@knolo/cli 5.2.1 → 5.2.3

package/README.md

@@ -57,21 +57,23 @@ knolo login --token kno_…
 # write requests use: Authorization: Bearer kno_…
 ```
 
-`knolo publish` uploads bytes directly to the public Blob URL returned by Hub,
-waits for verification, creates an attested draft, and releases it. The
-`--slug`, `--version`, and SPDX `--license` are required:
+`knolo publish` asks Hub for a Blob PUT grant with the dashboard token, PUTs
+bytes to that grant URL, then completes with the public pack URL from the PUT
+response. A `kno_…` token is the only credential. Do not set
+`PACKS_READ_WRITE_TOKEN` — that is Hub’s store secret, not a publisher token.
 
 ```bash
+knolo login --token kno_…
 knolo publish ./dist/knowledge.knolo \
   --slug refund-policy --version 1.2.0 --license Apache-2.0
 knolo yank acme/refund-policy@1.2.0
 ```
 
-Only public Blob URLs are accepted because Hub verification fetches the
-artifact itself. The CLI never sends the `kno_…` token to Blob, in a query
-string, cookie, or pack bytes. A 401 usually means the `Bearer` word is
-missing or the token was revoked; it does not mean the Hub write API requires
-a GitHub browser session.
+The grant pathname is `sha256/<64-lowercase-hex>.knolo`. Only public Blob URLs
+(`*.public.blob.vercel-storage.com`) are sent to `/api/upload/complete`. The
+CLI never sends the `kno_…` token to Blob, in a query string, cookie, or pack
+bytes. A 401 usually means the `Bearer` word is missing or the token was
+revoked; it does not mean the Hub write API requires a GitHub browser session.
 
 The older `@knolo/cli@5.2.0` publish/yank command was an unimplemented stub;
 current versions use the live Hub HTTP sequence. For a direct smoke test of a
@@ -99,7 +101,6 @@ Successful installs are cached by SHA-256 and recorded in
 `knolo.lock.json`. A yanked version or an existing conflicting pin requires
 `--force`; digest and artifact validation cannot be bypassed.
 
-
 ---
 
 ## 🚀 Commands
@@ -167,11 +168,11 @@ curl -sS "http://127.0.0.1:8787/search?q=billing&k=5"
 
 These commands stay local-first:
 
-* No hosted service
-* No vector database
-* Lexical retrieval by default
-* Controller-only pack mutation; 2 MiB pack limit
-* Pack state survives canister upgrades
+- No hosted service
+- No vector database
+- Lexical retrieval by default
+- Controller-only pack mutation; 2 MiB pack limit
+- Pack state survives canister upgrades
 
 ---
 
@@ -192,8 +193,8 @@ knolo.config.ts
 
 ```ts
 export default {
-  input: "./knowledge",
-  output: "./dist/knowledge.knolo"
+  input: './knowledge',
+  output: './dist/knowledge.knolo',
 };
 ```
 
@@ -201,12 +202,12 @@ export default {
 
 ## 🧱 What the CLI Does
 
-* Parses structured documents
-* Normalizes metadata
-* Indexes namespaces
-* Extracts agent routing profiles
-* Validates agent registry
-* Generates compact `.knolo` bundle
+- Parses structured documents
+- Normalizes metadata
+- Indexes namespaces
+- Extracts agent routing profiles
+- Validates agent registry
+- Generates compact `.knolo` bundle
 
 All builds are deterministic.
 
@@ -216,11 +217,11 @@ All builds are deterministic.
 
 Current v4 features include:
 
-* Routing profile extraction
-* Tool policy validation
-* Mount-time registry validation
-* Deterministic selection logic
-* Pack manifests, analyzer identities, retrieval plans, receipts, and evidence spans
+- Routing profile extraction
+- Tool policy validation
+- Mount-time registry validation
+- Deterministic selection logic
+- Pack manifests, analyzer identities, retrieval plans, receipts, and evidence spans
 
 ---
 
@@ -228,16 +229,16 @@ Current v4 features include:
 
 KnoLo intentionally avoids:
 
-* Vector databases
-* Similarity search
-* External inference APIs
+- Vector databases
+- Similarity search
+- External inference APIs
 
 This ensures:
 
-* Reproducibility
-* Security
-* Low memory usage
-* Predictable results
+- Reproducibility
+- Security
+- Low memory usage
+- Predictable results
 
 ---
 

package/bin/knolo.mjs

@@ -115,7 +115,7 @@ function printCommandHelp(command) {
     login: 'Usage: knolo login [--token kno_…] [--stdin] [--registry <url>]\n\nStores the raw token locally. Hub write calls send Authorization: Bearer kno_….\nMint tokens at https://hub.knolo.dev/dashboard/tokens; login does not call POST /api/v1/tokens.',
     whoami: 'Usage: knolo whoami',
     logout: 'Usage: knolo logout',
-    publish: 'Usage: knolo publish <pack.knolo> --slug <slug> --version <version> --license <SPDX> [--publisher <handle>] [--readme <text>] [--sources <text>] [--intended-use <text>] [--json] [--registry <url>]\n\nUses the stored token as Authorization: Bearer kno_…. Uploads go directly to a public Blob URL; Hub verifies before release.\nOlder @knolo/cli 5.2.0 builds were unimplemented; Hub has always accepted Bearer CLI tokens.',
+    publish: 'Usage: knolo publish <pack.knolo> --slug <slug> --version <version> --license <SPDX> [--publisher <handle>] [--readme <text>] [--sources <text>] [--intended-use <text>] [--json] [--registry <url>]\n\nUses the stored dashboard token as Authorization: Bearer kno_…. Hub issues a public Blob PUT grant; the CLI never needs PACKS_READ_WRITE_TOKEN.\nUploads go to the grant URL without the kno_ token. Complete sends the public Blob URL, then Hub verifies before release.',
     yank: 'Usage: knolo yank <publisher>/<slug>@<version> [--json] [--registry <url>]\n\nUses the stored token as Authorization: Bearer kno_…. Yank is owner-only and leaves the public Blob in place.',
     build: 'Usage: knolo build',
     query: 'Usage: knolo query <question> [--pack <path>] [--k <number>] [--receipt <file>] [--json]',