@kanonak-protocol/cli 4.15.0 → 4.17.0

package/dist/index.js

@@ -9,7 +9,7 @@ ${m}:`),console.log("  ERROR: Failed to parse document"),c++;continue}u.push({fi
 ${v}:`);for(let $ of h)console.log(`  ERROR: ${$.message}`),$.suggestion&&console.log(`    -> ${$.suggestion}`);for(let $ of y)console.log(`  WARN: ${$.message}`);for(let $ of w)console.log(`  INFO: ${$.message}`)}c+=h.length,l+=y.length,p+=w.length}console.log(`
 ${i.length} file(s) validated. ${c} error(s), ${l} warning(s), ${p} info(s).`),c>0&&process.exit(1)}import{KanonakParser as Do,PublisherIndex as Ao,CredentialStore as jo,createAuthenticatedFetch as Oo}from"@kanonak-protocol/sdk";import{loadLockFile as No,saveLockFile as Lo,computeIntegrity as Fo,assertPackageIdentity as Uo}from"@kanonak-protocol/sdk";function T(n){if(!n)return null;let e=n.indexOf("/");if(e===-1)return null;let t=n.substring(0,e),o=n.substring(e+1);if(!t||!o)return null;let r,a=null,s=null,i=o.indexOf("@");if(i!==-1){r=o.substring(0,i);let c=o.substring(i+1),l=c.indexOf("/");l===-1?a=c||null:(a=c.substring(0,l)||null,s=c.substring(l+1)||null)}else{let c=o.indexOf("/");c===-1?r=o:(r=o.substring(0,c),s=o.substring(c+1)||null)}return!r||s&&s.includes("/")||a&&a.includes("@")?null:{publisher:t,packageName:r,version:a,instanceName:s}}async function wn(n){let e=new I,t=new Do,o=new jo,r=Oo(o),a=new Ao({fetchFn:r}),s=No()??{version:"1",lastUpdated:new Date().toISOString(),packages:{}};if(!n){Object.keys(s.packages).length===0&&(console.error("No kanonak.lock file found or lock file is empty."),console.error("Usage: kanonak install {publisher}/{package}[@{version}]"),process.exit(1)),console.log(`Installing ${Object.keys(s.packages).length} package(s) from kanonak.lock...`);for(let[g,m]of Object.entries(s.packages)){let k=g.indexOf("/"),h=g.substring(0,k),y=g.substring(k+1),w=e.get(h,y,m.version);if(w)console.log(`  ${g}@${m.version} (cached)`);else{let b=m.resolved,v=await r(b,h);if(!v.ok)throw new Error(`Failed to fetch ${b} (${v.status} ${v.statusText})`);w=await v.text(),e.put(h,y,m.version,w),console.log(`  ${g}@${m.version}`)}}console.log(`
 Installed ${Object.keys(s.packages).length} package(s) from lock file.`);return}let i=T(n);i||(console.error(`Invalid package reference: "${n}"`),console.error("Expected format: {publisher}/{package}[@{version}]"),process.exit(1));let{publisher:c,packageName:l,version:p,instanceName:u}=i;u&&(console.error(`\`kanonak install\` works on whole packages \u2014 got an instance suffix "/${u}".`),console.error(`Try: kanonak install ${c}/${l}${p?"@"+p:""}`),console.error("(Use `kanonak <capability> add` if you want to install one named instance.)"),process.exit(1));let d=p??await a.getHighestVersion(c,l);d||(console.error(`Could not resolve version for "${c}/${l}".`),console.error("Check the spelling, or run a search to see what the publisher offers."),process.exit(1)),console.log(`Installing ${c}/${l}@${d}...`);let f=new Set;await bn(c,l,d,e,t,a,r,f,s),Lo(s),console.log(`
-Installed ${f.size} package(s).`)}async function bn(n,e,t,o,r,a,s,i,c){let l=`${n}/${e}@${t}`;if(i.has(l))return;i.add(l);let p=`${n}/${e}`,u=o.get(n,e,t),d=await a.getPackageUrl(n,e,t),f,g=!1;if(u)f=u;else{let h=await s(d,n);if(!h.ok)throw new Error(`Failed to fetch ${d} (${h.status} ${h.statusText})`);f=await h.text(),g=!0}let m=r.parse(f);Uo(m,n,e,t),g&&o.put(n,e,t,f),console.log(`  ${l}${g?"":" (cached)"}`);let k={};if(m.metadata.imports)for(let[h,y]of Object.entries(m.metadata.imports))for(let w of y){let b=await a.resolveVersion(h,w);b?(k[`${h}/${w.packageName}`]=b,await bn(h,w.packageName,b,o,r,a,s,i,c)):console.error(`  WARNING: Could not resolve ${h}/${w.packageName} ${w.package_}`)}c.packages[p]={version:t,resolved:d,integrity:Fo(f),dependencies:k}}import{readFileSync as Mo}from"fs";import{resolve as Vo,dirname as Ho}from"path";import{KanonakParser as zo}from"@kanonak-protocol/sdk";async function vn(n){let e=Vo(n),t=Mo(e,"utf-8"),o=new zo,r=o.parse(t),a=r.metadata.namespace_,s=a?`${a.publisher}/${a.package_}@${a.version}`:n;if(console.log(s),!r.metadata.imports){console.log("  (no imports)");return}let i=F(Ho(e)),c=await S(i,o),l=new Set;for(let[p,u]of Object.entries(r.metadata.imports))for(let d of u)await $n(p,d,c,l,"  ")}async function $n(n,e,t,o,r){let a=`${n}/${e.packageName}`;if(o.has(a)){console.log(`${r}${a} (${e.package_}) [circular]`);return}o.add(a);let s;try{s=await t.getHighestCompatibleVersionAsync(n,e)}catch{console.log(`${r}${a} (${e.package_}) [fetch failed]`);return}if(!s){console.log(`${r}${a} (${e.package_}) [not found]`);return}let i=s.metadata.namespace_?.version?.toString()??"?";if(console.log(`${r}${n}/${e.packageName}@${i}`),s.metadata.imports)for(let[c,l]of Object.entries(s.metadata.imports))for(let p of l)await $n(c,p,t,o,r+"  ")}import{CredentialStore as Yo,generateDPoPKeyPair as Xo,createDPoPProof as Cn,serverSupportsDPoP as Zo}from"@kanonak-protocol/sdk";import{normalizeHost as Bo}from"@kanonak-protocol/sdk";var Sn="key_thumbprint",D=class{cache=new Map;async discover(e){let t=Bo(e);if(this.cache.has(t))return this.cache.get(t);let o=`https://${t}/.well-known/oauth-authorization-server`,r=await this.tryEndpoint(o);if(!r){let a=`https://${t}/.well-known/openid-configuration`;r=await this.tryEndpoint(a)}return this.cache.set(t,r),r}async supportsOAuth(e){return await this.discover(e)!==null}static supportsPkceS256(e){return e.codeChallengeMethodsSupported?.some(t=>t.toUpperCase()==="S256")??!1}static supportsDynamicRegistration(e){return!!e.registrationEndpoint}static supportsAuthorizationCode(e){return e.responseTypesSupported?.some(t=>t.toLowerCase()==="code")??!1}static supportsEnrollment(e){return!!e.enrollmentEndpoint}async tryEndpoint(e){let t;try{t=await fetch(e)}catch(r){let a=r instanceof Error?r.message:String(r);return a.includes("ENOTFOUND")||a.includes("ECONNREFUSED")?(console.error(`  OAuth discovery: ${e} \u2014 host unreachable (${a})`),console.error("    If the server is behind a VPN, ensure you are connected.")):a.includes("CERT")||a.includes("SSL")||a.includes("TLS")?(console.error(`  OAuth discovery: ${e} \u2014 TLS error (${a})`),console.error("    If using a custom CA certificate, set NODE_EXTRA_CA_CERTS=/path/to/ca.pem")):console.error(`  OAuth discovery: ${e} \u2014 network error: ${a}`),null}if(!t.ok)return t.status===404||(t.status===403?(console.error(`  OAuth discovery: ${e} \u2014 HTTP 403 Forbidden`),console.error("    Access may be blocked by a firewall, proxy, or WAF.")):t.status>=500&&(console.error(`  OAuth discovery: ${e} \u2014 HTTP ${t.status} server error`),console.error("    The authorization server returned an internal error. Contact your IDP administrator."))),null;let o;try{o=await t.json()}catch{return console.error(`  OAuth discovery: ${e} \u2014 response is not valid JSON`),console.error("    The endpoint may be returning HTML instead of JSON. Check IDP configuration."),null}return{issuer:U(o.issuer),authorizationEndpoint:U(o.authorization_endpoint),tokenEndpoint:U(o.token_endpoint),registrationEndpoint:U(o.registration_endpoint),revocationEndpoint:U(o.revocation_endpoint),scopesSupported:O(o.scopes_supported),responseTypesSupported:O(o.response_types_supported),grantTypesSupported:O(o.grant_types_supported),codeChallengeMethodsSupported:O(o.code_challenge_methods_supported),tokenEndpointAuthMethodsSupported:O(o.token_endpoint_auth_methods_supported),dpopSigningAlgValuesSupported:O(o.dpop_signing_alg_values_supported),enrollmentEndpoint:U(o.enrollment_endpoint),enrollmentIssuanceProtocols:O(o.enrollment_issuance_protocols),enrollmentKeyTypes:O(o.enrollment_key_types),enrollmentScopesSupported:O(o.enrollment_scopes_supported),enrollmentConsentBindingParam:U(o.enrollment_consent_binding_param)}}};function U(n){return typeof n=="string"?n:null}function O(n){return Array.isArray(n)?n.filter(e=>typeof e=="string"):null}import{createHash as qo,randomBytes as Pn}from"crypto";import{createServer as Wo}from"http";import{execFile as Oe}from"child_process";function se(){return Pn(32).toString("base64url")}function ae(n){return qo("sha256").update(n).digest("base64url")}function ie(){return Pn(16).toString("base64url")}function ce(n){let e=new URLSearchParams({client_id:n.clientId,response_type:"code",redirect_uri:n.redirectUri,scope:n.scopes.join(" "),state:n.state,code_challenge:n.codeChallenge,code_challenge_method:"S256",...n.extraParams??{}});return`${n.endpoint}?${e}`}var Go=300*1e3;async function le(){return new Promise(n=>{let e,t,o=Wo((a,s)=>{let i=new URL(a.url,"http://localhost"),c=i.searchParams.get("code")??void 0,l=i.searchParams.get("state")??void 0,p=i.searchParams.get("error")??i.searchParams.get("error_description")??void 0,u=p?Jo(p):null,d=u?`<html><body><h1>Authorization failed</h1><p>${u}</p></body></html>`:"<html><body><h1>Authorization successful!</h1><p>You can close this window.</p></body></html>";s.writeHead(200,{"Content-Type":"text/html"}),s.end(d),t({code:c,state:l,error:p})}),r=new Promise(a=>{t=s=>{clearTimeout(e),a(s)},e=setTimeout(()=>t(null),Go),e.unref?.()});o.listen(0,"127.0.0.1",()=>{let a=o.address();n({redirectUri:`http://localhost:${a.port}/callback`,port:a.port,waitForCallback:()=>r,close:()=>{clearTimeout(e),o.close()}})})})}function Jo(n){return n.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;")}function pe(n){try{process.platform==="win32"?Oe("cmd",["/c","start","",n]):process.platform==="darwin"?Oe("open",[n]):Oe("xdg-open",[n])}catch{console.log("  Could not open browser automatically. Please navigate to the URL above manually.")}}var G=class{discovery;credentialStore;constructor(e,t){this.discovery=e??new D,this.credentialStore=t??new Yo}async authorize(e,t=[]){console.log(`Starting OAuth flow for ${e}...`);let o=await this.discovery.discover(e);if(!o)return K(`No OAuth discovery endpoint found for '${e}'.
+Installed ${f.size} package(s).`)}async function bn(n,e,t,o,r,a,s,i,c){let l=`${n}/${e}@${t}`;if(i.has(l))return;i.add(l);let p=`${n}/${e}`,u=o.get(n,e,t),d=await a.getPackageUrl(n,e,t),f,g=!1;if(u)f=u;else{let h=await s(d,n);if(!h.ok)throw new Error(`Failed to fetch ${d} (${h.status} ${h.statusText})`);f=await h.text(),g=!0}let m=r.parse(f);Uo(m,n,e,t),g&&o.put(n,e,t,f),console.log(`  ${l}${g?"":" (cached)"}`);let k={};if(m.metadata.imports)for(let[h,y]of Object.entries(m.metadata.imports))for(let w of y){let b=await a.resolveVersion(h,w);b?(k[`${h}/${w.packageName}`]=b,await bn(h,w.packageName,b,o,r,a,s,i,c)):console.error(`  WARNING: Could not resolve ${h}/${w.packageName} ${w.package_}`)}c.packages[p]={version:t,resolved:d,integrity:Fo(f),dependencies:k}}import{readFileSync as Mo}from"fs";import{resolve as Vo,dirname as Ho}from"path";import{KanonakParser as zo}from"@kanonak-protocol/sdk";async function vn(n){let e=Vo(n),t=Mo(e,"utf-8"),o=new zo,r=o.parse(t),a=r.metadata.namespace_,s=a?`${a.publisher}/${a.package_}@${a.version}`:n;if(console.log(s),!r.metadata.imports){console.log("  (no imports)");return}let i=F(Ho(e)),c=await S(i,o),l=new Set;for(let[p,u]of Object.entries(r.metadata.imports))for(let d of u)await $n(p,d,c,l,"  ")}async function $n(n,e,t,o,r){let a=`${n}/${e.packageName}`;if(o.has(a)){console.log(`${r}${a} (${e.package_}) [circular]`);return}o.add(a);let s;try{s=await t.getHighestCompatibleVersionAsync(n,e)}catch{console.log(`${r}${a} (${e.package_}) [fetch failed]`);return}if(!s){console.log(`${r}${a} (${e.package_}) [not found]`);return}let i=s.metadata.namespace_?.version?.toString()??"?";if(console.log(`${r}${n}/${e.packageName}@${i}`),s.metadata.imports)for(let[c,l]of Object.entries(s.metadata.imports))for(let p of l)await $n(c,p,t,o,r+"  ")}import{CredentialStore as Yo,generateDPoPKeyPair as Xo,createDPoPProof as Cn,serverSupportsDPoP as Zo}from"@kanonak-protocol/sdk";import{normalizeHost as Bo}from"@kanonak-protocol/sdk";var Sn="key_thumbprint",D=class{cache=new Map;async discover(e){let t=Bo(e);if(this.cache.has(t))return this.cache.get(t);let o=`https://${t}/.well-known/oauth-authorization-server`,r=await this.tryEndpoint(o);if(!r){let a=`https://${t}/.well-known/openid-configuration`;r=await this.tryEndpoint(a)}return this.cache.set(t,r),r}async supportsOAuth(e){return await this.discover(e)!==null}static supportsPkceS256(e){return e.codeChallengeMethodsSupported?.some(t=>t.toUpperCase()==="S256")??!1}static supportsDynamicRegistration(e){return!!e.registrationEndpoint}static supportsAuthorizationCode(e){return e.responseTypesSupported?.some(t=>t.toLowerCase()==="code")??!1}static supportsEnrollment(e){return!!e.enrollmentEndpoint}async tryEndpoint(e){let t;try{t=await fetch(e)}catch(r){let a=r instanceof Error?r.message:String(r);return a.includes("ENOTFOUND")||a.includes("ECONNREFUSED")?(console.error(`  OAuth discovery: ${e} \u2014 host unreachable (${a})`),console.error("    If the server is behind a VPN, ensure you are connected.")):a.includes("CERT")||a.includes("SSL")||a.includes("TLS")?(console.error(`  OAuth discovery: ${e} \u2014 TLS error (${a})`),console.error("    If using a custom CA certificate, set NODE_EXTRA_CA_CERTS=/path/to/ca.pem")):console.error(`  OAuth discovery: ${e} \u2014 network error: ${a}`),null}if(!t.ok)return t.status===404||(t.status===403?(console.error(`  OAuth discovery: ${e} \u2014 HTTP 403 Forbidden`),console.error("    Access may be blocked by a firewall, proxy, or WAF.")):t.status>=500&&(console.error(`  OAuth discovery: ${e} \u2014 HTTP ${t.status} server error`),console.error("    The authorization server returned an internal error. Contact your IDP administrator."))),null;let o;try{o=await t.json()}catch{return console.error(`  OAuth discovery: ${e} \u2014 response is not valid JSON`),console.error("    The endpoint may be returning HTML instead of JSON. Check IDP configuration."),null}return{issuer:U(o.issuer),authorizationEndpoint:U(o.authorization_endpoint),tokenEndpoint:U(o.token_endpoint),registrationEndpoint:U(o.registration_endpoint),revocationEndpoint:U(o.revocation_endpoint),scopesSupported:O(o.scopes_supported),responseTypesSupported:O(o.response_types_supported),grantTypesSupported:O(o.grant_types_supported),codeChallengeMethodsSupported:O(o.code_challenge_methods_supported),tokenEndpointAuthMethodsSupported:O(o.token_endpoint_auth_methods_supported),dpopSigningAlgValuesSupported:O(o.dpop_signing_alg_values_supported),enrollmentEndpoint:U(o.enrollment_endpoint),enrollmentIssuanceProtocols:O(o.enrollment_issuance_protocols),enrollmentKeyTypes:O(o.enrollment_key_types),enrollmentScopesSupported:O(o.enrollment_scopes_supported),enrollmentConsentBindingParam:U(o.enrollment_consent_binding_param)}}};function U(n){return typeof n=="string"?n:null}function O(n){return Array.isArray(n)?n.filter(e=>typeof e=="string"):null}import{createHash as qo,randomBytes as Pn}from"crypto";import{createServer as Wo}from"http";import{execFile as Oe}from"child_process";function se(){return Pn(32).toString("base64url")}function ae(n){return qo("sha256").update(n).digest("base64url")}function ie(){return Pn(16).toString("base64url")}function ce(n){let e=new URLSearchParams({client_id:n.clientId,response_type:"code",redirect_uri:n.redirectUri,scope:n.scopes.join(" "),state:n.state,code_challenge:n.codeChallenge,code_challenge_method:"S256",...n.extraParams??{}});return`${n.endpoint}?${e}`}var Go=300*1e3;async function le(){return new Promise(n=>{let e,t,o=Wo((a,s)=>{let i=new URL(a.url,"http://localhost"),c=i.searchParams.get("code")??void 0,l=i.searchParams.get("state")??void 0,p=i.searchParams.get("error")??i.searchParams.get("error_description")??void 0,u=p?Jo(p):null,d=u?`<html><body><h1>Authorization failed</h1><p>${u}</p></body></html>`:"<html><body><h1>Authorization successful!</h1><p>You can close this window.</p></body></html>";s.writeHead(200,{"Content-Type":"text/html"}),s.end(d),t({code:c,state:l,error:p})}),r=new Promise(a=>{t=s=>{clearTimeout(e),a(s)},e=setTimeout(()=>t(null),Go),e.unref?.()});o.listen(0,"127.0.0.1",()=>{let a=o.address();n({redirectUri:`http://localhost:${a.port}/callback`,port:a.port,waitForCallback:()=>r,close:()=>{clearTimeout(e),o.close()}})})})}function Jo(n){return n.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;")}function pe(n){try{process.platform==="win32"?Oe("rundll32",["url.dll,FileProtocolHandler",n]):process.platform==="darwin"?Oe("open",[n]):Oe("xdg-open",[n])}catch{console.log("  Could not open browser automatically. Please navigate to the URL above manually.")}}var G=class{discovery;credentialStore;constructor(e,t){this.discovery=e??new D,this.credentialStore=t??new Yo}async authorize(e,t=[]){console.log(`Starting OAuth flow for ${e}...`);let o=await this.discovery.discover(e);if(!o)return K(`No OAuth discovery endpoint found for '${e}'.
   The server must expose one of:
     - https://${e}/.well-known/oauth-authorization-server (RFC 8414)
     - https://${e}/.well-known/openid-configuration (OpenID Connect)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kanonak-protocol/cli",
-  "version": "4.15.0",
+  "version": "4.17.0",
   "description": "Command-line tool for the Kanonak Protocol — validate, resolve, preview, and publish semantic ontology packages.",
   "type": "module",
   "main": "./dist/index.js",
@@ -35,8 +35,8 @@
     "semantic-web"
   ],
   "dependencies": {
-    "@kanonak-protocol/sdk": "^4.15.0",
-    "@kanonak-protocol/types": "^4.15.0",
+    "@kanonak-protocol/sdk": "^4.17.0",
+    "@kanonak-protocol/types": "^4.17.0",
     "@peculiar/x509": "^2.0.0",
     "commander": "^13.0.0",
     "js-yaml": "^4.1.1",