@kanonak-protocol/cli 5.5.0 → 5.6.0

package/dist/auth/enrollment/EnrollmentFlow.d.ts

@@ -18,8 +18,9 @@ import type { FetchLike } from './IssuanceClient.js';
 /** The discovery capability the flow needs (satisfied by {@link OAuthDiscovery}). */
 export interface EnrollmentMetadataSource {
     discover(host: string): Promise<OAuthServerMetadata | null>;
-    /** Resolve a Kanonak publisher to its authority issuer URL(s) via kanonak.json. */
-    discoverKanonakAuthorities(host: string): Promise<string[] | null>;
+    /** Resolve a publisher to its authority issuer URL(s) via the always-public
+     *  RFC 9728 `oauth-protected-resource` document. */
+    discoverProtectedResource(host: string): Promise<string[] | null>;
 }
 /** Just enough of {@link CredentialStore} to reuse a stored OAuth client_id. */
 export interface CredentialLookup {

package/dist/commands/connect.d.ts

@@ -1,4 +1,4 @@
-import type { LockFile, LockEntry, PublisherConfig, DeviceEnrollmentRecord, AuthenticatedFetchFn } from '@kanonak-protocol/sdk';
+import type { LockFile, LockEntry, PublisherConfig, DeviceEnrollmentRecord, SessionRecord, AuthenticatedFetchFn } from '@kanonak-protocol/sdk';
 /** The outcome of a connect, for a host (CLI / VS Code) to report. */
 export interface ConnectResult {
     connected: boolean;
@@ -14,8 +14,9 @@ export interface ConnectResult {
  */
 export interface ConnectDeps {
     fetchFn?: AuthenticatedFetchFn;
+    /** Resolve a publisher to its authority via RFC 9728 oauth-protected-resource. */
     discovery?: {
-        discoverKanonakAuthorities(host: string): Promise<string[] | null>;
+        discoverProtectedResource(host: string): Promise<string[] | null>;
     };
     configResolver?: {
         getConfig(host: string): Promise<PublisherConfig>;
@@ -26,6 +27,9 @@ export interface ConnectDeps {
     publisherIndex?: {
         getLock(host: string): Promise<LockFile | null>;
     };
+    sessionManager?: {
+        getValidSession(host: string): Promise<SessionRecord | null>;
+    };
     /** Run device enrollment for a publisher (resolves its authority internally). */
     enroll?: (publisher: string) => Promise<{
         success: boolean;
@@ -42,13 +46,17 @@ export interface ConnectDeps {
     log?: (message: string) => void;
 }
 /**
- * The `connect` orchestrator core (issue #9): given a publisher domain, discover
- * it (kanonak.json → authorization_servers + featured_packages), enroll this
- * device if the publisher is gated and not already enrolled with its authority,
- * then install the featured packages and their pinned closures from the served
- * kanonak.lock. Pure of process/stdout concerns — returns a {@link ConnectResult}
- * and reports progress through `deps.log` — so the CLI and VS Code wrap it the
- * same way. A public publisher (no authorization_servers) never enrolls.
+ * The `connect` orchestrator core (issue #9): given a publisher domain, learn
+ * whether it is gated from the always-public RFC 9728 `oauth-protected-resource`
+ * document, enroll this device if it is gated and not already enrolled, then
+ * read the publisher's `kanonak.json` (its `featured_packages`) and install them
+ * and their pinned closures from the served `kanonak.lock`.
+ *
+ * For a gated publisher the `kanonak.json`/`kanonak.lock` are themselves behind
+ * auth, so those reads go through the device session minted from the enrolled
+ * cert. A public publisher (no `oauth-protected-resource`) never enrolls and
+ * reads everything anonymously. Pure of process/stdout concerns — returns a
+ * {@link ConnectResult} and reports via `deps.log`.
  */
 export declare function connect(publisher: string, options: {
     install?: boolean;