@kanonak-protocol/cli 5.8.0 → 5.9.0

package/dist/auth/publisherAuthority.d.ts

@@ -0,0 +1,38 @@
+import { DeviceCertificateStore } from '@kanonak-protocol/sdk';
+/**
+ * Publisher-centric authority resolution — the ONE way every CLI command turns
+ * what the user typed into the authority that actually keys an enrollment /
+ * session.
+ *
+ * Users think in PUBLISHERS (`paul.kanonak.com`) — the domain they `connect`,
+ * `enroll`, `install` from. But device certs and the sessions minted from them
+ * are keyed by the AUTHORITY (`oauth--paul.kanonak.com`), which the user neither
+ * knows nor should have to type. The mapping is the enrollment record's
+ * `publisher` field, captured at `connect`/`enroll` time. These helpers read it
+ * (and fall back to RFC 9728 discovery) so `session login/token/logout/status`,
+ * `device show/remove`, etc. all speak the publisher domain.
+ */
+export interface PublisherAuthorityDeps {
+    store?: Pick<DeviceCertificateStore, 'get' | 'list'>;
+    discovery?: {
+        discoverProtectedResource(host: string): Promise<string[] | null>;
+    };
+}
+/**
+ * Resolve the locally-enrolled AUTHORITY for what the user typed. Order:
+ *   1. Direct — the input is already an enrolled authority key (e.g. copied
+ *      from `device list`/`session status`).
+ *   2. Local mapping — an enrollment recorded this publisher; resolve with no
+ *      network call (the publisher-centric fast path).
+ *   3. Network fallback — resolve the publisher to its authority via RFC 9728
+ *      `oauth-protected-resource` (covers enrollments made before the publisher
+ *      was recorded).
+ * Returns the authority host that has a local enrollment, or null.
+ */
+export declare function resolveEnrolledAuthority(input: string, deps?: PublisherAuthorityDeps): Promise<string | null>;
+/**
+ * The publisher an enrolled authority was connected through, if it was recorded
+ * — for presenting authority-keyed state (sessions) in publisher terms. Returns
+ * undefined when the authority isn't enrolled locally or carries no publisher.
+ */
+export declare function publisherForAuthority(authority: string, deps?: PublisherAuthorityDeps): Promise<string | undefined>;

package/dist/commands/session.d.ts

@@ -4,6 +4,11 @@ import { Command } from 'commander';
  * auto-refreshing registry sessions (issue #72), for authenticating GIT to your
  * Kanonak package repositories.
  *
+ * Publisher-centric: every subcommand takes the PUBLISHER domain you connected
+ * to (`paul.kanonak.com`), not the OAuth authority host it resolves to. The
+ * mapping is the device enrollment captured by `connect`/`enroll`; see
+ * `resolveEnrolledAuthority`.
+ *
  * Scope: the CLI provides dynamic GIT authentication and does not manage
  * package-manager-native registry credentials. Kanonak packages live in Git, so
  * the git credential helper (plus Go's `GOAUTH=git` and any `git+https`