@kya-os/cli 1.6.3 → 1.8.1

package/README.md

@@ -166,7 +166,7 @@ Options:
 
 - `--json` - Output in JSON format for automation
 - `--path <path>` - Custom path for receipt storage
-- `--verify` - Verify receipts against KTA log
+- `--verify` - Request cryptographic verification (legacy registry receipts report unsupported)
 
 ### `doctor`
 

package/dist/commands/checkpoint-init.d.ts

@@ -0,0 +1,32 @@
+/**
+ * `mcpi checkpoint init`, KYA-1037, the one-command Detect install.
+ *
+ * A NEW command group (`checkpoint init`), not an overload of the
+ * existing top-level `init` (MCP-I agent identity init, unrelated and
+ * untouched). Since `package.json` exposes only the `mcpi` bin,
+ * `npx @kya-os/cli checkpoint init` resolves it, satisfying the
+ * one-command story without a second `kya` bin.
+ *
+ * Flow: register a claim token, print + open the claim URL, poll for the
+ * browser claim, exchange the claimed token for a project API key, write
+ * env + scaffold the right Detect layer, print the dashboard link.
+ * `.checkpoint/registration.json` (machine-local, 0600, gitignored)
+ * tracks progress through three states, so a re-run always resumes
+ * rather than starting over or losing the (single-use) exchange:
+ *
+ *   1. pending (registrationId + claimToken + claimUrl, no exchange yet)
+ *   2. exchanged (also projectId/apiKey/dashboardUrl/organizationId; the
+ *      finish step, env write + scaffold, hasn't run)
+ *   3. setupComplete (the finish step ran; claimToken is dropped, spent,
+ *      no further use, and the marker only proves "done")
+ */
+import { Command } from "commander";
+export declare const MAX_POLL_ATTEMPTS: number;
+export interface CheckpointInitOptions {
+    json?: boolean;
+    /** Include the live, token-bearing claim URL in --json output. Ignored in normal (non --json) mode, which always prints the URL. */
+    revealClaimUrl?: boolean;
+}
+export declare function checkpointInit(options?: CheckpointInitOptions): Promise<void>;
+export declare function createCheckpointCommand(): Command;
+//# sourceMappingURL=checkpoint-init.d.ts.map

package/dist/commands/checkpoint-init.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkpoint-init.d.ts","sourceRoot":"","sources":["../../src/commands/checkpoint-init.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAKH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA+CpC,eAAO,MAAM,iBAAiB,QAAiD,CAAC;AAwChF,MAAM,WAAW,qBAAqB;IACpC,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,oIAAoI;IACpI,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAsYD,wBAAsB,cAAc,CAClC,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,IAAI,CAAC,CAqQf;AAED,wBAAgB,uBAAuB,IAAI,OAAO,CAkBjD"}

package/dist/commands/checkpoint-init.js

@@ -0,0 +1,554 @@
+/**
+ * `mcpi checkpoint init`, KYA-1037, the one-command Detect install.
+ *
+ * A NEW command group (`checkpoint init`), not an overload of the
+ * existing top-level `init` (MCP-I agent identity init, unrelated and
+ * untouched). Since `package.json` exposes only the `mcpi` bin,
+ * `npx @kya-os/cli checkpoint init` resolves it, satisfying the
+ * one-command story without a second `kya` bin.
+ *
+ * Flow: register a claim token, print + open the claim URL, poll for the
+ * browser claim, exchange the claimed token for a project API key, write
+ * env + scaffold the right Detect layer, print the dashboard link.
+ * `.checkpoint/registration.json` (machine-local, 0600, gitignored)
+ * tracks progress through three states, so a re-run always resumes
+ * rather than starting over or losing the (single-use) exchange:
+ *
+ *   1. pending (registrationId + claimToken + claimUrl, no exchange yet)
+ *   2. exchanged (also projectId/apiKey/dashboardUrl/organizationId; the
+ *      finish step, env write + scaffold, hasn't run)
+ *   3. setupComplete (the finish step ran; claimToken is dropped, spent,
+ *      no further use, and the marker only proves "done")
+ */
+import chalk from "chalk";
+import ora from "ora";
+import open from "open";
+import { Command } from "commander";
+import { existsSync, mkdirSync, readFileSync, writeFileSync, chmodSync, unlinkSync, } from "fs";
+import { join } from "path";
+import { showInfo } from "../utils/prompts.js";
+import { detectPlatform, } from "../utils/platform-detector.js";
+import { detectCheckpointFramework, detectDomainHint, detectRepoName, checkpointFrameworkLabel, scaffoldNextjs, scaffoldExpress, scaffoldBeacon, } from "../utils/checkpoint-scaffold.js";
+import { registerCheckpointProject, fetchCheckpointClaimStatus, exchangeCheckpointClaim, buildCheckpointClaimUrl, checkpointOrigin, isInsecureCheckpointOrigin, isHttpUrl, isTrustedClaimUrl, CONFIRMATION_CODE_RE, API_KEY_RE, PROJECT_ID_RE, } from "../utils/checkpoint-api.js";
+import { writeCheckpointEnv } from "../utils/checkpoint-env.js";
+import { pollWithDeadline } from "../utils/poll.js";
+const MARKER_DIR = ".checkpoint";
+const MARKER_FILE = "registration.json";
+const POLL_INTERVAL_MS = 5000;
+const POLL_TIMEOUT_MS = 5 * 60 * 1000; // 5 minutes, per the plan's foreground cap
+export const MAX_POLL_ATTEMPTS = Math.floor(POLL_TIMEOUT_MS / POLL_INTERVAL_MS);
+function markerPath(projectRoot) {
+    return join(projectRoot, MARKER_DIR, MARKER_FILE);
+}
+function isOptionalString(value) {
+    return value === undefined || typeof value === "string";
+}
+/** Undefined is fine (the field is optional); if present, it must be a string matching the given shape check. */
+function isOptionalMatch(value, matches) {
+    return value === undefined || (typeof value === "string" && matches(value));
+}
+/**
+ * A marker read off disk could be hand-edited, truncated, written by a
+ * different CLI version, or (bestbrian, PR #658 follow-up) come from a
+ * hostile committed `.checkpoint/` directory: on the resume-after-exchange
+ * path these values reach writeCheckpointEnv, the Beacon snippet, and
+ * announceClaim directly, without ever passing through
+ * assertExchangeResult/assertRegisterResult, those only validate a FRESH
+ * API response, not a marker read off disk. Apply the SAME shape checks
+ * here, so a malformed value is treated as no marker at all rather than
+ * flowing through unchecked.
+ */
+function isValidMarker(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const v = value;
+    if (typeof v.registrationId !== "string" || v.registrationId.length === 0) {
+        return false;
+    }
+    // The origin check only matters while the claim is still pending and
+    // unclaimed: that's the window a hostile committed marker could exploit
+    // by luring the user into approving a cross-origin claim. Once past
+    // that (matches checkpointInit's OWN resume-after-exchange condition
+    // exactly, not just "apiKey is present": a marker missing projectId or
+    // dashboardUrl still falls into the pending-resume branch below, and a
+    // looser check here previously let its claimUrl through unchecked,
+    // Bugbot, PR #658 follow-up) or finished (setupComplete), claimUrl is
+    // dead, it's never opened, announced, or acted on again from either of
+    // those two states, only ever passed through unread. Origin-validating
+    // it there serves no protective purpose while risking exactly what it's
+    // meant to prevent: a later CHECKPOINT_API_URL change would reject the
+    // WHOLE marker, silently losing the one, unrecoverable copy of a minted
+    // apiKey, or making an already-complete setup re-register.
+    const pastPendingClaim = (v.projectId !== undefined &&
+        v.apiKey !== undefined &&
+        v.dashboardUrl !== undefined) ||
+        v.setupComplete === true;
+    const claimUrlIsValid = pastPendingClaim ? isHttpUrl : isTrustedClaimUrl;
+    if (!isOptionalString(v.claimToken) ||
+        !isOptionalString(v.organizationId) ||
+        !isOptionalMatch(v.claimUrl, claimUrlIsValid) ||
+        !isOptionalMatch(v.confirmationCode, (s) => CONFIRMATION_CODE_RE.test(s)) ||
+        !isOptionalMatch(v.projectId, (s) => PROJECT_ID_RE.test(s)) ||
+        !isOptionalMatch(v.apiKey, (s) => API_KEY_RE.test(s)) ||
+        !isOptionalMatch(v.dashboardUrl, isHttpUrl)) {
+        return false;
+    }
+    return v.setupComplete === undefined || typeof v.setupComplete === "boolean";
+}
+function readMarker(projectRoot) {
+    const filePath = markerPath(projectRoot);
+    if (!existsSync(filePath))
+        return null;
+    try {
+        const parsed = JSON.parse(readFileSync(filePath, "utf-8"));
+        return isValidMarker(parsed) ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+function writeMarker(projectRoot, marker) {
+    const dir = join(projectRoot, MARKER_DIR);
+    if (!existsSync(dir))
+        mkdirSync(dir, { recursive: true });
+    const filePath = markerPath(projectRoot);
+    writeFileSync(filePath, JSON.stringify(marker, null, 2), "utf-8");
+    try {
+        // Machine-local state holding a live claim/exchange credential until
+        // it's consumed, same 0600 posture register.ts uses for identity.json.
+        chmodSync(filePath, 0o600);
+    }
+    catch {
+        // Windows chmod semantics differ; best-effort, never fatal.
+    }
+}
+/**
+ * Drops the marker once its registration is dead (expired, never claimed
+ * in time, or the server has confirmed it no longer exists). Without
+ * this, a later run's "does a marker with a registrationId exist?" resume
+ * check keeps finding the SAME dead registration forever.
+ */
+function clearMarker(projectRoot) {
+    const filePath = markerPath(projectRoot);
+    try {
+        if (existsSync(filePath))
+            unlinkSync(filePath);
+    }
+    catch {
+        // Best-effort, worst case the next run's register overwrites it anyway.
+    }
+}
+/**
+ * Adds `entry` to .gitignore if no existing pattern already covers it,
+ * including a trailing-`*` wildcard pattern (e.g. `.env*`, create-next-app's
+ * own default), the same glob EnvManager.checkGitignore() already honors,
+ * so this doesn't append a redundant, already-covered line. Used for BOTH
+ * credential-bearing paths this command writes: `.checkpoint/` (holds a
+ * pending claim token) and `.env.local` (holds the live, minted API key).
+ * Neither write is safe to leave ungitignored, a repo whose `.gitignore`
+ * doesn't already cover it (hand-rolled Express apps, a pruned/custom
+ * .gitignore) would otherwise let `git add .` stage a real credential
+ * straight into history.
+ */
+function ensureGitignored(projectRoot, entry, label) {
+    const gitignorePath = join(projectRoot, ".gitignore");
+    const bare = entry.replace(/\/$/, "");
+    let content = existsSync(gitignorePath)
+        ? readFileSync(gitignorePath, "utf-8")
+        : "";
+    const alreadyIgnored = content
+        .split("\n")
+        .map((line) => line.trim())
+        .filter((line) => line && !line.startsWith("#"))
+        .some((line) => line === entry ||
+        line === bare ||
+        line === `/${bare}` ||
+        line === `/${entry}` ||
+        (line.endsWith("*") && bare.startsWith(line.slice(0, -1))));
+    if (alreadyIgnored)
+        return;
+    if (content && !content.endsWith("\n"))
+        content += "\n";
+    content += `${content ? "\n" : ""}# ${label}\n${entry}\n`;
+    writeFileSync(gitignorePath, content, "utf-8");
+}
+function scaffoldByFramework(framework, projectRoot, packageManager, projectId) {
+    if (framework === "nextjs")
+        return scaffoldNextjs(projectRoot, packageManager);
+    if (framework === "express")
+        return scaffoldExpress(projectRoot, packageManager);
+    return scaffoldBeacon(projectId, framework);
+}
+/** Poll the status endpoint roughly every 5s for up to 5 minutes (wall clock). */
+async function pollForClaim(registrationId, json) {
+    const spinner = json ? null : ora("Waiting for you to claim...").start();
+    const outcome = await pollWithDeadline(async (signal) => {
+        try {
+            const status = await fetchCheckpointClaimStatus(registrationId, signal);
+            if (status === "claimed" || status === "expired") {
+                return { kind: "done", value: status };
+            }
+            return { kind: "continue" };
+        }
+        catch (error) {
+            // A definitive "no such registration" is fatal, the server has
+            // confirmed the row is gone, so retrying can never succeed. Any
+            // other failure (network hiccup, 5xx, our own abort) is
+            // transient, same tolerance `pollForClaimStatus`
+            // (claim-polling.ts) uses for the sibling knowthat.ai flow.
+            if (error?.code === "NOT_FOUND") {
+                return { kind: "fatal", error };
+            }
+            return { kind: "continue" };
+        }
+    }, { intervalMs: POLL_INTERVAL_MS, timeoutMs: POLL_TIMEOUT_MS });
+    if (outcome.outcome === "done") {
+        if (outcome.value === "claimed")
+            spinner?.succeed("Claimed!");
+        else
+            spinner?.fail("Claim link expired.");
+        return outcome.value;
+    }
+    if (outcome.outcome === "fatal") {
+        spinner?.fail("This registration no longer exists.");
+        return "not-found";
+    }
+    if (outcome.outcome === "interrupted") {
+        spinner?.warn("Skipped waiting for you to claim.");
+        return "pending";
+    }
+    spinner?.warn("Still waiting for you to claim.");
+    return "pending";
+}
+function printOrJson(json, humanLine, jsonPayload) {
+    if (json) {
+        console.log(JSON.stringify(jsonPayload, null, 2));
+    }
+    else {
+        console.log(humanLine);
+    }
+}
+/**
+ * Announces the claim URL (+ confirmation code, when known) on both the
+ * fresh-register and resume paths.
+ *
+ * In --json mode, claimUrl is included ONLY when `revealClaimUrl` is set:
+ * the URL carries a live, one-time claim token, and --json output is the
+ * shape most likely to end up piped into a log or another tool. Without
+ * the flag, --json prints registrationId + confirmationCode, enough for
+ * a human watching the SAME terminal to cross-check the claim page, but
+ * nothing an automated log-scraper could use to steal the claim.
+ * Non-json (human) mode always prints the URL either way: a human has to
+ * literally click it, and that's the terminal they're already watching.
+ *
+ * The warning lines go to stderr, not through printOrJson: they must
+ * stay visible in --json mode too (a leaked pre-claim URL is exactly the
+ * failure this exists to catch, silence there defeats the point) without
+ * corrupting the JSON-per-line stream automation parses from stdout.
+ */
+function announceClaim(json, revealClaimUrl, registrationId, claimUrl, confirmationCode) {
+    const jsonPayload = {
+        status: "pending",
+        registrationId,
+        confirmationCode,
+    };
+    if (revealClaimUrl) {
+        jsonPayload.claimUrl = claimUrl;
+    }
+    printOrJson(json, `Claim your project: ${chalk.cyan(claimUrl)}`, jsonPayload);
+    // The URL itself is shown either in the human line above (always) or in
+    // the JSON payload (only with --reveal-claim-url). When neither holds
+    // (--json without the flag), no link reached the user anywhere, so the
+    // "this link" warning below would refer to something they never saw.
+    const urlWasShown = !json || revealClaimUrl;
+    if (json && !urlWasShown) {
+        console.error(chalk.gray("The claim URL is left out of --json output by default (it carries a live claim token). Re-run with --reveal-claim-url to include it."));
+    }
+    if (confirmationCode) {
+        console.error(chalk.yellow(`Confirmation code: ${confirmationCode}. Check this matches the claim page before approving.`));
+    }
+    if (urlWasShown) {
+        console.error(chalk.gray("This link contains a live claim token. Don't share it or paste it into a public log."));
+    }
+}
+/**
+ * Reports a failure uniformly: the human/JSON message plus a non-zero
+ * exit code. Never calls `process.exit()` directly, that would race
+ * pending stdout writes, setting `exitCode` lets Node exit naturally
+ * once the event loop drains, and needs no NODE_ENV/VITEST special-casing
+ * to stay testable.
+ */
+function reportFailure(json, error, fallbackMessage, guidance) {
+    const baseMessage = error instanceof Error ? error.message : fallbackMessage;
+    const humanLine = guidance ? `${baseMessage} ${guidance}` : baseMessage;
+    printOrJson(json, chalk.red(humanLine), {
+        success: false,
+        error: baseMessage,
+    });
+    process.exitCode = 1;
+}
+/**
+ * Writes .env.local (every framework, the key is minted either way, so
+ * discarding it for the keyless Beacon path would be the only record of
+ * it ever existing outside the dashboard) and scaffolds the Detect layer,
+ * then flips the marker to `setupComplete`, the ONLY signal the
+ * top-of-function idempotency check trusts. Split out of `checkpointInit`
+ * so it can run from two call sites: right after a fresh exchange, or on
+ * a resumed run that already has a persisted `apiKey` because a prior
+ * run's finish step never completed.
+ */
+async function finishSetup(projectRoot, framework, platformInfo, marker, json) {
+    let scaffold;
+    try {
+        // .env.local is about to hold a live, usable project API key, make
+        // sure it can't land in git BEFORE writing the secret into it, same
+        // as the .checkpoint/ guard for the claim token.
+        ensureGitignored(projectRoot, ".env.local", "Local environment variables");
+        writeCheckpointEnv(projectRoot, {
+            CHECKPOINT_API_KEY: marker.apiKey,
+            CHECKPOINT_PROJECT_ID: marker.projectId,
+        });
+        scaffold = scaffoldByFramework(framework, projectRoot, platformInfo.packageManager, marker.projectId);
+        if (!json) {
+            console.log(`\n${scaffold.message}`);
+        }
+        // Fully done: the key is safely in .env.local, drop it from the
+        // marker along with the now-spent claimToken, and flip setupComplete,
+        // the signal the top-of-function idempotency check looks for.
+        // Re-writing (not appending) keeps exactly one on-disk copy.
+        writeMarker(projectRoot, {
+            registrationId: marker.registrationId,
+            claimUrl: marker.claimUrl,
+            projectId: marker.projectId,
+            dashboardUrl: marker.dashboardUrl,
+            organizationId: marker.organizationId,
+            setupComplete: true,
+        });
+    }
+    catch (error) {
+        // The marker written right after exchange (holding apiKey) is still
+        // on disk, untouched, at this point, a re-run resumes straight back
+        // into this same finish step instead of losing the key or
+        // re-exchanging an already-spent token.
+        reportFailure(json, error, "Failed to finish setup.", "Run `mcpi checkpoint init` again to retry.");
+        return;
+    }
+    printOrJson(json, chalk.bold.green(`\nDone. Your project: ${marker.dashboardUrl}`), {
+        success: true,
+        projectId: marker.projectId,
+        organizationId: marker.organizationId,
+        dashboardUrl: marker.dashboardUrl,
+        scaffold: {
+            framework: scaffold.framework,
+            installed: scaffold.installed,
+            setupRan: scaffold.setupRan,
+        },
+    });
+}
+export async function checkpointInit(options = {}) {
+    const { json = false, revealClaimUrl = false } = options;
+    const projectRoot = process.cwd();
+    const existing = readMarker(projectRoot);
+    // Idempotency: already fully set up (env written + scaffold ran).
+    if (existing?.setupComplete) {
+        printOrJson(json, chalk.green(`Already set up. Your project: ${existing.dashboardUrl ?? ""}`), {
+            success: true,
+            alreadySetUp: true,
+            projectId: existing.projectId,
+            dashboardUrl: existing.dashboardUrl,
+        });
+        return;
+    }
+    // To stderr, not stdout: this must stay visible whether or not --json is
+    // set, without corrupting the JSON stream automation parses from stdout.
+    if (isInsecureCheckpointOrigin()) {
+        console.error(chalk.yellow("Warning: CHECKPOINT_API_URL is plain http on a non-localhost host. " +
+            "The claim token and, once claimed, your API key cross that connection in the clear."));
+    }
+    const platformInfo = detectPlatform(projectRoot);
+    const framework = detectCheckpointFramework(projectRoot, platformInfo);
+    if (!json) {
+        console.log(chalk.cyan(`\nDetected: ${checkpointFrameworkLabel(framework)}`));
+    }
+    // Resume after a successful exchange whose finish step (env write +
+    // scaffold) never completed, a crash, a full disk, the process getting
+    // killed. The claim token is already spent (the server accepts an
+    // exchange exactly once), so finish with the persisted credential
+    // instead of registering fresh or re-exchanging, which would 409.
+    if (existing?.projectId && existing?.apiKey && existing?.dashboardUrl) {
+        await finishSetup(projectRoot, framework, platformInfo, {
+            registrationId: existing.registrationId,
+            claimUrl: existing.claimUrl,
+            projectId: existing.projectId,
+            dashboardUrl: existing.dashboardUrl,
+            organizationId: existing.organizationId,
+            apiKey: existing.apiKey,
+        }, json);
+        return;
+    }
+    let registrationId;
+    let claimToken;
+    let claimUrl;
+    let confirmationCode;
+    if (existing?.registrationId && existing.claimToken) {
+        // Resume: skip register, reuse the persisted token, reprint the URL
+        // (the user may have lost the terminal output from the first run).
+        // Reprints the SERVER-ISSUED claimUrl persisted at register time, not
+        // a client-side reconstruction off the current CHECKPOINT_API_URL --
+        // if that env var differs from what it was at register time (a
+        // different machine, a flipped endpoint), a rebuilt URL would point
+        // at the wrong place while the original is still the valid one.
+        // Falls back to reconstructing only for a marker written before this
+        // CLI persisted claimUrl.
+        registrationId = existing.registrationId;
+        claimToken = existing.claimToken;
+        claimUrl = existing.claimUrl ?? buildCheckpointClaimUrl(claimToken);
+        // Undefined only for a marker written before this CLI persisted the
+        // code -- announceClaim degrades gracefully and just omits the line.
+        confirmationCode = existing.confirmationCode;
+        if (!json) {
+            showInfo("Resuming a previous `checkpoint init` run.");
+        }
+        announceClaim(json, revealClaimUrl, registrationId, claimUrl, confirmationCode);
+    }
+    else {
+        const spinner = json ? null : ora("Registering with Checkpoint...").start();
+        let registered;
+        try {
+            registered = await registerCheckpointProject({
+                domainHint: detectDomainHint(projectRoot),
+                repoName: detectRepoName(projectRoot),
+                framework,
+            });
+        }
+        catch (error) {
+            spinner?.fail("Registration failed.");
+            reportFailure(json, error, "Failed to register with Checkpoint.");
+            return;
+        }
+        spinner?.succeed("Registered with Checkpoint.");
+        registrationId = registered.registrationId;
+        claimToken = registered.claimToken;
+        claimUrl = registered.claimUrl;
+        confirmationCode = registered.confirmationCode;
+        // Gitignore BEFORE the write, same ordering as the .env.local guard
+        // below, the marker is about to hold a live claim token, so it must
+        // never be writable-then-gitignored (a window where `git add .` could
+        // pick it up).
+        ensureGitignored(projectRoot, `${MARKER_DIR}/`, "Checkpoint CLI local state");
+        writeMarker(projectRoot, {
+            registrationId,
+            claimToken,
+            claimUrl,
+            confirmationCode,
+        });
+        // In --json mode this is the ONLY line naming the claim URL: with no
+        // other announcement, automation polling the JSON stream would have
+        // no way to open/surface the link and could only wait out the poll
+        // cap and fail.
+        announceClaim(json, revealClaimUrl, registrationId, claimUrl, confirmationCode);
+        if (!json) {
+            // Only ever hand the OS's default-protocol-handler a URL that's
+            // both http(s) and actually points at the configured Checkpoint
+            // origin -- assertRegisterResult already rejects a non-http(s)
+            // claimUrl outright, but a scheme/host check right here, at the
+            // one place this value reaches a system-level open() call, is
+            // cheap defense in depth against a compromised or misconfigured
+            // origin returning something like a file:/vscode: URI.
+            const opensSafely = isHttpUrl(claimUrl) && new URL(claimUrl).origin === checkpointOrigin();
+            if (opensSafely) {
+                try {
+                    await open(claimUrl);
+                }
+                catch {
+                    // Best-effort, the printed URL above is the fallback.
+                }
+            }
+        }
+    }
+    const status = await pollForClaim(registrationId, json);
+    if (status === "not-found") {
+        // The server confirmed this registration no longer exists, resuming
+        // would just poll (or exchange) the same dead id forever.
+        clearMarker(projectRoot);
+        reportFailure(json, new Error("This registration no longer exists on Checkpoint."), "This registration no longer exists on Checkpoint.", "Run `mcpi checkpoint init` again to start fresh.");
+        return;
+    }
+    if (status !== "claimed") {
+        if (status === "expired") {
+            // Drop the marker so re-running actually registers fresh instead of
+            // resuming (and re-polling) this same dead registration forever,
+            // the message below promises a NEW link, so the next run must
+            // deliver one.
+            clearMarker(projectRoot);
+        }
+        const message = status === "expired"
+            ? "This claim link expired. Run `mcpi checkpoint init` again to get a new one."
+            : "Run `mcpi checkpoint init` again after claiming to finish setup.";
+        printOrJson(json, chalk.yellow(message), {
+            success: false,
+            status,
+            message,
+            // Expired means the link is dead, the message above already
+            // promises a fresh one on re-run, so don't hand back a stale URL.
+            // Otherwise, same --reveal-claim-url gating as announceClaim: a
+            // live claim token doesn't belong in --json output by default.
+            claimUrl: status === "expired" || !revealClaimUrl ? undefined : claimUrl,
+        });
+        return; // exit 0 -- the resume path above makes re-running the fix.
+    }
+    const spinner = json ? null : ora("Finishing setup...").start();
+    let exchanged;
+    try {
+        exchanged = await exchangeCheckpointClaim(claimToken);
+    }
+    catch (error) {
+        spinner?.fail("Could not finish setup.");
+        const code = error?.code;
+        // A definitive rejection (unknown token, already spent, expired)
+        // means retrying with the SAME token can never succeed, the server
+        // has permanently closed this door. Clear the marker so a re-run
+        // registers fresh instead of retrying the same dead exchange forever.
+        // Anything else (network-shaped, 5xx) is transient: keep the marker
+        // so a re-run resumes and simply retries the exchange.
+        const definitive = code === "NOT_FOUND" ||
+            code === "ALREADY_EXCHANGED" ||
+            code === "EXPIRED";
+        if (definitive) {
+            clearMarker(projectRoot);
+        }
+        reportFailure(json, error, "Failed to exchange claim token.", definitive
+            ? "Run `mcpi checkpoint init` again to start fresh."
+            : "Run `mcpi checkpoint init` again to retry.");
+        return;
+    }
+    // Not "Set up complete" -- finishSetup (env write + scaffold) hasn't
+    // run yet and can still fail, which would leave a contradictory green
+    // checkmark on screen right above the error it then reports.
+    spinner?.succeed("Claim exchanged.");
+    // Persist immediately: exchange succeeds exactly once, so this is the
+    // only moment the API key exists. If the finish step below fails or the
+    // process dies before it completes, a re-run must resume from here
+    // rather than re-exchanging (which the server would reject with 409).
+    const exchangedMarker = {
+        registrationId,
+        claimUrl,
+        projectId: exchanged.projectId,
+        dashboardUrl: exchanged.dashboardUrl,
+        organizationId: exchanged.organizationId,
+        apiKey: exchanged.apiKey,
+    };
+    writeMarker(projectRoot, exchangedMarker);
+    await finishSetup(projectRoot, framework, platformInfo, exchangedMarker, json);
+}
+export function createCheckpointCommand() {
+    const checkpoint = new Command("checkpoint").description("Set up Checkpoint Detect for this repo");
+    checkpoint
+        .command("init")
+        .description("Register this repo with Checkpoint, claim it in your browser, and scaffold detection")
+        .option("--json", "Output in JSON format for automation")
+        .option("--reveal-claim-url", "Include the live claim URL in --json output. Off by default: the URL carries a one-time claim token, and --json output is the shape most likely to end up piped into a log.")
+        .action((options) => checkpointInit(options));
+    return checkpoint;
+}
+//# sourceMappingURL=checkpoint-init.js.map

package/dist/commands/checkpoint-init.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkpoint-init.js","sourceRoot":"","sources":["../../src/commands/checkpoint-init.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,GAAG,MAAM,KAAK,CAAC;AACtB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EACL,UAAU,EACV,SAAS,EACT,YAAY,EACZ,aAAa,EACb,SAAS,EACT,UAAU,GACX,MAAM,IAAI,CAAC;AACZ,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EACL,cAAc,GAEf,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,yBAAyB,EACzB,gBAAgB,EAChB,cAAc,EACd,wBAAwB,EACxB,cAAc,EACd,eAAe,EACf,cAAc,GAGf,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,yBAAyB,EACzB,0BAA0B,EAC1B,uBAAuB,EACvB,uBAAuB,EACvB,gBAAgB,EAChB,0BAA0B,EAC1B,SAAS,EACT,iBAAiB,EACjB,oBAAoB,EACpB,UAAU,EACV,aAAa,GAEd,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEpD,MAAM,UAAU,GAAG,aAAa,CAAC;AACjC,MAAM,WAAW,GAAG,mBAAmB,CAAC;AACxC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAC9B,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,2CAA2C;AAClF,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,GAAG,gBAAgB,CAAC,CAAC;AA8ChF,SAAS,UAAU,CAAC,WAAmB;IACrC,OAAO,IAAI,CAAC,WAAW,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC;AAC1D,CAAC;AAED,iHAAiH;AACjH,SAAS,eAAe,CACtB,KAAc,EACd,OAA+B;IAE/B,OAAO,KAAK,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,IAAI,CAAC,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1E,OAAO,KAAK,CAAC;IACf,CAAC;IACD,qEAAqE;IACrE,wEAAwE;IACxE,oEAAoE;IACpE,qEAAqE;IACrE,uEAAuE;IACvE,uEAAuE;IACvE,mEAAmE;IACnE,sEAAsE;IACtE,uEAAuE;IACvE,uEAAuE;IACvE,wEAAwE;IACxE,uEAAuE;IACvE,wEAAwE;IACxE,2DAA2D;IAC3D,MAAM,gBAAgB,GACpB,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS;QACxB,CAAC,CAAC,MAAM,KAAK,SAAS;QACtB,CAAC,CAAC,YAAY,KAAK,SAAS,CAAC;QAC/B,CAAC,CAAC,aAAa,KAAK,IAAI,CAAC;IAC3B,MAAM,eAAe,GAAG,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC;IACzE,IACE,CAAC,gBAAgB,CAAC,CAAC,CAAC,UAAU,CAAC;QAC/B,CAAC,gBAAgB,CAAC,CAAC,CAAC,cAAc,CAAC;QACnC,CAAC,eAAe,CAAC,CAAC,CAAC,QAAQ,EAAE,eAAe,CAAC;QAC7C,CAAC,eAAe,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACzE,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3D,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrD,CAAC,eAAe,CAAC,CAAC,CAAC,YAAY,EAAE,SAAS,CAAC,EAC3C,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,CAAC,CAAC,aAAa,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,aAAa,KAAK,SAAS,CAAC;AAC/E,CAAC;AAED,SAAS,UAAU,CAAC,WAAmB;IACrC,MAAM,QAAQ,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;IACzC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;QACpE,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,WAAmB,EAAE,MAA0B;IAClE,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IAC1C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;IACzC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAClE,IAAI,CAAC;QACH,qEAAqE;QACrE,uEAAuE;QACvE,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,4DAA4D;IAC9D,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,WAAmB;IACtC,MAAM,QAAQ,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;IACzC,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,QAAQ,CAAC;YAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;IAC1E,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,gBAAgB,CACvB,WAAmB,EACnB,KAAa,EACb,KAAa;IAEb,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACtC,IAAI,OAAO,GAAG,UAAU,CAAC,aAAa,CAAC;QACrC,CAAC,CAAC,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC;QACtC,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,cAAc,GAAG,OAAO;SAC3B,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;SAC/C,IAAI,CACH,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,KAAK,KAAK;QACd,IAAI,KAAK,IAAI;QACb,IAAI,KAAK,IAAI,IAAI,EAAE;QACnB,IAAI,KAAK,IAAI,KAAK,EAAE;QACpB,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAC7D,CAAC;IACJ,IAAI,cAAc;QAAE,OAAO;IAE3B,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,IAAI,CAAC;IACxD,OAAO,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,KAAK,KAAK,IAAI,CAAC;IAC1D,aAAa,CAAC,aAAa,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,mBAAmB,CAC1B,SAA8B,EAC9B,WAAmB,EACnB,cAA8C,EAC9C,SAAiB;IAEjB,IAAI,SAAS,KAAK,QAAQ;QACxB,OAAO,cAAc,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;IACrD,IAAI,SAAS,KAAK,SAAS;QACzB,OAAO,eAAe,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;IACtD,OAAO,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;AAC9C,CAAC;AAED,kFAAkF;AAClF,KAAK,UAAU,YAAY,CACzB,cAAsB,EACtB,IAAa;IAEb,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC,KAAK,EAAE,CAAC;IAEzE,MAAM,OAAO,GAAG,MAAM,gBAAgB,CACpC,KAAK,EAAE,MAAM,EAAE,EAAE;QACf,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;YACxE,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACjD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YACzC,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;QAC9B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,+DAA+D;YAC/D,gEAAgE;YAChE,wDAAwD;YACxD,iDAAiD;YACjD,4DAA4D;YAC5D,IAAK,KAA2B,EAAE,IAAI,KAAK,WAAW,EAAE,CAAC;gBACvD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAClC,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;QAC9B,CAAC;IACH,CAAC,EACD,EAAE,UAAU,EAAE,gBAAgB,EAAE,SAAS,EAAE,eAAe,EAAE,CAC7D,CAAC;IAEF,IAAI,OAAO,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;QAC/B,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;YAAE,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;;YACzD,OAAO,EAAE,IAAI,CAAC,qBAAqB,CAAC,CAAC;QAC1C,OAAO,OAAO,CAAC,KAAK,CAAC;IACvB,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QAChC,OAAO,EAAE,IAAI,CAAC,qCAAqC,CAAC,CAAC;QACrD,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,KAAK,aAAa,EAAE,CAAC;QACtC,OAAO,EAAE,IAAI,CAAC,mCAAmC,CAAC,CAAC;QACnD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,IAAI,CAAC,iCAAiC,CAAC,CAAC;IACjD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,WAAW,CAClB,IAAa,EACb,SAAiB,EACjB,WAAoC;IAEpC,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACpD,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACzB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,aAAa,CACpB,IAAa,EACb,cAAuB,EACvB,cAAsB,EACtB,QAAgB,EAChB,gBAAoC;IAEpC,MAAM,WAAW,GAA4B;QAC3C,MAAM,EAAE,SAAS;QACjB,cAAc;QACd,gBAAgB;KACjB,CAAC;IACF,IAAI,cAAc,EAAE,CAAC;QACnB,WAAW,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAClC,CAAC;IACD,WAAW,CAAC,IAAI,EAAE,uBAAuB,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;IAE9E,wEAAwE;IACxE,sEAAsE;IACtE,uEAAuE;IACvE,qEAAqE;IACrE,MAAM,WAAW,GAAG,CAAC,IAAI,IAAI,cAAc,CAAC;IAE5C,IAAI,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACzB,OAAO,CAAC,KAAK,CACX,KAAK,CAAC,IAAI,CACR,sIAAsI,CACvI,CACF,CAAC;IACJ,CAAC;IACD,IAAI,gBAAgB,EAAE,CAAC;QACrB,OAAO,CAAC,KAAK,CACX,KAAK,CAAC,MAAM,CACV,sBAAsB,gBAAgB,uDAAuD,CAC9F,CACF,CAAC;IACJ,CAAC;IACD,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,CAAC,KAAK,CACX,KAAK,CAAC,IAAI,CACR,sFAAsF,CACvF,CACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,aAAa,CACpB,IAAa,EACb,KAAc,EACd,eAAuB,EACvB,QAAiB;IAEjB,MAAM,WAAW,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;IAC7E,MAAM,SAAS,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,WAAW,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC;IACxE,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE;QACtC,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,WAAW;KACnB,CAAC,CAAC;IACH,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,WAAW,CACxB,WAAmB,EACnB,SAA8B,EAC9B,YAA0B,EAC1B,MAAuB,EACvB,IAAa;IAEb,IAAI,QAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,mEAAmE;QACnE,oEAAoE;QACpE,iDAAiD;QACjD,gBAAgB,CAAC,WAAW,EAAE,YAAY,EAAE,6BAA6B,CAAC,CAAC;QAC3E,kBAAkB,CAAC,WAAW,EAAE;YAC9B,kBAAkB,EAAE,MAAM,CAAC,MAAM;YACjC,qBAAqB,EAAE,MAAM,CAAC,SAAS;SACxC,CAAC,CAAC;QAEH,QAAQ,GAAG,mBAAmB,CAC5B,SAAS,EACT,WAAW,EACX,YAAY,CAAC,cAAc,EAC3B,MAAM,CAAC,SAAS,CACjB,CAAC;QACF,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;QACvC,CAAC;QAED,gEAAgE;QAChE,sEAAsE;QACtE,8DAA8D;QAC9D,6DAA6D;QAC7D,WAAW,CAAC,WAAW,EAAE;YACvB,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,aAAa,EAAE,IAAI;SACpB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,oEAAoE;QACpE,oEAAoE;QACpE,0DAA0D;QAC1D,wCAAwC;QACxC,aAAa,CACX,IAAI,EACJ,KAAK,EACL,yBAAyB,EACzB,4CAA4C,CAC7C,CAAC;QACF,OAAO;IACT,CAAC;IAED,WAAW,CACT,IAAI,EACJ,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,yBAAyB,MAAM,CAAC,YAAY,EAAE,CAAC,EAChE;QACE,OAAO,EAAE,IAAI;QACb,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,QAAQ,EAAE;YACR,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;SAC5B;KACF,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,UAAiC,EAAE;IAEnC,MAAM,EAAE,IAAI,GAAG,KAAK,EAAE,cAAc,GAAG,KAAK,EAAE,GAAG,OAAO,CAAC;IACzD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAElC,MAAM,QAAQ,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;IAEzC,kEAAkE;IAClE,IAAI,QAAQ,EAAE,aAAa,EAAE,CAAC;QAC5B,WAAW,CACT,IAAI,EACJ,KAAK,CAAC,KAAK,CACT,iCAAiC,QAAQ,CAAC,YAAY,IAAI,EAAE,EAAE,CAC/D,EACD;YACE,OAAO,EAAE,IAAI;YACb,YAAY,EAAE,IAAI;YAClB,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,YAAY,EAAE,QAAQ,CAAC,YAAY;SACpC,CACF,CAAC;QACF,OAAO;IACT,CAAC;IAED,yEAAyE;IACzE,yEAAyE;IACzE,IAAI,0BAA0B,EAAE,EAAE,CAAC;QACjC,OAAO,CAAC,KAAK,CACX,KAAK,CAAC,MAAM,CACV,qEAAqE;YACnE,qFAAqF,CACxF,CACF,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,yBAAyB,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IAEvE,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,IAAI,CAAC,eAAe,wBAAwB,CAAC,SAAS,CAAC,EAAE,CAAC,CACjE,CAAC;IACJ,CAAC;IAED,oEAAoE;IACpE,uEAAuE;IACvE,kEAAkE;IAClE,kEAAkE;IAClE,kEAAkE;IAClE,IAAI,QAAQ,EAAE,SAAS,IAAI,QAAQ,EAAE,MAAM,IAAI,QAAQ,EAAE,YAAY,EAAE,CAAC;QACtE,MAAM,WAAW,CACf,WAAW,EACX,SAAS,EACT,YAAY,EACZ;YACE,cAAc,EAAE,QAAQ,CAAC,cAAc;YACvC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,cAAc,EAAE,QAAQ,CAAC,cAAc;YACvC,MAAM,EAAE,QAAQ,CAAC,MAAM;SACxB,EACD,IAAI,CACL,CAAC;QACF,OAAO;IACT,CAAC;IAED,IAAI,cAAsB,CAAC;IAC3B,IAAI,UAAkB,CAAC;IACvB,IAAI,QAAgB,CAAC;IACrB,IAAI,gBAAoC,CAAC;IAEzC,IAAI,QAAQ,EAAE,cAAc,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;QACpD,oEAAoE;QACpE,mEAAmE;QACnE,sEAAsE;QACtE,qEAAqE;QACrE,+DAA+D;QAC/D,oEAAoE;QACpE,gEAAgE;QAChE,qEAAqE;QACrE,0BAA0B;QAC1B,cAAc,GAAG,QAAQ,CAAC,cAAc,CAAC;QACzC,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC;QACjC,QAAQ,GAAG,QAAQ,CAAC,QAAQ,IAAI,uBAAuB,CAAC,UAAU,CAAC,CAAC;QACpE,oEAAoE;QACpE,qEAAqE;QACrE,gBAAgB,GAAG,QAAQ,CAAC,gBAAgB,CAAC;QAC7C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,QAAQ,CAAC,4CAA4C,CAAC,CAAC;QACzD,CAAC;QACD,aAAa,CACX,IAAI,EACJ,cAAc,EACd,cAAc,EACd,QAAQ,EACR,gBAAgB,CACjB,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC,KAAK,EAAE,CAAC;QAC5E,IAAI,UAAU,CAAC;QACf,IAAI,CAAC;YACH,UAAU,GAAG,MAAM,yBAAyB,CAAC;gBAC3C,UAAU,EAAE,gBAAgB,CAAC,WAAW,CAAC;gBACzC,QAAQ,EAAE,cAAc,CAAC,WAAW,CAAC;gBACrC,SAAS;aACV,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,EAAE,IAAI,CAAC,sBAAsB,CAAC,CAAC;YACtC,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,qCAAqC,CAAC,CAAC;YAClE,OAAO;QACT,CAAC;QACD,OAAO,EAAE,OAAO,CAAC,6BAA6B,CAAC,CAAC;QAEhD,cAAc,GAAG,UAAU,CAAC,cAAc,CAAC;QAC3C,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACnC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QAC/B,gBAAgB,GAAG,UAAU,CAAC,gBAAgB,CAAC;QAE/C,oEAAoE;QACpE,oEAAoE;QACpE,sEAAsE;QACtE,eAAe;QACf,gBAAgB,CACd,WAAW,EACX,GAAG,UAAU,GAAG,EAChB,4BAA4B,CAC7B,CAAC;QACF,WAAW,CAAC,WAAW,EAAE;YACvB,cAAc;YACd,UAAU;YACV,QAAQ;YACR,gBAAgB;SACjB,CAAC,CAAC;QAEH,qEAAqE;QACrE,oEAAoE;QACpE,mEAAmE;QACnE,gBAAgB;QAChB,aAAa,CACX,IAAI,EACJ,cAAc,EACd,cAAc,EACd,QAAQ,EACR,gBAAgB,CACjB,CAAC;QACF,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,gEAAgE;YAChE,gEAAgE;YAChE,+DAA+D;YAC/D,gEAAgE;YAChE,8DAA8D;YAC9D,gEAAgE;YAChE,uDAAuD;YACvD,MAAM,WAAW,GACf,SAAS,CAAC,QAAQ,CAAC,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;YACzE,IAAI,WAAW,EAAE,CAAC;gBAChB,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACvB,CAAC;gBAAC,MAAM,CAAC;oBACP,sDAAsD;gBACxD,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;IAExD,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;QAC3B,oEAAoE;QACpE,0DAA0D;QAC1D,WAAW,CAAC,WAAW,CAAC,CAAC;QACzB,aAAa,CACX,IAAI,EACJ,IAAI,KAAK,CAAC,mDAAmD,CAAC,EAC9D,mDAAmD,EACnD,kDAAkD,CACnD,CAAC;QACF,OAAO;IACT,CAAC;IAED,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,oEAAoE;YACpE,iEAAiE;YACjE,8DAA8D;YAC9D,eAAe;YACf,WAAW,CAAC,WAAW,CAAC,CAAC;QAC3B,CAAC;QACD,MAAM,OAAO,GACX,MAAM,KAAK,SAAS;YAClB,CAAC,CAAC,6EAA6E;YAC/E,CAAC,CAAC,kEAAkE,CAAC;QACzE,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE;YACvC,OAAO,EAAE,KAAK;YACd,MAAM;YACN,OAAO;YACP,4DAA4D;YAC5D,kEAAkE;YAClE,gEAAgE;YAChE,+DAA+D;YAC/D,QAAQ,EAAE,MAAM,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;SACzE,CAAC,CAAC;QACH,OAAO,CAAC,4DAA4D;IACtE,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,KAAK,EAAE,CAAC;IAChE,IAAI,SAAS,CAAC;IACd,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,uBAAuB,CAAC,UAAU,CAAC,CAAC;IACxD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,IAAI,CAAC,yBAAyB,CAAC,CAAC;QACzC,MAAM,IAAI,GAAI,KAA2B,EAAE,IAAI,CAAC;QAChD,iEAAiE;QACjE,mEAAmE;QACnE,iEAAiE;QACjE,sEAAsE;QACtE,oEAAoE;QACpE,uDAAuD;QACvD,MAAM,UAAU,GACd,IAAI,KAAK,WAAW;YACpB,IAAI,KAAK,mBAAmB;YAC5B,IAAI,KAAK,SAAS,CAAC;QACrB,IAAI,UAAU,EAAE,CAAC;YACf,WAAW,CAAC,WAAW,CAAC,CAAC;QAC3B,CAAC;QACD,aAAa,CACX,IAAI,EACJ,KAAK,EACL,iCAAiC,EACjC,UAAU;YACR,CAAC,CAAC,kDAAkD;YACpD,CAAC,CAAC,4CAA4C,CACjD,CAAC;QACF,OAAO;IACT,CAAC;IACD,qEAAqE;IACrE,sEAAsE;IACtE,6DAA6D;IAC7D,OAAO,EAAE,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAErC,sEAAsE;IACtE,wEAAwE;IACxE,mEAAmE;IACnE,sEAAsE;IACtE,MAAM,eAAe,GAAoB;QACvC,cAAc;QACd,QAAQ;QACR,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,YAAY,EAAE,SAAS,CAAC,YAAY;QACpC,cAAc,EAAE,SAAS,CAAC,cAAc;QACxC,MAAM,EAAE,SAAS,CAAC,MAAM;KACzB,CAAC;IACF,WAAW,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;IAE1C,MAAM,WAAW,CACf,WAAW,EACX,SAAS,EACT,YAAY,EACZ,eAAe,EACf,IAAI,CACL,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,uBAAuB;IACrC,MAAM,UAAU,GAAG,IAAI,OAAO,CAAC,YAAY,CAAC,CAAC,WAAW,CACtD,wCAAwC,CACzC,CAAC;IAEF,UAAU;SACP,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CACV,sFAAsF,CACvF;SACA,MAAM,CAAC,QAAQ,EAAE,sCAAsC,CAAC;SACxD,MAAM,CACL,oBAAoB,EACpB,6KAA6K,CAC9K;SACA,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;IAEhD,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/commands/receipts.d.ts

@@ -1,3 +1,4 @@
+import type { Receipt } from "@kya-os/contracts/registry";
 interface ReceiptsOptions {
     json?: boolean;
     path?: string;
@@ -7,5 +8,15 @@ interface ReceiptsOptions {
  * List and manage stored receipts
  */
 export declare function receipts(options?: ReceiptsOptions): Promise<void>;
+/**
+ * Legacy registry receipts do not carry the signed KYA-OS audit envelopes
+ * required by the core verifier. Never promote structural well-formedness to
+ * cryptographic verification.
+ */
+export declare function verifyReceipt(receipt: Receipt): Promise<{
+    status: "invalid" | "unsupported";
+    valid: false;
+    error: string;
+}>;
 export {};
 //# sourceMappingURL=receipts.d.ts.map

package/dist/commands/receipts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"receipts.d.ts","sourceRoot":"","sources":["../../src/commands/receipts.ts"],"names":[],"mappings":"AAOA,UAAU,eAAe;IACvB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;GAEG;AACH,wBAAsB,QAAQ,CAAC,OAAO,GAAE,eAAoB,iBAgM3D"}
+{"version":3,"file":"receipts.d.ts","sourceRoot":"","sources":["../../src/commands/receipts.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAC;AAE1D,UAAU,eAAe;IACvB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;GAEG;AACH,wBAAsB,QAAQ,CAAC,OAAO,GAAE,eAAoB,iBAqM3D;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,OAAO,GACf,OAAO,CAAC;IACT,MAAM,EAAE,SAAS,GAAG,aAAa,CAAC;IAClC,KAAK,EAAE,KAAK,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf,CAAC,CA0BD"}