@kya-os/cli 1.8.1 → 2.0.0

package/dist/utils/dco/verify.js

@@ -0,0 +1,383 @@
+import { lookup as dnsLookup } from "node:dns/promises";
+import { isValidDid } from "./claude-config.js";
+const defaultLookup = async (hostname) => {
+    const records = await dnsLookup(hostname, { all: true });
+    return records.map((record) => record.address);
+};
+/**
+ * The document host is chosen by the DID, which comes from a PR body we do
+ * not control. Without a deadline a hostile or merely unreachable host hangs
+ * the command for as long as it cares to hold the socket open — tolerable
+ * when a human can interrupt it, not when this runs unattended in CI.
+ */
+export const RESOLVE_TIMEOUT_MS = 10000;
+/**
+ * Captures the whole remainder of the line, not the first whitespace-free
+ * run. Truncating at whitespace would silently reduce a malformed value to
+ * whichever prefix happens to parse: `Agent DID: did:web:knowthat.ai junk`
+ * would become `did:web:knowthat.ai`, resolve the registry's own root
+ * document, match its own `id`, and report a forged line as verified.
+ */
+const AGENT_DID_LINE = /Agent DID:[^\S\n\r]*([^\n\r]*)/g;
+/**
+ * Pull the claimed DID out of a PR body.
+ *
+ * Returns null when the body claims two *different* DIDs. Taking the first
+ * match would mean an appended line could never change the verdict, but it
+ * would also mean a forged line prepended above the real one silently wins.
+ * Ambiguous attribution is a failure, not a tie to be broken.
+ */
+export function extractAgentDid(prBody) {
+    const claimed = new Set();
+    for (const match of prBody.matchAll(AGENT_DID_LINE)) {
+        // The managed block wraps the line in a code span, so a trailing
+        // backtick is expected punctuation rather than part of the identifier.
+        const candidate = match[1].replace(/`+\s*$/, "").trim();
+        if (isValidDid(candidate)) {
+            claimed.add(candidate);
+        }
+    }
+    if (claimed.size !== 1)
+        return null;
+    return [...claimed][0];
+}
+/**
+ * Whether a piece of text already carries an `Agent DID:` attribution line
+ * that `extractAgentDid` would pick up. Uses the exact same line pattern and
+ * backtick/whitespace handling, so a caller (notably `dco dispatch`, which
+ * appends its own authoritative line) can reject a description that would
+ * otherwise put a second, conflicting DID into the PR body. Matches the
+ * managed CLAUDE.md block's backticked, mid-line form, not just a line-start
+ * one.
+ */
+export function hasAgentDidClaim(text) {
+    for (const match of text.matchAll(AGENT_DID_LINE)) {
+        const candidate = match[1].replace(/`+\s*$/, "").trim();
+        if (isValidDid(candidate)) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Map a `did:web` to the HTTPS URL its document must be served from, per the
+ * did:web method spec: the identifier's colon-separated segments *are* the
+ * path, and a bare domain resolves under `/.well-known/`.
+ *
+ * Segments are validated AFTER percent-decoding. `DID_PATTERN` permits `%`,
+ * so a crafted `%2F` would otherwise smuggle a path separator through and
+ * point resolution at an attacker-chosen URL on the same host.
+ */
+export function didWebToHttpsUrl(did) {
+    const prefix = "did:web:";
+    if (!did.startsWith(prefix))
+        return null;
+    const segments = did.slice(prefix.length).split(":");
+    if (segments.length === 0 || segments.some((segment) => segment === "")) {
+        return null;
+    }
+    const decoded = [];
+    for (const segment of segments) {
+        try {
+            decoded.push(decodeURIComponent(segment));
+        }
+        catch {
+            return null;
+        }
+    }
+    const [host, ...path] = decoded;
+    // Host may carry a port (encoded as %3A in the DID) but nothing else.
+    if (!/^[A-Za-z0-9.-]+(:\d+)?$/.test(host))
+        return null;
+    if (path.some((segment) => segment === "" ||
+        segment === "." ||
+        segment === ".." ||
+        /[/\\?#]/.test(segment))) {
+        return null;
+    }
+    const suffix = path.length
+        ? `${path.join("/")}/did.json`
+        : ".well-known/did.json";
+    return `https://${host}/${suffix}`;
+}
+/**
+ * IPv4 ranges that must never be treated as a resolvable did:web host:
+ * loopback, all three RFC1918 private blocks, link-local (which is also
+ * where every major cloud's instance-metadata service lives, at
+ * 169.254.169.254), and the remaining reserved/special-use blocks that have
+ * no business serving a public DID document.
+ */
+const BLOCKED_IPV4_RANGES = [
+    ["0.0.0.0", 8], // "this network"
+    ["10.0.0.0", 8], // RFC1918 private
+    ["100.64.0.0", 10], // shared address space (CGNAT)
+    ["127.0.0.0", 8], // loopback
+    ["169.254.0.0", 16], // link-local, incl. cloud metadata (169.254.169.254)
+    ["172.16.0.0", 12], // RFC1918 private
+    ["192.0.0.0", 24], // IETF protocol assignments
+    ["192.0.2.0", 24], // documentation (TEST-NET-1)
+    ["192.168.0.0", 16], // RFC1918 private
+    ["198.18.0.0", 15], // benchmarking
+    ["198.51.100.0", 24], // documentation (TEST-NET-2)
+    ["203.0.113.0", 24], // documentation (TEST-NET-3)
+    ["224.0.0.0", 4], // multicast
+    ["240.0.0.0", 4], // reserved, incl. the 255.255.255.255 broadcast address
+];
+function ipv4ToInt(ip) {
+    const match = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(ip);
+    if (!match)
+        return null;
+    const octets = match.slice(1, 5).map(Number);
+    if (octets.some((octet) => octet > 255))
+        return null;
+    return (((octets[0] << 24) | (octets[1] << 16) | (octets[2] << 8) | octets[3]) >>>
+        0);
+}
+function isBlockedIpv4(ip) {
+    const value = ipv4ToInt(ip);
+    if (value === null)
+        return false;
+    return BLOCKED_IPV4_RANGES.some(([base, prefix]) => {
+        const mask = prefix === 0 ? 0 : (0xffffffff << (32 - prefix)) >>> 0;
+        return (value & mask) === (ipv4ToInt(base) & mask);
+    });
+}
+/**
+ * The IPv6 counterparts of the ranges above: loopback, unspecified,
+ * link-local (`fe80::/10`), and unique-local (`fc00::/7`, the IPv6 analogue
+ * of RFC1918). A resolver can hand back either family, so an address that
+ * only checked IPv4 would wave an AAAA-only loopback/private record through.
+ */
+function isBlockedIpv6(ip) {
+    const lower = ip.toLowerCase();
+    // A v4-mapped/v4-compatible address ends in a dotted IPv4 literal (e.g.
+    // "::ffff:127.0.0.1") — defer to the IPv4 check on that embedded address.
+    const tail = lower.slice(lower.lastIndexOf(":") + 1);
+    if (tail.includes(".") && isBlockedIpv4(tail))
+        return true;
+    if (lower === "::1" || lower === "::")
+        return true;
+    const firstGroup = lower.split(":")[0];
+    const firstHextet = firstGroup === "" ? NaN : parseInt(firstGroup, 16);
+    if (Number.isNaN(firstHextet))
+        return false;
+    if (firstHextet >= 0xfe80 && firstHextet <= 0xfebf)
+        return true; // link-local
+    if (firstHextet >= 0xfc00 && firstHextet <= 0xfdff)
+        return true; // unique-local
+    return false;
+}
+function isBlockedAddress(ip) {
+    return ip.includes(":") ? isBlockedIpv6(ip) : isBlockedIpv4(ip);
+}
+/**
+ * Cheap, synchronous first line of defense against the exact literals an
+ * attacker would put directly in a did:web host: `localhost`, or an IPv4
+ * literal in a private, loopback, link-local, or otherwise reserved range.
+ *
+ * Takes the hostname `new URL()` produces, not the raw did:web segment.
+ * `URL` canonicalizes decimal/hex/octal IPv4 shorthand (`2130706433` and
+ * `0x7f000001` both become `127.0.0.1`) before `fetch` ever sees it, so
+ * checking the pre-parse segment would miss exactly the encodings an
+ * attacker would reach for to slip past a naive dotted-quad check. The
+ * trailing dot is stripped first for the same reason: `new URL()` preserves
+ * a root-zone dot (`"localhost."` stays `"localhost."`), and DNS treats it
+ * as identical to `"localhost"` — an unstripped compare would let that
+ * single character walk straight past an exact-match or `endsWith` check.
+ *
+ * This is a fast-path, not the actual guarantee: it only catches literals,
+ * so it cannot see a normal-looking hostname whose A/AAAA record happens to
+ * point at an internal address. `hostResolvesToBlockedAddress` below is
+ * what actually closes that gap, by checking where the name resolves to
+ * rather than how it's spelled.
+ */
+export function isBlockedResolutionHost(hostname) {
+    const lower = hostname.toLowerCase().replace(/\.$/, "");
+    if (lower === "localhost" || lower.endsWith(".localhost"))
+        return true;
+    return isBlockedAddress(lower);
+}
+/**
+ * The actual guarantee `isBlockedResolutionHost` can't provide on its own:
+ * resolve the hostname and check every address it answers to, not just
+ * whether the hostname string itself looks like one of the blocked
+ * literals. A domain an attacker controls can point an A/AAAA record at
+ * 169.254.169.254 (or loopback, or an RFC1918 address) just as easily as a
+ * did:web host can spell the address out directly — DNS is the attacker's
+ * to shape here just as much as the PR body text is, since the DID names
+ * whatever host they choose.
+ *
+ * Deliberately does not catch a lookup failure: that is "no evidence
+ * either way", the same as a failed fetch, and the caller already has a
+ * reason for that (`unresolvable`) that this must not collide with —
+ * mislabeling a plain NXDOMAIN as "blocked-host" would tell the CLI's user
+ * they hit a private address when they actually just mistyped a domain.
+ */
+export async function hostResolvesToBlockedAddress(hostname, lookupImpl = defaultLookup) {
+    const addresses = await lookupImpl(hostname);
+    return addresses.some(isBlockedAddress);
+}
+/**
+ * Everything that has to be true about `documentUrl`'s host before it is
+ * worth spending a request on: it must parse, it must not be one of the
+ * literals `isBlockedResolutionHost` recognizes, and it must not resolve to
+ * one either. Pulled out on its own so `verifyPrAttribution` reads as one
+ * linear pipeline instead of three nested guard clauses doing the same kind
+ * of check.
+ */
+async function checkDocumentHostIsSafe(documentUrl, lookupImpl) {
+    let hostname;
+    try {
+        hostname = new URL(documentUrl).hostname;
+    }
+    catch {
+        return {
+            safe: false,
+            reason: "unresolvable",
+            detail: "The resolved document URL was invalid.",
+        };
+    }
+    if (isBlockedResolutionHost(hostname)) {
+        return {
+            safe: false,
+            reason: "blocked-host",
+            detail: "Refusing to resolve a private, loopback, link-local, or metadata address.",
+        };
+    }
+    let blocked;
+    try {
+        blocked = await hostResolvesToBlockedAddress(hostname, lookupImpl);
+    }
+    catch (error) {
+        // Same reasoning as a failed fetch: no evidence either way, so no pass.
+        return {
+            safe: false,
+            reason: "unresolvable",
+            detail: error instanceof Error ? error.message : String(error),
+        };
+    }
+    if (blocked) {
+        return {
+            safe: false,
+            reason: "blocked-host",
+            detail: "The claimed DID resolves to a private, loopback, link-local, or metadata address.",
+        };
+    }
+    return { safe: true };
+}
+function readServiceEndpoint(document) {
+    if (typeof document !== "object" || document === null)
+        return undefined;
+    const service = document.service;
+    if (!Array.isArray(service))
+        return undefined;
+    for (const entry of service) {
+        if (typeof entry !== "object" || entry === null)
+            continue;
+        const endpoint = entry.serviceEndpoint;
+        if (typeof endpoint === "string" && endpoint.length > 0)
+            return endpoint;
+    }
+    return undefined;
+}
+/**
+ * Resolve the DID claimed by a PR body and confirm the document describes
+ * that same DID.
+ */
+export async function verifyPrAttribution(prBody, fetchImpl = (url, init) => fetch(url, init), lookupImpl = defaultLookup) {
+    const did = extractAgentDid(prBody);
+    if (!did)
+        return { ok: false, reason: "no-did" };
+    const documentUrl = didWebToHttpsUrl(did);
+    if (!documentUrl) {
+        return {
+            ok: false,
+            did,
+            reason: "unsupported-method",
+            detail: "Only did:web identities can be resolved over HTTPS.",
+        };
+    }
+    // The document host came from a PR body we do not control, so it is
+    // checked — both how it's spelled and where it actually resolves — before
+    // we ever make a request to it. Skipping this would let an IP literal, or
+    // a normal-looking domain with an A/AAAA record pointing at one, reach a
+    // loopback, private, link-local, or cloud-metadata address — an SSRF that
+    // a hostile PR description can trigger unattended in CI.
+    const hostCheck = await checkDocumentHostIsSafe(documentUrl, lookupImpl);
+    if (!hostCheck.safe) {
+        return {
+            ok: false,
+            did,
+            documentUrl,
+            reason: hostCheck.reason,
+            detail: hostCheck.detail,
+        };
+    }
+    let response;
+    try {
+        response = await fetchImpl(documentUrl, {
+            signal: AbortSignal.timeout(RESOLVE_TIMEOUT_MS),
+            // A redirect target is unverified: it could bounce to an internal
+            // address the check above never saw. Refusing to follow it, rather
+            // than trusting `fetch`'s default of following automatically, keeps
+            // this host check from being bypassable by a 3xx response.
+            redirect: "manual",
+        });
+    }
+    catch (error) {
+        // A transport failure is indistinguishable from a missing document as far
+        // as trust goes: neither produced evidence, so neither may pass.
+        return {
+            ok: false,
+            did,
+            documentUrl,
+            reason: "unresolvable",
+            detail: error instanceof Error ? error.message : String(error),
+        };
+    }
+    if (!response.ok) {
+        return {
+            ok: false,
+            did,
+            documentUrl,
+            reason: "unresolvable",
+            detail: response.type === "opaqueredirect"
+                ? "Server returned a redirect, which is not followed."
+                : `HTTP ${response.status}`,
+        };
+    }
+    let document;
+    try {
+        document = await response.json();
+    }
+    catch {
+        return {
+            ok: false,
+            did,
+            documentUrl,
+            reason: "unresolvable",
+            detail: "Response was not valid JSON.",
+        };
+    }
+    const resolvedId = typeof document === "object" && document !== null
+        ? document.id
+        : undefined;
+    // A document that resolves but names a different subject proves nothing
+    // about the claimed identity.
+    if (resolvedId !== did) {
+        return {
+            ok: false,
+            did,
+            documentUrl,
+            reason: "did-mismatch",
+            detail: `Document describes ${typeof resolvedId === "string" ? resolvedId : "no DID"}.`,
+        };
+    }
+    return {
+        ok: true,
+        did,
+        documentUrl,
+        agentUrl: readServiceEndpoint(document),
+    };
+}
+//# sourceMappingURL=verify.js.map

package/dist/utils/dco/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../../src/utils/dco/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AA6ChD,MAAM,aAAa,GAAe,KAAK,EAAE,QAAQ,EAAE,EAAE;IACnD,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACjD,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAM,CAAC;AAEzC;;;;;;GAMG;AACH,MAAM,cAAc,GAAG,iCAAiC,CAAC;AAEzD;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACpD,iEAAiE;QACjE,uEAAuE;QACvE,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACxD,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1B,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;AACzB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QAClD,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACxD,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,MAAM,MAAM,GAAG,UAAU,CAAC;IAC1B,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAEzC,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACrD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,EAAE,CAAC,EAAE,CAAC;QACxE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC;IAChC,sEAAsE;IACtE,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,IACE,IAAI,CAAC,IAAI,CACP,CAAC,OAAO,EAAE,EAAE,CACV,OAAO,KAAK,EAAE;QACd,OAAO,KAAK,GAAG;QACf,OAAO,KAAK,IAAI;QAChB,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAC1B,EACD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM;QACxB,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW;QAC9B,CAAC,CAAC,sBAAsB,CAAC;IAC3B,OAAO,WAAW,IAAI,IAAI,MAAM,EAAE,CAAC;AACrC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,mBAAmB,GAA6C;IACpE,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,iBAAiB;IACjC,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,kBAAkB;IACnC,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,+BAA+B;IACnD,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,WAAW;IAC7B,CAAC,aAAa,EAAE,EAAE,CAAC,EAAE,qDAAqD;IAC1E,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,kBAAkB;IACtC,CAAC,WAAW,EAAE,EAAE,CAAC,EAAE,4BAA4B;IAC/C,CAAC,WAAW,EAAE,EAAE,CAAC,EAAE,6BAA6B;IAChD,CAAC,aAAa,EAAE,EAAE,CAAC,EAAE,kBAAkB;IACvC,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,eAAe;IACnC,CAAC,cAAc,EAAE,EAAE,CAAC,EAAE,6BAA6B;IACnD,CAAC,aAAa,EAAE,EAAE,CAAC,EAAE,6BAA6B;IAClD,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,YAAY;IAC9B,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,wDAAwD;CAC3E,CAAC;AAEF,SAAS,SAAS,CAAC,EAAU;IAC3B,MAAM,KAAK,GAAG,8CAA8C,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtE,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7C,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,OAAO,CACL,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACtE,CAAC,CACF,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,EAAU;IAC/B,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;IAC5B,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACjC,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE;QACjD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC;QACpE,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAE,GAAG,IAAI,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,EAAU;IAC/B,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;IAE/B,wEAAwE;IACxE,0EAA0E;IAC1E,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAE3D,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAEnD,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACvC,MAAM,WAAW,GAAG,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACvE,IAAI,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,WAAW,IAAI,MAAM,IAAI,WAAW,IAAI,MAAM;QAAE,OAAO,IAAI,CAAC,CAAC,aAAa;IAC9E,IAAI,WAAW,IAAI,MAAM,IAAI,WAAW,IAAI,MAAM;QAAE,OAAO,IAAI,CAAC,CAAC,eAAe;IAChF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,gBAAgB,CAAC,EAAU;IAClC,OAAO,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,uBAAuB,CAAC,QAAgB;IACtD,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACxD,IAAI,KAAK,KAAK,WAAW,IAAI,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IACvE,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,QAAgB,EAChB,aAAyB,aAAa;IAEtC,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC7C,OAAO,SAAS,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;AAC1C,CAAC;AAMD;;;;;;;GAOG;AACH,KAAK,UAAU,uBAAuB,CACpC,WAAmB,EACnB,UAAsB;IAEtB,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,cAAc;YACtB,MAAM,EAAE,wCAAwC;SACjD,CAAC;IACJ,CAAC;IAED,IAAI,uBAAuB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtC,OAAO;YACL,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,cAAc;YACtB,MAAM,EACJ,2EAA2E;SAC9E,CAAC;IACJ,CAAC;IAED,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,4BAA4B,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACrE,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,wEAAwE;QACxE,OAAO;YACL,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,cAAc;YACtB,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC/D,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO;YACL,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,cAAc;YACtB,MAAM,EACJ,mFAAmF;SACtF,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACxB,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAiB;IAC5C,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACxE,MAAM,OAAO,GAAI,QAAkC,CAAC,OAAO,CAAC;IAC5D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9C,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS;QAC1D,MAAM,QAAQ,GAAI,KAAuC,CAAC,eAAe,CAAC;QAC1E,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,QAAQ,CAAC;IAC3E,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAc,EACd,YAAuB,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,EACtD,aAAyB,aAAa;IAEtC,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAEjD,MAAM,WAAW,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,GAAG;YACH,MAAM,EAAE,oBAAoB;YAC5B,MAAM,EAAE,qDAAqD;SAC9D,CAAC;IACJ,CAAC;IAED,oEAAoE;IACpE,0EAA0E;IAC1E,0EAA0E;IAC1E,yEAAyE;IACzE,0EAA0E;IAC1E,yDAAyD;IACzD,MAAM,SAAS,GAAG,MAAM,uBAAuB,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACzE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QACpB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,GAAG;YACH,WAAW;YACX,MAAM,EAAE,SAAS,CAAC,MAAM;YACxB,MAAM,EAAE,SAAS,CAAC,MAAM;SACzB,CAAC;IACJ,CAAC;IAED,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,SAAS,CAAC,WAAW,EAAE;YACtC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC;YAC/C,kEAAkE;YAClE,mEAAmE;YACnE,oEAAoE;YACpE,2DAA2D;YAC3D,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,0EAA0E;QAC1E,iEAAiE;QACjE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,GAAG;YACH,WAAW;YACX,MAAM,EAAE,cAAc;YACtB,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC/D,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,GAAG;YACH,WAAW;YACX,MAAM,EAAE,cAAc;YACtB,MAAM,EACJ,QAAQ,CAAC,IAAI,KAAK,gBAAgB;gBAChC,CAAC,CAAC,oDAAoD;gBACtD,CAAC,CAAC,QAAQ,QAAQ,CAAC,MAAM,EAAE;SAChC,CAAC;IACJ,CAAC;IAED,IAAI,QAAiB,CAAC;IACtB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,EAAE,EAAE,KAAK;YACT,GAAG;YACH,WAAW;YACX,MAAM,EAAE,cAAc;YACtB,MAAM,EAAE,8BAA8B;SACvC,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GACd,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI;QAC/C,CAAC,CAAE,QAA6B,CAAC,EAAE;QACnC,CAAC,CAAC,SAAS,CAAC;IAEhB,wEAAwE;IACxE,8BAA8B;IAC9B,IAAI,UAAU,KAAK,GAAG,EAAE,CAAC;QACvB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,GAAG;YACH,WAAW;YACX,MAAM,EAAE,cAAc;YACtB,MAAM,EAAE,sBACN,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAChD,GAAG;SACJ,CAAC;IACJ,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,GAAG;QACH,WAAW;QACX,QAAQ,EAAE,mBAAmB,CAAC,QAAQ,CAAC;KACxC,CAAC;AACJ,CAAC"}

package/dist/utils/gitignore.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Adds `entry` to .gitignore if no existing pattern already covers it,
+ * including a trailing-`*` wildcard pattern (e.g. `.env*`, create-next-app's
+ * own default), the same glob EnvManager.checkGitignore() already honors, so
+ * this doesn't append a redundant, already-covered line.
+ *
+ * Shared by every command that writes a credential-bearing path into a
+ * project directory it doesn't fully control (`.env.local`, `.checkpoint/`,
+ * `.mcpi/`). Neither write is safe to leave ungitignored: a repo whose
+ * `.gitignore` doesn't already cover it (hand-rolled apps, a pruned/custom
+ * .gitignore, a repo that was never scaffolded by this CLI) would otherwise
+ * let `git add .` stage a real credential straight into history. Callers
+ * should call this BEFORE writing the secret, not after, so there's no
+ * window where the file exists ungitignored.
+ */
+export declare function ensureGitignored(projectRoot: string, entry: string, label: string): void;
+//# sourceMappingURL=gitignore.d.ts.map

package/dist/utils/gitignore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitignore.d.ts","sourceRoot":"","sources":["../../src/utils/gitignore.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,GACZ,IAAI,CAwBN"}

package/dist/utils/gitignore.js

@@ -0,0 +1,40 @@
+import { existsSync, readFileSync, writeFileSync } from "fs";
+import { join } from "path";
+/**
+ * Adds `entry` to .gitignore if no existing pattern already covers it,
+ * including a trailing-`*` wildcard pattern (e.g. `.env*`, create-next-app's
+ * own default), the same glob EnvManager.checkGitignore() already honors, so
+ * this doesn't append a redundant, already-covered line.
+ *
+ * Shared by every command that writes a credential-bearing path into a
+ * project directory it doesn't fully control (`.env.local`, `.checkpoint/`,
+ * `.mcpi/`). Neither write is safe to leave ungitignored: a repo whose
+ * `.gitignore` doesn't already cover it (hand-rolled apps, a pruned/custom
+ * .gitignore, a repo that was never scaffolded by this CLI) would otherwise
+ * let `git add .` stage a real credential straight into history. Callers
+ * should call this BEFORE writing the secret, not after, so there's no
+ * window where the file exists ungitignored.
+ */
+export function ensureGitignored(projectRoot, entry, label) {
+    const gitignorePath = join(projectRoot, ".gitignore");
+    const bare = entry.replace(/\/$/, "");
+    let content = existsSync(gitignorePath)
+        ? readFileSync(gitignorePath, "utf-8")
+        : "";
+    const alreadyIgnored = content
+        .split("\n")
+        .map((line) => line.trim())
+        .filter((line) => line && !line.startsWith("#"))
+        .some((line) => line === entry ||
+        line === bare ||
+        line === `/${bare}` ||
+        line === `/${entry}` ||
+        (line.endsWith("*") && bare.startsWith(line.slice(0, -1))));
+    if (alreadyIgnored)
+        return;
+    if (content && !content.endsWith("\n"))
+        content += "\n";
+    content += `${content ? "\n" : ""}# ${label}\n${entry}\n`;
+    writeFileSync(gitignorePath, content, "utf-8");
+}
+//# sourceMappingURL=gitignore.js.map

package/dist/utils/gitignore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitignore.js","sourceRoot":"","sources":["../../src/utils/gitignore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AAC7D,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,gBAAgB,CAC9B,WAAmB,EACnB,KAAa,EACb,KAAa;IAEb,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACtC,IAAI,OAAO,GAAG,UAAU,CAAC,aAAa,CAAC;QACrC,CAAC,CAAC,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC;QACtC,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,cAAc,GAAG,OAAO;SAC3B,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;SAC/C,IAAI,CACH,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,KAAK,KAAK;QACd,IAAI,KAAK,IAAI;QACb,IAAI,KAAK,IAAI,IAAI,EAAE;QACnB,IAAI,KAAK,IAAI,KAAK,EAAE;QACpB,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAC7D,CAAC;IACJ,IAAI,cAAc;QAAE,OAAO;IAE3B,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,IAAI,CAAC;IACxD,OAAO,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,KAAK,KAAK,IAAI,CAAC;IAC1D,aAAa,CAAC,aAAa,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AACjD,CAAC"}

package/dist/utils/identity-heal.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Patches only the `did` field of an on-disk `.mcpi/identity.json`,
+ * preserving every other field (privateKey, publicKey, kid, createdAt, ...).
+ *
+ * Both `init` and `register` mint or accept a locally-generated placeholder
+ * did before the registry assigns the real did:web record; once the
+ * canonical did is known, this heals identity.json in place so it never
+ * drifts from agent.json (dco setup.ts throws "for a different agent" the
+ * moment they disagree).
+ *
+ * Returns false, without writing anything, when the file does not exist or
+ * already has the target did. Read/parse/write errors are left to THROW:
+ * callers each keep their own catch-and-warn behavior around this call.
+ */
+export declare function patchIdentityDidInPlace(identityFilePath: string, newDid: string): boolean;
+//# sourceMappingURL=identity-heal.d.ts.map

package/dist/utils/identity-heal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-heal.d.ts","sourceRoot":"","sources":["../../src/utils/identity-heal.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CACrC,gBAAgB,EAAE,MAAM,EACxB,MAAM,EAAE,MAAM,GACb,OAAO,CAsBT"}

package/dist/utils/identity-heal.js

@@ -0,0 +1,37 @@
+import { existsSync, readFileSync, chmodSync } from "fs";
+import { writeFileAtomicSafe } from "./cli-kit/index.js";
+/**
+ * Patches only the `did` field of an on-disk `.mcpi/identity.json`,
+ * preserving every other field (privateKey, publicKey, kid, createdAt, ...).
+ *
+ * Both `init` and `register` mint or accept a locally-generated placeholder
+ * did before the registry assigns the real did:web record; once the
+ * canonical did is known, this heals identity.json in place so it never
+ * drifts from agent.json (dco setup.ts throws "for a different agent" the
+ * moment they disagree).
+ *
+ * Returns false, without writing anything, when the file does not exist or
+ * already has the target did. Read/parse/write errors are left to THROW:
+ * callers each keep their own catch-and-warn behavior around this call.
+ */
+export function patchIdentityDidInPlace(identityFilePath, newDid) {
+    if (!existsSync(identityFilePath)) {
+        return false;
+    }
+    const existing = JSON.parse(readFileSync(identityFilePath, "utf-8"));
+    if (!existing || typeof existing !== "object" || existing.did === newDid) {
+        return false;
+    }
+    // Atomic + symlink-safe: identity.json holds a private key, so a crash
+    // mid-write must never truncate it, and a planted symlink at the write's
+    // temp sibling must never be followed into an arbitrary file.
+    writeFileAtomicSafe(identityFilePath, JSON.stringify({ ...existing, did: newDid }, null, 2), 0o600);
+    try {
+        chmodSync(identityFilePath, 0o600);
+    }
+    catch {
+        // Best-effort; e.g. unsupported on Windows.
+    }
+    return true;
+}
+//# sourceMappingURL=identity-heal.js.map

package/dist/utils/identity-heal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-heal.js","sourceRoot":"","sources":["../../src/utils/identity-heal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,uBAAuB,CACrC,gBAAwB,EACxB,MAAc;IAEd,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAClC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC;IACrE,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,GAAG,KAAK,MAAM,EAAE,CAAC;QACzE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,uEAAuE;IACvE,yEAAyE;IACzE,8DAA8D;IAC9D,mBAAmB,CACjB,gBAAgB,EAChB,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EACrD,KAAK,CACN,CAAC;IACF,IAAI,CAAC;QACH,SAAS,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,4CAA4C;IAC9C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/utils/poll.d.ts

@@ -9,7 +9,7 @@
  * this is exactly the drift that let checkpoint-init.ts's own poll loop
  * ship without the SIGINT guard claim-polling.ts already had (PR #658
  * deep review, finding B7). Left unmigrated here: this change's ground
- * rules explicitly scope out the existing top-level `mcpi init` (MCP-I
+ * rules explicitly scope out the existing top-level `kya-os init` (MCP-I
  * agent flow) beyond the parseAsync entrypoint change, so claim-polling.ts
  * keeps its own copy for now; folding it onto this shared helper is a
  * follow-up once that flow is in scope.

package/dist/utils/poll.js

@@ -9,7 +9,7 @@
  * this is exactly the drift that let checkpoint-init.ts's own poll loop
  * ship without the SIGINT guard claim-polling.ts already had (PR #658
  * deep review, finding B7). Left unmigrated here: this change's ground
- * rules explicitly scope out the existing top-level `mcpi init` (MCP-I
+ * rules explicitly scope out the existing top-level `kya-os init` (MCP-I
  * agent flow) beyond the parseAsync entrypoint change, so claim-polling.ts
  * keeps its own copy for now; folding it onto this shared helper is a
  * follow-up once that flow is in scope.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kya-os/cli",
-  "version": "1.8.1",
+  "version": "2.0.0",
   "description": "CLI for MCP-I setup and management",
   "keywords": [
     "cli",
@@ -19,14 +19,15 @@
   "main": "dist/index.js",
   "type": "module",
   "bin": {
-    "mcpi": "./dist/index.js"
+    "kya-os": "./dist/index.js",
+    "dco": "./dist/dco.js"
   },
   "files": [
     "dist",
     "templates"
   ],
   "scripts": {
-    "build": "rm -f tsconfig.build.tsbuildinfo && tsc -p tsconfig.build.json && mv dist/index.prod.js dist/index.js && mv dist/index.prod.d.ts dist/index.d.ts && rm -f dist/index.prod.* && node scripts/fix-esm-imports.js && chmod +x dist/index.js",
+    "build": "rm -f tsconfig.build.tsbuildinfo && tsc -p tsconfig.build.json && mv dist/index.prod.js dist/index.js && mv dist/index.prod.d.ts dist/index.d.ts && rm -f dist/index.prod.* && node scripts/fix-esm-imports.js && chmod +x dist/index.js dist/dco.js",
     "dev": "tsx src/index.ts",
     "clean": "rm -rf dist",
     "prepublishOnly": "npm run clean && npm run build && node ../create-mcpi-app/scripts/validate-dependencies.js",

package/dist/utils/claim-polling.d.ts

@@ -1,21 +0,0 @@
-/**
- * Options for claim polling
- */
-export interface ClaimPollingOptions {
-    verbose?: boolean;
-    maxAttempts?: number;
-    pollInterval?: number;
-}
-/**
- * Poll for agent claim status
- *
- * Polls the KTA API to check if an agent has been claimed.
- * Returns true when claimed, false if timeout or interrupted.
- *
- * @param agentName - The agent's name (slug) to check
- * @param did - The agent's DID
- * @param endpoint - API endpoint URL (default: https://knowthat.ai)
- * @param options - Polling options
- */
-export declare function pollForClaimStatus(agentName: string, did: string, endpoint?: string, options?: ClaimPollingOptions): Promise<boolean>;
-//# sourceMappingURL=claim-polling.d.ts.map

package/dist/utils/claim-polling.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"claim-polling.d.ts","sourceRoot":"","sources":["../../src/utils/claim-polling.ts"],"names":[],"mappings":"AAGA;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,CACtC,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,QAAQ,GAAE,MAA8B,EACxC,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC,OAAO,CAAC,CA4GlB"}

package/dist/utils/claim-polling.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"claim-polling.js","sourceRoot":"","sources":["../../src/utils/claim-polling.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,GAAG,MAAM,KAAK,CAAC;AAWtB;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,SAAiB,EACjB,GAAW,EACX,WAAmB,qBAAqB,EACxC,UAA+B,EAAE;IAEjC,MAAM,EACJ,OAAO,GAAG,KAAK,EACf,WAAW,GAAG,EAAE,EAAE,kCAAkC;IACpD,YAAY,GAAG,IAAI,EAAE,YAAY;MAClC,GAAG,OAAO,CAAC;IAEZ,MAAM,OAAO,GAAG,GAAG,CAAC;QAClB,IAAI,EAAE,wCAAwC;QAC9C,KAAK,EAAE,QAAQ;KAChB,CAAC,CAAC,KAAK,EAAE,CAAC;IAEX,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,WAAW,GAAG,KAAK,CAAC;IAExB,2CAA2C;IAC3C,MAAM,eAAe,GAAG,GAAG,EAAE;QAC3B,WAAW,GAAG,IAAI,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,6BAA6B,CAAC,CAAC,CAAC;IAC5D,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAEtC,IAAI,CAAC;QACH,OAAO,QAAQ,GAAG,WAAW,IAAI,CAAC,WAAW,EAAE,CAAC;YAC9C,IAAI,CAAC;gBACH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,cAAc,GAAG,kBAAkB,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,CAAC;gBAEzF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,QAAQ,EAAE,EAAE;oBACtD,MAAM,EAAE,KAAK;oBACb,OAAO,EAAE;wBACP,YAAY,EAAE,YAAY;wBAC1B,MAAM,EAAE,kBAAkB;qBAC3B;iBACF,CAAC,CAAC;gBAEH,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;oBAChB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAM/B,CAAC;oBAEF,IAAI,OAAO,EAAE,CAAC;wBACZ,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,CAAC;wBACnD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBACzD,CAAC;oBAED,kDAAkD;oBAClD,IACE,IAAI;wBACJ,CAAC,IAAI,CAAC,MAAM;4BACV,IAAI,CAAC,MAAM,KAAK,QAAQ;4BACxB,IAAI,CAAC,KAAK;4BACV,IAAI,CAAC,SAAS;4BACd,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,EACzB,CAAC;wBACD,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC,CAAC;wBAC9D,OAAO,CAAC,cAAc,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;wBAClD,OAAO,IAAI,CAAC;oBACd,CAAC;gBACH,CAAC;qBAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBACnC,+DAA+D;oBAC/D,IAAI,OAAO,EAAE,CAAC;wBACZ,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC,CAAC;oBAChF,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,OAAO,UAAU,EAAE,CAAC;gBACpB,gEAAgE;gBAChE,IAAI,OAAO,EAAE,CAAC;oBACZ,OAAO,CAAC,IAAI,CACV,KAAK,CAAC,MAAM,CACV,0BAA0B,QAAQ,GAAG,CAAC,YACpC,UAAU,YAAY,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,eACrD,EAAE,CACH,CACF,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;YAClE,QAAQ,EAAE,CAAC;YAEX,qCAAqC;YACrC,MAAM,aAAa,GAAG,CAAC,WAAW,GAAG,QAAQ,CAAC,GAAG,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;YACvE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,GAAG,EAAE,CAAC,CAAC;YAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,GAAG,EAAE,CAAC,CAAC;YAC/C,OAAO,CAAC,IAAI,GAAG,2CAA2C,OAAO,IAAI,OAAO;iBACzE,QAAQ,EAAE;iBACV,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,aAAa,CAAC;QACnC,CAAC;QAED,OAAO,CAAC,cAAc,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;QAElD,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC,CAAC;YAC1E,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAC,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC,CAAC;QAC7E,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,cAAc,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;QAClD,OAAO,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QACrC,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/utils/dco/fs-safe.d.ts

@@ -1,14 +0,0 @@
-/**
- * Atomic, symlink-safe file replace.
- *
- * For `mcpi dco`, the destination and its temp sibling live in the current
- * working tree, which may be an untrusted cloned repo. A tracked symlink
- * planted at the predictable `<path>.mcpi-tmp` sibling would otherwise make
- * a plain writeFileSync follow it and clobber an arbitrary file the user can
- * write. So: unlink any pre-existing temp (rmSync removes the link itself,
- * never its target), then create it with O_EXCL (`wx`) so a planted or
- * racing symlink makes the write fail closed instead of being followed.
- * renameSync replaces the destination without following a symlink there.
- */
-export declare function writeFileAtomicSafe(path: string, content: string, mode?: number): void;
-//# sourceMappingURL=fs-safe.d.ts.map

package/dist/utils/dco/fs-safe.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"fs-safe.d.ts","sourceRoot":"","sources":["../../../src/utils/dco/fs-safe.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,IAAI,SAAQ,GACX,IAAI,CAKN"}

package/dist/utils/dco/fs-safe.js

@@ -1,20 +0,0 @@
-import { renameSync, rmSync, writeFileSync } from "fs";
-/**
- * Atomic, symlink-safe file replace.
- *
- * For `mcpi dco`, the destination and its temp sibling live in the current
- * working tree, which may be an untrusted cloned repo. A tracked symlink
- * planted at the predictable `<path>.mcpi-tmp` sibling would otherwise make
- * a plain writeFileSync follow it and clobber an arbitrary file the user can
- * write. So: unlink any pre-existing temp (rmSync removes the link itself,
- * never its target), then create it with O_EXCL (`wx`) so a planted or
- * racing symlink makes the write fail closed instead of being followed.
- * renameSync replaces the destination without following a symlink there.
- */
-export function writeFileAtomicSafe(path, content, mode = 0o644) {
-    const tempPath = `${path}.mcpi-tmp`;
-    rmSync(tempPath, { force: true });
-    writeFileSync(tempPath, content, { flag: "wx", mode });
-    renameSync(tempPath, path);
-}
-//# sourceMappingURL=fs-safe.js.map