kaven-cli 0.4.1-alpha.0 → 0.4.2-alpha.2

package/dist/core/SignatureVerifier.js

@@ -1,75 +0,0 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.computeFileChecksum = computeFileChecksum;
-exports.verifyEd25519Signature = verifyEd25519Signature;
-exports.verifyDownload = verifyDownload;
-const crypto_1 = __importDefault(require("crypto"));
-const fs_extra_1 = __importDefault(require("fs-extra"));
-const errors_1 = require("../infrastructure/errors");
-/**
- * Compute SHA-256 hex checksum of a file.
- */
-async function computeFileChecksum(filePath) {
-    const data = await fs_extra_1.default.readFile(filePath);
-    return crypto_1.default.createHash("sha256").update(data).digest("hex");
-}
-const HEX_PATTERN = /^[0-9a-fA-F]+$/;
-/**
- * Decode a signature string that may be hex or base64 encoded.
- * Ed25519 signatures are always 64 bytes:
- *   - hex: 128 chars, only [0-9a-fA-F]
- *   - base64: 88 chars, may contain +/=
- */
-function decodeSignature(encoded) {
-    if (HEX_PATTERN.test(encoded) && encoded.length === 128) {
-        return Buffer.from(encoded, "hex");
-    }
-    return Buffer.from(encoded, "base64");
-}
-/**
- * Verify Ed25519 signature against a SHA-256 checksum.
- *
- * Accepts signature in either hex or base64 encoding.
- * Tolerates signatures made over checksum with trailing newline
- * (common when signing via `echo checksum > file && openssl sign`).
- */
-function verifyEd25519Signature(checksum, signature, publicKeyBase64) {
-    try {
-        const publicKey = crypto_1.default.createPublicKey({
-            key: Buffer.from(publicKeyBase64, "base64"),
-            type: "spki",
-            format: "der",
-        });
-        const sigBuffer = decodeSignature(signature);
-        if (crypto_1.default.verify(null, Buffer.from(checksum), publicKey, sigBuffer)) {
-            return true;
-        }
-        // Tolerate trailing newline from shell-based signing
-        return crypto_1.default.verify(null, Buffer.from(checksum + "\n"), publicKey, sigBuffer);
-    }
-    catch {
-        return false;
-    }
-}
-/**
- * Verify a downloaded module tarball:
- * 1. Compute SHA-256 checksum and compare to expected
- * 2. Verify Ed25519 signature of checksum with publisher key
- *
- * Throws SignatureVerificationError on failure.
- */
-async function verifyDownload(opts) {
-    const actualChecksum = await computeFileChecksum(opts.filePath);
-    if (actualChecksum !== opts.expectedChecksum) {
-        throw new errors_1.SignatureVerificationError(`Checksum mismatch: expected ${opts.expectedChecksum.substring(0, 16)}..., ` +
-            `got ${actualChecksum.substring(0, 16)}...`);
-    }
-    const valid = verifyEd25519Signature(opts.expectedChecksum, opts.signature, opts.publicKeyBase64);
-    if (!valid) {
-        throw new errors_1.SignatureVerificationError("Ed25519 signature verification failed. " +
-            "The package may have been tampered with.");
-    }
-}

package/dist/core/index.js

@@ -1,2 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });

package/dist/infrastructure/Container.js

@@ -1,37 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.container = exports.Container = void 0;
-class Container {
-    services = new Map();
-    factories = new Map();
-    register(name, factory) {
-        this.factories.set(name, factory);
-    }
-    registerSingleton(name, instance) {
-        this.services.set(name, instance);
-    }
-    resolve(name) {
-        // Check singletons first
-        if (this.services.has(name)) {
-            return this.services.get(name);
-        }
-        // Check factories
-        if (this.factories.has(name)) {
-            const factory = this.factories.get(name);
-            if (factory) {
-                const instance = factory();
-                // Cache as singleton
-                this.services.set(name, instance);
-                return instance;
-            }
-        }
-        throw new Error(`Service not found: ${name}`);
-    }
-    clear() {
-        this.services.clear();
-        this.factories.clear();
-    }
-}
-exports.Container = Container;
-// Global container instance
-exports.container = new Container();

package/dist/infrastructure/MarketplaceClient.js

@@ -1,425 +0,0 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.MarketplaceClient = void 0;
-const fs_extra_1 = __importDefault(require("fs-extra"));
-const path_1 = __importDefault(require("path"));
-const os_1 = __importDefault(require("os"));
-const errors_1 = require("./errors");
-const DEFAULT_BASE_URL = "https://marketplace.kaven.site";
-const REQUEST_TIMEOUT_MS = 30_000;
-const MAX_RETRIES = 3;
-const INITIAL_RETRY_DELAY_MS = 1_000;
-function debug(message) {
-    if (process.env.KAVEN_DEBUG === "1") {
-        console.debug(`[kaven:debug] ${message}`);
-    }
-}
-/** Load the apiUrl from ~/.kaven/config.json if present. */
-async function loadConfigApiUrl() {
-    try {
-        const configPath = path_1.default.join(os_1.default.homedir(), ".kaven", "config.json");
-        if (await fs_extra_1.default.pathExists(configPath)) {
-            const config = await fs_extra_1.default.readJson(configPath);
-            if (typeof config.apiUrl === "string" && config.apiUrl) {
-                return config.apiUrl;
-            }
-        }
-    }
-    catch {
-        // Ignore config read errors
-    }
-    return null;
-}
-/**
- * Load a service token for agent-to-service auth.
- * Resolution order: KAVEN_SERVICE_TOKEN env → ~/.kaven/config.json#serviceToken
- */
-async function loadServiceToken() {
-    if (process.env.KAVEN_SERVICE_TOKEN) {
-        return process.env.KAVEN_SERVICE_TOKEN;
-    }
-    try {
-        const configPath = path_1.default.join(os_1.default.homedir(), ".kaven", "config.json");
-        if (await fs_extra_1.default.pathExists(configPath)) {
-            const config = await fs_extra_1.default.readJson(configPath);
-            if (typeof config.serviceToken === "string" && config.serviceToken) {
-                return config.serviceToken;
-            }
-        }
-    }
-    catch {
-        // Ignore config read errors
-    }
-    return null;
-}
-/** Resolve base URL from env → config file → default. */
-async function resolveBaseUrl() {
-    if (process.env.KAVEN_API_URL) {
-        return process.env.KAVEN_API_URL.replace(/\/$/, "");
-    }
-    const configUrl = await loadConfigApiUrl();
-    if (configUrl) {
-        return configUrl.replace(/\/$/, "");
-    }
-    return DEFAULT_BASE_URL;
-}
-/** Sleep helper for retry backoff. */
-function sleep(ms) {
-    return new Promise((resolve) => setTimeout(resolve, ms));
-}
-/** Determine if the error code / HTTP status is retryable. */
-function isRetryable(status) {
-    return status >= 500;
-}
-class MarketplaceClient {
-    baseURLPromise;
-    authService;
-    constructor(authService) {
-        this.authService = authService ?? null;
-        this.baseURLPromise = resolveBaseUrl();
-    }
-    /** Resolve a relative API path to an absolute URL. */
-    async resolveUrl(path) {
-        const baseURL = await this.baseURLPromise;
-        return `${baseURL}${path}`;
-    }
-    // ──────────────────────────────────────────────────────────
-    // Core HTTP helpers
-    // ──────────────────────────────────────────────────────────
-    /**
-     * Make an HTTP request with retry logic and typed error mapping.
-     * `authenticated` controls whether Authorization header is attached.
-     */
-    async request(method, endpoint, options = {}) {
-        const baseURL = await this.baseURLPromise;
-        const url = `${baseURL}${endpoint}`;
-        const { body, authenticated = false } = options;
-        let lastError = null;
-        for (let attempt = 0; attempt <= MAX_RETRIES; attempt++) {
-            if (attempt > 0) {
-                const delay = INITIAL_RETRY_DELAY_MS * Math.pow(2, attempt - 1);
-                debug(`Retry attempt ${attempt} for ${method} ${endpoint} (delay ${delay}ms)`);
-                await sleep(delay);
-            }
-            try {
-                const headers = {
-                    "Content-Type": "application/json",
-                    Accept: "application/json",
-                };
-                if (authenticated && this.authService) {
-                    const token = await this.authService.getValidToken();
-                    headers["Authorization"] = `Bearer ${token}`;
-                }
-                const serviceToken = await loadServiceToken();
-                if (serviceToken) {
-                    headers["X-Service-Token"] = serviceToken;
-                }
-                debug(`${method} ${url}`);
-                const controller = new AbortController();
-                const timeoutId = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);
-                let response;
-                try {
-                    response = await fetch(url, {
-                        method,
-                        headers,
-                        body: body !== undefined ? JSON.stringify(body) : undefined,
-                        signal: controller.signal,
-                    });
-                }
-                finally {
-                    clearTimeout(timeoutId);
-                }
-                debug(`Response: ${response.status} ${response.statusText}`);
-                // Map HTTP errors to typed exceptions
-                if (!response.ok) {
-                    const errorText = await response.text().catch(() => "");
-                    let errorMessage = errorText;
-                    try {
-                        const errorJson = JSON.parse(errorText);
-                        errorMessage = errorJson.message || errorJson.error || errorText;
-                    }
-                    catch {
-                        // keep raw text
-                    }
-                    switch (response.status) {
-                        case 401:
-                            throw new errors_1.AuthenticationError(errorMessage || "Authentication required");
-                        case 403: {
-                            let requiredTier = "pro";
-                            try {
-                                const parsed = JSON.parse(errorText);
-                                requiredTier = parsed.requiredTier || requiredTier;
-                            }
-                            catch {
-                                // ignore
-                            }
-                            throw new errors_1.LicenseRequiredError(requiredTier, errorMessage || "License required");
-                        }
-                        case 404:
-                            throw new errors_1.NotFoundError(errorMessage || "Resource not found");
-                        case 429: {
-                            const retryAfter = parseInt(response.headers.get("retry-after") ?? "60", 10);
-                            throw new errors_1.RateLimitError(isNaN(retryAfter) ? 60 : retryAfter);
-                        }
-                        default:
-                            if (isRetryable(response.status)) {
-                                lastError = new errors_1.ServerError(errorMessage || `Server error: ${response.status}`);
-                                continue; // retry
-                            }
-                            throw new errors_1.ServerError(errorMessage || `Server error: ${response.status}`);
-                    }
-                }
-                // Parse successful response
-                const contentType = response.headers.get("content-type") ?? "";
-                if (contentType.includes("application/json")) {
-                    return (await response.json());
-                }
-                // Return empty object for no-body responses (204, etc.)
-                return {};
-            }
-            catch (error) {
-                // Re-throw our typed errors without retrying on 4xx
-                if (error instanceof errors_1.AuthenticationError ||
-                    error instanceof errors_1.LicenseRequiredError ||
-                    error instanceof errors_1.NotFoundError ||
-                    error instanceof errors_1.RateLimitError) {
-                    throw error;
-                }
-                // Network / timeout errors
-                if (error instanceof TypeError ||
-                    (error instanceof Error && error.name === "AbortError")) {
-                    const networkError = new errors_1.NetworkError(error.name === "AbortError"
-                        ? "Request timed out after 30s"
-                        : `Network error: ${error.message}`);
-                    lastError = networkError;
-                    // Retry on network errors too
-                    if (attempt < MAX_RETRIES)
-                        continue;
-                    throw networkError;
-                }
-                // ServerError already stored in lastError, will retry
-                if (error instanceof errors_1.ServerError) {
-                    lastError = error;
-                    if (attempt < MAX_RETRIES)
-                        continue;
-                    throw error;
-                }
-                // Unknown error — don't retry
-                throw error;
-            }
-        }
-        // All retries exhausted
-        throw lastError ?? new errors_1.NetworkError("Request failed after retries");
-    }
-    // ──────────────────────────────────────────────────────────
-    // Auth endpoints (unauthenticated)
-    // ──────────────────────────────────────────────────────────
-    /**
-     * Step 1 of Device Code Flow: Request device code from marketplace.
-     */
-    async requestDeviceCode() {
-        return this.request("POST", "/auth/device-code", {
-            body: { client_id: "kaven-cli" },
-            authenticated: false,
-        });
-    }
-    /**
-     * Step 2 of Device Code Flow: Poll for access token.
-     */
-    async pollDeviceToken(deviceCode) {
-        try {
-            const baseURL = await this.baseURLPromise;
-            const url = `${baseURL}/auth/token`;
-            const controller = new AbortController();
-            const timeoutId = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);
-            let response;
-            try {
-                response = await fetch(url, {
-                    method: "POST",
-                    headers: { "Content-Type": "application/json" },
-                    body: JSON.stringify({
-                        device_code: deviceCode,
-                        grant_type: "urn:ietf:params:oauth:grant-type:device_code",
-                    }),
-                    signal: controller.signal,
-                });
-            }
-            finally {
-                clearTimeout(timeoutId);
-            }
-            if (response.ok) {
-                const tokens = await response.json();
-                return { status: "success", tokens };
-            }
-            const errorData = await response.json().catch(() => ({}));
-            const errorCode = errorData.error ?? "unknown_error";
-            switch (errorCode) {
-                case "authorization_pending":
-                    return { status: "authorization_pending" };
-                case "slow_down":
-                    return { status: "slow_down" };
-                case "access_denied":
-                    return { status: "access_denied" };
-                case "expired_token":
-                    return { status: "expired_token" };
-                default:
-                    throw new Error(`Unexpected error: ${errorCode}`);
-            }
-        }
-        catch (error) {
-            const nodeError = error;
-            if (nodeError.code === "ECONNREFUSED" ||
-                nodeError.code === "ENOTFOUND") {
-                throw new errors_1.NetworkError("Network error. Check your connection and try again.");
-            }
-            throw error;
-        }
-    }
-    /**
-     * Refresh access token using refresh token.
-     */
-    async refreshToken(refreshToken) {
-        return this.request("POST", "/auth/refresh", {
-            body: { refresh_token: refreshToken },
-            authenticated: false,
-        });
-    }
-    // ──────────────────────────────────────────────────────────
-    // Module endpoints (authenticated)
-    // ──────────────────────────────────────────────────────────
-    /**
-     * List available modules with optional filters.
-     */
-    async listModules(filters) {
-        const params = new URLSearchParams();
-        if (filters?.category)
-            params.set("category", filters.category);
-        if (filters?.tier)
-            params.set("tier", filters.tier);
-        if (filters?.q)
-            params.set("q", filters.q);
-        if (filters?.page)
-            params.set("page", String(filters.page));
-        if (filters?.pageSize)
-            params.set("pageSize", String(filters.pageSize));
-        const query = params.toString();
-        const endpoint = `/modules${query ? `?${query}` : ""}`;
-        return this.request("GET", endpoint);
-    }
-    /**
-     * Get a single module by slug.
-     */
-    async getModule(slug) {
-        return this.request("GET", `/modules/${slug}`);
-    }
-    /**
-     * Get a module's manifest for a specific version.
-     */
-    async getManifest(slug, version) {
-        return this.request("GET", `/modules/${slug}/versions/${version}/manifest`);
-    }
-    /**
-     * Create a download token for a module release.
-     */
-    async createDownloadToken(moduleSlug, version) {
-        return this.request("POST", "/download-tokens", {
-            body: { moduleSlug, version },
-            authenticated: true,
-        });
-    }
-    // ──────────────────────────────────────────────────────────
-    // License endpoints
-    // ──────────────────────────────────────────────────────────
-    /**
-     * Validate a license key against the required tier.
-     */
-    async validateLicense(licenseKey, requiredTier) {
-        const response = await this.request('POST', '/licenses/validate', {
-            body: { licenseKey, requiredTier },
-        });
-        return response;
-    }
-    /**
-     * Get full license status including expiry information.
-     */
-    async getLicenseStatus(licenseKey) {
-        return this.request('GET', `/licenses/status?key=${encodeURIComponent(licenseKey)}`);
-    }
-    // ──────────────────────────────────────────────────────────
-    // Legacy / backward-compat methods
-    // ──────────────────────────────────────────────────────────
-    /**
-     * @deprecated Use getManifest(slug, version) instead.
-     */
-    async getModuleManifest(moduleId) {
-        try {
-            // Try to get latest manifest — for backward-compat we use "latest"
-            return await this.getManifest(moduleId, "latest");
-        }
-        catch (error) {
-            if (error instanceof errors_1.NotFoundError)
-                return null;
-            throw error;
-        }
-    }
-    /**
-     * Get release details for a specific module version.
-     * Returns checksum, signature, and publicKey for verification.
-     */
-    async getReleaseInfo(slug, version) {
-        return this.request("GET", `/modules/${slug}/versions/${version}`);
-    }
-    // ──────────────────────────────────────────────────────────
-    // Publish endpoints (authenticated)
-    // ──────────────────────────────────────────────────────────
-    /**
-     * Get a presigned S3 upload URL for a new module release.
-     */
-    async getUploadUrl(moduleSlug, version, size) {
-        return this.request("POST", "/releases/upload-url", {
-            body: { moduleSlug, version, size },
-            authenticated: true,
-        });
-    }
-    /**
-     * Create a release record after uploading the artifact.
-     */
-    async createRelease(data) {
-        return this.request("POST", "/releases", {
-            body: data,
-            authenticated: true,
-        });
-    }
-    // ──────────────────────────────────────────────────────────
-    // Checkout / upgrade endpoints (authenticated)
-    // ──────────────────────────────────────────────────────────
-    /**
-     * Create a Paddle checkout session for tier upgrade.
-     */
-    async createCheckoutSession(tier, licenseKey) {
-        return this.request("POST", "/checkout/session", {
-            body: { tier, licenseKey },
-            authenticated: true,
-        });
-    }
-    /**
-     * Poll the status of an ongoing Paddle checkout session.
-     */
-    async getCheckoutStatus(sessionId) {
-        return this.request("GET", `/checkout/session/${sessionId}/status`, { authenticated: true });
-    }
-    // ──────────────────────────────────────────────────────────
-    // Categories endpoint (authenticated)
-    // ──────────────────────────────────────────────────────────
-    /**
-     * Get all available module categories.
-     */
-    async getCategories() {
-        const result = await this.request("GET", "/modules/categories", { authenticated: true });
-        return result.categories;
-    }
-}
-exports.MarketplaceClient = MarketplaceClient;

package/dist/infrastructure/TelemetryBuffer.js

@@ -1,73 +0,0 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.TelemetryBuffer = void 0;
-const fs_extra_1 = __importDefault(require("fs-extra"));
-const path_1 = __importDefault(require("path"));
-const os_1 = __importDefault(require("os"));
-class TelemetryBuffer {
-    static instance;
-    logPath;
-    buffer = [];
-    constructor() {
-        this.logPath = path_1.default.join(os_1.default.homedir(), ".kaven", "telemetry.log");
-    }
-    static getInstance() {
-        if (!TelemetryBuffer.instance) {
-            TelemetryBuffer.instance = new TelemetryBuffer();
-        }
-        return TelemetryBuffer.instance;
-    }
-    /**
-     * Captura um evento de telemetria
-     */
-    capture(event, metadata, duration) {
-        const telemetryEvent = {
-            event,
-            timestamp: new Date().toISOString(),
-            metadata,
-            duration,
-        };
-        this.buffer.push(telemetryEvent);
-    }
-    /**
-     * Persiste os eventos do buffer no arquivo local
-     */
-    async flush() {
-        if (this.buffer.length === 0)
-            return;
-        try {
-            const logDir = path_1.default.dirname(this.logPath);
-            await fs_extra_1.default.ensureDir(logDir);
-            const lines = this.buffer.map((e) => JSON.stringify(e)).join("\n") + "\n";
-            await fs_extra_1.default.appendFile(this.logPath, lines, "utf8");
-            this.buffer = [];
-        }
-        catch (error) {
-            // Falha silenciosa na telemetria para não interromper fluxo principal
-            console.debug("Erro ao gravar telemetria:", error);
-        }
-    }
-    /**
-     * Recupera os últimos eventos registrados
-     */
-    async getRecentEvents(limit = 20) {
-        if (!(await fs_extra_1.default.pathExists(this.logPath)))
-            return [];
-        try {
-            const content = await fs_extra_1.default.readFile(this.logPath, "utf8");
-            return content
-                .trim()
-                .split("\n")
-                .reverse()
-                .slice(0, limit)
-                .map((line) => JSON.parse(line));
-        }
-        catch {
-            return [];
-        }
-    }
-}
-exports.TelemetryBuffer = TelemetryBuffer;