@kya-os/cli 1.8.1 → 1.8.3

package/dist/utils/init/pipeline.js

@@ -0,0 +1,96 @@
+/**
+ * The stage pipeline `kya-os init` runs.
+ *
+ * `init.ts`'s flow is seven ordered stages (readiness/install, identity,
+ * claim, agent profiles, GitHub credentials, hub context, summary+TUI
+ * handoff). Each stage decides for itself whether it applies at all
+ * (`when`) and reports one summary line plus any warnings (`run`) instead
+ * of printing ad hoc -- the pipeline collects every stage's report so the
+ * caller can print one consolidated block before the TUI handoff question,
+ * which is what makes a re-run ("already set up" in one line each, per
+ * stage) possible without every stage re-implementing that summary itself.
+ *
+ * `when` is also the seam P16/P17 runtime-optionality depends on: a guard
+ * that checks whether the stage's own module exists (a dynamic import
+ * wrapped in try/catch) rather than a hardcoded flag means a stage
+ * activates itself the moment its dependency lands on `main`, with zero
+ * code change here.
+ *
+ * A stage's `run` is expected to catch its own recoverable failures and
+ * report them as `{ ok: false, warnings: [...] }` -- exactly how init.ts's
+ * existing non-fatal error handling already works. A `run` that needs to
+ * stop the whole pipeline (today: only a missing `git` or an identity
+ * failure) throws a {@link StageFatalError}; anything else it throws is
+ * treated as an unexpected bug, not a modeled failure, and propagates
+ * uncaught. This module never touches `process.exit` itself -- the caller
+ * owns the NODE_ENV=test guard and the exit code, which is what keeps this
+ * file trivially unit-testable on its own.
+ *
+ * @module cli/utils/init/pipeline
+ */
+/** Raised by a stage's `run` to stop the pipeline with a specific exit code. */
+export class StageFatalError extends Error {
+    constructor(exitCode, message) {
+        super(message);
+        this.name = "StageFatalError";
+        this.exitCode = exitCode;
+    }
+}
+/**
+ * Runs every applicable stage in order, stopping immediately (and
+ * rethrowing) if a stage throws. Callers that want a "skipped" line for an
+ * omitted stage build it from {@link RunStagesReport.omitted} themselves --
+ * this function does not synthesize one, since a stage's own `when` is the
+ * only place that knows WHY it does not apply (module absent vs. a --skip
+ * flag vs. platform mismatch).
+ */
+export async function runStages(stages, ctx) {
+    const ran = [];
+    const omitted = [];
+    for (const stage of stages) {
+        if (!(await stage.when(ctx))) {
+            omitted.push(stage.name);
+            continue;
+        }
+        const result = await stage.run(ctx);
+        ran.push({ name: stage.name, result });
+    }
+    return { ran, omitted };
+}
+/**
+ * Attempts a dynamic import purely to test whether a module resolves,
+ * discarding the module itself. The standard `when` guard for a
+ * runtime-optional stage (P16/P17): resolves true once the real file lands
+ * on disk, false while it is absent, with no other code change required.
+ *
+ * `fromUrl` is REQUIRED, not optional, and exists specifically so a
+ * relative `specifier` resolves against the CALLER's own module location
+ * rather than this file's. A dynamic `import()` written inside this
+ * function always resolves a relative specifier against pipeline.ts's own
+ * URL, not wherever the string was written -- a bug this signature makes
+ * structurally impossible to reintroduce, caught once already by a
+ * relative specifier silently resolving one directory short of where its
+ * author meant (`../utils/x.js` written in `commands/init-stages.ts`, but
+ * evaluated from `utils/init/`, landing on a nonexistent
+ * `utils/utils/x.js`). Call as `moduleExists("../utils/x.js",
+ * import.meta.url)` from the module that owns the specifier.
+ *
+ * Memoized per RESOLVED specifier for the life of the process. Whether a
+ * module exists cannot change between two `init()` invocations in the
+ * same process (the CLI is not hot-reloaded mid-run), and re-attempting a
+ * failing dynamic import on every call is measurably expensive -- a test
+ * suite that calls `init()` hundreds of times was slow enough to make
+ * unrelated, timing-sensitive tests miss their own deadlines under
+ * parallel load before this cache existed.
+ */
+const moduleExistsCache = new Map();
+export async function moduleExists(specifier, fromUrl) {
+    const resolved = new URL(specifier, fromUrl).href;
+    let cached = moduleExistsCache.get(resolved);
+    if (!cached) {
+        cached = import(resolved).then(() => true, () => false);
+        moduleExistsCache.set(resolved, cached);
+    }
+    return cached;
+}
+//# sourceMappingURL=pipeline.js.map

package/dist/utils/init/pipeline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pipeline.js","sourceRoot":"","sources":["../../../src/utils/init/pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAQH,gFAAgF;AAChF,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAExC,YAAY,QAAgB,EAAE,OAAe;QAC3C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;CACF;AA4BD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,MAAiC,EACjC,GAAQ;IAER,MAAM,GAAG,GAAe,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC7B,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACzB,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACpC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;AAC1B,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAA4B,CAAC;AAC9D,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,SAAiB,EAAE,OAAe;IACnE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;IAClD,IAAI,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAC5B,GAAG,EAAE,CAAC,IAAI,EACV,GAAG,EAAE,CAAC,KAAK,CACZ,CAAC;QACF,iBAAiB,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/utils/poll.d.ts

@@ -9,7 +9,7 @@
  * this is exactly the drift that let checkpoint-init.ts's own poll loop
  * ship without the SIGINT guard claim-polling.ts already had (PR #658
  * deep review, finding B7). Left unmigrated here: this change's ground
- * rules explicitly scope out the existing top-level `mcpi init` (MCP-I
+ * rules explicitly scope out the existing top-level `kya-os init` (MCP-I
  * agent flow) beyond the parseAsync entrypoint change, so claim-polling.ts
  * keeps its own copy for now; folding it onto this shared helper is a
  * follow-up once that flow is in scope.
@@ -38,6 +38,20 @@ export interface PollOptions {
     intervalMs: number;
     timeoutMs: number;
 }
+/**
+ * Equivalent to `AbortSignal.timeout(ms)`, built from a plain
+ * `setTimeout` instead so a test using `vi.useFakeTimers()` can control
+ * it: Node's native `AbortSignal.timeout` doesn't respect faked timers,
+ * since it isn't implemented in terms of the global `setTimeout` vitest
+ * patches. Exported so any command issuing its own single-shot `fetch`
+ * outside `pollWithDeadline` (e.g. score.ts's submit request) gets the
+ * same fake-timer-safe per-request timeout instead of a second, subtly
+ * different copy of this logic.
+ */
+export declare function timeoutSignal(ms: number): {
+    signal: AbortSignal;
+    cancel: () => void;
+};
 /**
  * Calls `step` roughly every `intervalMs` until it returns `done`/`fatal`
  * or `timeoutMs` elapses on the wall clock. Each attempt gets an

package/dist/utils/poll.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"poll.d.ts","sourceRoot":"","sources":["../../src/utils/poll.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,MAAM,QAAQ,CAAC,CAAC,IAClB;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,GACpB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAC1B;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CAAC;AAEtC,MAAM,MAAM,WAAW,CAAC,CAAC,IACrB;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAC7B;IAAE,OAAO,EAAE,SAAS,CAAA;CAAE,GACtB;IAAE,OAAO,EAAE,aAAa,CAAA;CAAE,GAC1B;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CAAC;AAEzC,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAqBD;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CAAC,CAAC,EACtC,IAAI,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EACnD,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAmCzB"}
+{"version":3,"file":"poll.d.ts","sourceRoot":"","sources":["../../src/utils/poll.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,MAAM,QAAQ,CAAC,CAAC,IAClB;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,GACpB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAC1B;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CAAC;AAEtC,MAAM,MAAM,WAAW,CAAC,CAAC,IACrB;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAC7B;IAAE,OAAO,EAAE,SAAS,CAAA;CAAE,GACtB;IAAE,OAAO,EAAE,aAAa,CAAA;CAAE,GAC1B;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CAAC;AAEzC,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG;IACzC,MAAM,EAAE,WAAW,CAAC;IACpB,MAAM,EAAE,MAAM,IAAI,CAAC;CACpB,CAOA;AAED;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CAAC,CAAC,EACtC,IAAI,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EACnD,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAmCzB"}

package/dist/utils/poll.js

@@ -9,7 +9,7 @@
  * this is exactly the drift that let checkpoint-init.ts's own poll loop
  * ship without the SIGINT guard claim-polling.ts already had (PR #658
  * deep review, finding B7). Left unmigrated here: this change's ground
- * rules explicitly scope out the existing top-level `mcpi init` (MCP-I
+ * rules explicitly scope out the existing top-level `kya-os init` (MCP-I
  * agent flow) beyond the parseAsync entrypoint change, so claim-polling.ts
  * keeps its own copy for now; folding it onto this shared helper is a
  * follow-up once that flow is in scope.
@@ -19,9 +19,12 @@
  * `setTimeout` instead so a test using `vi.useFakeTimers()` can control
  * it: Node's native `AbortSignal.timeout` doesn't respect faked timers,
  * since it isn't implemented in terms of the global `setTimeout` vitest
- * patches.
+ * patches. Exported so any command issuing its own single-shot `fetch`
+ * outside `pollWithDeadline` (e.g. score.ts's submit request) gets the
+ * same fake-timer-safe per-request timeout instead of a second, subtly
+ * different copy of this logic.
  */
-function timeoutSignal(ms) {
+export function timeoutSignal(ms) {
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(new Error("Request timed out")), ms);
     return { signal: controller.signal, cancel: () => clearTimeout(timer) };

package/dist/utils/poll.js.map

@@ -1 +1 @@
-{"version":3,"file":"poll.js","sourceRoot":"","sources":["../../src/utils/poll.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAkBH;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,EAAU;IAI/B,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CACtB,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC,EACtD,EAAE,CACH,CAAC;IACF,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;AAC1E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAmD,EACnD,OAAoB;IAEpB,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IACxC,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,MAAM,eAAe,GAAG,GAAG,EAAE;QAC3B,WAAW,GAAG,IAAI,CAAC;IACrB,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAEtC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;YAC7B,IAAI,WAAW;gBAAE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;YAEnD,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;YACrD,IAAI,MAAmB,CAAC;YACxB,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC;YAC9B,CAAC;oBAAS,CAAC;gBACT,MAAM,EAAE,CAAC;YACX,CAAC;YAED,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM;gBACxB,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;YAClD,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO;gBACzB,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;YAEnD,IAAI,WAAW;gBAAE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;YACnD,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;gBAAE,MAAM,CAAC,0CAA0C;YAE7E,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;QAClE,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAChC,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,cAAc,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IACpD,CAAC;AACH,CAAC"}
+{"version":3,"file":"poll.js","sourceRoot":"","sources":["../../src/utils/poll.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAkBH;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAAC,EAAU;IAItC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CACtB,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC,EACtD,EAAE,CACH,CAAC;IACF,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;AAC1E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAmD,EACnD,OAAoB;IAEpB,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IACxC,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,MAAM,eAAe,GAAG,GAAG,EAAE;QAC3B,WAAW,GAAG,IAAI,CAAC;IACrB,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAEtC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;YAC7B,IAAI,WAAW;gBAAE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;YAEnD,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;YACrD,IAAI,MAAmB,CAAC;YACxB,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC;YAC9B,CAAC;oBAAS,CAAC;gBACT,MAAM,EAAE,CAAC;YACX,CAAC;YAED,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM;gBACxB,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;YAClD,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO;gBACzB,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;YAEnD,IAAI,WAAW;gBAAE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;YACnD,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;gBAAE,MAAM,CAAC,0CAA0C;YAE7E,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;QAClE,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAChC,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,cAAc,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IACpD,CAAC;AACH,CAAC"}

package/dist/utils/register-agent-identity.d.ts

@@ -0,0 +1,67 @@
+import type { RegisterAgentIdentity } from "./agent-profile-stage.js";
+/**
+ * Builds a `RegisterAgentIdentity` seam for `kya-os init`'s agent-profile
+ * stage that mints and registers a genuinely separate identity per profile,
+ * by running the SAME registration path init's own primary identity uses
+ * (`enableMCPIdentityCLI`) -- but inside a throwaway temp directory.
+ *
+ * Why the temp directory: `enableMCPIdentityCLI` hardcodes
+ * `.mcpi/identity.json` relative to `process.cwd()` (see
+ * `@kya-os/mcp-i`'s `IdentityManager`); it has no parameter to point at a
+ * different identity file. Running it a second time in the SAME cwd would
+ * just find the primary agent's identity.json already there and return
+ * that same identity again, not mint a new one. Isolating each call in its
+ * own temp dir is the only way to get a distinct identity out of the public
+ * API without modifying `@kya-os/mcp-i`.
+ *
+ * `process.chdir` is restored in a `finally` no matter what, and the whole
+ * call is awaited sequentially by the profile stage's loop (never run
+ * concurrently with other cwd-sensitive work in this process).
+ */
+/**
+ * The real shape of @kya-os/mcp-i's `enableMCPIdentityCLI`, modeled locally
+ * rather than imported: the dynamic `import("@kya-os/mcp-i")` init.ts uses
+ * exists specifically to survive monorepo CI orderings where that package
+ * isn't built yet, and a static (even type-only) import from it here would
+ * reintroduce that exact dependency at typecheck time. Covers every field
+ * either call site (init.ts's own primary-identity call, and this file's
+ * profile-registration call) actually reads or passes.
+ */
+export interface EnableMCPIdentityCLIResult {
+    identity: {
+        did: string;
+        privateKey: string;
+        publicKey: string;
+        kid: string;
+    };
+    metadata: {
+        isNewIdentity: boolean;
+        claimUrl?: string;
+        agentSlug?: string;
+        agentId?: string;
+        registryUrl: string;
+    };
+}
+export type EnableMCPIdentityCLIFn = (options: {
+    name?: string;
+    description?: string;
+    repository?: string;
+    endpoint?: string;
+    logLevel?: "silent" | "info" | "debug";
+    skipRegistration?: boolean;
+    onProgress?: (event: {
+        stage: string;
+        data?: unknown;
+    }) => void | Promise<void>;
+}) => Promise<EnableMCPIdentityCLIResult>;
+export interface CreateRegisterAgentIdentityOptions {
+    endpoint?: string;
+    /** Required: the real `enableMCPIdentityCLI` from `@kya-os/mcp-i`. */
+    enableMCPIdentityCLIImpl: EnableMCPIdentityCLIFn;
+    cwdImpl?: () => string;
+    chdirImpl?: (dir: string) => void;
+    mkdtempImpl?: (prefix: string) => string;
+    rmImpl?: (path: string) => void;
+}
+export declare function createRegisterAgentIdentity(options: CreateRegisterAgentIdentityOptions): RegisterAgentIdentity;
+//# sourceMappingURL=register-agent-identity.d.ts.map

package/dist/utils/register-agent-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"register-agent-identity.d.ts","sourceRoot":"","sources":["../../src/utils/register-agent-identity.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,qBAAqB,EAAsB,MAAM,0BAA0B,CAAC;AAE1F;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;;;;;GAQG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9E,QAAQ,EAAE;QACR,aAAa,EAAE,OAAO,CAAC;QACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;CACH;AAED,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,EAAE;IAC7C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC;IACvC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjF,KAAK,OAAO,CAAC,0BAA0B,CAAC,CAAC;AAE1C,MAAM,WAAW,kCAAkC;IACjD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sEAAsE;IACtE,wBAAwB,EAAE,sBAAsB,CAAC;IACjD,OAAO,CAAC,EAAE,MAAM,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAClC,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,CAAC;IACzC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACjC;AAED,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,kCAAkC,GAC1C,qBAAqB,CA8BvB"}

package/dist/utils/register-agent-identity.js

@@ -0,0 +1,34 @@
+import { mkdtempSync, rmSync } from "fs";
+import { tmpdir } from "os";
+import { join } from "path";
+export function createRegisterAgentIdentity(options) {
+    const cwdImpl = options.cwdImpl ?? (() => process.cwd());
+    const chdirImpl = options.chdirImpl ?? ((dir) => process.chdir(dir));
+    const mkdtempImpl = options.mkdtempImpl ?? ((prefix) => mkdtempSync(prefix));
+    const rmImpl = options.rmImpl ?? ((path) => rmSync(path, { recursive: true, force: true }));
+    return async ({ name }) => {
+        const originalCwd = cwdImpl();
+        const tempDir = mkdtempImpl(join(tmpdir(), "mcpi-profile-"));
+        try {
+            chdirImpl(tempDir);
+            const result = await options.enableMCPIdentityCLIImpl({
+                name,
+                endpoint: options.endpoint,
+                logLevel: "silent",
+                skipRegistration: false,
+            });
+            return {
+                did: result.identity.did,
+                claimUrl: result.metadata.claimUrl,
+                agentSlug: result.metadata.agentSlug,
+                privateKey: result.identity.privateKey,
+                publicKey: result.identity.publicKey,
+            };
+        }
+        finally {
+            chdirImpl(originalCwd);
+            rmImpl(tempDir);
+        }
+    };
+}
+//# sourceMappingURL=register-agent-identity.js.map

package/dist/utils/register-agent-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"register-agent-identity.js","sourceRoot":"","sources":["../../src/utils/register-agent-identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AAC5B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AA+D5B,MAAM,UAAU,2BAA2B,CACzC,OAA2C;IAE3C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,CAAC,CAAC,GAAW,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7E,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,CAAC,CAAC,MAAc,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;IACrF,MAAM,MAAM,GACV,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAEvF,OAAO,KAAK,EAAE,EAAE,IAAI,EAAE,EAA+B,EAAE;QACrD,MAAM,WAAW,GAAG,OAAO,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,CAAC;QAC7D,IAAI,CAAC;YACH,SAAS,CAAC,OAAO,CAAC,CAAC;YACnB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,wBAAwB,CAAC;gBACpD,IAAI;gBACJ,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,QAAQ,EAAE,QAAQ;gBAClB,gBAAgB,EAAE,KAAK;aACxB,CAAC,CAAC;YACH,OAAO;gBACL,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG;gBACxB,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ;gBAClC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS;gBACpC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU;gBACtC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS;aACrC,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,SAAS,CAAC,WAAW,CAAC,CAAC;YACvB,MAAM,CAAC,OAAO,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/utils/review/did-web-key.d.ts

@@ -0,0 +1,34 @@
+/**
+ * did:web -> raw Ed25519 public key resolution for `kya-os review verify`
+ * (review-loop P9 commit 3).
+ *
+ * Scope v1: `did:web` only — the epic's reviewer DIDs are all
+ * `did:web:knowthat.ai:agents:<slug>`. Reuses the SAME URL mapping and SSRF
+ * defense `dco verify`'s PR-attribution check already established
+ * (`didWebToHttpsUrl`, `checkDocumentHostIsSafe`) rather than re-deriving
+ * either: the host here is exactly as untrusted (wire-supplied, from a
+ * signed verdict's `proof.kid`) as the DID claimed in a PR body is there.
+ *
+ * @module cli/utils/review/did-web-key
+ */
+import { type LookupLike } from "../dco/verify.js";
+export type DidWebKeyFailure = "unsupported-method" | "unresolvable" | "blocked-host" | "no-key";
+export interface DidWebKeyResult {
+    ok: boolean;
+    /** Raw 32-byte Ed25519 public key. Present only when `ok` is true. */
+    raw?: Buffer;
+    reason?: DidWebKeyFailure;
+    detail?: string;
+}
+export type FetchLike = (url: string, init?: {
+    signal?: AbortSignal;
+    redirect?: RequestInit["redirect"];
+}) => Promise<Response>;
+/**
+ * Resolve a `did:web` identity to its raw 32-byte Ed25519 public key by
+ * fetching its DID document. Fail-closed: any host-safety failure, network
+ * error, non-200, invalid JSON, or missing key returns `{ ok: false, ... }`
+ * rather than throwing.
+ */
+export declare function resolveDidWebEd25519Key(did: string, fetchImpl?: FetchLike, lookupImpl?: LookupLike): Promise<DidWebKeyResult>;
+//# sourceMappingURL=did-web-key.d.ts.map

package/dist/utils/review/did-web-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"did-web-key.d.ts","sourceRoot":"","sources":["../../../src/utils/review/did-web-key.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAIL,KAAK,UAAU,EAChB,MAAM,kBAAkB,CAAC;AAE1B,MAAM,MAAM,gBAAgB,GACxB,oBAAoB,GACpB,cAAc,GACd,cAAc,GACd,QAAQ,CAAC;AAEb,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,OAAO,CAAC;IACZ,sEAAsE;IACtE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,SAAS,GAAG,CACtB,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,UAAU,CAAC,CAAA;CAAE,KAChE,OAAO,CAAC,QAAQ,CAAC,CAAC;AA+BvB;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,MAAM,EACX,SAAS,GAAE,SAA2C,EACtD,UAAU,GAAE,UAA0B,GACrC,OAAO,CAAC,eAAe,CAAC,CA4D1B"}

package/dist/utils/review/did-web-key.js

@@ -0,0 +1,104 @@
+/**
+ * did:web -> raw Ed25519 public key resolution for `kya-os review verify`
+ * (review-loop P9 commit 3).
+ *
+ * Scope v1: `did:web` only — the epic's reviewer DIDs are all
+ * `did:web:knowthat.ai:agents:<slug>`. Reuses the SAME URL mapping and SSRF
+ * defense `dco verify`'s PR-attribution check already established
+ * (`didWebToHttpsUrl`, `checkDocumentHostIsSafe`) rather than re-deriving
+ * either: the host here is exactly as untrusted (wire-supplied, from a
+ * signed verdict's `proof.kid`) as the DID claimed in a PR body is there.
+ *
+ * @module cli/utils/review/did-web-key
+ */
+import { didWebToHttpsUrl, checkDocumentHostIsSafe, defaultLookup, } from "../dco/verify.js";
+const RESOLVE_TIMEOUT_MS = 10000;
+/**
+ * Pull the first Ed25519 (OKP) `publicKeyJwk` out of a DID document's
+ * `verificationMethod` array. Mirrors
+ * `packages/compute/src/didcomm/did-web.ts`'s `extractEd25519Jwk` exactly
+ * (same kty/crv/x checks) — compute can't be imported from the CLI (see
+ * this command's constraints), so the ~15-line check is duplicated rather
+ * than shared; keep the two in sync if the JWK shape check ever changes.
+ */
+function extractEd25519Jwk(doc) {
+    if (!doc || typeof doc !== "object")
+        return null;
+    const methods = doc.verificationMethod;
+    if (!Array.isArray(methods))
+        return null;
+    for (const method of methods) {
+        const jwk = method?.publicKeyJwk;
+        if (jwk &&
+            typeof jwk.kty === "string" &&
+            jwk.kty.toUpperCase() === "OKP" &&
+            jwk.crv === "Ed25519" &&
+            typeof jwk.x === "string") {
+            return { x: jwk.x };
+        }
+    }
+    return null;
+}
+/**
+ * Resolve a `did:web` identity to its raw 32-byte Ed25519 public key by
+ * fetching its DID document. Fail-closed: any host-safety failure, network
+ * error, non-200, invalid JSON, or missing key returns `{ ok: false, ... }`
+ * rather than throwing.
+ */
+export async function resolveDidWebEd25519Key(did, fetchImpl = (url, init) => fetch(url, init), lookupImpl = defaultLookup) {
+    const documentUrl = didWebToHttpsUrl(did);
+    if (!documentUrl) {
+        return {
+            ok: false,
+            reason: "unsupported-method",
+            detail: "Only did:web identities can be resolved (v1 scope).",
+        };
+    }
+    const hostCheck = await checkDocumentHostIsSafe(documentUrl, lookupImpl);
+    if (!hostCheck.safe) {
+        return { ok: false, reason: hostCheck.reason, detail: hostCheck.detail };
+    }
+    let response;
+    try {
+        response = await fetchImpl(documentUrl, {
+            signal: AbortSignal.timeout(RESOLVE_TIMEOUT_MS),
+            // A redirect target is unverified — refusing to follow it keeps the
+            // host check above from being bypassable by a 3xx response, same
+            // reasoning as verifyPrAttribution's identical guard.
+            redirect: "manual",
+        });
+    }
+    catch (error) {
+        return {
+            ok: false,
+            reason: "unresolvable",
+            detail: error instanceof Error ? error.message : String(error),
+        };
+    }
+    if (!response.ok) {
+        return {
+            ok: false,
+            reason: "unresolvable",
+            detail: response.type === "opaqueredirect"
+                ? "Server returned a redirect, which is not followed."
+                : `HTTP ${response.status}`,
+        };
+    }
+    let document;
+    try {
+        document = await response.json();
+    }
+    catch {
+        return { ok: false, reason: "unresolvable", detail: "Response was not valid JSON." };
+    }
+    const jwk = extractEd25519Jwk(document);
+    if (!jwk) {
+        return {
+            ok: false,
+            reason: "no-key",
+            detail: "No Ed25519 verification key in DID document.",
+        };
+    }
+    return { ok: true, raw: Buffer.from(jwk.x, "base64url") };
+}
+//# sourceMappingURL=did-web-key.js.map

package/dist/utils/review/did-web-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"did-web-key.js","sourceRoot":"","sources":["../../../src/utils/review/did-web-key.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,aAAa,GAEd,MAAM,kBAAkB,CAAC;AAqB1B,MAAM,kBAAkB,GAAG,KAAM,CAAC;AAElC;;;;;;;GAOG;AACH,SAAS,iBAAiB,CAAC,GAAY;IACrC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,OAAO,GAAI,GAAwC,CAAC,kBAAkB,CAAC;IAC7E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAI,MAAqD,EAAE,YAAY,CAAC;QACjF,IACE,GAAG;YACH,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ;YAC3B,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,KAAK;YAC/B,GAAG,CAAC,GAAG,KAAK,SAAS;YACrB,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ,EACzB,CAAC;YACD,OAAO,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,GAAW,EACX,YAAuB,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,EACtD,aAAyB,aAAa;IAEtC,MAAM,WAAW,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,oBAAoB;YAC5B,MAAM,EAAE,qDAAqD;SAC9D,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,uBAAuB,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACzE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QACpB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;IAC3E,CAAC;IAED,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,SAAS,CAAC,WAAW,EAAE;YACtC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC;YAC/C,oEAAoE;YACpE,iEAAiE;YACjE,sDAAsD;YACtD,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,cAAc;YACtB,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC/D,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,cAAc;YACtB,MAAM,EACJ,QAAQ,CAAC,IAAI,KAAK,gBAAgB;gBAChC,CAAC,CAAC,oDAAoD;gBACtD,CAAC,CAAC,QAAQ,QAAQ,CAAC,MAAM,EAAE;SAChC,CAAC;IACJ,CAAC;IAED,IAAI,QAAiB,CAAC;IACtB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;IACvF,CAAC;IAED,MAAM,GAAG,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,8CAA8C;SACvD,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,CAAC,EAAE,CAAC;AAC5D,CAAC"}

package/dist/utils/review/load-registry.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Reviewer registry loading for `kya-os review verify` (review-loop P9,
+ * sm2 finding: a signature verifying is NOT the same guarantee as "this
+ * signer is a recognized reviewer for this org" — see review.ts's own doc
+ * comment on why this exists and how its absence is surfaced).
+ *
+ * Mirrors `packages/compute/src/didcomm/reviewer-registry.ts`'s resolution
+ * order (`REVIEW_REGISTRY_PATH`, then `REVIEW_REGISTRY_JSON`) and its
+ * "never return a partially valid registry" contract, reimplemented here
+ * rather than imported: that loader lives in `@kya-os/compute`, which the
+ * CLI must never import (compute is PID 1 in Fly workers; the CLI is a
+ * published binary — same boundary `did-web-key.ts`'s doc comment notes).
+ * `ReviewerRegistrySchema` itself IS shared, from `@kya-os/contracts/review`,
+ * a pure Zod schema with no compute dependency.
+ *
+ * @module cli/utils/review/load-registry
+ */
+import { type ReviewerRegistry } from "@kya-os/contracts/review";
+export interface LoadRegistryResult {
+    /** Present when a registry was found and validated. */
+    registry?: ReviewerRegistry;
+    /** Present when a registry source WAS configured but failed to load or validate — distinct from "none configured" (undefined `registry` with no `error` either). */
+    error?: string;
+}
+/**
+ * Resolution order: an explicit path (the `--registry` flag), then
+ * `REVIEW_REGISTRY_PATH`, then `REVIEW_REGISTRY_JSON`. Returns `{}` (both
+ * fields undefined) when nothing is configured — the command treats that
+ * as "membership checking unavailable," not an error, since it wasn't part
+ * of this command's original required scope.
+ */
+export declare function loadReviewerRegistryForVerify(explicitPath?: string): LoadRegistryResult;
+//# sourceMappingURL=load-registry.d.ts.map

package/dist/utils/review/load-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"load-registry.d.ts","sourceRoot":"","sources":["../../../src/utils/review/load-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,EAA0B,KAAK,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAEzF,MAAM,WAAW,kBAAkB;IACjC,uDAAuD;IACvD,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,oKAAoK;IACpK,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,kBAAkB,CAkBvF"}

package/dist/utils/review/load-registry.js

@@ -0,0 +1,62 @@
+/**
+ * Reviewer registry loading for `kya-os review verify` (review-loop P9,
+ * sm2 finding: a signature verifying is NOT the same guarantee as "this
+ * signer is a recognized reviewer for this org" — see review.ts's own doc
+ * comment on why this exists and how its absence is surfaced).
+ *
+ * Mirrors `packages/compute/src/didcomm/reviewer-registry.ts`'s resolution
+ * order (`REVIEW_REGISTRY_PATH`, then `REVIEW_REGISTRY_JSON`) and its
+ * "never return a partially valid registry" contract, reimplemented here
+ * rather than imported: that loader lives in `@kya-os/compute`, which the
+ * CLI must never import (compute is PID 1 in Fly workers; the CLI is a
+ * published binary — same boundary `did-web-key.ts`'s doc comment notes).
+ * `ReviewerRegistrySchema` itself IS shared, from `@kya-os/contracts/review`,
+ * a pure Zod schema with no compute dependency.
+ *
+ * @module cli/utils/review/load-registry
+ */
+import { readFileSync } from "node:fs";
+import { ReviewerRegistrySchema } from "@kya-os/contracts/review";
+/**
+ * Resolution order: an explicit path (the `--registry` flag), then
+ * `REVIEW_REGISTRY_PATH`, then `REVIEW_REGISTRY_JSON`. Returns `{}` (both
+ * fields undefined) when nothing is configured — the command treats that
+ * as "membership checking unavailable," not an error, since it wasn't part
+ * of this command's original required scope.
+ */
+export function loadReviewerRegistryForVerify(explicitPath) {
+    const path = explicitPath ?? process.env.REVIEW_REGISTRY_PATH;
+    if (path) {
+        let raw;
+        try {
+            raw = readFileSync(path, "utf-8");
+        }
+        catch (error) {
+            return { error: `failed to read reviewer registry at "${path}": ${describeError(error)}` };
+        }
+        return parseRegistry(raw, `file "${path}"`);
+    }
+    const inline = process.env.REVIEW_REGISTRY_JSON;
+    if (inline) {
+        return parseRegistry(inline, "REVIEW_REGISTRY_JSON");
+    }
+    return {};
+}
+function parseRegistry(raw, sourceLabel) {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (error) {
+        return { error: `failed to parse reviewer registry JSON from ${sourceLabel}: ${describeError(error)}` };
+    }
+    const result = ReviewerRegistrySchema.safeParse(parsed);
+    if (!result.success) {
+        return { error: `invalid reviewer registry from ${sourceLabel}: ${result.error.message}` };
+    }
+    return { registry: result.data };
+}
+function describeError(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+//# sourceMappingURL=load-registry.js.map

package/dist/utils/review/load-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"load-registry.js","sourceRoot":"","sources":["../../../src/utils/review/load-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,sBAAsB,EAAyB,MAAM,0BAA0B,CAAC;AASzF;;;;;;GAMG;AACH,MAAM,UAAU,6BAA6B,CAAC,YAAqB;IACjE,MAAM,IAAI,GAAG,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IAC9D,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,EAAE,KAAK,EAAE,wCAAwC,IAAI,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QAC7F,CAAC;QACD,OAAO,aAAa,CAAC,GAAG,EAAE,SAAS,IAAI,GAAG,CAAC,CAAC;IAC9C,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IAChD,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,aAAa,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IACvD,CAAC;IAED,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,aAAa,CAAC,GAAW,EAAE,WAAmB;IACrD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,KAAK,EAAE,+CAA+C,WAAW,KAAK,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;IAC1G,CAAC;IACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,EAAE,KAAK,EAAE,kCAAkC,WAAW,KAAK,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;IAC7F,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AACnC,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC"}

package/dist/utils/review/verdict-verify.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Local review-verdict proof verification for `kya-os review verify`
+ * (review-loop P9 commit 3).
+ *
+ * Seam completed (was TEMPORARY pending review-loop P13's commit 0 / PR
+ * #701, now merged): delegates the signature check to
+ * `@kya-os/contracts/review/verify`'s `verifyReviewVerdictProof(body,
+ * publicKeyRaw)` (the same raw-bytes shape `resolveDidWebEd25519Key`,
+ * did-web-key.ts, already produces) rather than reimplementing the
+ * SPKI-wrap Ed25519 verify locally. `verifyLocalReviewVerdictProof` stays
+ * as a thin wrapper -- not deleted outright -- because contracts' function
+ * returns a plain boolean with no way to distinguish a digest mismatch
+ * from a signature failure, and `commands/review.ts` reports those as two
+ * different human-readable reasons; this wrapper does the digest
+ * pre-check itself (matching compute's `review.ts`'s identical seam) to
+ * keep that distinction, then delegates for the signature half.
+ *
+ * @module cli/utils/review/verdict-verify
+ */
+import { type ReviewVerdictBody } from "@kya-os/contracts/review";
+export type VerdictProofFailureReason = "digest" | "signature";
+export interface VerdictProofResult {
+    valid: boolean;
+    reason?: VerdictProofFailureReason;
+}
+/**
+ * Verify a review verdict's proof against a RAW Ed25519 public key: that
+ * `findingsDigest` matches `findings`, and that `proof.signature` was
+ * produced by the private half of `publicKeyRaw`. Fail-closed — any
+ * malformed input or key-import failure returns `{ valid: false, reason:
+ * "signature" }` rather than throwing (contracts' `verifyReviewVerdictProof`
+ * is itself fail-closed, never throws).
+ */
+export declare function verifyLocalReviewVerdictProof(body: ReviewVerdictBody, publicKeyRaw: Buffer): VerdictProofResult;
+/**
+ * Extract every fenced ```kya-os-signed-verdict block's raw contents from a
+ * review or comment body. Returns the raw text (not yet parsed/validated) —
+ * callers JSON.parse and `ReviewVerdictBodySchema.safeParse` each block
+ * themselves, so a malformed block reports as one INVALID row rather than
+ * aborting extraction of the others.
+ */
+export declare function extractSignedVerdictBlocks(markdown: string): string[];
+//# sourceMappingURL=verdict-verify.d.ts.map

package/dist/utils/review/verdict-verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verdict-verify.d.ts","sourceRoot":"","sources":["../../../src/utils/review/verdict-verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,EAEL,KAAK,iBAAiB,EACvB,MAAM,0BAA0B,CAAC;AAElC,MAAM,MAAM,yBAAyB,GAAG,QAAQ,GAAG,WAAW,CAAC;AAE/D,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,yBAAyB,CAAC;CACpC;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,iBAAiB,EACvB,YAAY,EAAE,MAAM,GACnB,kBAAkB,CAOpB;AAID;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAMrE"}

package/dist/utils/review/verdict-verify.js

@@ -0,0 +1,53 @@
+/**
+ * Local review-verdict proof verification for `kya-os review verify`
+ * (review-loop P9 commit 3).
+ *
+ * Seam completed (was TEMPORARY pending review-loop P13's commit 0 / PR
+ * #701, now merged): delegates the signature check to
+ * `@kya-os/contracts/review/verify`'s `verifyReviewVerdictProof(body,
+ * publicKeyRaw)` (the same raw-bytes shape `resolveDidWebEd25519Key`,
+ * did-web-key.ts, already produces) rather than reimplementing the
+ * SPKI-wrap Ed25519 verify locally. `verifyLocalReviewVerdictProof` stays
+ * as a thin wrapper -- not deleted outright -- because contracts' function
+ * returns a plain boolean with no way to distinguish a digest mismatch
+ * from a signature failure, and `commands/review.ts` reports those as two
+ * different human-readable reasons; this wrapper does the digest
+ * pre-check itself (matching compute's `review.ts`'s identical seam) to
+ * keep that distinction, then delegates for the signature half.
+ *
+ * @module cli/utils/review/verdict-verify
+ */
+import { verifyReviewVerdictProof } from "@kya-os/contracts/review/verify";
+import { computeFindingsDigest, } from "@kya-os/contracts/review";
+/**
+ * Verify a review verdict's proof against a RAW Ed25519 public key: that
+ * `findingsDigest` matches `findings`, and that `proof.signature` was
+ * produced by the private half of `publicKeyRaw`. Fail-closed — any
+ * malformed input or key-import failure returns `{ valid: false, reason:
+ * "signature" }` rather than throwing (contracts' `verifyReviewVerdictProof`
+ * is itself fail-closed, never throws).
+ */
+export function verifyLocalReviewVerdictProof(body, publicKeyRaw) {
+    if (computeFindingsDigest(body.findings) !== body.findingsDigest) {
+        return { valid: false, reason: "digest" };
+    }
+    return verifyReviewVerdictProof(body, publicKeyRaw)
+        ? { valid: true }
+        : { valid: false, reason: "signature" };
+}
+const SIGNED_VERDICT_FENCE = /```kya-os-signed-verdict\n([\s\S]*?)\n```/g;
+/**
+ * Extract every fenced ```kya-os-signed-verdict block's raw contents from a
+ * review or comment body. Returns the raw text (not yet parsed/validated) —
+ * callers JSON.parse and `ReviewVerdictBodySchema.safeParse` each block
+ * themselves, so a malformed block reports as one INVALID row rather than
+ * aborting extraction of the others.
+ */
+export function extractSignedVerdictBlocks(markdown) {
+    const blocks = [];
+    for (const match of markdown.matchAll(SIGNED_VERDICT_FENCE)) {
+        blocks.push(match[1]);
+    }
+    return blocks;
+}
+//# sourceMappingURL=verdict-verify.js.map