@knolo/cli 5.2.0 → 5.2.2

package/README.md

@@ -47,10 +47,56 @@ An explicit `--registry` value takes precedence over `KNOLO_HUB_URL`. In
 development mode (`NODE_ENV=development`), the default is
 `http://localhost:3000`; otherwise the default is `https://hub.knolo.dev`.
 
-The current Hub surface is read-only discovery and verified installation. Local
-`knolo add <name> <path>` continues to update a project’s local source
-configuration. A Hub pack is installed only after its manifest, Blob bytes,
-digest, size, and local Knowledge Image structure have all been verified:
+Hub writes use a dashboard token as an HTTP Bearer credential. GitHub sign-in
+is needed only to mint that token at
+`https://hub.knolo.dev/dashboard/tokens`; `knolo login` is local-only and does
+not call a Hub login or token-minting endpoint:
+
+```bash
+knolo login --token kno_…
+# write requests use: Authorization: Bearer kno_…
+```
+
+`knolo publish` uploads bytes with `@vercel/blob` to the public store, waits
+for verification, creates an attested draft, and releases it. Set
+`PACKS_READ_WRITE_TOKEN` from the production `knolo-hub` Vercel environment
+before publishing; do not substitute `BLOB_READ_WRITE_TOKEN`:
+
+```bash
+cd /path/to/knolo-hub
+npx vercel env pull /tmp/knolo-env-prod --environment=production --yes
+export PACKS_READ_WRITE_TOKEN="$(awk -F= '$1 == "PACKS_READ_WRITE_TOKEN" {sub(/^[^=]*=/, ""); gsub(/^\"|\"$/, ""); print; exit}' /tmp/knolo-env-prod)"
+
+knolo publish ./dist/knowledge.knolo \
+  --slug refund-policy --version 1.2.0 --license Apache-2.0
+knolo yank acme/refund-policy@1.2.0
+```
+
+The upload uses pathname `sha256/<64-lowercase-hex>.knolo`, public access,
+`addRandomSuffix: false`, `application/octet-stream`, and a one-year cache.
+Only public Blob URLs are accepted because Hub verification fetches the
+artifact itself. The CLI never sends the `kno_…` token to Blob, in a query
+string, cookie, or pack bytes. A 401 usually means the `Bearer` word is
+missing or the token was revoked; it does not mean the Hub write API requires
+a GitHub browser session.
+
+The older `@knolo/cli@5.2.0` publish/yank command was an unimplemented stub;
+current versions use the live Hub HTTP sequence. For a direct smoke test of a
+stored credential, request the account endpoint with the same header:
+
+```bash
+curl -sS \
+  -H "Authorization: Bearer kno_…" \
+  -H "Accept: application/json" \
+  https://hub.knolo.dev/api/v1/account
+```
+
+Do not use `POST /api/v1/tokens` as a CLI login endpoint; it is for the
+dashboard/GitHub session that mints tokens.
+
+Hub pack installation remains available without credentials and only happens
+after its manifest, Blob bytes, digest, size, and local Knowledge Image
+structure have all been verified:
 
 ```bash
 knolo add acme/refund-policy@1.2.0
@@ -127,11 +173,11 @@ curl -sS "http://127.0.0.1:8787/search?q=billing&k=5"
 
 These commands stay local-first:
 
-* No hosted service
-* No vector database
-* Lexical retrieval by default
-* Controller-only pack mutation; 2 MiB pack limit
-* Pack state survives canister upgrades
+- No hosted service
+- No vector database
+- Lexical retrieval by default
+- Controller-only pack mutation; 2 MiB pack limit
+- Pack state survives canister upgrades
 
 ---
 
@@ -152,8 +198,8 @@ knolo.config.ts
 
 ```ts
 export default {
-  input: "./knowledge",
-  output: "./dist/knowledge.knolo"
+  input: './knowledge',
+  output: './dist/knowledge.knolo',
 };
 ```
 
@@ -161,12 +207,12 @@ export default {
 
 ## 🧱 What the CLI Does
 
-* Parses structured documents
-* Normalizes metadata
-* Indexes namespaces
-* Extracts agent routing profiles
-* Validates agent registry
-* Generates compact `.knolo` bundle
+- Parses structured documents
+- Normalizes metadata
+- Indexes namespaces
+- Extracts agent routing profiles
+- Validates agent registry
+- Generates compact `.knolo` bundle
 
 All builds are deterministic.
 
@@ -176,11 +222,11 @@ All builds are deterministic.
 
 Current v4 features include:
 
-* Routing profile extraction
-* Tool policy validation
-* Mount-time registry validation
-* Deterministic selection logic
-* Pack manifests, analyzer identities, retrieval plans, receipts, and evidence spans
+- Routing profile extraction
+- Tool policy validation
+- Mount-time registry validation
+- Deterministic selection logic
+- Pack manifests, analyzer identities, retrieval plans, receipts, and evidence spans
 
 ---
 
@@ -188,16 +234,16 @@ Current v4 features include:
 
 KnoLo intentionally avoids:
 
-* Vector databases
-* Similarity search
-* External inference APIs
+- Vector databases
+- Similarity search
+- External inference APIs
 
 This ensures:
 
-* Reproducibility
-* Security
-* Low memory usage
-* Predictable results
+- Reproducibility
+- Security
+- Low memory usage
+- Predictable results
 
 ---
 

package/bin/knolo.mjs

@@ -20,7 +20,7 @@ import path from 'node:path';
 import process from 'node:process';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { createRequire } from 'node:module';
-import { isHubAddInvocation, runHubAdd, runHubInfo, runHubLogin, runHubLogout, runHubPublishStub, runHubSearch, runHubWhoami } from './registry/commands.mjs';
+import { isHubAddInvocation, runHubAdd, runHubInfo, runHubLogin, runHubLogout, runHubPublish, runHubSearch, runHubWhoami, runHubYank } from './registry/commands.mjs';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const require = createRequire(import.meta.url);
@@ -34,7 +34,7 @@ const DEFAULT_CONFIG = {
 };
 const SUPPORTED_EXTENSIONS = new Set(['.md', '.txt', '.json']);
 const SKIP_DIRS = new Set(['node_modules', 'dist', '.git', '.dfx', '.cargo-target']);
-const SUBCOMMANDS = new Set(['init', 'add', 'build', 'query', 'inspect', 'migrate', 'verify', 'explain', 'diff', 'dev', 'v5', 'search', 'info', 'login', 'whoami', 'logout', 'publish', 'semantic:index', 'semantic:inspect', 'semantic:validate']);
+const SUBCOMMANDS = new Set(['init', 'add', 'build', 'query', 'inspect', 'migrate', 'verify', 'explain', 'diff', 'dev', 'v5', 'search', 'info', 'login', 'whoami', 'logout', 'publish', 'yank', 'semantic:index', 'semantic:inspect', 'semantic:validate']);
 const ICP_SUBCOMMANDS = new Set(['init', 'build-pack', 'upload', 'query', 'health', 'info', 'clear']);
 const ICP_TEMPLATE_CANDIDATES = [
   path.resolve(__dirname, '../templates/icp-knowledge-canister'),
@@ -86,7 +86,8 @@ Commands:
   login                   Store a Hub token locally
   whoami                  Show the stored Hub token prefix
   logout                  Remove the stored Hub token
-  publish                 Publish support is waiting for Hub write APIs
+  publish                 Publish a pack with a Hub Bearer token
+  yank <pack>@<version>   Yank a released pack with a Hub Bearer token
   build                   Build a .knolo pack from configured sources
   query <question>        Query a built pack and print top hits
   inspect <pack>          Inspect pack format, sections, and manifest
@@ -111,10 +112,11 @@ function printCommandHelp(command) {
     add: 'Usage: knolo add <name> <path> | <publisher>/<slug>[@<version>] [--out <path>] [--force] [--json] [--registry <url>]',
     search: 'Usage: knolo search <query> [--format V4|V5] [--license <id>] [--official] [--agents] [--json] [--registry <url>]',
     info: 'Usage: knolo info <publisher>/<slug> [--json] [--registry <url>]',
-    login: 'Usage: knolo login [--token kno_…] [--stdin] [--registry <url>]',
+    login: 'Usage: knolo login [--token kno_…] [--stdin] [--registry <url>]\n\nStores the raw token locally. Hub write calls send Authorization: Bearer kno_….\nMint tokens at https://hub.knolo.dev/dashboard/tokens; login does not call POST /api/v1/tokens.',
     whoami: 'Usage: knolo whoami',
     logout: 'Usage: knolo logout',
-    publish: 'Usage: knolo publish <pack.knolo>  (not available until Hub write APIs support CLI tokens)',
+    publish: 'Usage: knolo publish <pack.knolo> --slug <slug> --version <version> --license <SPDX> [--publisher <handle>] [--readme <text>] [--sources <text>] [--intended-use <text>] [--json] [--registry <url>]\n\nUses the stored token as Authorization: Bearer kno_…. Uploads go directly to a public Blob URL; Hub verifies before release.\nOlder @knolo/cli 5.2.0 builds were unimplemented; Hub has always accepted Bearer CLI tokens.',
+    yank: 'Usage: knolo yank <publisher>/<slug>@<version> [--json] [--registry <url>]\n\nUses the stored token as Authorization: Bearer kno_…. Yank is owner-only and leaves the public Blob in place.',
     build: 'Usage: knolo build',
     query: 'Usage: knolo query <question> [--pack <path>] [--k <number>] [--receipt <file>] [--json]',
     inspect: 'Usage: knolo inspect <pack.knolo>',
@@ -1195,7 +1197,8 @@ async function main() {
       if (command === 'login') return await runHubLogin(commandArgs);
       if (command === 'whoami') return await runHubWhoami(commandArgs);
       if (command === 'logout') return await runHubLogout(commandArgs);
-      if (command === 'publish') return runHubPublishStub(commandArgs);
+      if (command === 'publish') return runHubPublish(commandArgs);
+      if (command === 'yank') return runHubYank(commandArgs);
 
       const core = await loadCore();
       if (command === 'build') return await cmdBuild(core);

package/bin/registry/artifacts.mjs

@@ -1,6 +1,6 @@
 import { createHash, randomUUID } from 'node:crypto';
 import { createWriteStream } from 'node:fs';
-import { chmod, mkdir, readFile, rename, unlink } from 'node:fs/promises';
+import { chmod, copyFile, mkdir, readFile, rename, unlink } from 'node:fs/promises';
 import path from 'node:path';
 import { Readable } from 'node:stream';
 
@@ -86,11 +86,27 @@ export async function readArtifact(tempPath) {
 }
 
 export async function installCachedArtifact(tempPath, cachePath) {
+  const stagedPath = await stageCachedArtifact(tempPath, cachePath);
+  try {
+    await rename(stagedPath, cachePath);
+    await chmod(cachePath, 0o644);
+    return cachePath;
+  } finally {
+    await unlink(stagedPath).catch(() => {});
+  }
+}
+
+export async function stageCachedArtifact(sourcePath, cachePath) {
   await mkdir(path.dirname(cachePath), { recursive: true });
-  await chmod(tempPath, 0o644);
-  await rename(tempPath, cachePath);
-  await chmod(cachePath, 0o644);
-  return cachePath;
+  const stagedPath = `${cachePath}.tmp-${process.pid}-${randomUUID()}`;
+  try {
+    await copyFile(sourcePath, stagedPath);
+    await chmod(stagedPath, 0o644);
+    return stagedPath;
+  } catch (error) {
+    await unlink(stagedPath).catch(() => {});
+    throw error;
+  }
 }
 
 async function writeChunk(stream, chunk) {