@native-knowledge/cli 0.1.0-rc.1 → 0.1.0-rc.2

package/dist/internal/serving-contracts/tenant-web.js

@@ -0,0 +1,53 @@
+/** Provider21 增量能力；17–20 的注册表、默认版本和既有错误合同保持。 */
+import { z } from 'zod';
+import { tenantWebSpecSchema, tenantWebSummarySchema, tenantWebJobRefSchema, tenantWebSpecRevision, tenantCollectionCycleSchema, materialTenantIdSchema, tenantStorageKey, TENANT_WEB_SPEC_CAPABILITY } from '../contracts/index.js';
+import { tenantRuntimeWorkspaceToolSchemas, tenantRuntimeWorkspaceDataSchemas, tenantRuntimeEnvelopeSchema, tenantRuntimeProviderSchema, tenantRuntimeScopesForInput, tenantRuntimeAuthorization } from './tenant-runtime.js';
+import { tenantProjectErrorSchema } from './tenant-project.js';
+import { tenantManagementSafeErrorRef } from './tenant-management.js';
+export const tenantWebToolSchemas = {
+    tenant_web_collect_preview: z.object({ spec: tenantWebSpecSchema }).strict(),
+    tenant_web_collect_submit: z.object({ requestId: tenantCollectionCycleSchema, spec: tenantWebSpecSchema }).strict(),
+    tenant_web_collect_status: z.object({ jobRef: tenantWebJobRefSchema }).strict(),
+};
+export const tenantWebDataSchemas = {
+    tenant_web_collect_preview: z.object({ spec: tenantWebSpecSchema, specRevision: tenantWebSummarySchema.shape.specRevision, networkValidated: z.literal(false), budgetReserved: z.literal(false), execution: z.literal('UNAVAILABLE'), reason: z.literal('S2_NOT_IMPLEMENTED'), requirementsState: z.literal('DECLARED_NOT_EVALUATED') }).strict().superRefine((v, ctx) => { if (v.specRevision !== tenantWebSpecRevision(v.spec))
+        ctx.addIssue({ code: 'custom', message: 'Preview specification identity mismatch' }); }),
+    tenant_web_collect_submit: z.object({ inserted: z.boolean(), job: tenantWebSummarySchema }).strict(),
+    tenant_web_collect_status: tenantWebSummarySchema,
+};
+export const tenantWebWorkspaceToolSchemas = { ...tenantRuntimeWorkspaceToolSchemas, ...tenantWebToolSchemas };
+export const tenantWebWorkspaceDataSchemas = { ...tenantRuntimeWorkspaceDataSchemas, ...tenantWebDataSchemas };
+export const tenantWebErrorSchema = tenantProjectErrorSchema.extend({ completedPhase: z.enum([...tenantProjectErrorSchema.shape.completedPhase.unwrap().options, 'WEB_INTENT_PERSISTED']).optional() }).strict();
+export function tenantWebSafeErrorRef(raw, tenantId) {
+    if (typeof raw === 'string' && new RegExp('^tenant-web-collection://' + tenantStorageKey(tenantId) + '/[a-f0-9]{64}$').test(raw))
+        return raw;
+    return tenantManagementSafeErrorRef(raw, tenantId);
+}
+export function tenantWebScopesForInput(name, raw) {
+    if (Object.hasOwn(tenantWebToolSchemas, name)) {
+        tenantWebToolSchemas[name].parse(raw);
+        return name === 'tenant_web_collect_status' ? ['knowledge.collect'] : ['knowledge.source.manage', 'knowledge.collect'];
+    }
+    return tenantRuntimeScopesForInput(name, raw);
+}
+export function tenantWebAuthorization(name) {
+    if (Object.hasOwn(tenantWebToolSchemas, name))
+        return { selection: 'FIXED', scopeAlternatives: [name === 'tenant_web_collect_status' ? ['knowledge.collect'] : ['knowledge.source.manage', 'knowledge.collect']] };
+    return tenantRuntimeAuthorization(name);
+}
+export function tenantWebEnvelopeSchema(tool) {
+    return z.object({ schemaVersion: z.literal(2), tenantId: materialTenantIdSchema, tool: z.literal(tool), data: tenantWebDataSchemas[tool] }).strict().superRefine((value, ctx) => {
+        const envelope = value, ref = envelope.data.jobRef ?? envelope.data.job?.jobRef;
+        if (ref && !ref.startsWith('tenant-web-collection://' + tenantStorageKey(envelope.tenantId) + '/'))
+            ctx.addIssue({ code: 'custom', message: 'Web intent must belong to the exact authenticated Tenant' });
+    });
+}
+export const tenantWebInputJsonSchemas = Object.fromEntries(Object.entries(tenantWebWorkspaceToolSchemas).map(([name, schema]) => [name, z.toJSONSchema(schema, { target: 'draft-07' })]));
+export const tenantWebOutputJsonSchemas = Object.fromEntries(Object.keys(tenantWebWorkspaceToolSchemas).map(name => [name, { type: 'object', oneOf: [z.toJSONSchema(Object.hasOwn(tenantWebToolSchemas, name) ? tenantWebEnvelopeSchema(name) : tenantRuntimeEnvelopeSchema(name), { target: 'draft-07' }), z.toJSONSchema(tenantWebErrorSchema, { target: 'draft-07' })] }]));
+export const tenantWebProviderSchema = z.object({ ...tenantRuntimeProviderSchema.shape,
+    schemaVersion: z.literal(21), tools: z.array(z.string()).length(Object.keys(tenantWebWorkspaceToolSchemas).length),
+    capabilities: z.tuple([z.literal('TENANT_MANAGEMENT_V1'), z.literal('TENANT_WORKFLOW_V1'), z.literal('TENANT_CURRENTNESS_V2'), z.literal('TENANT_SOURCE_V1'), z.literal('TENANT_WORKSPACE_METADATA_V1'), z.literal('TENANT_PROJECT_CONTEXT_V1'), z.literal('TENANT_RUNTIME_STATUS_V1'), z.literal(TENANT_WEB_SPEC_CAPABILITY)]),
+}).strict().superRefine((value, ctx) => {
+    if (new Set(value.tools).size !== Object.keys(tenantWebWorkspaceToolSchemas).length || value.tools.some(name => !Object.hasOwn(tenantWebWorkspaceToolSchemas, name)))
+        ctx.addIssue({ code: 'custom', message: 'Provider21 tools must match the exact versioned registry' });
+});

package/dist/internal/serving-contracts/tenant-workspace.js

@@ -0,0 +1,28 @@
+/** Provider18 adds explicit metadata reads; Provider17 remains the exact original twenty tools. */
+import { z } from 'zod';
+import { tenantResourceRefSchema, tenantSourceIdSchema, collectionRefreshSchema, stableUriSchema, isoDateTimeSchema, materialTenantIdSchema } from '../contracts/index.js';
+import { tenantManagementToolSchemas, tenantManagementDataSchemas, tenantManagementScopesForInput, tenantManagementAuthorization, tenantManagementProviderBaseSchema, tenantManagementErrorSchema } from './tenant-management.js';
+const page = { after: z.string().min(1).max(4096).optional(), limit: z.number().int().min(1).max(100).optional() };
+export const tenantWorkStageSchema = z.enum(['ALL', 'RESEARCH', 'DRAFT', 'READY_FOR_REVIEW', 'REWORK_REQUIRED', 'APPROVED']);
+export const tenantWorkspaceExtraToolSchemas = { tenant_source_inventory: z.object(page).strict(), tenant_work_queue: z.object({ ...page, stage: tenantWorkStageSchema.default('ALL') }).strict() };
+const source = z.object({ sourceId: tenantSourceIdSchema, title: z.string().min(1).max(512).nullable(), revisionRef: stableUriSchema.nullable(), generation: z.number().int().positive().safe().nullable(), paused: z.boolean().nullable(), tenantEnabled: z.boolean().nullable(), refresh: collectionRefreshSchema.nullable(), canonicalState: z.enum(['READY', 'UNAVAILABLE', 'INTEGRITY_MISMATCH']) }).strict();
+const artifact = z.object({ ref: tenantResourceRefSchema, title: z.string().max(512), kind: z.string().max(128).nullable(), status: z.string().max(128).nullable(), version: z.number().int().positive().safe().nullable(), recordedAt: isoDateTimeSchema.nullable(), availability: z.enum(['READY', 'UNAVAILABLE', 'INTEGRITY_MISMATCH']), succession: z.enum(['SUCCESSOR_VISIBLE', 'NO_VISIBLE_SUCCESSOR', 'UNCONFIRMED']) }).strict();
+export const tenantWorkspaceExtraDataSchemas = {
+    tenant_source_inventory: z.object({ items: z.array(source).max(100), nextAfter: z.string().max(4096).nullable(), coverage: z.literal('REGISTERED_TENANT_SOURCES') }).strict(),
+    tenant_work_queue: z.object({ items: z.array(artifact).max(100), nextAfter: z.string().max(4096).nullable(), stage: tenantWorkStageSchema, candidateCount: z.number().int().min(0).max(100), coverage: z.literal('AUTHORIZED_NATIVE_ARTIFACT_METADATA'), total: z.null() }).strict(),
+};
+export const tenantWorkspaceToolSchemas = { ...tenantManagementToolSchemas, ...tenantWorkspaceExtraToolSchemas };
+export const tenantWorkspaceDataSchemas = { ...tenantManagementDataSchemas, ...tenantWorkspaceExtraDataSchemas };
+export function tenantWorkspaceScopesForInput(name, raw) { if (name === 'tenant_source_inventory') {
+    tenantWorkspaceExtraToolSchemas[name].parse(raw);
+    return ['knowledge.source.read'];
+} if (name === 'tenant_work_queue') {
+    tenantWorkspaceExtraToolSchemas[name].parse(raw);
+    return ['knowledge.workflow.read'];
+} return tenantManagementScopesForInput(name, raw); }
+export function tenantWorkspaceAuthorization(name) { return name === 'tenant_source_inventory' || name === 'tenant_work_queue' ? { selection: 'FIXED', scopeAlternatives: [[name === 'tenant_source_inventory' ? 'knowledge.source.read' : 'knowledge.workflow.read']] } : tenantManagementAuthorization(name); }
+export function tenantWorkspaceEnvelopeSchema(tool) { return z.object({ schemaVersion: z.literal(2), tenantId: materialTenantIdSchema, tool: z.literal(tool), data: tenantWorkspaceDataSchemas[tool] }).strict(); }
+export const tenantWorkspaceInputJsonSchemas = Object.fromEntries(Object.entries(tenantWorkspaceToolSchemas).map(([name, schema]) => [name, z.toJSONSchema(schema, { target: 'draft-07' })]));
+export const tenantWorkspaceOutputJsonSchemas = Object.fromEntries(Object.keys(tenantWorkspaceToolSchemas).map(name => [name, { type: 'object', oneOf: [z.toJSONSchema(tenantWorkspaceEnvelopeSchema(name), { target: 'draft-07' }), z.toJSONSchema(tenantManagementErrorSchema, { target: 'draft-07' })] }]));
+export const tenantWorkspaceProviderSchema = tenantManagementProviderBaseSchema.extend({ schemaVersion: z.literal(18), tools: z.array(z.string()).length(Object.keys(tenantWorkspaceToolSchemas).length), capabilities: z.tuple([z.literal('TENANT_MANAGEMENT_V1'), z.literal('TENANT_WORKFLOW_V1'), z.literal('TENANT_CURRENTNESS_V2'), z.literal('TENANT_SOURCE_V1'), z.literal('TENANT_WORKSPACE_METADATA_V1')]) }).strict().superRefine((value, ctx) => { if (new Set(value.tools).size !== Object.keys(tenantWorkspaceToolSchemas).length || value.tools.some(name => !Object.hasOwn(tenantWorkspaceToolSchemas, name)))
+    ctx.addIssue({ code: 'custom', message: 'Workspace tools must match the exact version18 contract' }); });

package/dist/internal/serving-contracts/workflow.js

@@ -0,0 +1,37 @@
+/** Agent 的治理合同描述真实状态和下一步，不把写入权限解释为审核或正文权限。 */
+import { z } from 'zod';
+import { artifactStatusSchema, idSchema, isoDateTimeSchema, publicationReadinessReportSchema, sha256Schema, stableUriSchema } from '../contracts/index.js';
+import { consumerProjectRefSchema } from './consumer.js';
+import { managementToolInputSchemas } from './management.js';
+const project = z.object({ projectRef: consumerProjectRefSchema }).strict();
+export const workflowPlanInputSchema = project.extend({ ref: stableUriSchema }).strict();
+export const workflowGuideInputSchema = project;
+export const workflowActionSchema = z.enum(['PREPARE_SOURCE', 'SUBMIT_REVIEW', 'FINALIZE_REVIEW', 'REGISTER']);
+export const workflowAdvanceInputSchema = workflowPlanInputSchema.extend({ action: workflowActionSchema, expectedVersion: z.number().int().nonnegative().optional(), actedAt: isoDateTimeSchema.optional() }).strict().superRefine((value, ctx) => {
+    if (['SUBMIT_REVIEW', 'FINALIZE_REVIEW'].includes(value.action) && (!value.expectedVersion || !value.actedAt))
+        ctx.addIssue({ code: 'custom', message: 'transition requires exact expectedVersion and actedAt' });
+});
+export const agentSubmitInputSchema = project.extend({ sourceId: idSchema, contentBase64: z.string().min(1).max(87384), mediaType: z.string().trim().min(1).max(256), access: z.enum(['PUBLIC', 'TENANT', 'INTERNAL', 'FDE_INTERNAL']).default('TENANT'), submittedAt: isoDateTimeSchema.optional(), freshnessSeconds: z.number().int().min(60).max(86400).optional() }).strict();
+const argumentsSchema = z.record(z.string(), z.json());
+export const workflowNextActionSchema = z.object({ id: z.string(), tool: z.string().nullable(), arguments: argumentsSchema, requiredScopes: z.array(z.string()), missingScopes: z.array(z.string()), missingFields: z.array(z.string()), canExecute: z.boolean(), automatic: z.boolean(), reasonCode: z.string(), cli: z.object({ command: z.string(), flags: argumentsSchema }).strict(), http: z.object({ method: z.literal('POST'), path: z.literal('/mcp/management'), tool: z.string().nullable() }).strict() }).strict();
+const readDecision = z.object({ action: z.enum(['ALLOW', 'REVIEW_REQUIRED', 'DENY']), reasonCodes: z.array(z.string()), authority: z.enum(['AUTHENTICATED_READER', 'LOCAL_PROFILE_SIMULATION']) }).strict();
+export const workflowPlanSchema = z.object({ schemaVersion: z.literal(1), projectRef: consumerProjectRefSchema, ref: stableUriSchema, contentHash: sha256Schema, kind: z.string(), version: z.number().int().positive().nullable(), status: artifactStatusSchema.or(z.enum(['RAW_EVIDENCE', 'RAW_MATERIAL'])), productionPhase: z.enum(['PERSISTED', 'CATALOG_PROJECTED', 'REGISTERED']), rawMaterialAvailable: z.boolean().nullable(), readiness: publicationReadinessReportSchema.nullable(), reviewRef: stableUriSchema.nullable(), reviewDecision: z.enum(['PASS', 'REWORK', 'REJECT']).nullable(), support: z.object({ action: z.enum(['ALLOW', 'REVIEW_REQUIRED', 'DENY']), reasonCodes: z.array(z.string()), missingEvidenceRefs: z.array(stableUriSchema) }).strict().nullable(), governedPolicyReady: z.boolean(), consumerReadDecision: readDecision.nullable(), externalReady: z.boolean(), successorRef: stableUriSchema.nullable(), blockers: z.array(z.string()), nextActions: z.array(workflowNextActionSchema).max(70) }).strict();
+export const workflowAdvanceResultSchema = z.object({ schemaVersion: z.literal(1), action: workflowActionSchema, previousRef: stableUriSchema, inserted: z.boolean(), plan: workflowPlanSchema }).strict();
+export const workflowErrorSchema = z.object({ errorCode: z.string(), completedPhase: z.enum(['VALIDATED', 'PERSISTED', 'CATALOG_PROJECTED', 'REGISTERED']).optional(), ref: stableUriSchema.optional() }).strict();
+export const workflowToolInputSchemas = { knowledge_workflow_guide: z.toJSONSchema(workflowGuideInputSchema, { target: 'draft-07' }), knowledge_workflow_plan: z.toJSONSchema(workflowPlanInputSchema, { target: 'draft-07' }), knowledge_workflow_advance: z.toJSONSchema(workflowAdvanceInputSchema, { target: 'draft-07' }), knowledge_agent_submit: z.toJSONSchema(agentSubmitInputSchema, { target: 'draft-07' }) };
+export const workflowToolScopes = { knowledge_workflow_guide: 'knowledge.workflow.read', knowledge_workflow_plan: 'knowledge.workflow.read', knowledge_workflow_advance: 'knowledge.workflow.read', knowledge_agent_submit: 'knowledge.material.write' };
+export const workflowActionScopes = { PREPARE_SOURCE: 'knowledge.compose', SUBMIT_REVIEW: 'knowledge.compose', FINALIZE_REVIEW: 'knowledge.approve', REGISTER: 'knowledge.material.write' };
+/** 网络成功和失败共享可发现 schema，阶段包含已经完成注册后的尾部失败。 */
+export const agentSubmitResultSchema = z.object({ schemaVersion: z.literal(1), production: z.object({ phase: z.enum(['CATALOG_PROJECTED', 'REGISTERED']), ref: stableUriSchema, registered: z.boolean(), identity: z.enum(['CONFIGURED', 'NOT_CONFIGURED']) }).strict(), presentation: z.object({ documentRef: stableUriSchema, inserted: z.boolean(), contentHash: sha256Schema }).strict().nullable(), evidenceRef: stableUriSchema, projectRef: consumerProjectRefSchema, contentHash: sha256Schema, byteLength: z.number().int().min(1).max(65536), inserted: z.boolean(), lifecycle: z.literal('QUEUED'), contentClass: z.literal('RAW_EVIDENCE'), nextStep: z.object({ tool: z.literal('knowledge_workflow_plan'), arguments: workflowPlanInputSchema }).strict() }).strict();
+const guideSchema = z.object({ schemaVersion: z.literal(1), model: z.record(z.string(), z.json()), rules: z.array(z.string()), tools: z.record(z.string(), z.object({ requiredScope: z.string(), inputSchema: z.json() }).strict()), advanceScopes: z.record(z.string(), z.string()), https: z.json() }).strict();
+const output = (success) => ({ type: 'object', oneOf: [z.toJSONSchema(success, { target: 'draft-07' }), z.toJSONSchema(workflowErrorSchema, { target: 'draft-07' })] });
+export const workflowToolOutputSchemas = { knowledge_workflow_guide: output(guideSchema), knowledge_workflow_plan: output(workflowPlanSchema), knowledge_workflow_advance: output(workflowAdvanceResultSchema), knowledge_agent_submit: output(agentSubmitResultSchema) };
+/** 同一份模型与参数 schema 供 CLI、MCP guide 和文档示例使用；不给 review 默认 PASS。 */
+export function workflowGuide() {
+    const tools = {};
+    for (const [name, schema] of Object.entries(workflowToolInputSchemas))
+        tools[name] = { requiredScope: workflowToolScopes[name], inputSchema: schema };
+    for (const [name, schema] of Object.entries(managementToolInputSchemas))
+        tools[name] = { requiredScope: name === 'knowledge_review' ? 'knowledge.review' : name === 'knowledge_finalize_review' ? 'knowledge.approve' : 'knowledge.compose', inputSchema: schema };
+    return { schemaVersion: 1, model: { raw: 'Evidence / Material 保留原字节和 provenance；原文可读不等于结论已审核。', reviewed: 'KNOWLEDGE / INSIGHT', lifecycle: ['DRAFT', 'READY_FOR_REVIEW', 'REVIEW(PASS|REWORK|REJECT)', 'APPROVED|REWORK_REQUIRED|REJECTED'], publication: ['PERSISTED', 'CATALOG_PROJECTED', 'REGISTERED', 'consumer read ALLOW'] }, rules: ['先调用 knowledge_workflow_plan，再执行 canExecute 动作；缺字段由 Agent 补齐并重新计划。', '读取原文、核对引用和适用范围后，获授权 reviewer 显式写 PASS / REWORK / REJECT；不根据写入成功推断 PASS。', 'RESEARCH 先正式合成为 KNOWLEDGE / INSIGHT；Claim Currentness proposal 使用专门审核链。', 'freshnessSeconds 仅为作者在系统内首次保存的精确快照时效，不证明外部网页已复核；同身份重放不延长时效。', 'externalReady 需要注册、治理门通过及当前已鉴权消费者实际 read ALLOW；CLI profile 是模拟。', 'Plan 不提供正文或 Review summary；审核时使用独立 read scope 读取 exact ref。'], tools, advanceScopes: workflowActionScopes, https: { method: 'POST', path: '/mcp/management', body: { tool: 'tool name', arguments: '对应 inputSchema' }, authorization: 'OAuth Bearer + client/project binding；API key 不授予管理权限' } };
+}

package/dist/profile-store.js

@@ -0,0 +1,142 @@
+/** 客户端只持久化私有配置与凭据，不包含资料或运行数据库。 */
+import { open, mkdir, lstat, rename, unlink } from 'node:fs/promises';
+import { constants } from 'node:fs';
+import path from 'node:path';
+import { randomBytes } from 'node:crypto';
+import { AuthError } from '@native-knowledge/knowledge-sdk';
+export class ProfileStore {
+    root;
+    constructor(root) {
+        this.root = root;
+        if (!path.isAbsolute(root))
+            throw new AuthError('AUTH_CONFIG_PATH_INVALID');
+    }
+    name(name) { if (!/^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/.test(name))
+        throw new AuthError('AUTH_PROFILE_INVALID'); return name; }
+    async directory(create = false) { if (create)
+        await mkdir(this.root, { recursive: true, mode: 0o700 }); let s; try {
+        s = await lstat(this.root);
+    }
+    catch (e) {
+        if (e.code === 'ENOENT' && !create)
+            return false;
+        throw e;
+    } if (!s.isDirectory() || s.isSymbolicLink() || s.uid !== process.getuid?.() || (s.mode & 0o077) !== 0)
+        throw new AuthError('AUTH_CONFIG_PERMISSIONS'); return true; }
+    async read(name) {
+        if (!await this.directory())
+            return null;
+        let h;
+        try {
+            h = await open(path.join(this.root, name), constants.O_RDONLY | constants.O_NOFOLLOW);
+        }
+        catch (e) {
+            if (e.code === 'ENOENT')
+                return null;
+            throw new AuthError('AUTH_CONFIG_PERMISSIONS');
+        }
+        try {
+            const s = await h.stat();
+            if (!s.isFile() || s.uid !== process.getuid?.() || (s.mode & 0o077) !== 0 || s.size > 65536)
+                throw new AuthError('AUTH_CONFIG_PERMISSIONS');
+            return JSON.parse(await h.readFile('utf8'));
+        }
+        catch (e) {
+            if (e instanceof AuthError)
+                throw e;
+            throw new AuthError('AUTH_CONFIG_INVALID');
+        }
+        finally {
+            await h.close();
+        }
+    }
+    async write(name, value) { await this.directory(true); const temp = path.join(this.root, '.write-' + randomBytes(16).toString('hex')), h = await open(temp, 'wx', 0o600); try {
+        await h.writeFile(JSON.stringify(value));
+        await h.sync();
+        await h.close();
+        await rename(temp, path.join(this.root, name));
+        const d = await open(this.root, 'r');
+        try {
+            await d.sync();
+        }
+        finally {
+            await d.close();
+        }
+    }
+    catch (e) {
+        await h.close().catch(() => { });
+        await unlink(temp).catch(() => { });
+        throw e;
+    } }
+    async config() { const c = await this.read('profiles.json') ?? { version: 1, selected: null, profiles: {} }; if (c.version !== 1 || !c.profiles || Array.isArray(c.profiles) || typeof c.profiles !== 'object' || c.selected !== null && typeof c.selected !== 'string')
+        throw new AuthError('AUTH_CONFIG_INVALID'); return c; }
+    async selected(explicit) { const c = await this.config(), name = explicit ?? c.selected; if (!name || !Object.hasOwn(c.profiles, this.name(name)))
+        throw new AuthError('AUTH_REQUIRED'); return { name, profile: c.profiles[name] }; }
+    async secret(name) { const s = await this.read(this.name(name) + '.secret.json'); if (s && (!Number.isSafeInteger(s.generation) || s.generation < 1 || !['READY', 'REFRESH_PENDING', 'REAUTH_REQUIRED'].includes(s.state) || typeof s.expiresAt !== 'string' || !Number.isFinite(Date.parse(s.expiresAt)) || !/^[-\w]{43}$/.test(s.accessToken) || !/^[-\w]{43}$/.test(s.refreshToken) || !Array.isArray(s.scopes)))
+        throw new AuthError('AUTH_CONFIG_INVALID'); return s; }
+    async putSecret(name, s) { await this.write(this.name(name) + '.secret.json', s); }
+    async lock(operation) {
+        await this.directory(true);
+        const file = path.join(this.root, 'operation.lock'), deadline = Date.now() + 20000;
+        let h;
+        while (!h) {
+            try {
+                h = await open(file, 'wx', 0o600);
+                await h.writeFile(JSON.stringify({ pid: process.pid, at: Date.now() }));
+            }
+            catch (e) {
+                if (h) {
+                    await h.close();
+                    h = undefined;
+                    await unlink(file).catch(() => { });
+                    throw e;
+                }
+                if (e.code !== 'EEXIST')
+                    throw e;
+                let old;
+                try {
+                    old = await this.read('operation.lock');
+                }
+                catch (e) {
+                    if (!(e instanceof AuthError) || e.code !== 'AUTH_CONFIG_INVALID' || Date.now() >= deadline)
+                        throw e;
+                    await new Promise(r => setTimeout(r, 50));
+                    continue;
+                }
+                if (old && Number.isSafeInteger(old.pid) && old.pid > 0 && Date.now() - old.at > 60000) {
+                    let alive = true;
+                    try {
+                        process.kill(old.pid, 0);
+                    }
+                    catch (e) {
+                        if (e.code === 'ESRCH')
+                            alive = false;
+                    }
+                    if (!alive) {
+                        await unlink(file).catch(() => { });
+                        continue;
+                    }
+                }
+                if (Date.now() >= deadline)
+                    throw new AuthError('AUTH_CONFIG_BUSY');
+                await new Promise(r => setTimeout(r, 50));
+            }
+        }
+        try {
+            return await operation();
+        }
+        finally {
+            await h.close();
+            await unlink(file);
+        }
+    }
+    async save(name, p, t) { this.name(name); return this.lock(async () => { const c = await this.config(), old = c.profiles[name]; if (old && ['issuer', 'resource', 'clientId', 'userId', 'tenantId', 'authorityVersion'].some(k => old.session[k] !== p.session[k]))
+        throw new AuthError('AUTH_CONTEXT_MISMATCH'); const previous = await this.secret(name); await this.putSecret(name, { ...t, generation: (previous?.generation ?? 0) + 1, state: 'READY' }); c.profiles[name] = p; c.selected = name; await this.write('profiles.json', c); }); }
+    async clear(name) { await this.directory(); await unlink(path.join(this.root, this.name(name) + '.secret.json')).catch(e => { if (e.code !== 'ENOENT')
+        throw e; }); }
+    async use(name) { return this.lock(async () => { const c = await this.config(); if (!Object.hasOwn(c.profiles, this.name(name)))
+        throw new AuthError('AUTH_PROFILE_INVALID'); c.selected = name; await this.write('profiles.json', c); return { selected: name }; }); }
+    async remove(name) { return this.lock(async () => { const c = await this.config(); if (await this.secret(name))
+        throw new AuthError('AUTH_LOGOUT_REQUIRED'); delete c.profiles[this.name(name)]; if (c.selected === name)
+        c.selected = null; await this.write('profiles.json', c); return { removed: name }; }); }
+}

package/package.json

@@ -1,33 +1,29 @@
 {
-  "version": "0.1.0-rc.1",
+  "name": "@native-knowledge/cli",
+  "version": "0.1.0-rc.2",
   "private": false,
   "type": "module",
-  "license": "MIT",
+  "description": "Remote Tenant CLI with OAuth and Agent-native discovery",
   "engines": {
     "node": ">=24"
   },
+  "license": "Apache-2.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/SENLIN746/native-knowledge.git"
   },
-  "publishConfig": {
-    "access": "public",
-    "tag": "next",
-    "registry": "https://registry.npmjs.org/"
-  },
   "files": [
     "dist",
     "README.md",
-    "LICENSE"
+    "LICENSE",
+    "NOTICE"
   ],
-  "name": "@native-knowledge/cli",
-  "description": "Network CLI for native-knowledge",
   "bin": {
     "native-knowledge": "./dist/cli.js",
     "knowledge-v2": "./dist/cli.js"
   },
   "dependencies": {
-    "@native-knowledge/knowledge-sdk": "0.1.0-rc.1",
-    "zod": "4.6.7"
+    "@native-knowledge/knowledge-sdk": "0.1.0-rc.2",
+    "zod": "^4.6.7"
   }
-}
+}