@kanonak-protocol/cli 4.20.0 → 5.1.0

package/dist/auth/enrollment/EnrollmentFlow.d.ts

@@ -1,6 +1,6 @@
 import 'reflect-metadata';
 import type { DeviceEnrollmentRecord } from '@kanonak-protocol/sdk';
-import type { OAuthServerMetadata } from '../OAuthDiscovery.js';
+import type { OAuthServerMetadata } from '@kanonak-protocol/sdk';
 import type { KeyProvider, KeyType } from './KeyProvider.js';
 import type { FetchLike } from './IssuanceClient.js';
 /**

package/dist/auth/oauthHelpers.d.ts

@@ -1,9 +1,8 @@
 /**
- * Reusable OAuth 2.0 / RFC 8252 native-app helpers shared by the interactive
- * flows: the loopback callback server, PKCE (RFC 7636) generation, the
- * authorization-URL builder, and the system browser opener. Both `OAuthFlow`
- * (login) and `EnrollmentFlow` (device enrollment) build on these so the
- * loopback + PKCE mechanics live in exactly one place.
+ * Reusable OAuth 2.0 / RFC 8252 native-app helpers: the loopback callback
+ * server, PKCE (RFC 7636) generation, the authorization-URL builder, and the
+ * system browser opener. `EnrollmentFlow` (device enrollment) builds on these so
+ * the loopback + PKCE mechanics live in exactly one place.
  */
 export declare function generateCodeVerifier(): string;
 export declare function generateCodeChallenge(verifier: string): string;

package/dist/auth/session/GitCredentialHelper.d.ts

@@ -0,0 +1,47 @@
+import { type CredentialResolverDeps } from '@kanonak-protocol/sdk';
+/**
+ * `kanonak` as a git credential helper (issue #72). Git invokes the helper per
+ * request; for a Kanonak-credentialed repository host it returns a freshly-valid
+ * session token, so pushes/pulls just work without static, expiring files.
+ *
+ * The actual resolution (RFC 9728 host→authority, then the authority-scoped
+ * device session) lives in the SDK's CredentialResolver — the durable primitive.
+ * This class owns only the git-specific concerns: the stdin/stdout protocol and
+ * the HTTP Basic user-id. Self-filtering: when the resolver declines (no Kanonak
+ * authority, or unenrolled), the helper emits nothing and git falls through.
+ * Identity is never inferred; the Basic user-id is an RFC 7617 carrier (the token
+ * is the credential).
+ */
+/** A git credential description (the key=value lines git sends on stdin). */
+export interface GitCredential {
+    protocol?: string;
+    host?: string;
+    path?: string;
+    username?: string;
+    [key: string]: string | undefined;
+}
+export interface GitCredentialHelperDeps extends CredentialResolverDeps {
+    /** Carrier user-id when git's request supplies none (RFC 7617; not an identity). */
+    carrierUserId?: string;
+}
+export declare class GitCredentialHelper {
+    private readonly resolver;
+    private readonly carrier;
+    constructor(deps?: GitCredentialHelperDeps);
+    /**
+     * Resolve a git request to credentials, or null to DECLINE (git falls through).
+     */
+    resolve(cred: GitCredential): Promise<{
+        username: string;
+        password: string;
+    } | null>;
+    /**
+     * Run one git credential-helper invocation: parse the request from `input`,
+     * handle the operation, and return the stdout to emit ('' = decline). Only
+     * `get` produces credentials; `store`/`erase` are no-ops because Kanonak
+     * sessions are managed by `kanonak session`, not by git.
+     */
+    run(operation: string, input: string): Promise<string>;
+}
+/** Parse git's credential stdin: `key=value` lines, blank-line terminated. */
+export declare function parseGitCredential(input: string): GitCredential;

package/dist/commands/credential.d.ts

@@ -0,0 +1,10 @@
+import { Command } from 'commander';
+/**
+ * `kanonak credential resolve <host>` — the durable host→credential primitive
+ * (issue #72), exposed for scripting. Given any registry/repo host, it resolves
+ * a freshly-valid credential (via RFC 9728 discovery + the authority-scoped
+ * device session) and prints it as JSON, or exits non-zero when Kanonak has none
+ * for that host. This is the same resolver the git credential helper uses; other
+ * tooling builds on it instead of reimplementing the auth.
+ */
+export declare function credentialCommand(): Command;

package/dist/commands/credentialHelper.d.ts

@@ -0,0 +1,10 @@
+import { Command } from 'commander';
+/**
+ * `kanonak credential-helper <get|store|erase>` — a git credential helper
+ * (issue #72). Git invokes it (configured via `credential.helper = !kanonak
+ * credential-helper`), passing the credential description on stdin. For a
+ * repository host that advertises a Kanonak authority (RFC 9728), it returns a
+ * freshly-refreshed session token; for any other host it prints nothing, so git
+ * falls through to its normal flow. Not meant to be run by hand.
+ */
+export declare function credentialHelperCommand(): Command;

package/dist/commands/session.d.ts

@@ -0,0 +1,19 @@
+import { Command } from 'commander';
+/**
+ * `kanonak session` — turn an enrolled device certificate into scoped,
+ * auto-refreshing registry sessions (issue #72), for authenticating GIT to your
+ * Kanonak package repositories.
+ *
+ * Scope: the CLI provides dynamic GIT authentication and does not manage
+ * package-manager-native registry credentials. Kanonak packages live in Git, so
+ * the git credential helper (plus Go's `GOAUTH=git` and any `git+https`
+ * dependency fetch) is the universal mechanism; package-manager registry auth is
+ * out of scope here.
+ *
+ * `install-git-helper` wires `kanonak` in as a git credential helper; pushes and
+ * pulls then authenticate transparently (a fresh session minted from the cert per
+ * request, the repo host resolved to its authority via RFC 9728). `token` hands
+ * out a session token on demand for any other use (a git credential file, an env
+ * var, CI).
+ */
+export declare function sessionCommand(): Command;