@kanonak-protocol/cli 5.5.0 → 5.7.0

package/dist/auth/enrollment/EnrollmentFlow.d.ts

@@ -18,8 +18,9 @@ import type { FetchLike } from './IssuanceClient.js';
 /** The discovery capability the flow needs (satisfied by {@link OAuthDiscovery}). */
 export interface EnrollmentMetadataSource {
     discover(host: string): Promise<OAuthServerMetadata | null>;
-    /** Resolve a Kanonak publisher to its authority issuer URL(s) via kanonak.json. */
-    discoverKanonakAuthorities(host: string): Promise<string[] | null>;
+    /** Resolve a publisher to its authority issuer URL(s) via the always-public
+     *  RFC 9728 `oauth-protected-resource` document. */
+    discoverProtectedResource(host: string): Promise<string[] | null>;
 }
 /** Just enough of {@link CredentialStore} to reuse a stored OAuth client_id. */
 export interface CredentialLookup {

package/dist/auth/sessionFetch.d.ts

@@ -0,0 +1,21 @@
+import { CredentialResolver } from '@kanonak-protocol/sdk';
+import type { AuthenticatedFetchFn } from '@kanonak-protocol/sdk';
+/**
+ * A fetch transport that authenticates GATED reads with the device session.
+ *
+ * Per host, it resolves the publisher → authority → device session
+ * (CredentialResolver) and presents the session token as `Authorization: Bearer`.
+ * A public publisher resolves to no credential and the request goes out
+ * anonymously. This is what makes `install` / `connect` read a gated publisher's
+ * `kanonak.json` / `kanonak.lock` / package sources — without it, those requests
+ * hit the gate unauthenticated.
+ *
+ * Crucially it uses `redirect: 'manual'`: a gated endpoint 302-redirects an
+ * unauthenticated request (e.g. to a login), and Node's default auto-following
+ * turns that into a redirect LOOP. Not following means a gated 302 surfaces as a
+ * clean non-OK response the caller reports, instead of spinning.
+ *
+ * The resolved credential is cached per host so one `connect`/`install` doesn't
+ * re-mint a session for every package in the closure.
+ */
+export declare function createSessionFetch(resolver?: CredentialResolver): AuthenticatedFetchFn;

package/dist/commands/connect.d.ts

@@ -14,8 +14,9 @@ export interface ConnectResult {
  */
 export interface ConnectDeps {
     fetchFn?: AuthenticatedFetchFn;
+    /** Resolve a publisher to its authority via RFC 9728 oauth-protected-resource. */
     discovery?: {
-        discoverKanonakAuthorities(host: string): Promise<string[] | null>;
+        discoverProtectedResource(host: string): Promise<string[] | null>;
     };
     configResolver?: {
         getConfig(host: string): Promise<PublisherConfig>;
@@ -42,13 +43,17 @@ export interface ConnectDeps {
     log?: (message: string) => void;
 }
 /**
- * The `connect` orchestrator core (issue #9): given a publisher domain, discover
- * it (kanonak.json → authorization_servers + featured_packages), enroll this
- * device if the publisher is gated and not already enrolled with its authority,
- * then install the featured packages and their pinned closures from the served
- * kanonak.lock. Pure of process/stdout concerns — returns a {@link ConnectResult}
- * and reports progress through `deps.log` — so the CLI and VS Code wrap it the
- * same way. A public publisher (no authorization_servers) never enrolls.
+ * The `connect` orchestrator core (issue #9): given a publisher domain, learn
+ * whether it is gated from the always-public RFC 9728 `oauth-protected-resource`
+ * document, enroll this device if it is gated and not already enrolled, then
+ * read the publisher's `kanonak.json` (its `featured_packages`) and install them
+ * and their pinned closures from the served `kanonak.lock`.
+ *
+ * For a gated publisher the `kanonak.json`/`kanonak.lock` are themselves behind
+ * auth, so those reads go through the device session minted from the enrolled
+ * cert. A public publisher (no `oauth-protected-resource`) never enrolls and
+ * reads everything anonymously. Pure of process/stdout concerns — returns a
+ * {@link ConnectResult} and reports via `deps.log`.
  */
 export declare function connect(publisher: string, options: {
     install?: boolean;