@kanonak-protocol/cli 6.3.0 → 6.4.0

package/dist/commands/install.d.ts

@@ -1,5 +1,4 @@
-import { KanonakParser } from '@kanonak-protocol/sdk';
-import type { AuthenticatedFetchFn } from '@kanonak-protocol/sdk';
+import { KanonakParser, PublisherIndex } from '@kanonak-protocol/sdk';
 import type { LockFile, LockEntry } from '@kanonak-protocol/sdk';
 import { FileCache } from '../cache/FileCache.js';
 /**
@@ -12,6 +11,12 @@ import { FileCache } from '../cache/FileCache.js';
  * sha256 before caching (the `npm ci` model). There is no version-range
  * selection: the publisher's lock IS the resolution.
  *
+ * Where the bytes come from is the consumer's choice when it configured
+ * package URL templates (#130): a new install records the template's URL in
+ * each entry's `resolved`, and an install from the local lock fetches from the
+ * template too, leaving the lock as it is. With no template, an install from
+ * the lock fetches `resolved` as recorded. The sha256 is checked either way.
+ *
  * Usage: kanonak install kanonak.org/core-rdf      (install what the lock pins)
  *        kanonak install kanonak.org/core-rdf@1.0.1 (must match the pinned version)
  *        kanonak install                            (install from the local kanonak.lock)
@@ -19,11 +24,12 @@ import { FileCache } from '../cache/FileCache.js';
 export declare function installCommand(packageRef?: string): Promise<void>;
 /**
  * Ensure a pinned package is in the cache: a cache hit is verified against the
- * lock's integrity; a miss is fetched from the entry's `resolved` URL, verified,
- * identity-checked, then cached. Never caches bytes whose hash or namespace
- * disagrees with the lock — a mismatch throws.
+ * lock's integrity; a miss is fetched through `publisherIndex` (the user's
+ * template, else the entry's `resolved` URL), verified, identity-checked, then
+ * cached. Never caches bytes whose hash or namespace disagrees with the lock —
+ * a mismatch throws.
  */
-export declare function fetchVerifyCache(publisher: string, packageName: string, entry: LockEntry, fileCache: FileCache, parser: KanonakParser, fetchFn: AuthenticatedFetchFn): Promise<void>;
+export declare function fetchVerifyCache(publisher: string, packageName: string, entry: LockEntry, fileCache: FileCache, parser: KanonakParser, publisherIndex: PublisherIndex): Promise<void>;
 /**
  * The keys of `rootKey` and every package reachable through its (transitive)
  * `dependencies`, all resolved within `lock`. A dependency the lock references

package/dist/commands/verify.d.ts

@@ -4,8 +4,10 @@
  * The cache is an untrusted accelerator: this re-hashes each cached package and
  * compares it to the committed `kanonak.lock` (catches local tampering/
  * corruption of the cache). With `--remote` it also re-fetches each package
- * from its recorded origin and compares to the lock (catches lock↔origin drift:
- * a tampered lock, a republished package, or a MITM). The lock — committed and
+ * from where `install` would, the user's package URL template or else its
+ * recorded `resolved` URL, through the credentialed transport, and compares to
+ * the lock (catches lock↔origin drift: a tampered lock, a republished package,
+ * or a MITM). The lock — committed and
  * reviewed in version control — is the trust root; this command makes any
  * divergence from it detectable rather than silent. Exits non-zero on any
  * mismatch, so it can gate a build in CI.