@kya-os/cli 1.7.0 → 2.0.0

package/dist/utils/checkpoint-scaffold.js

@@ -0,0 +1,268 @@
+/**
+ * Detect-layer scaffolding for `kya-os checkpoint init` (KYA-1037).
+ *
+ * Maps the repo's detected platform onto one of the three Detect layers
+ * Checkpoint ships (Next.js middleware, Express snippet, the keyless
+ * Beacon), and, for Next.js, installs the SDK and writes middleware.ts
+ * directly (no shelling out to another package's setup script, see the
+ * comment on scaffoldNextjs for why). Every install/write step is behind
+ * an injectable ScaffoldRunner, so tests never spawn a real process or
+ * touch the real filesystem.
+ */
+import { execFileSync } from "child_process";
+import { existsSync, readFileSync, writeFileSync } from "fs";
+import { basename, join } from "path";
+import { detectPlatform } from "./platform-detector.js";
+/** True if package.json declares a `next` dependency, checked directly rather than through detectPlatform's derived fields. */
+function hasNextDependency(projectRoot) {
+    const pkgPath = join(projectRoot, "package.json");
+    if (!existsSync(pkgPath))
+        return false;
+    try {
+        const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
+        return Boolean(pkg.dependencies?.next || pkg.devDependencies?.next);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Maps `detectPlatform()`'s general-purpose platform/framework detection
+ * onto the three layers Checkpoint's `init` can scaffold. A repo with no
+ * `package.json` at all (a plain HTML/CSS/JS site) maps to `static`; one
+ * with a `package.json` but no recognized framework maps to `unknown`,
+ * both get the same keyless Beacon snippet, but the distinction is kept
+ * server-side as a hint for future support triage.
+ *
+ * Checks package.json's own `next` dependency directly, not just
+ * platformInfo's derived platform/framework fields: detectPlatform()
+ * unconditionally overwrites both to 'cloudflare'/'cloudflare-workers'
+ * whenever wrangler.toml/json exists, even for a Next.js repo deployed
+ * there, silently losing the nextjs detection underneath it.
+ */
+export function detectCheckpointFramework(projectRoot = process.cwd(), platformInfo = detectPlatform(projectRoot)) {
+    if (platformInfo.framework === "nextjs" ||
+        platformInfo.platform === "nextjs" ||
+        platformInfo.platform === "vercel" ||
+        hasNextDependency(projectRoot)) {
+        return "nextjs";
+    }
+    if (platformInfo.framework === "express") {
+        return "express";
+    }
+    return existsSync(join(projectRoot, "package.json")) ? "unknown" : "static";
+}
+export function checkpointFrameworkLabel(framework) {
+    switch (framework) {
+        case "nextjs":
+            return "Next.js app";
+        case "express":
+            return "Express app";
+        case "static":
+            return "static site";
+        case "unknown":
+        default:
+            return "project";
+    }
+}
+/** Best-effort repo name: git remote slug, else the directory name. */
+export function detectRepoName(projectRoot = process.cwd()) {
+    try {
+        const remote = execFileSync("git", ["config", "--get", "remote.origin.url"], {
+            cwd: projectRoot,
+            encoding: "utf-8",
+            stdio: ["ignore", "pipe", "ignore"],
+        }).trim();
+        const match = remote.match(/([^/:]+?)(\.git)?$/);
+        if (match?.[1])
+            return match[1];
+    }
+    catch {
+        // Not a git repo, or no `origin` remote, fall through to the directory name.
+    }
+    const dir = basename(projectRoot);
+    return dir || undefined;
+}
+/** Best-effort domain hint from `package.json`'s `homepage` field. */
+export function detectDomainHint(projectRoot = process.cwd()) {
+    const pkgPath = join(projectRoot, "package.json");
+    if (!existsSync(pkgPath))
+        return undefined;
+    try {
+        const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
+        if (typeof pkg.homepage === "string" && pkg.homepage) {
+            try {
+                return new URL(pkg.homepage).hostname;
+            }
+            catch {
+                return undefined;
+            }
+        }
+    }
+    catch {
+        // Malformed package.json, no hint, not a fatal error for `init`.
+    }
+    return undefined;
+}
+/** The real runner: shells out via execFileSync (swallowing spawn errors into a non-zero status) and touches the real filesystem. */
+export const defaultScaffoldRunner = {
+    run(command, args, cwd) {
+        try {
+            execFileSync(command, args, {
+                cwd,
+                stdio: "ignore",
+                // npm/pnpm/yarn/npx resolve to .cmd shims on Windows; execFileSync
+                // without shell:true throws ENOENT/EINVAL there (this is also the
+                // shape Node's CVE-2024-27980 .bat/.cmd fix requires), so every
+                // install would otherwise "fail" for Windows users even when the
+                // tool is genuinely on PATH.
+                shell: process.platform === "win32",
+            });
+            return { status: 0 };
+        }
+        catch {
+            return { status: 1 };
+        }
+    },
+    writeFile(path, content) {
+        writeFileSync(path, content, "utf-8");
+    },
+    fileExists(path) {
+        return existsSync(path);
+    },
+};
+const NEXTJS_PACKAGE = "@kya-os/checkpoint-nextjs";
+const EXPRESS_PACKAGE = "@kya-os/checkpoint-express";
+const BEACON_PACKAGE = "@kya-os/checkpoint-beacon";
+const BEACON_CDN_URL = `https://cdn.jsdelivr.net/npm/${BEACON_PACKAGE}/dist/beacon.min.js`;
+/** `npm install <pkg>` / `pnpm add <pkg>` / `yarn add <pkg>`, matching the target repo's package manager. */
+function installCommand(packageManager, pkg) {
+    if (packageManager === "pnpm")
+        return { command: "pnpm", args: ["add", pkg] };
+    if (packageManager === "yarn")
+        return { command: "yarn", args: ["add", pkg] };
+    return { command: "npm", args: ["install", pkg] };
+}
+export const NEXTJS_MANUAL_SNIPPET = `import { createMiddleware } from '${NEXTJS_PACKAGE}';
+
+export default createMiddleware({
+  apiKey: process.env.CHECKPOINT_API_KEY!,
+  projectId: process.env.CHECKPOINT_PROJECT_ID!,
+  // The SDK default is 'enforce', which is inert without a deployed
+  // policy, spelled out explicitly so flipping it later is a one-word diff.
+  enforcementMode: 'observe',
+});
+
+export const config = { matcher: '/((?!_next/static|_next/image|favicon.ico).*)' };
+`;
+export const EXPRESS_SNIPPET = `import { withCheckpoint } from '${EXPRESS_PACKAGE}';
+
+app.use(withCheckpoint({
+  apiKey: process.env.CHECKPOINT_API_KEY!,
+  projectId: process.env.CHECKPOINT_PROJECT_ID!,
+}));
+`;
+export function beaconSnippet(projectId) {
+    // The exact CDN Usage snippet from checkpoint-beacon's own README:
+    // loads the global CheckpointBeacon constructor from jsDelivr and
+    // instantiates it inline. Keyless by design (credentials.mdx), the
+    // Beacon takes only a projectId and nothing else credential-shaped, so
+    // no CHECKPOINT_API_KEY here.
+    return `<script src="${BEACON_CDN_URL}"></script>
+<script>
+  const beacon = new CheckpointBeacon({ projectId: '${projectId}' });
+  beacon.collect('pageview');
+</script>\n`;
+}
+const DOCS_LINK = "https://docs.kya-os.ai/checkpoint/install";
+/** Next.js's own convention: middleware.ts lives at the project root, or inside src/ when the app uses a src directory. */
+function middlewareTargetPath(projectRoot, runner) {
+    const usesSrcDir = runner.fileExists(join(projectRoot, "src", "app")) ||
+        runner.fileExists(join(projectRoot, "src", "pages"));
+    return usesSrcDir
+        ? join(projectRoot, "src", "middleware.ts")
+        : join(projectRoot, "middleware.ts");
+}
+/** Any of the file locations/extensions Next.js recognizes as middleware, already present. */
+function existingMiddlewarePath(projectRoot, runner) {
+    const candidates = [
+        join(projectRoot, "middleware.ts"),
+        join(projectRoot, "middleware.js"),
+        join(projectRoot, "src", "middleware.ts"),
+        join(projectRoot, "src", "middleware.js"),
+    ];
+    return candidates.find((path) => runner.fileExists(path));
+}
+export function scaffoldNextjs(projectRoot, packageManager, runner = defaultScaffoldRunner) {
+    const install = installCommand(packageManager, NEXTJS_PACKAGE);
+    const installResult = runner.run(install.command, install.args, projectRoot);
+    if (installResult.status !== 0) {
+        return {
+            framework: "nextjs",
+            installed: false,
+            setupRan: false,
+            message: `Could not install ${NEXTJS_PACKAGE} automatically. Add it yourself, then:\n\n${NEXTJS_MANUAL_SNIPPET}\nDocs: ${DOCS_LINK}`,
+        };
+    }
+    // Writes middleware.ts directly instead of shelling out to
+    // checkpoint-setup-edge (@kya-os/checkpoint-nextjs's own bin): that bin
+    // hard-exits 1 unless the LEGACY node_modules/@kya-os/agentshield-nextjs
+    // path exists, which this command never installs, so it always failed;
+    // even a success would have written the legacy offline middleware that
+    // never reads CHECKPOINT_API_KEY/CHECKPOINT_PROJECT_ID; and invoking a
+    // bare unscoped name via npx can silently fetch and run a squatted
+    // package from the public registry on a .bin-layout miss (Yarn PnP,
+    // among others). Writing the file ourselves avoids all three.
+    const existing = existingMiddlewarePath(projectRoot, runner);
+    if (existing) {
+        return {
+            framework: "nextjs",
+            installed: true,
+            setupRan: false,
+            message: `Installed ${NEXTJS_PACKAGE}. ${existing} already exists, so it was left untouched, wire it up yourself:\n\n${NEXTJS_MANUAL_SNIPPET}\nDocs: ${DOCS_LINK}`,
+        };
+    }
+    const targetPath = middlewareTargetPath(projectRoot, runner);
+    try {
+        runner.writeFile(targetPath, NEXTJS_MANUAL_SNIPPET);
+    }
+    catch {
+        return {
+            framework: "nextjs",
+            installed: true,
+            setupRan: false,
+            message: `${NEXTJS_PACKAGE} installed, but writing middleware.ts failed. Wire it up yourself:\n\n${NEXTJS_MANUAL_SNIPPET}\nDocs: ${DOCS_LINK}`,
+        };
+    }
+    return {
+        framework: "nextjs",
+        installed: true,
+        setupRan: true,
+        message: `Installed ${NEXTJS_PACKAGE} and wrote ${targetPath}.`,
+    };
+}
+export function scaffoldExpress(projectRoot, packageManager, runner = defaultScaffoldRunner) {
+    const install = installCommand(packageManager, EXPRESS_PACKAGE);
+    const installResult = runner.run(install.command, install.args, projectRoot);
+    const message = installResult.status === 0
+        ? `Installed ${EXPRESS_PACKAGE}. Wire it into your app:\n\n${EXPRESS_SNIPPET}`
+        : `Could not install ${EXPRESS_PACKAGE} automatically. Add it yourself, then:\n\n${EXPRESS_SNIPPET}\nDocs: ${DOCS_LINK}`;
+    return {
+        framework: "express",
+        installed: installResult.status === 0,
+        // Express scaffolding never edits the target app's source (per plan);
+        // printing the snippet IS the setup step, so it "ran" whenever we got
+        // far enough to print it, which is always.
+        setupRan: true,
+        message,
+    };
+}
+export function scaffoldBeacon(projectId, framework) {
+    return {
+        framework,
+        installed: false,
+        setupRan: true,
+        message: `Add this before the closing </head> tag:\n\n${beaconSnippet(projectId)}`,
+    };
+}
+//# sourceMappingURL=checkpoint-scaffold.js.map

package/dist/utils/checkpoint-scaffold.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkpoint-scaffold.js","sourceRoot":"","sources":["../../src/utils/checkpoint-scaffold.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AAC7D,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACtC,OAAO,EAAE,cAAc,EAAqB,MAAM,wBAAwB,CAAC;AAI3E,+HAA+H;AAC/H,SAAS,iBAAiB,CAAC,WAAmB;IAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;IAClD,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAGpD,CAAC;QACF,OAAO,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,IAAI,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,yBAAyB,CACvC,cAAsB,OAAO,CAAC,GAAG,EAAE,EACnC,eAA6B,cAAc,CAAC,WAAW,CAAC;IAExD,IACE,YAAY,CAAC,SAAS,KAAK,QAAQ;QACnC,YAAY,CAAC,QAAQ,KAAK,QAAQ;QAClC,YAAY,CAAC,QAAQ,KAAK,QAAQ;QAClC,iBAAiB,CAAC,WAAW,CAAC,EAC9B,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,IAAI,YAAY,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACzC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,SAA8B;IAE9B,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,QAAQ;YACX,OAAO,aAAa,CAAC;QACvB,KAAK,SAAS;YACZ,OAAO,aAAa,CAAC;QACvB,KAAK,QAAQ;YACX,OAAO,aAAa,CAAC;QACvB,KAAK,SAAS,CAAC;QACf;YACE,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,cAAc,CAC5B,cAAsB,OAAO,CAAC,GAAG,EAAE;IAEnC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,YAAY,CACzB,KAAK,EACL,CAAC,QAAQ,EAAE,OAAO,EAAE,mBAAmB,CAAC,EACxC;YACE,GAAG,EAAE,WAAW;YAChB,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;SACpC,CACF,CAAC,IAAI,EAAE,CAAC;QACT,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;QACjD,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,6EAA6E;IAC/E,CAAC;IACD,MAAM,GAAG,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;IAClC,OAAO,GAAG,IAAI,SAAS,CAAC;AAC1B,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,gBAAgB,CAC9B,cAAsB,OAAO,CAAC,GAAG,EAAE;IAEnC,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;IAClD,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAEpD,CAAC;QACF,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;YACrD,IAAI,CAAC;gBACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC;YACxC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,iEAAiE;IACnE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAWD,qIAAqI;AACrI,MAAM,CAAC,MAAM,qBAAqB,GAAmB;IACnD,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG;QACpB,IAAI,CAAC;YACH,YAAY,CAAC,OAAO,EAAE,IAAI,EAAE;gBAC1B,GAAG;gBACH,KAAK,EAAE,QAAQ;gBACf,mEAAmE;gBACnE,kEAAkE;gBAClE,gEAAgE;gBAChE,iEAAiE;gBACjE,6BAA6B;gBAC7B,KAAK,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO;aACpC,CAAC,CAAC;YACH,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;QACvB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;QACvB,CAAC;IACH,CAAC;IACD,SAAS,CAAC,IAAI,EAAE,OAAO;QACrB,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACxC,CAAC;IACD,UAAU,CAAC,IAAI;QACb,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;CACF,CAAC;AAEF,MAAM,cAAc,GAAG,2BAA2B,CAAC;AACnD,MAAM,eAAe,GAAG,4BAA4B,CAAC;AACrD,MAAM,cAAc,GAAG,2BAA2B,CAAC;AACnD,MAAM,cAAc,GAAG,gCAAgC,cAAc,qBAAqB,CAAC;AAE3F,6GAA6G;AAC7G,SAAS,cAAc,CACrB,cAA8C,EAC9C,GAAW;IAEX,IAAI,cAAc,KAAK,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;IAC9E,IAAI,cAAc,KAAK,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;IAC9E,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC;AACpD,CAAC;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,qCAAqC,cAAc;;;;;;;;;;;CAWvF,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,mCAAmC,eAAe;;;;;;CAMhF,CAAC;AAEF,MAAM,UAAU,aAAa,CAAC,SAAiB;IAC7C,mEAAmE;IACnE,kEAAkE;IAClE,mEAAmE;IACnE,uEAAuE;IACvE,8BAA8B;IAC9B,OAAO,gBAAgB,cAAc;;sDAEe,SAAS;;YAEnD,CAAC;AACb,CAAC;AAYD,MAAM,SAAS,GAAG,2CAA2C,CAAC;AAE9D,2HAA2H;AAC3H,SAAS,oBAAoB,CAC3B,WAAmB,EACnB,MAAsB;IAEtB,MAAM,UAAU,GACd,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAClD,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;IACvD,OAAO,UAAU;QACf,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,eAAe,CAAC;QAC3C,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;AACzC,CAAC;AAED,8FAA8F;AAC9F,SAAS,sBAAsB,CAC7B,WAAmB,EACnB,MAAsB;IAEtB,MAAM,UAAU,GAAG;QACjB,IAAI,CAAC,WAAW,EAAE,eAAe,CAAC;QAClC,IAAI,CAAC,WAAW,EAAE,eAAe,CAAC;QAClC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,eAAe,CAAC;QACzC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,eAAe,CAAC;KAC1C,CAAC;IACF,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,WAAmB,EACnB,cAA8C,EAC9C,SAAyB,qBAAqB;IAE9C,MAAM,OAAO,GAAG,cAAc,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;IAC/D,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAC7E,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO;YACL,SAAS,EAAE,QAAQ;YACnB,SAAS,EAAE,KAAK;YAChB,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,qBAAqB,cAAc,6CAA6C,qBAAqB,WAAW,SAAS,EAAE;SACrI,CAAC;IACJ,CAAC;IAED,2DAA2D;IAC3D,wEAAwE;IACxE,yEAAyE;IACzE,uEAAuE;IACvE,uEAAuE;IACvE,uEAAuE;IACvE,mEAAmE;IACnE,oEAAoE;IACpE,8DAA8D;IAC9D,MAAM,QAAQ,GAAG,sBAAsB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC7D,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO;YACL,SAAS,EAAE,QAAQ;YACnB,SAAS,EAAE,IAAI;YACf,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,aAAa,cAAc,KAAK,QAAQ,sEAAsE,qBAAqB,WAAW,SAAS,EAAE;SACnK,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,oBAAoB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC7D,IAAI,CAAC;QACH,MAAM,CAAC,SAAS,CAAC,UAAU,EAAE,qBAAqB,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,SAAS,EAAE,QAAQ;YACnB,SAAS,EAAE,IAAI;YACf,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,GAAG,cAAc,yEAAyE,qBAAqB,WAAW,SAAS,EAAE;SAC/I,CAAC;IACJ,CAAC;IAED,OAAO;QACL,SAAS,EAAE,QAAQ;QACnB,SAAS,EAAE,IAAI;QACf,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,aAAa,cAAc,cAAc,UAAU,GAAG;KAChE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,WAAmB,EACnB,cAA8C,EAC9C,SAAyB,qBAAqB;IAE9C,MAAM,OAAO,GAAG,cAAc,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;IAChE,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAC7E,MAAM,OAAO,GACX,aAAa,CAAC,MAAM,KAAK,CAAC;QACxB,CAAC,CAAC,aAAa,eAAe,+BAA+B,eAAe,EAAE;QAC9E,CAAC,CAAC,qBAAqB,eAAe,6CAA6C,eAAe,WAAW,SAAS,EAAE,CAAC;IAC7H,OAAO;QACL,SAAS,EAAE,SAAS;QACpB,SAAS,EAAE,aAAa,CAAC,MAAM,KAAK,CAAC;QACrC,sEAAsE;QACtE,sEAAsE;QACtE,2CAA2C;QAC3C,QAAQ,EAAE,IAAI;QACd,OAAO;KACR,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,SAAiB,EACjB,SAA8B;IAE9B,OAAO;QACL,SAAS;QACT,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,+CAA+C,aAAa,CAAC,SAAS,CAAC,EAAE;KACnF,CAAC;AACJ,CAAC"}

package/dist/utils/cli-kit/browser.d.ts

@@ -0,0 +1,24 @@
+export interface OpenUrlInBrowserOptions {
+    /** Wait for the user to press Enter before opening, when attached to a TTY. Default true. */
+    waitForEnter?: boolean;
+    /** Max time to wait for Enter, in ms. Default 30000. */
+    enterTimeoutMs?: number;
+}
+export interface OpenUrlInBrowserResult {
+    opened: boolean;
+    /** Present when `opened` is false: "non-tty", or the `open()` failure message. */
+    reason?: string;
+}
+/**
+ * Open a URL in the user's browser, but only when attached to an
+ * interactive terminal.
+ *
+ * A non-TTY run (CI, Docker, a piped process) has no user present to
+ * consent to a browser launching, so this never attempts to open one
+ * there — it returns immediately with `{ opened: false, reason: "non-tty" }`
+ * so the caller can print the URL instead. Auto-opening anyway after a
+ * short delay was a real bug in the code this replaces: a non-interactive
+ * `init` run would pop a browser window with no user watching for it.
+ */
+export declare function openUrlInBrowser(url: string, options?: OpenUrlInBrowserOptions): Promise<OpenUrlInBrowserResult>;
+//# sourceMappingURL=browser.d.ts.map

package/dist/utils/cli-kit/browser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser.d.ts","sourceRoot":"","sources":["../../../src/utils/cli-kit/browser.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,uBAAuB;IACtC,6FAA6F;IAC7F,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,wDAAwD;IACxD,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,OAAO,CAAC;IAChB,kFAAkF;IAClF,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,sBAAsB,CAAC,CA+CjC"}

package/dist/utils/cli-kit/browser.js

@@ -0,0 +1,58 @@
+import chalk from "chalk";
+/**
+ * Open a URL in the user's browser, but only when attached to an
+ * interactive terminal.
+ *
+ * A non-TTY run (CI, Docker, a piped process) has no user present to
+ * consent to a browser launching, so this never attempts to open one
+ * there — it returns immediately with `{ opened: false, reason: "non-tty" }`
+ * so the caller can print the URL instead. Auto-opening anyway after a
+ * short delay was a real bug in the code this replaces: a non-interactive
+ * `init` run would pop a browser window with no user watching for it.
+ */
+export async function openUrlInBrowser(url, options = {}) {
+    const { waitForEnter = true, enterTimeoutMs = 30000 } = options;
+    if (!process.stdin.isTTY || !process.stdout.isTTY) {
+        return { opened: false, reason: "non-tty" };
+    }
+    if (waitForEnter) {
+        console.log(`   ${chalk.gray("Press Enter to open in browser...")}`);
+        // The two arms must cancel each other: a leaked timer would later fire
+        // process.stdin.pause() and freeze any interactive prompt on screen at
+        // that moment.
+        const cleanup = () => {
+            process.stdin.pause();
+            process.stdin.removeAllListeners("data");
+        };
+        let enterTimeout;
+        await Promise.race([
+            new Promise((resolve) => {
+                process.stdin.once("data", () => {
+                    if (enterTimeout)
+                        clearTimeout(enterTimeout);
+                    cleanup();
+                    resolve();
+                });
+                process.stdin.resume();
+            }),
+            new Promise((resolve) => {
+                enterTimeout = setTimeout(() => {
+                    cleanup();
+                    resolve();
+                }, enterTimeoutMs);
+            }),
+        ]);
+    }
+    try {
+        const open = (await import("open")).default;
+        await open(url);
+        return { opened: true };
+    }
+    catch (error) {
+        return {
+            opened: false,
+            reason: error instanceof Error ? error.message : String(error),
+        };
+    }
+}
+//# sourceMappingURL=browser.js.map

package/dist/utils/cli-kit/browser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser.js","sourceRoot":"","sources":["../../../src/utils/cli-kit/browser.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAe1B;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAW,EACX,UAAmC,EAAE;IAErC,MAAM,EAAE,YAAY,GAAG,IAAI,EAAE,cAAc,GAAG,KAAK,EAAE,GAAG,OAAO,CAAC;IAEhE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC9C,CAAC;IAED,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,mCAAmC,CAAC,EAAE,CAAC,CAAC;QAErE,uEAAuE;QACvE,uEAAuE;QACvE,eAAe;QACf,MAAM,OAAO,GAAG,GAAG,EAAE;YACnB,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACtB,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAC3C,CAAC,CAAC;QAEF,IAAI,YAAwC,CAAC;QAC7C,MAAM,OAAO,CAAC,IAAI,CAAC;YACjB,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;gBAC5B,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE;oBAC9B,IAAI,YAAY;wBAAE,YAAY,CAAC,YAAY,CAAC,CAAC;oBAC7C,OAAO,EAAE,CAAC;oBACV,OAAO,EAAE,CAAC;gBACZ,CAAC,CAAC,CAAC;gBACH,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACzB,CAAC,CAAC;YACF,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;gBAC5B,YAAY,GAAG,UAAU,CAAC,GAAG,EAAE;oBAC7B,OAAO,EAAE,CAAC;oBACV,OAAO,EAAE,CAAC;gBACZ,CAAC,EAAE,cAAc,CAAC,CAAC;YACrB,CAAC,CAAC;SACH,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QAC5C,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;QAChB,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC/D,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/utils/cli-kit/claim-polling.d.ts

@@ -0,0 +1,18 @@
+export interface ClaimPollingOptions {
+    verbose?: boolean;
+    maxAttempts?: number;
+    pollInterval?: number;
+}
+/**
+ * Poll a claim-status endpoint until claimed, timed out, or interrupted.
+ *
+ * Endpoint-agnostic: `endpoint` is the base URL and `statusPath` builds the
+ * per-check path from it, so a caller can point this at knowthat.ai's
+ * `/api/agents/:slug` today or a Checkpoint `/api/v1/cli/claim-status`
+ * tomorrow without forking the polling logic. A response is "claimed" when
+ * `isClaimed` returns true for its parsed JSON body.
+ *
+ * Returns true when claimed, false on timeout or user interrupt (Ctrl+C).
+ */
+export declare function pollForClaimStatus(statusUrl: string, isClaimed: (body: unknown) => boolean, options?: ClaimPollingOptions): Promise<boolean>;
+//# sourceMappingURL=claim-polling.d.ts.map

package/dist/utils/cli-kit/claim-polling.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claim-polling.d.ts","sourceRoot":"","sources":["../../../src/utils/cli-kit/claim-polling.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,mBAAmB;IAClC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,CACtC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,EACrC,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC,OAAO,CAAC,CA4FlB"}

package/dist/utils/{claim-polling.js → cli-kit/claim-polling.js}

@@ -1,17 +1,17 @@
 import chalk from "chalk";
 import ora from "ora";
 /**
- * Poll for agent claim status
+ * Poll a claim-status endpoint until claimed, timed out, or interrupted.
  *
- * Polls the KTA API to check if an agent has been claimed.
- * Returns true when claimed, false if timeout or interrupted.
+ * Endpoint-agnostic: `endpoint` is the base URL and `statusPath` builds the
+ * per-check path from it, so a caller can point this at knowthat.ai's
+ * `/api/agents/:slug` today or a Checkpoint `/api/v1/cli/claim-status`
+ * tomorrow without forking the polling logic. A response is "claimed" when
+ * `isClaimed` returns true for its parsed JSON body.
  *
- * @param agentName - The agent's name (slug) to check
- * @param did - The agent's DID
- * @param endpoint - API endpoint URL (default: https://knowthat.ai)
- * @param options - Polling options
+ * Returns true when claimed, false on timeout or user interrupt (Ctrl+C).
  */
-export async function pollForClaimStatus(agentName, did, endpoint = "https://knowthat.ai", options = {}) {
+export async function pollForClaimStatus(statusUrl, isClaimed, options = {}) {
     const { verbose = false, maxAttempts = 60, // 5 minutes at 5 second intervals
     pollInterval = 5000, // 5 seconds
      } = options;
@@ -26,12 +26,11 @@ export async function pollForClaimStatus(agentName, did, endpoint = "https://kno
         skipPolling = true;
         spinner.warn(chalk.yellow("⏭️  Skipping claim check..."));
     };
-    process.on('SIGINT', handleInterrupt);
+    process.on("SIGINT", handleInterrupt);
     try {
         while (attempts < maxAttempts && !skipPolling) {
             try {
-                const statusCheckUrl = new URL("/api/agents/" + encodeURIComponent(agentName), endpoint);
-                const response = await fetch(statusCheckUrl.toString(), {
+                const response = await fetch(statusUrl, {
                     method: "GET",
                     headers: {
                         "User-Agent": "kya-os-cli",
@@ -41,25 +40,19 @@ export async function pollForClaimStatus(agentName, did, endpoint = "https://kno
                 if (response.ok) {
                     const data = await response.json();
                     if (verbose) {
-                        console.log(chalk.gray(`\n[DEBUG] Agent status:`));
+                        console.log(chalk.gray(`\n[DEBUG] Claim status:`));
                         console.log(chalk.gray(JSON.stringify(data, null, 2)));
                     }
-                    // Check if claimed (multiple possible indicators)
-                    if (data &&
-                        (data.userId ||
-                            data.status === 'active' ||
-                            data.owner ||
-                            data.claimedAt ||
-                            data.isDraft === false)) {
-                        spinner.succeed(chalk.green("✅ Agent claimed successfully!"));
-                        process.removeListener('SIGINT', handleInterrupt);
+                    if (isClaimed(data)) {
+                        spinner.succeed(chalk.green("✅ Claimed successfully!"));
+                        process.removeListener("SIGINT", handleInterrupt);
                         return true;
                     }
                 }
                 else if (response.status === 404) {
-                    // Agent not found - might not be indexed yet, continue polling
+                    // Not found yet - might not be indexed yet, continue polling
                     if (verbose) {
-                        console.log(chalk.gray(`\n[DEBUG] Agent not found yet (404), continuing...`));
+                        console.log(chalk.gray(`\n[DEBUG] Not found yet (404), continuing...`));
                     }
                 }
             }
@@ -79,17 +72,17 @@ export async function pollForClaimStatus(agentName, did, endpoint = "https://kno
                 .toString()
                 .padStart(2, "0")} remaining)`;
         }
-        process.removeListener('SIGINT', handleInterrupt);
+        process.removeListener("SIGINT", handleInterrupt);
         if (skipPolling) {
             console.log(chalk.gray("\n   You can complete the claim process later."));
             return false;
         }
         spinner.warn(chalk.yellow("⏱️  Claim check timed out"));
-        console.log(chalk.gray("\n   Don't worry! You can still claim your agent."));
+        console.log(chalk.gray("\n   Don't worry! You can still complete the claim."));
         return false;
     }
     catch (error) {
-        process.removeListener('SIGINT', handleInterrupt);
+        process.removeListener("SIGINT", handleInterrupt);
         spinner.fail("Claim polling failed");
         throw error;
     }

package/dist/utils/cli-kit/claim-polling.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claim-polling.js","sourceRoot":"","sources":["../../../src/utils/cli-kit/claim-polling.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,GAAG,MAAM,KAAK,CAAC;AAQtB;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,SAAiB,EACjB,SAAqC,EACrC,UAA+B,EAAE;IAEjC,MAAM,EACJ,OAAO,GAAG,KAAK,EACf,WAAW,GAAG,EAAE,EAAE,kCAAkC;IACpD,YAAY,GAAG,IAAI,EAAE,YAAY;MAClC,GAAG,OAAO,CAAC;IAEZ,MAAM,OAAO,GAAG,GAAG,CAAC;QAClB,IAAI,EAAE,wCAAwC;QAC9C,KAAK,EAAE,QAAQ;KAChB,CAAC,CAAC,KAAK,EAAE,CAAC;IAEX,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,WAAW,GAAG,KAAK,CAAC;IAExB,2CAA2C;IAC3C,MAAM,eAAe,GAAG,GAAG,EAAE;QAC3B,WAAW,GAAG,IAAI,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,6BAA6B,CAAC,CAAC,CAAC;IAC5D,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAEtC,IAAI,CAAC;QACH,OAAO,QAAQ,GAAG,WAAW,IAAI,CAAC,WAAW,EAAE,CAAC;YAC9C,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,EAAE;oBACtC,MAAM,EAAE,KAAK;oBACb,OAAO,EAAE;wBACP,YAAY,EAAE,YAAY;wBAC1B,MAAM,EAAE,kBAAkB;qBAC3B;iBACF,CAAC,CAAC;gBAEH,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;oBAChB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;oBAEnC,IAAI,OAAO,EAAE,CAAC;wBACZ,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,CAAC;wBACnD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBACzD,CAAC;oBAED,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;wBACpB,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC;wBACxD,OAAO,CAAC,cAAc,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;wBAClD,OAAO,IAAI,CAAC;oBACd,CAAC;gBACH,CAAC;qBAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBACnC,6DAA6D;oBAC7D,IAAI,OAAO,EAAE,CAAC;wBACZ,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC,CAAC;oBAC1E,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,OAAO,UAAU,EAAE,CAAC;gBACpB,gEAAgE;gBAChE,IAAI,OAAO,EAAE,CAAC;oBACZ,OAAO,CAAC,IAAI,CACV,KAAK,CAAC,MAAM,CACV,0BAA0B,QAAQ,GAAG,CAAC,YACpC,UAAU,YAAY,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,eACrD,EAAE,CACH,CACF,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;YAClE,QAAQ,EAAE,CAAC;YAEX,qCAAqC;YACrC,MAAM,aAAa,GAAG,CAAC,WAAW,GAAG,QAAQ,CAAC,GAAG,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;YACvE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,GAAG,EAAE,CAAC,CAAC;YAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,GAAG,EAAE,CAAC,CAAC;YAC/C,OAAO,CAAC,IAAI,GAAG,2CAA2C,OAAO,IAAI,OAAO;iBACzE,QAAQ,EAAE;iBACV,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,aAAa,CAAC;QACnC,CAAC;QAED,OAAO,CAAC,cAAc,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;QAElD,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC,CAAC;YAC1E,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAC,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC,CAAC;QAC/E,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,cAAc,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;QAClD,OAAO,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QACrC,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/utils/cli-kit/diagnostics.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Run a named set of async checks in parallel and collect their results
+ * under the same keys, e.g. `doctor`-style commands that report several
+ * independent health checks (packages, connectivity, config, ...) at once.
+ */
+export declare function runDiagnosticChecks<T extends Record<string, unknown>>(checks: {
+    [K in keyof T]: () => Promise<T[K]>;
+}): Promise<T>;
+//# sourceMappingURL=diagnostics.d.ts.map

package/dist/utils/cli-kit/diagnostics.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"diagnostics.d.ts","sourceRoot":"","sources":["../../../src/utils/cli-kit/diagnostics.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,wBAAsB,mBAAmB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACzE,MAAM,EAAE;KAAG,CAAC,IAAI,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;CAAE,GAC9C,OAAO,CAAC,CAAC,CAAC,CAIZ"}

package/dist/utils/cli-kit/diagnostics.js

@@ -0,0 +1,11 @@
+/**
+ * Run a named set of async checks in parallel and collect their results
+ * under the same keys, e.g. `doctor`-style commands that report several
+ * independent health checks (packages, connectivity, config, ...) at once.
+ */
+export async function runDiagnosticChecks(checks) {
+    const keys = Object.keys(checks);
+    const values = await Promise.all(keys.map((key) => checks[key]()));
+    return Object.fromEntries(keys.map((key, i) => [key, values[i]]));
+}
+//# sourceMappingURL=diagnostics.js.map

package/dist/utils/cli-kit/diagnostics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"diagnostics.js","sourceRoot":"","sources":["../../../src/utils/cli-kit/diagnostics.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAA+C;IAE/C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAgB,CAAC;IAChD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACnE,OAAO,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAM,CAAC;AACzE,CAAC"}

package/dist/utils/cli-kit/fs-safe.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Atomic, symlink-safe file replace.
+ *
+ * The destination and its temp sibling may live in an untrusted working
+ * tree (e.g. a cloned repo). A tracked symlink planted at the predictable
+ * `<path>.mcpi-tmp` sibling would otherwise make a plain writeFileSync
+ * follow it and clobber an arbitrary file the caller can write. So: unlink
+ * any pre-existing temp (rmSync removes the link itself, never its
+ * target), then create it with O_EXCL (`wx`) so a planted or racing
+ * symlink makes the write fail closed instead of being followed.
+ * renameSync replaces the destination without following a symlink there.
+ */
+export declare function writeFileAtomicSafe(path: string, content: string, mode?: number): void;
+//# sourceMappingURL=fs-safe.d.ts.map

package/dist/utils/cli-kit/fs-safe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fs-safe.d.ts","sourceRoot":"","sources":["../../../src/utils/cli-kit/fs-safe.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,IAAI,SAAQ,GACX,IAAI,CAKN"}

package/dist/utils/cli-kit/fs-safe.js

@@ -0,0 +1,20 @@
+import { renameSync, rmSync, writeFileSync } from "fs";
+/**
+ * Atomic, symlink-safe file replace.
+ *
+ * The destination and its temp sibling may live in an untrusted working
+ * tree (e.g. a cloned repo). A tracked symlink planted at the predictable
+ * `<path>.mcpi-tmp` sibling would otherwise make a plain writeFileSync
+ * follow it and clobber an arbitrary file the caller can write. So: unlink
+ * any pre-existing temp (rmSync removes the link itself, never its
+ * target), then create it with O_EXCL (`wx`) so a planted or racing
+ * symlink makes the write fail closed instead of being followed.
+ * renameSync replaces the destination without following a symlink there.
+ */
+export function writeFileAtomicSafe(path, content, mode = 0o644) {
+    const tempPath = `${path}.mcpi-tmp`;
+    rmSync(tempPath, { force: true });
+    writeFileSync(tempPath, content, { flag: "wx", mode });
+    renameSync(tempPath, path);
+}
+//# sourceMappingURL=fs-safe.js.map

package/dist/utils/cli-kit/fs-safe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fs-safe.js","sourceRoot":"","sources":["../../../src/utils/cli-kit/fs-safe.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AAEvD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAY,EACZ,OAAe,EACf,IAAI,GAAG,KAAK;IAEZ,MAAM,QAAQ,GAAG,GAAG,IAAI,WAAW,CAAC;IACpC,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAClC,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACvD,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;AAC7B,CAAC"}

package/dist/utils/cli-kit/index.d.ts

@@ -0,0 +1,15 @@
+export { writeFileAtomicSafe } from "./fs-safe.js";
+export { upsertMarkerBlock } from "./marker-block.js";
+export type { UpsertResult } from "./marker-block.js";
+export { mergeJsonFile } from "./json-file.js";
+export type { MergeJsonResult } from "./json-file.js";
+export { renderSteps, statusLabel } from "./step-report.js";
+export type { StepStatus, StepResult } from "./step-report.js";
+export { SLUG_PATTERN, isValidSlug, stateDir } from "./paths.js";
+export { ensureSecureDir, writeSecureFile } from "./secure-storage.js";
+export { pollForClaimStatus } from "./claim-polling.js";
+export type { ClaimPollingOptions } from "./claim-polling.js";
+export { openUrlInBrowser } from "./browser.js";
+export type { OpenUrlInBrowserOptions, OpenUrlInBrowserResult, } from "./browser.js";
+export { runDiagnosticChecks } from "./diagnostics.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/utils/cli-kit/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/utils/cli-kit/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAEnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEtD,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,YAAY,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEtD,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC5D,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE/D,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEjE,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,YAAY,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAE9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,YAAY,EACV,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/utils/cli-kit/index.js

@@ -0,0 +1,10 @@
+export { writeFileAtomicSafe } from "./fs-safe.js";
+export { upsertMarkerBlock } from "./marker-block.js";
+export { mergeJsonFile } from "./json-file.js";
+export { renderSteps, statusLabel } from "./step-report.js";
+export { SLUG_PATTERN, isValidSlug, stateDir } from "./paths.js";
+export { ensureSecureDir, writeSecureFile } from "./secure-storage.js";
+export { pollForClaimStatus } from "./claim-polling.js";
+export { openUrlInBrowser } from "./browser.js";
+export { runDiagnosticChecks } from "./diagnostics.js";
+//# sourceMappingURL=index.js.map

package/dist/utils/cli-kit/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/utils/cli-kit/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAEnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAGtD,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAG/C,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAG5D,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEjE,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAGxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAMhD,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/utils/cli-kit/json-file.d.ts

@@ -0,0 +1,21 @@
+export type MergeJsonResult = "created" | "updated" | "unchanged" | "skipped-invalid" | "would-change";
+/**
+ * Merge `patch` into a JSON file at `path`, preserving every other key.
+ *
+ * A file we cannot parse (or that doesn't hold a plain object) is left
+ * untouched and reported "skipped-invalid": clobbering a caller's existing
+ * config is worse than leaving the patch unapplied. Already-applied patches
+ * report "unchanged" without writing.
+ *
+ * `path` is used as given, with no containment check against a base
+ * directory (unlike `upsertMarkerBlock`, this function takes a fully
+ * resolved path, not a `cwd` + relative segment) — resolving it safely is
+ * the caller's responsibility.
+ */
+export declare function mergeJsonFile(path: string, patch: Record<string, unknown>, options?: {
+    dryRun?: boolean;
+}): {
+    result: MergeJsonResult;
+    path: string;
+};
+//# sourceMappingURL=json-file.d.ts.map

package/dist/utils/cli-kit/json-file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"json-file.d.ts","sourceRoot":"","sources":["../../../src/utils/cli-kit/json-file.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,eAAe,GACvB,SAAS,GACT,SAAS,GACT,WAAW,GACX,iBAAiB,GACjB,cAAc,CAAC;AAEnB;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,GACjC;IAAE,MAAM,EAAE,eAAe,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAoC3C"}