text(),i.put(n,r,p,m)}let h=a.parse(m),g=await L(process.cwd(),a),k=new C(h,g),S=await c.parseKanonaks(k),y=_(S,Me);y.length===0&&(console.error(`Package ${n}/${r}@${p} does not contain a ${K}/${P}/Capability instance.`),process.exit(1));let D=y[0],w=A(D,Jr);w||(console.error(`Capability instance in ${n}/${r}@${p} has no commandName property.`),process.exit(1));let $=J();$.capabilities[w]={publisher:n,package_:r,version:p,resolved:await u.getPackageUrl(n,r,p),integrity:N(m)},Ne($),console.log(`
+Installed capability "${w}".`),console.log(`Run "kanonak ${w} --help" to get started.`)}async function Zr(t){let e=J();e.capabilities[t]||(console.error(`Capability "${t}" is not installed.`),process.exit(1));let n=e.capabilities[t];delete e.capabilities[t],Ne(e),console.log(`Removed capability "${t}" (${n.publisher}/${n.package_}@${n.version}).`)}async function Qr(){let t=J(),e=Object.entries(t.capabilities);if(e.length===0){console.log("No capabilities installed."),console.log("Install one with: kanonak capability add {publisher}/{package}");return}console.log(`Installed capabilities:
+`);for(let[n,r]of e)console.log(`  ${n}  ${r.publisher}/${r.package_}@${r.version}`)}import{Command as Rt}from"commander";function Z(t){return`${K}/${P}/${t}`}var Be={[Z("fetch-and-deploy")]:(t,e,n,r)=>t.add(e,n[0],r),[Z("remove-deployed")]:(t,e,n,r)=>t.remove(e,n[0],r),[Z("list-deployed")]:(t,e,n,r)=>t.list(e,r),[Z("update-deployed")]:(t,e,n,r)=>t.update(e,n[0],r),[Z("search-available")]:(t,e,n,r)=>t.search(e,r),[Z("show-info")]:(t,e,n,r)=>t.info(e,n[0],r)};function Tt(t,e,n){for(let r of e){let o=new Rt(r.commandName).description(r.description.trim());for(let i of r.commands){let a=o.command(eo(i));a.description(i.description);for(let c of i.arguments)if(c.isOption){let s=c.defaultValue!=null?`--${c.argumentName} [value]`:`--${c.argumentName} <value>`;a.option(s,"",c.defaultValue)}a.action(async(...c)=>{let s=to(c);await no(n,r,i,c,s)})}t.addCommand(o)}}function eo(t){let e=t.arguments.filter(n=>!n.isOption).map(n=>n.required?`<${n.argumentName}>`:`[${n.argumentName}]`);return[t.subcommandName,...e].join(" ")}function to(t){for(let e=t.length-1;e>=0;e--)if(t[e]&&typeof t[e]=="object"&&!(t[e]instanceof Rt))return t[e];return{}}async function no(t,e,n,r,o){let i=[];for(let c of r)if(typeof c=="string")i.push(c);else break;n.actionKey||(console.error(`Capability subcommand '${n.subcommandName}' has no resolved \`performs:\` Action. Every CapabilityCommand must declare a performs value pointing at a named Action instance from the capabilities ontology. Known actions: ${Object.keys(Be).join(", ")}.`),process.exit(1));let a=Be[n.actionKey];a||(console.error(`Capability subcommand '${n.subcommandName}' references unknown Action '${n.actionKey}'. Known actions: ${Object.keys(Be).join(", ")}.`),process.exit(1)),await a(t,e,i,o)}import{KanonakObjectParser as ro,PublisherIndex as Ve,PublisherConfigResolver as oo}from"@kanonak-protocol/sdk";var fe=class{constructor(e,n,r,o,i,a){this.fileCache=e;this.parser=n;this.publisherIndex=r;this.fetchFn=o;this.handlerRegistry=i;this.repository=a}fileCache;parser;publisherIndex;fetchFn;handlerRegistry;repository;objectParser=new ro;async add(e,n,r){let o=G(n);o||(console.error(`Invalid package reference: ${n}`),console.error("Expected format: {publisher}/{package}@{version} or {publisher}/{package}"),process.exit(1));let{publisher:i,packageName:a,version:c}=o,s=c??await this.publisherIndex.getHighestVersion(i,a);s||(console.error(`Could not resolve version for ${i}/${a}`),process.exit(1));let l=this.fileCache.get(i,a,s);if(!l){let S=await this.publisherIndex.getPackageUrl(i,a,s),y=await this.fetchFn(S,i);if(!y.ok)throw new Error(`Failed to fetch ${S} (${y.status} ${y.statusText})`);l=await y.text(),this.fileCache.put(i,a,s,l)}let u=this.parser.parse(l),p=new C(u,this.repository),m=await this.objectParser.parseKanonaks(p),h=jt(e.managesTypeKey);h||(console.error(`Capability "${e.commandName}" has no resolved managesType.`),process.exit(1));let g=_(m,h);g.length===0&&(console.error(`Package ${i}/${a}@${s} does not contain any ${x(h)} instances.`),process.exit(1));let k=this.handlerRegistry.get(e.deploymentTargetKey);k?await k.deploy({instances:g,allKanonaks:m,repository:this.repository,options:r}):console.log(`Cached ${i}/${a}@${s} (no deployment handler for "${e.deploymentTargetKey}")`)}async remove(e,n,r){await this.requireHandler(e).undeploy(n,{repository:this.repository,options:r})}async list(e,n){let o=await this.requireHandler(e).list({repository:this.repository,options:n}),i=e.managesTypeKey||"managed";if(o.length===0){console.log(`No ${i} instances installed.`);return}console.log(`Installed ${i} instances:
+`);for(let a of o){let c=a.publisher?`${a.publisher}/${a.package_}@${a.version}`:"unmanaged";console.log(`  ${a.name}  (${c})  ${a.path}`)}}async update(e,n,r){let i=await this.requireHandler(e).list({repository:this.repository,options:r}),a=n?i.filter(s=>s.name===n):i.filter(s=>s.publisher);if(a.length===0){console.log(n?`"${n}" not found.`:"No managed instances to update.");return}let c=0;for(let s of a){let l=await this.publisherIndex.getHighestVersion(s.publisher,s.package_);!l||l===s.version||(console.log(`Updating ${s.name}: ${s.version} \u2192 ${l}`),await this.add(e,`${s.publisher}/${s.package_}@${l}`,r),c++)}console.log(c===0?"All instances are up to date.":`
+Updated ${c} instance(s).`)}async search(e,n){let r=n.publisher??"kanonak.org",o=jt(e.managesTypeKey);if(!o){console.error("Capability has no resolved managesType; nothing to search for.");return}console.log(`Searching ${r} for ${x(o)} instances...
+`);let i=new oo,a=await i.getConfig(r),c=i.resolveIndexUrl(r,a),s=await this.fetchFn(c,r);if(!s.ok){console.error(`Failed to fetch package index from ${r}.`);return}let l=await s.text(),u=Ve.parseIndex(l);if(u.size===0){console.error(`No packages found for publisher "${r}".`);return}let p=new Map;for(let[g,k]of u){let S=[...k].sort((y,D)=>{let w=Ve.parseVersion(y),$=Ve.parseVersion(D);return!w||!$?0:w.major!==$.major?$.major-w.major:w.minor!==$.minor?$.minor-w.minor:$.patch-w.patch});p.set(g,S[0])}let m=[],h=0;for(let[g,k]of p){let S=this.fileCache.get(r,g,k);if(!S)try{let y=await this.publisherIndex.getPackageUrl(r,g,k),D=await this.fetchFn(y,r);if(!D.ok)continue;S=await D.text(),this.fileCache.put(r,g,k,S)}catch{continue}try{let y=this.parser.parse(S),D=new C(y,this.repository),w=await this.objectParser.parseKanonaks(D),$=_(w,o);for(let R of $)m.push({publisher:r,package_:g,version:k,subject:R});h++}catch{continue}}if(m.length===0){console.log(`No ${x(o)} instances found across ${h} package(s).`);return}console.log(`Found ${m.length} ${x(o)} instance(s):
+`);for(let g of m)console.log(`  ${g.publisher}/${g.package_}@${g.version}`),console.log(`    ${g.subject.name}`),console.log()}async info(e,n,r){let a=(await this.requireHandler(e).list({repository:this.repository,options:r})).find(c=>c.name===n);a||(console.error(`"${n}" is not installed.`),process.exit(1)),console.log(`Name:      ${a.name}`),console.log(`Type:      ${e.managesTypeKey||"n/a"}`),console.log(`Publisher: ${a.publisher||"unmanaged"}`),console.log(`Package:   ${a.package_||"n/a"}`),console.log(`Version:   ${a.version||"n/a"}`),console.log(`Path:      ${a.path}`)}requireHandler(e){let n=this.handlerRegistry.get(e.deploymentTargetKey);return n||(console.error(`No deployment handler registered for "${e.deploymentTargetKey}". Ensure the capability's deploymentTarget resolves to a DeploymentTarget instance whose URI is registered in the CLI at startup.`),process.exit(1)),n}};function jt(t){if(!t)return;let e=t.split("/");if(e.length===3)return{publisher:e[0],package_:e[1],name:e[2]}}var ge=class{handlers=new Map;register(e,n){this.handlers.set(e,n)}get(e){return this.handlers.get(e)??null}};import{mkdirSync as ki,rmSync as bi,existsSync as _e,readdirSync as wi,writeFileSync as Si}from"fs";import{join as Ke}from"path";import{KanonakObjectParser as Di,KanonakParser as vi}from"@kanonak-protocol/sdk";import{SubjectKanonak as Ut}from"@kanonak-protocol/sdk";var ye=class{constructor(e,n,r){this.repository=e;this.parser=n;this.objectParser=r}repository;parser;objectParser;cache=new Map;async resolveSubject(e,n){let r=Dt(n,e);if(r)return r;let o=`${e.publisher}/${e.package_}`,i=this.cache.get(o);if(!i){let a=await this.repository.getDocumentsByNamespaceAsync(e.publisher,e.package_);if(a.length===0)return;let c=a[0],s=new C(c,this.repository);i=await this.objectParser.parseKanonaks(s),this.cache.set(o,i)}for(let a of i)if(a instanceof Ut&&a.name===e.name&&a.namespace&&a.namespace.startsWith(`${e.publisher}/${e.package_}@`))return a;for(let a of i)if(a instanceof Ut&&a.name===e.name)return a}};import{DefinedKanonak as xt,ReferenceKanonak as He,StringStatement as lo,NumberStatement as uo,BooleanStatement as po,ReferenceStatement as mo,EmbeddedStatement as fo,ListStatement as go}from"@kanonak-protocol/sdk";var io="kanonak.org",ao="document-ast",b=t=>({publisher:io,package_:ao,name:t}),T={Document:b("Document"),Block:b("Block"),Inline:b("Inline"),StructuredValue:b("StructuredValue"),Heading:b("Heading"),Paragraph:b("Paragraph"),RawBlock:b("RawBlock"),Text:b("Text"),StructuredMap:b("StructuredMap"),StructuredEntry:b("StructuredEntry"),StructuredList:b("StructuredList"),StringScalar:b("StringScalar"),IntegerScalar:b("IntegerScalar"),EscapeHint:b("EscapeHint"),MediaType:b("MediaType"),metadata:b("metadata"),children:b("children"),level:b("level"),inlines:b("inlines"),text:b("text"),entries:b("entries"),key:b("key"),value:b("value"),escapeHint:b("escapeHint"),items:b("items"),stringValue:b("stringValue"),integerValue:b("integerValue"),rawContent:b("rawContent"),mediaType:b("mediaType"),mimeType:b("mimeType"),ESC_RAW:b("esc-raw"),ESC_YAML_SAFE:b("esc-yaml-safe"),ESC_TOML_STRING:b("esc-toml-string"),ESC_TOML_MULTILINE:b("esc-toml-multiline"),ESC_JSON:b("esc-json"),TEXT_PLAIN:b("text-plain"),TEXT_MARKDOWN:b("text-markdown"),TEXT_HTML:b("text-html"),APPLICATION_JSON:b("application-json"),TEXT_YAML:b("text-yaml"),IMAGE_SVG_XML:b("image-svg-xml")},so="kanonak.org",co="transformations",d=t=>({publisher:so,package_:co,name:t}),f={Transformation:d("Transformation"),InputPattern:d("InputPattern"),Expression:d("Expression"),ExpressionKind:d("ExpressionKind"),ExpressionFragment:d("ExpressionFragment"),AstFieldBinding:d("AstFieldBinding"),OutputFormat:d("OutputFormat"),FormatOverride:d("FormatOverride"),RenameEntry:d("RenameEntry"),Artifact:d("Artifact"),NormalizeKind:d("NormalizeKind"),inputPattern:d("inputPattern"),rule:d("rule"),artifactName:d("artifactName"),outputs:d("outputs"),formatOverrides:d("formatOverrides"),matchesClass:d("matchesClass"),requires:d("requires"),kind:d("kind"),astClass:d("astClass"),set:d("set"),iterate:d("iterate"),loopVar:d("loopVar"),emit:d("emit"),condition:d("condition"),thenBuild:d("thenBuild"),elseBuild:d("elseBuild"),parts:d("parts"),stringLiteral:d("stringLiteral"),integerLiteral:d("integerLiteral"),booleanLiteral:d("booleanLiteral"),varName:d("varName"),readSource:d("readSource"),readProp:d("readProp"),traverseSource:d("traverseSource"),through:d("through"),step:d("step"),primary:d("primary"),alternate:d("alternate"),uriNameOf:d("uriNameOf"),listMapSource:d("listMapSource"),mapBody:d("mapBody"),separator:d("separator"),items:d("items"),normSource:d("normSource"),normKind:d("normKind"),checkExpr:d("checkExpr"),refTo:d("refTo"),fragmentRef:d("fragmentRef"),expr:d("expr"),labelTarget:d("labelTarget"),labelSource:d("labelSource"),field:d("field"),bindValue:d("bindValue"),backendUri:d("backendUri"),formatTarget:d("formatTarget"),metadataKeys:d("metadataKeys"),metadataRenames:d("metadataRenames"),trailingNewline:d("trailingNewline"),fromKey:d("fromKey"),toKey:d("toKey"),KIND_BUILD_AST_NODE:d("build-ast-node"),KIND_FOR_EACH:d("for-each"),KIND_WHEN:d("when"),KIND_CONCAT:d("concat"),KIND_STRING_LITERAL:d("string-literal"),KIND_INTEGER_LITERAL:d("integer-literal"),KIND_BOOLEAN_LITERAL:d("boolean-literal"),KIND_VAR_REF:d("var-ref"),KIND_PROPERTY_READ:d("property-read"),KIND_TRAVERSE:d("traverse"),KIND_FALLBACK:d("fallback"),KIND_URI_NAME:d("uri-name"),KIND_LIST_MAP:d("list-map"),KIND_JOIN:d("join"),KIND_NORMALIZE:d("normalize"),KIND_IS_SET:d("is-set"),KIND_URI_LITERAL:d("uri-literal"),KIND_CALL_FRAGMENT:d("call-fragment"),KIND_DISPLAY_LABEL:d("display-label"),NORM_TRIM_END:d("trim-end"),FMT_MARKDOWN_FRONTMATTER:d("markdown-with-frontmatter"),FMT_TOML:d("toml"),FMT_JSON:d("json"),FMT_PLAIN_MARKDOWN:d("plain-markdown")};var he=class extends Error{constructor(e){super(e)}},ke=class{constructor(e,n){this.resolver=e;this.allKanonaks=n}resolver;allKanonaks;async evaluate(e,n){switch(e.kind){case"var-ref":{if(!n.has(e.varName))throw new he(`Unbound variable "${e.varName}"`);return n.get(e.varName)}case"string-literal":return e.value;case"integer-literal":return e.value;case"boolean-literal":return e.value;case"uri-literal":return{...e.refTo};case"property-read":{let r=await this.evaluate(e.source,n);return r instanceof xt?ze(r,e.readProp):void 0}case"traverse":{let r=await this.evaluate(e.source,n);if(!(r instanceof xt))return;let o=ze(r,e.through),i;if(o instanceof He?i=o.subject:Array.isArray(o)&&o.length>0&&o[0]instanceof He&&(i=o[0].subject),!i)return;let a=await this.resolver.resolveSubject(i,this.allKanonaks);if(!a)return;let c=new Map(n);return c.set("input",a),this.evaluate(e.step,c)}case"fallback":{let r=await this.evaluate(e.primary,n);return Lt(r)?r:this.evaluate(e.alternate,n)}case"uri-name":{let r=await this.evaluate(e.of,n);return r instanceof He?r.subject.name:ho(r)?r.name:void 0}case"list-map":{let r=await this.evaluate(e.source,n),o=Ge(r),i=[];for(let a of o){let c=new Map(n);c.set(e.loopVar,a),i.push(await this.evaluate(e.mapBody,c))}return i}case"join":{let r=await this.evaluate(e.items,n),o=Ge(r),i=[];for(let a of o)a!=null&&i.push(String(a));return i.join(e.separator)}case"normalize":{let r=await this.evaluate(e.source,n);return typeof r!="string"?r:e.normKind==="trim-end"?r.trimEnd():r}case"is-set":{let r=await this.evaluate(e.check,n);return Lt(r)}case"when":{let r=await this.evaluate(e.condition,n);return yo(r)?this.evaluate(e.thenBuild,n):e.elseBuild?this.evaluate(e.elseBuild,n):void 0}case"concat":{let r=[];for(let o of e.parts){let i=await this.evaluate(o,n);if(i!=null)if(Array.isArray(i))for(let a of i)r.push(a);else r.push(i)}return r}case"for-each":{let r=await this.evaluate(e.iterate,n),o=Ge(r),i=[];for(let a of o){let c=new Map(n);c.set(e.loopVar,a);let s=await this.evaluate(e.emit,c);if(s!=null)if(Array.isArray(s))for(let l of s)i.push(l);else i.push(s)}return i}case"build-ast-node":return this.buildAstNode(e,n);case"display-label":{let r={publisher:e.labelTarget.publisher,package_:e.labelTarget.package_,name:e.labelTarget.name},o=await this.resolver.resolveSubject(r,this.allKanonaks);if(o){let i=ze(o,e.labelSource);if(typeof i=="string"&&i.length>0)return i}return e.labelTarget.name}default:{let r=e;throw new he(`Unhandled expression kind: ${JSON.stringify(r)}`)}}}async buildAstNode(e,n){let r={kind:e.astClass.name};for(let o of e.set){let i=await this.evaluate(o.value,n);if(i==null||Array.isArray(i)&&i.length===0)continue;let a=o.field.name;r[a]=i}return r}};function ze(t,e){let n=[];for(let o of t.statement){let i=o.predicate;i?.subject&&M(i.subject,e)&&n.push(o)}if(n.length===0)return;if(n.length===1&&n[0]instanceof go)return n[0].object;if(n.length===1)return Ot(n[0]);let r=[];for(let o of n){let i=Ot(o);i!==void 0&&r.push(i)}return r}function Ot(t){if(t instanceof lo||t instanceof uo||t instanceof po||t instanceof mo||t instanceof fo)return t.object}function Lt(t){return t==null?!1:typeof t=="string"||Array.isArray(t)?t.length>0:!0}function yo(t){return t==null?!1:typeof t=="boolean"?t:typeof t=="string"?t.length>0:typeof t=="number"?t!==0:Array.isArray(t)?t.length>0:!0}function Ge(t){return t==null?[]:Array.isArray(t)?t:[t]}function ho(t){return t!==null&&typeof t=="object"&&"publisher"in t&&"package_"in t&&"name"in t}import{EmbeddedKanonak as ko,ReferenceKanonak as qe,SubjectKanonak as bo,ListStatement as Ft,StringStatement as wo,ReferenceStatement as We}from"@kanonak-protocol/sdk";var v=class extends Error{constructor(n,r){super(`${n} (at ${r})`);this.path=r}path},Nt=16;function So(t){return t.predicate?.subject}function Mt(t,e){let n=[];for(let r of t.statement){let o=So(r);o&&M(o,e)&&n.push(r)}return n}function j(t,e){let n=B(t,e);if(n)return n;let r=Y(t,e);if(r.length===1&&r[0]instanceof qe)return r[0].subject}function be(t,e){let n=Y(t,e),r=[];for(let o of n)o instanceof ko&&r.push(o);return r}function Bt(t,e){let n=[];for(let r of Mt(t,e))if(r instanceof wo)n.push(r.object);else if(r instanceof Ft)for(let o of r.object)typeof o=="string"?n.push(o):o instanceof qe&&n.push(o.subject.name);else r instanceof We&&n.push(r.object.subject.name);return n}function Do(t,e){let n=t.split("/");if(n.length<3)throw new v(`Invalid property URI "${t}" \u2014 expected publisher/package/name`,e);let[r,o,...i]=n;return{publisher:r,package_:o,name:i.join("/")}}function Vt(t,e){let n=t.name,r=`transformation[${n}]`,o={catalog:e,depth:0},i=V(t,f.inputPattern);if(!i)throw new v("Transformation has no inputPattern",r);let a=vo(i,o,`${r}.inputPattern`),c=V(t,f.rule);if(!c)throw new v("Transformation has no rule",r);let s=Q(c,o,`${r}.rule`),l=V(t,f.artifactName);if(!l)throw new v("Transformation has no artifactName",r);let u=Q(l,o,`${r}.artifactName`),p=new Set;for(let h of Mt(t,f.outputs))if(h instanceof We)p.add(h.object.subject.name);else if(h instanceof Ft)for(let g of h.object)g instanceof qe&&p.add(g.subject.name);if(p.size===0)throw new v("Transformation has no outputs",r);let m=new Map;for(let h of be(t,f.formatOverrides)){let g=`${r}.formatOverrides[]`,k=j(h,f.formatTarget);if(!k)throw new v("FormatOverride missing formatTarget",g);m.set(k.name,Ao(h,g))}return{name:n,inputPattern:a,rule:s,artifactName:u,outputs:p,overrides:m}}function vo(t,e,n){let r=j(t,f.matchesClass);if(!r)throw new v("InputPattern has no matchesClass",n);let o={publisher:r.publisher,package_:r.package_,name:r.name},a=Bt(t,f.requires).map((c,s)=>Do(c,`${n}.requires[${s}]`));return{matchesClass:o,requires:a}}function Ao(t,e){let n=Bt(t,f.metadataKeys),r=n.length>0?n:void 0,o=new Map;for(let c of be(t,f.metadataRenames)){let s=A(c,f.fromKey),l=A(c,f.toKey);s&&l&&o.set(s,l)}let i=se(t,f.trailingNewline);return{metadataKeys:r,metadataRenames:o,trailingNewline:typeof i=="boolean"?i:void 0}}function Q(t,e,n){let r=j(t,f.kind);if(!r)throw new v("Expression has no kind",n);let o=r.name;switch(o){case"build-ast-node":return _o(t,e,n);case"for-each":return Ko(t,e,n);case"when":return Po(t,e,n);case"concat":return Eo(t,e,n);case"string-literal":return{kind:"string-literal",value:ce(t,f.stringLiteral,n)};case"integer-literal":return{kind:"integer-literal",value:xo(t,f.integerLiteral,n)};case"boolean-literal":return{kind:"boolean-literal",value:Oo(t,f.booleanLiteral,n)};case"var-ref":return{kind:"var-ref",varName:ce(t,f.varName,n)};case"property-read":return Io(t,e,n);case"traverse":return Ro(t,e,n);case"fallback":return To(t,e,n);case"uri-name":return{kind:"uri-name",of:E(t,f.uriNameOf,e,`${n}.uriNameOf`)};case"list-map":return jo(t,e,n);case"join":return{kind:"join",separator:ce(t,f.separator,n),items:E(t,f.items,e,`${n}.items`)};case"normalize":return Uo(t,e,n);case"is-set":return{kind:"is-set",check:E(t,f.checkExpr,e,`${n}.checkExpr`)};case"uri-literal":{let i=j(t,f.refTo);if(!i)throw new v("uri-literal has no refTo",n);return{kind:"uri-literal",refTo:{publisher:i.publisher,package_:i.package_,name:i.name}}}case"display-label":{let i=j(t,f.labelTarget);if(!i)throw new v("display-label has no labelTarget",n);let a=j(t,f.labelSource);if(!a)throw new v("display-label has no labelSource",n);return{kind:"display-label",labelTarget:{publisher:i.publisher,package_:i.package_,name:i.name},labelSource:{publisher:a.publisher,package_:a.package_,name:a.name}}}case"call-fragment":{if(e.depth>=Nt)throw new v(`call-fragment recursion exceeded ${Nt} levels (cycle?)`,n);let i=j(t,f.fragmentRef);if(!i)throw new v("call-fragment has no fragmentRef",n);let a=$o(e.catalog,i);if(!a)throw new v(`call-fragment: no ExpressionFragment found matching ${i.publisher}/${i.package_}/${i.name} \u2014 either the fragment is missing or its package is not in the compilation catalog`,n);let c=V(a,f.expr);if(!c)throw new v(`ExpressionFragment "${a.name}" has no expr`,n);let s={catalog:e.catalog,depth:e.depth+1};return Q(c,s,`${n}\u2192fragment[${a.name}]`)}default:throw new v(`Unknown ExpressionKind "${o}"`,n)}}function $o(t,e){for(let n of t)if(n instanceof bo&&n.name===e.name&&n.namespace&&n.namespace.startsWith(`${e.publisher}/${e.package_}@`)&&Co(n))return n}function Co(t){for(let e of t.statement){let n=e.predicate;if(!(!n||n.subject?.name!=="type")&&e instanceof We){let r=e.object.subject;if(r.publisher===f.ExpressionFragment.publisher&&r.package_===f.ExpressionFragment.package_&&r.name===f.ExpressionFragment.name)return!0}}return!1}function _o(t,e,n){let r=j(t,f.astClass);if(!r)throw new v("build-ast-node has no astClass",n);let o={publisher:r.publisher,package_:r.package_,name:r.name},i=[];return be(t,f.set).forEach((c,s)=>{let l=`${n}.set[${s}]`,u=j(c,f.field);if(!u)throw new v("AstFieldBinding has no field",l);let p=E(c,f.bindValue,e,`${l}.bindValue`);i.push({field:{publisher:u.publisher,package_:u.package_,name:u.name},value:p})}),{kind:"build-ast-node",astClass:o,set:i}}function Ko(t,e,n){return{kind:"for-each",iterate:E(t,f.iterate,e,`${n}.iterate`),loopVar:ce(t,f.loopVar,n),emit:E(t,f.emit,e,`${n}.emit`)}}function Po(t,e,n){let r=V(t,f.elseBuild);return{kind:"when",condition:E(t,f.condition,e,`${n}.condition`),thenBuild:E(t,f.thenBuild,e,`${n}.thenBuild`),elseBuild:r?Q(r,e,`${n}.elseBuild`):void 0}}function Eo(t,e,n){return{kind:"concat",parts:be(t,f.parts).map((o,i)=>Q(o,e,`${n}.parts[${i}]`))}}function Io(t,e,n){let r=j(t,f.readProp);if(!r)throw new v("property-read has no readProp",n);return{kind:"property-read",source:E(t,f.readSource,e,`${n}.readSource`),readProp:{publisher:r.publisher,package_:r.package_,name:r.name}}}function Ro(t,e,n){let r=j(t,f.through);if(!r)throw new v("traverse has no through",n);return{kind:"traverse",source:E(t,f.traverseSource,e,`${n}.traverseSource`),through:{publisher:r.publisher,package_:r.package_,name:r.name},step:E(t,f.step,e,`${n}.step`)}}function To(t,e,n){return{kind:"fallback",primary:E(t,f.primary,e,`${n}.primary`),alternate:E(t,f.alternate,e,`${n}.alternate`)}}function jo(t,e,n){return{kind:"list-map",source:E(t,f.listMapSource,e,`${n}.listMapSource`),loopVar:ce(t,f.loopVar,n),mapBody:E(t,f.mapBody,e,`${n}.mapBody`)}}function Uo(t,e,n){let r=j(t,f.normKind);if(!r)throw new v("normalize has no normKind",n);let o=r.name;if(o!=="trim-end")throw new v(`Unknown NormalizeKind "${o}"`,n);return{kind:"normalize",source:E(t,f.normSource,e,`${n}.normSource`),normKind:o}}function E(t,e,n,r){let o=V(t,e);if(!o)throw new v("missing child expression",r);return Q(o,n,r)}function ce(t,e,n){let r=A(t,e);if(typeof r!="string")throw new v(`missing required string property "${e.name}"`,n);return r}function xo(t,e,n){let r=se(t,e);if(typeof r!="number")throw new v(`missing required integer property "${e.name}"`,n);return r}function Oo(t,e,n){let r=se(t,e);if(typeof r!="boolean")throw new v(`missing required boolean property "${e.name}"`,n);return r}function Ht(t,e){return t.publisher===e.publisher&&t.package_===e.package_&&t.name===e.name}var we=class{backendUri="kanonak.org/transformations/backend/markdown-with-frontmatter";render(e,n){let r=Lo(e.metadata,n),o=Mo(e.children),a=["---",...r,"---","",o].join(`
+`);return n?.trailingNewline&&(a.endsWith(`
+`)||(a+=`
+`)),a}};function Lo(t,e){if(!t)return[];let n=new Map;for(let i of t.entries)n.set(i.key,i);let r=e?.metadataKeys??t.entries.map(i=>i.key),o=[];for(let i of r){let a=n.get(i);if(!a)continue;let c=e?.metadataRenames.get(i)??i,s=Gt(a.value,a.escapeHint);s!==void 0&&o.push(`${c}: ${s}`)}return o}function Gt(t,e){switch(t.kind){case"StringScalar":return No(t.stringValue,e);case"IntegerScalar":return String(t.integerValue);case"StructuredList":{let n=[];for(let r of t.items){let o=Gt(r,e);o!==void 0&&n.push(o)}return n.join(", ")}case"StructuredMap":return;default:return}}function No(t,e){return!e||Ht(e,T.ESC_RAW)?t:Ht(e,T.ESC_YAML_SAFE)?Fo(t):t}function Fo(t){return t.includes(`
+`)?`|-
+  ${t.replace(/\n/g,`
+  `).trimEnd()}`:/[:#\[\]{}&*!|>'"%@`,]/.test(t)?`"${t.replace(/\\/g,"\\\\").replace(/"/g,'\\"')}"`:t}function Mo(t){let e=[];for(let n of t){let r=Bo(n);r&&e.push(r)}return e.join(`
 
-`),d=["---",...s,"---","",p].join(`
-`);return{name:o,description:r,skillMd:d}}function ao(n){if(!(n instanceof Wn))return"";let e=P(n,oo),t=P(n,ro),o=[];return e&&o.push(`## ${e}`),t&&o.push(fe(t)),o.join(`
-
-`)}async function co(n,e,t){let o=[];for(let r of n)r instanceof qn&&o.push(r.subject.name);return o.join(" ")}function fe(n){return n.trimEnd()}var ye=class{constructor(e,t,o){this.repository=e;this.parser=t;this.objectParser=o}repository;parser;objectParser;cache=new Map;async resolveSubject(e,t){let o=Fe(t,e);if(o)return o;let r=`${e.publisher}/${e.package_}`,s=this.cache.get(r);if(!s){let i=await this.repository.getDocumentsByNamespaceAsync(e.publisher,e.package_);if(i.length===0)return;let a=i[0],c=new _(a,this.repository);s=await this.objectParser.parseKanonaks(c),this.cache.set(r,s)}for(let i of s)if(i instanceof Ze&&i.name===e.name&&i.namespace&&i.namespace.startsWith(`${e.publisher}/${e.package_}@`))return i;for(let i of s)if(i instanceof Ze&&i.name===e.name)return i}};import{join as he}from"path";import{homedir as tt}from"os";import{KanonakObjectParser as lo}from"@kanonak-protocol/sdk";var B="kanonak.org",z="agent-skills",ot={publisher:B,package_:z,name:"Client"},rt={publisher:B,package_:z,name:"clientId"},po={publisher:B,package_:z,name:"projectSkillDir"},uo={publisher:B,package_:z,name:"userSkillDir"},mo="agents";async function q(n,e){let t=(n.client??go()??mo).toLowerCase(),o=n.scope??"project",r=await fo(t,e);if(!r){let a=await yo(e);throw new Error(`Unknown client "${t}". Known clients: ${a.join(", ")||"(none)"}. Add a Client instance to a package that imports kanonak.org/agent-skills and install that package to make it available.`)}let i=P(r,o==="user"?uo:po);if(!i)throw new Error(`Client "${t}" has no ${o==="user"?"userSkillDir":"projectSkillDir"} declared.`);return ho(i)}async function Z(n,e,t){let o=await q(e,t);return he(o,n)}function go(){if(process.env.CLAUDE_CODE||process.env.CLAUDE_PROJECT_DIR)return"claude-code"}var nt=new WeakMap;async function st(n){let e=nt.get(n);if(e)return e;let t=await n.getDocumentsByNamespaceAsync(B,z);if(t.length===0)throw new Error(`Could not find ${B}/${z} in the repository. Install a skill capability (which transitively imports agent-skills) or fetch agent-skills directly to populate the cache.`);let r=[...t].sort((c,l)=>{let p=c.metadata.namespace_?.version,d=l.metadata.namespace_?.version;return!p||!d?0:p.major!==d.major?d.major-p.major:p.minor!==d.minor?d.minor-p.minor:d.patch-p.patch})[0],s=new lo,i=new _(r,n),a=await s.parseKanonaks(i);return nt.set(n,a),a}async function fo(n,e){let t=await st(e),o=D(t,ot);for(let r of o)if(P(r,rt)===n)return r}async function yo(n){let e=await st(n),t=D(e,ot),o=[];for(let r of t){let s=P(r,rt);s&&o.push(s)}return o}function ho(n){return n.startsWith("~/")?he(tt(),n.slice(2)):n==="~"?tt():n.startsWith("/")||/^[A-Za-z]:[\\/]/.test(n)?n:he(process.cwd(),n)}import{readFileSync as ko,writeFileSync as bo,existsSync as Po}from"fs";import{join as it}from"path";import at from"js-yaml";var ct="skills.lock",wo=`# This file is generated by Kanonak CLI. Do not edit manually.
-`;function ee(n){let e=it(n,ct);if(!Po(e))return{version:"1",lastUpdated:new Date().toISOString(),skills:{}};let t=ko(e,"utf-8"),o=at.load(t);return!o||typeof o!="object"||o.version!=="1"?{version:"1",lastUpdated:new Date().toISOString(),skills:{}}:{version:"1",lastUpdated:o.lastUpdated??new Date().toISOString(),skills:o.skills??{}}}function ke(n,e){e.lastUpdated=new Date().toISOString();let t={};for(let s of Object.keys(e.skills).sort())t[s]=e.skills[s];e.skills=t;let o=it(n,ct),r=at.dump(e,{lineWidth:-1,sortKeys:!1,quotingType:'"'});bo(o,wo+r,"utf-8")}var oe=class{parser=new Co;objectParser=new _o;async deploy(e){let{instances:t,allKanonaks:o,repository:r,options:s}=e;if(t.length===0){console.error("No Skill instances to deploy.");return}let i=await et(o,t,r,this.parser,this.objectParser);if(i.length===0){console.error("No skills could be transformed from the package.");return}let a=await q(s,r),c=ee(a),l=t[0].namespace,{publisher:p,package_:d,version:u}=Do(l);for(let g of i){let f=await Z(g.name,s,r),y=te(ne(f,"SKILL.md"));So(f,{recursive:!0}),Ro(ne(f,"SKILL.md"),g.skillMd,"utf-8"),c.skills[g.name]={publisher:p,package_:d,version:u,resolved:p?`kanonak://${p}/${d}@${u}`:"",integrity:O(g.skillMd)},console.log(`  ${y?"Updated":"Installed"} skill "${g.name}" \u2192 ${f}`)}ke(a,c)}async undeploy(e,t){let{repository:o,options:r}=t,s=await Z(e,r,o);te(s)||(console.error(`Skill "${e}" is not installed at ${s}`),process.exit(1)),vo(s,{recursive:!0,force:!0});let i=await q(r,o),a=ee(i);delete a.skills[e],ke(i,a),console.log(`Removed skill "${e}" from ${s}`)}async list(e){let{repository:t,options:o}=e,r=await q(o,t),s=ee(r),i=[];for(let[a,c]of Object.entries(s.skills))i.push({name:a,publisher:c.publisher,package_:c.package_,version:c.version,path:await Z(a,o,t)});if(te(r))try{let a=$o(r,{withFileTypes:!0});for(let c of a){if(!c.isDirectory()||s.skills[c.name])continue;let l=ne(r,c.name,"SKILL.md");te(l)&&i.push({name:c.name,publisher:"",package_:"",version:"",path:ne(r,c.name)})}}catch{}return i}};function Do(n){if(!n)return{publisher:"",package_:"",version:""};let e=n.indexOf("@");if(e===-1)return{publisher:"",package_:"",version:""};let t=n.substring(0,e),o=n.substring(e+1),r=t.indexOf("/");return r===-1?{publisher:"",package_:"",version:""}:{publisher:t.substring(0,r),package_:t.substring(r+1),version:o}}var jo=xo(Ao(import.meta.url)),No=JSON.parse(Ko(Eo(jo,"..","package.json"),"utf-8")),K=new Io;K.name("kanonak").description("Kanonak Protocol CLI - Validate and resolve Kanonak ontology packages").version(No.version);K.command("validate <path>").description("Validate .kan.yml file(s). Resolves imports via HTTP from publisher domains.").action(async n=>{await ve(n)});K.command("install [package]").description("Install a package and its dependencies, or install all from kanonak.lock.").action(async n=>{await Ce(n)});K.command("deps <path>").description("Show resolved dependency tree for a .kan.yml file.").action(async n=>{await Ie(n)});K.command("login <publisher>").description("Authenticate with a package publisher using OAuth 2.0.").action(async n=>{await Te(n)});K.command("logout <publisher>").description("Revoke tokens and remove stored credentials for a publisher.").action(async n=>{await Oe(n)});K.addCommand(Ye());async function Fo(){try{let n=new C,e=new To,t=new Uo,o=Lo(t),r=new Oo({fetchFn:o}),s=await A(process.cwd(),e),i=new Q;i.register("kanonak.org/capabilities/AgentSkillDeployment",new oe);let a=await We(n,e,s),c=new X(n,e,r,o,i,s);Xe(K,a,c)}catch{}}await Fo();K.parse();
+`)}function Bo(t){switch(t.kind){case"Heading":return`${"#".repeat(t.level)} ${zt(t.inlines)}`;case"Paragraph":return zt(t.inlines);case"RawBlock":return t.rawContent;default:return""}}function zt(t){let e=[];for(let n of t)n.kind==="Text"&&e.push(n.text);return e.join("")}function Vo(t,e){return t.publisher===e.publisher&&t.package_===e.package_&&t.name===e.name}var Se=class{backendUri="kanonak.org/transformations/backend/toml";render(e,n){let o=Ho(e.metadata,n).join(`
+`);return n?.trailingNewline&&(o.endsWith(`
+`)||(o+=`
+`)),o}};function Ho(t,e){if(!t)return[];let n=new Map;for(let i of t.entries)n.set(i.key,i);let r=e?.metadataKeys??t.entries.map(i=>i.key),o=[];for(let i of r){let a=n.get(i);if(!a)continue;let c=e?.metadataRenames.get(i)??i,s=qt(a.value,a.escapeHint);s!==void 0&&o.push(`${c} = ${s}`)}return o}function qt(t,e){switch(t.kind){case"StringScalar":return zo(t.stringValue,e);case"IntegerScalar":return String(t.integerValue);case"StructuredList":{let n=[];for(let r of t.items){let o=qt(r,e);o!==void 0&&n.push(o)}return`[${n.join(", ")}]`}case"StructuredMap":return;default:return}}function zo(t,e){return e&&Vo(e,T.ESC_TOML_MULTILINE)?qo(t):Go(t)}function Go(t){return`"${t.replace(/\\/g,"\\\\").replace(/"/g,'\\"').replace(/\n/g,"\\n")}"`}function qo(t){return`"""
+${t.replace(/"""/g,'\\"\\"\\"')}
+"""`}var De=class{backendUri="kanonak.org/transformations/backend/json";render(e,n){let r=JSON.stringify(e,null,2);return n?.trailingNewline&&!r.endsWith(`
+`)?r+`
+`:r}};function Xt(t){let e=t.replace(/\r\n/g,`
+`).split(`
+`),n=[],r=0;for(;r<e.length;){let o=e[r];if(o.trim()===""){r++;continue}let i=/^(\s*)```(\S*)\s*$/.exec(o);if(i){let s=i[2],l=[];for(r++;r<e.length&&!/^(\s*)```\s*$/.test(e[r]);)l.push(e[r]),r++;r++;let u=Jt(l.join(`
+`)),p=s?` class="language-${Yt(s)}"`:"";n.push(`<pre><code${p}>${u}</code></pre>`);continue}let a=/^(#{1,6})\s+(.*)$/.exec(o);if(a){let s=a[1].length,l=ee(a[2].trim());n.push(`<h${s}>${l}</h${s}>`),r++;continue}if(o.includes("|")&&r+1<e.length&&Wt(e[r+1])){let s=Xe(o),l=Wo(e[r+1]);r+=2;let u=[];for(;r<e.length&&e[r].trim()!==""&&e[r].includes("|");)u.push(Xe(e[r])),r++;n.push(Xo(s,l,u));continue}if(/^\s*[-*]\s+/.test(o)){let s=[];for(;r<e.length&&/^\s*[-*]\s+/.test(e[r]);){let l=[e[r].replace(/^\s*[-*]\s+/,"")];for(r++;r<e.length&&e[r].trim()!==""&&!/^\s*[-*]\s+/.test(e[r])&&!/^\s*\d+\.\s+/.test(e[r]);)l.push(e[r]),r++;r<e.length&&e[r].trim()===""&&r++,s.push(`<li>${ee(l.join(" ").trim())}</li>`)}n.push(`<ul>
+${s.join(`
+`)}
+</ul>`);continue}if(/^\s*\d+\.\s+/.test(o)){let s=[];for(;r<e.length&&/^\s*\d+\.\s+/.test(e[r]);){let l=[e[r].replace(/^\s*\d+\.\s+/,"")];for(r++;r<e.length&&e[r].trim()!==""&&!/^\s*\d+\.\s+/.test(e[r])&&!/^\s*[-*]\s+/.test(e[r]);)l.push(e[r]),r++;r<e.length&&e[r].trim()===""&&r++,s.push(`<li>${ee(l.join(" ").trim())}</li>`)}n.push(`<ol>
+${s.join(`
+`)}
+</ol>`);continue}let c=[o];for(r++;r<e.length&&e[r].trim()!==""&&!/^(#{1,6})\s+/.test(e[r])&&!/^(\s*)```/.test(e[r])&&!/^\s*[-*]\s+/.test(e[r])&&!/^\s*\d+\.\s+/.test(e[r])&&!(e[r].includes("|")&&r+1<e.length&&Wt(e[r+1]));)c.push(e[r]),r++;n.push(`<p>${ee(c.join(" "))}</p>`)}return n.join(`
+`)}function Wt(t){return t.includes("-")?/^[\s|:-]+$/.test(t):!1}function Xe(t){let e=t.trim();return e.startsWith("|")&&(e=e.slice(1)),e.endsWith("|")&&(e=e.slice(0,-1)),e.split("|").map(n=>n.trim())}function Wo(t){return Xe(t).map(e=>{let n=e.startsWith(":"),r=e.endsWith(":");return n&&r?"center":r?"right":n?"left":null})}function Xo(t,e,n){let r=a=>{let c=e[a];return c?` style="text-align:${c}"`:""},o=t.map((a,c)=>`<th${r(c)}>${ee(a)}</th>`).join(""),i=n.map(a=>`<tr>${a.map((s,l)=>`<td${r(l)}>${ee(s)}</td>`).join("")}</tr>`).join(`
+`);return`<table>
+<thead><tr>${o}</tr></thead>
+<tbody>
+${i}
+</tbody>
+</table>`}function ee(t){let e=Jt(t);return e=e.replace(/`([^`\n]+)`/g,(n,r)=>`<code>${r}</code>`),e=e.replace(/\[([^\]]+)\]\(([^)\s]+)\)/g,(n,r,o)=>`<a href="${Yt(o)}">${r}</a>`),e=e.replace(/\*\*([^*\n]+)\*\*/g,(n,r)=>`<strong>${r}</strong>`),e=e.replace(/(^|[^*])\*([^*\n]+)\*(?!\*)/g,(n,r,o)=>`${r}<em>${o}</em>`),e=e.replace(/(^|[\s(])_([^_\n]+)_(?=[\s).,;:!?]|$)/g,(n,r,o)=>`${r}<em>${o}</em>`),e}function Jt(t){return t.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;").replace(/'/g,"&#39;")}function Yt(t){return t.replace(/"/g,"&quot;").replace(/&/g,"&amp;")}function Je(t,e){return t.publisher===e.publisher&&t.package_===e.package_&&t.name===e.name}var ve=class{backendUri="kanonak.org/transformations/backend/html";render(e,n){let r=Jo(e.metadata)??"Untitled",o=Yo(e.metadata,n),i=Zo(e.children),a=`<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<title>${le(r)}</title>
+<style>
+body { font-family: -apple-system, Segoe UI, Helvetica, Arial, sans-serif; max-width: 860px; margin: 2rem auto; padding: 0 1rem; color: #222; line-height: 1.55; }
+h1, h2, h3, h4 { line-height: 1.2; }
+h1 { border-bottom: 1px solid #ddd; padding-bottom: 0.3em; }
+dl.metadata { background: #f6f8fa; border: 1px solid #e4e8ec; border-radius: 6px; padding: 0.75rem 1rem; margin-bottom: 1.5rem; }
+dl.metadata dt { font-weight: 600; color: #555; margin-top: 0.35rem; }
+dl.metadata dt:first-child { margin-top: 0; }
+dl.metadata dd { margin: 0; }
+code { background: #f6f8fa; padding: 0.1rem 0.3rem; border-radius: 3px; font-size: 0.92em; }
+pre { background: #f6f8fa; border: 1px solid #e4e8ec; border-radius: 6px; padding: 0.8rem 1rem; overflow-x: auto; }
+pre code { background: transparent; padding: 0; font-size: 0.88em; }
+p { margin: 0.85em 0; }
+table { border-collapse: collapse; width: 100%; margin: 1em 0; font-size: 0.93em; }
+table th, table td { border: 1px solid #d0d7de; padding: 0.4em 0.7em; text-align: left; vertical-align: top; }
+table th { background: #f6f8fa; font-weight: 600; }
+table tr:nth-child(even) td { background: #fafbfc; }
+figure.svg-figure { margin: 1.5em 0; text-align: center; }
+figure.svg-figure svg { max-width: 100%; height: auto; }
+</style>
+</head>
+<body>
+${o}${i}
+</body>
+</html>
+`;return n?.trailingNewline===!1&&a.endsWith(`
+`)?a.slice(0,-1):a}};function Jo(t){if(t){for(let e of t.entries)if((e.key==="title"||e.key==="name")&&e.value.kind==="StringScalar")return e.value.stringValue}}function Yo(t,e){if(!t||t.entries.length===0)return"";let n=e?.metadataKeys??t.entries.map(i=>i.key),r=new Map(t.entries.map(i=>[i.key,i])),o=[];for(let i of n){let a=r.get(i);if(!a)continue;let c=e?.metadataRenames.get(i)??i,s=Qt(a.value);s!==void 0&&o.push(`  <dt>${le(c)}</dt>
+  <dd>${s}</dd>`)}return o.length===0?"":`<dl class="metadata">
+${o.join(`
+`)}
+</dl>
+`}function Qt(t){switch(t.kind){case"StringScalar":return le(t.stringValue);case"IntegerScalar":return String(t.integerValue);case"StructuredList":{let e=[];for(let n of t.items){let r=Qt(n);r!==void 0&&e.push(`<code>${r}</code>`)}return e.join(", ")}case"StructuredMap":return;default:return}}function Zo(t){let e=[];for(let n of t){let r=Qo(n);r&&e.push(r)}return e.join(`
+`)}function Qo(t){switch(t.kind){case"Heading":{let e=Math.max(1,Math.min(6,t.level));return`<h${e}>${Zt(t.inlines)}</h${e}>`}case"Paragraph":return`<p>${Zt(t.inlines)}</p>`;case"RawBlock":return ei(t);default:return""}}function ei(t){let e=t.mediaType;return e&&Je(e,T.TEXT_MARKDOWN)?Xt(t.rawContent):e&&Je(e,T.TEXT_HTML)?t.rawContent:e&&Je(e,T.IMAGE_SVG_XML)?`<figure class="svg-figure">
+${t.rawContent}
+</figure>`:`<pre${e?` class="media-${ti(e.name)}"`:""}><code>${le(t.rawContent)}</code></pre>`}function Zt(t){let e=[];for(let n of t)n.kind==="Text"&&e.push(le(n.text));return e.join("")}function le(t){return t.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;").replace(/'/g,"&#39;")}function ti(t){return t.replace(/"/g,"&quot;").replace(/&/g,"&amp;")}function ni(t,e){return t.publisher===e.publisher&&t.package_===e.package_&&t.name===e.name}var Ae=class{backendUri="kanonak.org/transformations/backend/svg";render(e,n){for(let r of e.children)if(r.kind==="RawBlock"&&r.mediaType&&ni(r.mediaType,T.IMAGE_SVG_XML)){let o=r.rawContent;return n?.trailingNewline&&!o.endsWith(`
+`)&&(o+=`
+`),o}return'<svg xmlns="http://www.w3.org/2000/svg" width="1" height="1"/>'}};var te=class extends Error{},ne=class{backends=new Map;constructor(){this.register(new we),this.register(new Se),this.register(new De),this.register(new ve),this.register(new Ae)}register(e){this.backends.set(e.backendUri,e)}async run(e){let n=e.transformationKanonaks??e.allKanonaks,r=Vt(e.transformation,n);if(!r.outputs.has(e.outputFormat))throw new te(`Transformation "${r.name}" does not support output format "${e.outputFormat}". Declared outputs: ${Array.from(r.outputs).join(", ")}`);let o=new ye(e.repository,e.parser,e.objectParser),i=new ke(o,e.allKanonaks),a=e.instances.filter(u=>ri(u,r)),c=this.findBackendForFormat(e.outputFormat);if(!c)throw new te(`No backend registered for OutputFormat "${e.outputFormat}".`);let s=r.overrides.get(e.outputFormat),l=[];for(let u of a){let p=new Map;p.set("input",u);let m=await i.evaluate(r.rule,p);if(!ii(m))throw new te(`Transformation "${r.name}" rule did not yield a Document for input "${u.name}". Got: ${en(m)}`);let h=await i.evaluate(r.artifactName,p);if(typeof h!="string")throw new te(`Transformation "${r.name}" artifactName did not yield a string for input "${u.name}". Got: ${en(h)}`);let g=c.render(m,s);l.push({fileName:h,format:e.outputFormat,content:g,sourceName:u.name})}return l}findBackendForFormat(e){let r={"markdown-with-frontmatter":"kanonak.org/transformations/backend/markdown-with-frontmatter",toml:"kanonak.org/transformations/backend/toml",json:"kanonak.org/transformations/backend/json","plain-markdown":"kanonak.org/transformations/backend/plain-markdown",html:"kanonak.org/transformations/backend/html",svg:"kanonak.org/transformations/backend/svg"}[e];if(r)return this.backends.get(r)}};function ri(t,e){if(!Fe(t,e.inputPattern.matchesClass))return!1;for(let n of e.inputPattern.requires)if(!oi(t,n))return!1;return!0}function oi(t,e){for(let n of t.statement){let r=n.predicate?.subject;if(r&&M(r,e)){let o=n.object;if(o==null||typeof o=="string"&&o.length===0||Array.isArray(o)&&o.length===0)continue;return!0}}return!1}function ii(t){return typeof t=="object"&&t!==null&&t.kind==="Document"&&Array.isArray(t.children)}function en(t){if(t===void 0)return"undefined";if(t===null)return"null";if(Array.isArray(t))return`array(${t.length})`;if(typeof t=="object"){let e=t.kind;return e?`object(kind=${e})`:"object"}return typeof t}import{join as Ye}from"path";import{homedir as tn}from"os";import{KanonakObjectParser as ai}from"@kanonak-protocol/sdk";var re="kanonak.org",oe="agent-skills",rn={publisher:re,package_:oe,name:"Client"},on={publisher:re,package_:oe,name:"clientId"},si={publisher:re,package_:oe,name:"projectSkillDir"},ci={publisher:re,package_:oe,name:"userSkillDir"},li="agents";async function ue(t,e){let n=(t.client??ui()??li).toLowerCase(),r=t.scope??"project",o=await di(n,e);if(!o){let c=await pi(e);throw new Error(`Unknown client "${n}". Known clients: ${c.join(", ")||"(none)"}. Add a Client instance to a package that imports kanonak.org/agent-skills and install that package to make it available.`)}let a=A(o,r==="user"?ci:si);if(!a)throw new Error(`Client "${n}" has no ${r==="user"?"userSkillDir":"projectSkillDir"} declared.`);return mi(a)}async function $e(t,e,n){let r=await ue(e,n);return Ye(r,t)}function ui(){if(process.env.CLAUDE_CODE||process.env.CLAUDE_PROJECT_DIR)return"claude-code"}var nn=new WeakMap;async function an(t){let e=nn.get(t);if(e)return e;let n=await t.getDocumentsByNamespaceAsync(re,oe);if(n.length===0)throw new Error(`Could not find ${re}/${oe} in the repository. Install a skill capability (which transitively imports agent-skills) or fetch agent-skills directly to populate the cache.`);let o=[...n].sort((s,l)=>{let u=s.metadata.namespace_?.version,p=l.metadata.namespace_?.version;return!u||!p?0:u.major!==p.major?p.major-u.major:u.minor!==p.minor?p.minor-u.minor:p.patch-u.patch})[0],i=new ai,a=new C(o,t),c=await i.parseKanonaks(a);return nn.set(t,c),c}async function di(t,e){let n=await an(e),r=_(n,rn);for(let o of r)if(A(o,on)===t)return o}async function pi(t){let e=await an(t),n=_(e,rn),r=[];for(let o of n){let i=A(o,on);i&&r.push(i)}return r}function mi(t){return t.startsWith("~/")?Ye(tn(),t.slice(2)):t==="~"?tn():t.startsWith("/")||/^[A-Za-z]:[\\/]/.test(t)?t:Ye(process.cwd(),t)}import{readFileSync as fi,writeFileSync as gi,existsSync as yi}from"fs";import{join as sn}from"path";import cn from"js-yaml";var ln="skills.lock",hi=`# This file is generated by Kanonak CLI. Do not edit manually.
+`;function Ce(t){let e=sn(t,ln);if(!yi(e))return{version:"1",lastUpdated:new Date().toISOString(),skills:{}};let n=fi(e,"utf-8"),r=cn.load(n);return!r||typeof r!="object"||r.version!=="1"?{version:"1",lastUpdated:new Date().toISOString(),skills:{}}:{version:"1",lastUpdated:r.lastUpdated??new Date().toISOString(),skills:r.skills??{}}}function Ze(t,e){e.lastUpdated=new Date().toISOString();let n={};for(let i of Object.keys(e.skills).sort())n[i]=e.skills[i];e.skills=n;let r=sn(t,ln),o=cn.dump(e,{lineWidth:-1,sortKeys:!1,quotingType:'"'});gi(r,hi+o,"utf-8")}var un="kanonak.org",dn="skill-to-skill-md",Pe=class{parser=new vi;objectParser=new Di;runner=new ne;async deploy(e){let{instances:n,allKanonaks:r,repository:o,options:i}=e;if(n.length===0){console.error("No Skill instances to deploy.");return}let a=await Ai(o,this.objectParser);if(!a){console.error(`Cannot deploy: ${un}/${dn}@1.0.0 is not installed in the workspace or cache.`);return}let c=await this.runner.run({transformation:a,instances:n,allKanonaks:r,repository:o,parser:this.parser,objectParser:this.objectParser,outputFormat:"markdown-with-frontmatter"});if(c.length===0){console.error("No skills could be transformed from the package.");return}let s=await ue(i,o),l=Ce(s),u=n[0].namespace,{publisher:p,package_:m,version:h}=$i(u);for(let g of c){let k=await $e(g.fileName,i,o),S=_e(Ke(k,"SKILL.md"));ki(k,{recursive:!0}),Si(Ke(k,"SKILL.md"),g.content,"utf-8"),l.skills[g.fileName]={publisher:p,package_:m,version:h,resolved:p?`kanonak://${p}/${m}@${h}`:"",integrity:N(g.content)},console.log(`  ${S?"Updated":"Installed"} skill "${g.fileName}" \u2192 ${k}`)}Ze(s,l)}async undeploy(e,n){let{repository:r,options:o}=n,i=await $e(e,o,r);_e(i)||(console.error(`Skill "${e}" is not installed at ${i}`),process.exit(1)),bi(i,{recursive:!0,force:!0});let a=await ue(o,r),c=Ce(a);delete c.skills[e],Ze(a,c),console.log(`Removed skill "${e}" from ${i}`)}async list(e){let{repository:n,options:r}=e,o=await ue(r,n),i=Ce(o),a=[];for(let[c,s]of Object.entries(i.skills))a.push({name:c,publisher:s.publisher,package_:s.package_,version:s.version,path:await $e(c,r,n)});if(_e(o))try{let c=wi(o,{withFileTypes:!0});for(let s of c){if(!s.isDirectory()||i.skills[s.name])continue;let l=Ke(o,s.name,"SKILL.md");_e(l)&&a.push({name:s.name,publisher:"",package_:"",version:"",path:Ke(o,s.name)})}}catch{}return a}};async function Ai(t,e){let n=await t.getDocumentsByNamespaceAsync(un,dn);if(n.length===0)return;let r=new C(n[0],t),o=await e.parseKanonaks(r);return _(o,f.Transformation)[0]}function $i(t){if(!t)return{publisher:"",package_:"",version:""};let e=t.indexOf("@");if(e===-1)return{publisher:"",package_:"",version:""};let n=t.substring(0,e),r=t.substring(e+1),o=n.indexOf("/");return o===-1?{publisher:"",package_:"",version:""}:{publisher:n.substring(0,o),package_:n.substring(o+1),version:r}}import{mkdirSync as Ni,rmSync as Fi,existsSync as et,readdirSync as Mi,writeFileSync as Bi,statSync as Vi}from"fs";import{join as Re}from"path";import{KanonakObjectParser as Hi,KanonakParser as zi}from"@kanonak-protocol/sdk";import{join as pn}from"path";import{homedir as mn}from"os";import{KanonakObjectParser as Ci}from"@kanonak-protocol/sdk";var H="kanonak.org",z="agent-skills",gn={publisher:H,package_:z,name:"Client"},yn={publisher:H,package_:z,name:"clientId"},_i={publisher:H,package_:z,name:"projectAgentDir"},Ki={publisher:H,package_:z,name:"userAgentDir"},Pi={publisher:H,package_:z,name:"agentFileFormat"},Ei="agents";function Ii(){if(process.env.CLAUDE_CODE||process.env.CLAUDE_PROJECT_DIR)return"claude-code"}async function Ee(t,e){let n=(t.client??Ii()??Ei).toLowerCase(),r=t.scope??"project",o=await Ri(n,e);if(!o){let u=await Ti(e);throw new Error(`Unknown client "${n}". Known clients: ${u.join(", ")||"(none)"}. Add a Client instance to a package that imports kanonak.org/agent-skills and install that package to make it available.`)}let a=A(o,r==="user"?Ki:_i);if(!a)throw new Error(`Client "${n}" has no ${r==="user"?"userAgentDir":"projectAgentDir"} declared.`);let s=B(o,Pi)?.name==="toml"?"toml":"markdown-frontmatter",l=s==="toml"?".toml":".md";return{agentsDir:ji(a),format:s,fileExtension:l}}var fn=new WeakMap;async function hn(t){let e=fn.get(t);if(e)return e;let n=await t.getDocumentsByNamespaceAsync(H,z);if(n.length===0)throw new Error(`Could not find ${H}/${z} in the repository. Install a capability that imports agent-skills to populate the cache.`);let o=[...n].sort((s,l)=>{let u=s.metadata.namespace_?.version,p=l.metadata.namespace_?.version;return!u||!p?0:u.major!==p.major?p.major-u.major:u.minor!==p.minor?p.minor-u.minor:p.patch-u.patch})[0],i=new Ci,a=new C(o,t),c=await i.parseKanonaks(a);return fn.set(t,c),c}async function Ri(t,e){let n=await hn(e),r=_(n,gn);for(let o of r)if(A(o,yn)===t)return o}async function Ti(t){let e=await hn(t),n=_(e,gn),r=[];for(let o of n){let i=A(o,yn);i&&r.push(i)}return r}function ji(t){return t.startsWith("~/")?pn(mn(),t.slice(2)):t==="~"?mn():t.startsWith("/")||/^[A-Za-z]:[\\/]/.test(t)?t:pn(process.cwd(),t)}import{readFileSync as Ui,writeFileSync as xi,existsSync as Oi}from"fs";import{join as kn}from"path";import bn from"js-yaml";var wn="agents.lock",Li=`# This file is generated by Kanonak CLI. Do not edit manually.
+`;function Ie(t){let e=kn(t,wn);if(!Oi(e))return{version:"1",lastUpdated:new Date().toISOString(),agents:{}};let n=Ui(e,"utf-8"),r=bn.load(n);return!r||typeof r!="object"||r.version!=="1"?{version:"1",lastUpdated:new Date().toISOString(),agents:{}}:{version:"1",lastUpdated:r.lastUpdated??new Date().toISOString(),agents:r.agents??{}}}function Qe(t,e){e.lastUpdated=new Date().toISOString();let n={};for(let i of Object.keys(e.agents).sort())n[i]=e.agents[i];e.agents=n;let r=kn(t,wn),o=bn.dump(e,{lineWidth:-1,sortKeys:!1,quotingType:'"'});xi(r,Li+o,"utf-8")}var Sn="kanonak.org",Dn="agent-to-agent-file",Te=class{parser=new zi;objectParser=new Hi;runner=new ne;async deploy(e){let{instances:n,allKanonaks:r,repository:o,options:i}=e;if(n.length===0){console.error("No Agent instances to deploy.");return}let{agentsDir:a,format:c,fileExtension:s}=await Ee(i,o),l=await Gi(o,this.objectParser);if(!l){console.error(`Cannot deploy: ${Sn}/${Dn}@1.0.0 is not installed in the workspace or cache.`);return}let u=c==="toml"?"toml":"markdown-with-frontmatter",p=await this.runner.run({transformation:l,instances:n,allKanonaks:r,repository:o,parser:this.parser,objectParser:this.objectParser,outputFormat:u});if(p.length===0){console.error("No agents could be transformed from the package.");return}Ni(a,{recursive:!0});let m=Ie(a),h=n[0].namespace,{publisher:g,package_:k,version:S}=Wi(h);for(let y of p){let D=`${y.fileName}${s}`,w=Re(a,D),$=et(w);Bi(w,y.content,"utf-8"),m.agents[y.fileName]={publisher:g,package_:k,version:S,resolved:g?`kanonak://${g}/${k}@${S}`:"",integrity:N(y.content),fileName:D},console.log(`  ${$?"Updated":"Installed"} agent "${y.fileName}" \u2192 ${w}`)}Qe(a,m)}async undeploy(e,n){let{repository:r,options:o}=n,{agentsDir:i}=await Ee(o,r),a=Ie(i),c=a.agents[e];c||(console.error(`Agent "${e}" is not installed at ${i}`),process.exit(1));let s=Re(i,c.fileName);et(s)&&Fi(s,{force:!0}),delete a.agents[e],Qe(i,a),console.log(`Removed agent "${e}" from ${s}`)}async list(e){let{repository:n,options:r}=e,{agentsDir:o}=await Ee(r,n),i=Ie(o),a=[];for(let[c,s]of Object.entries(i.agents))a.push({name:c,publisher:s.publisher,package_:s.package_,version:s.version,path:Re(o,s.fileName)});if(et(o))try{let c=Mi(o,{withFileTypes:!0});for(let s of c){if(!s.isFile()||s.name==="agents.lock")continue;let l=Re(o,s.name),u=qi(s.name);if(!i.agents[u]){try{if(!Vi(l).isFile())continue}catch{continue}a.push({name:u,publisher:"",package_:"",version:"",path:l})}}}catch{}return a}};async function Gi(t,e){let n=await t.getDocumentsByNamespaceAsync(Sn,Dn);if(n.length===0)return;let r=new C(n[0],t),o=await e.parseKanonaks(r);return _(o,f.Transformation)[0]}function qi(t){let e=t.lastIndexOf(".");return e===-1?t:t.substring(0,e)}function Wi(t){if(!t)return{publisher:"",package_:"",version:""};let e=t.indexOf("@");if(e===-1)return{publisher:"",package_:"",version:""};let n=t.substring(0,e),r=t.substring(e+1),o=n.indexOf("/");return o===-1?{publisher:"",package_:"",version:""}:{publisher:n.substring(0,o),package_:n.substring(o+1),version:r}}var oa=Zi(Yi(import.meta.url)),ia=JSON.parse(Ji(Qi(oa,"..","package.json"),"utf-8")),O=new Xi;O.name("kanonak").description("Kanonak Protocol CLI - Validate and resolve Kanonak ontology packages").version(ia.version);O.command("validate <path>").description("Validate .kan.yml file(s). Resolves imports via HTTP from publisher domains.").action(async t=>{await it(t)});O.command("install [package]").description("Install a package and its dependencies, or install all from kanonak.lock.").action(async t=>{await lt(t)});O.command("deps <path>").description("Show resolved dependency tree for a .kan.yml file.").action(async t=>{await dt(t)});O.command("login <publisher>").description("Authenticate with a package publisher using OAuth 2.0.").action(async t=>{await yt(t)});O.command("logout <publisher>").description("Revoke tokens and remove stored credentials for a publisher.").action(async t=>{await ht(t)});O.addCommand(It());async function aa(){try{let t=new U,e=new ea,n=new na,r=ra(n),o=new ta({fetchFn:r}),i=await L(process.cwd(),e),a=new ge;a.register("kanonak.org/capabilities/agent-skill-deployment",new Pe),a.register("kanonak.org/agent-capabilities/agent-instance-deployment",new Te);let c=await Pt(t,e,i),s=new fe(t,e,o,r,a,i);Tt(O,c,s)}catch{}}await aa();O.parse();

package/dist/skills/SkillDeploymentHandler.d.ts

@@ -11,6 +11,7 @@ import type { DeploymentContext, DeploymentHandler, DeployedInstance, OperationC
 export declare class SkillDeploymentHandler implements DeploymentHandler {
     private readonly parser;
     private readonly objectParser;
+    private readonly runner;
     deploy(context: DeploymentContext): Promise<void>;
     undeploy(name: string, context: OperationContext): Promise<void>;
     list(context: OperationContext): Promise<DeployedInstance[]>;