@kya-os/cli 1.8.3 → 2.0.2

package/node_modules/@kya-os/contracts/dist/did/types.js

@@ -0,0 +1,70 @@
+"use strict";
+/**
+ * DID Document Types (W3C Compliant)
+ *
+ * These types conform to the W3C DID Core specification and provide
+ * TypeScript parity with the Python implementation.
+ *
+ * Related Spec: MCP-I §2.1, §2.3
+ * Python Reference: DID-Documentation.md, DID-Service.md
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isVerificationMethod = isVerificationMethod;
+exports.isVerificationMethodReference = isVerificationMethodReference;
+exports.isDidDocument = isDidDocument;
+exports.extractDidMethod = extractDidMethod;
+exports.extractKeyId = extractKeyId;
+/**
+ * Helper type guards
+ */
+/**
+ * Type guard to check if a value is a VerificationMethod
+ */
+function isVerificationMethod(value) {
+    return (typeof value === 'object' &&
+        value !== null &&
+        typeof value.id === 'string' &&
+        typeof value.type === 'string' &&
+        typeof value.controller === 'string');
+}
+/**
+ * Type guard to check if a value is a string reference to a verification method
+ */
+function isVerificationMethodReference(value) {
+    return typeof value === 'string';
+}
+/**
+ * Type guard to check if a DID Document is valid (basic structural check)
+ */
+function isDidDocument(value) {
+    return (typeof value === 'object' &&
+        value !== null &&
+        typeof value.id === 'string' &&
+        value.id.startsWith('did:'));
+}
+/**
+ * Extract DID method from a DID string
+ *
+ * @param did - The DID string (e.g., "did:key:z6Mk...")
+ * @returns The method name (e.g., "key") or null if invalid
+ */
+function extractDidMethod(did) {
+    const parts = did.split(':');
+    if (parts.length < 3 || parts[0] !== 'did') {
+        return null;
+    }
+    return parts[1];
+}
+/**
+ * Extract key ID from a DID URL
+ *
+ * @param didUrl - A DID URL with fragment (e.g., "did:key:z6Mk...#key-1")
+ * @returns The fragment part (e.g., "key-1") or null if no fragment
+ */
+function extractKeyId(didUrl) {
+    const hashIndex = didUrl.indexOf('#');
+    if (hashIndex === -1) {
+        return null;
+    }
+    return didUrl.substring(hashIndex + 1);
+}

package/node_modules/@kya-os/contracts/dist/env/constants.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Environment Constants
+ *
+ * System-wide constants for algorithms, TTLs, and limits
+ *
+ * Related Spec: MCP-I §8
+ * Python Reference: All service documentation files
+ */
+/**
+ * Hash algorithm for cryptographic operations
+ */
+export declare const HASH_ALGO: "SHA-256";
+/**
+ * Supported signature algorithms
+ */
+export declare const SIG_ALGOS: readonly ["Ed25519", "ES256"];
+export type SignatureAlgorithm = (typeof SIG_ALGOS)[number];
+/**
+ * Nonce TTL in milliseconds (5 minutes)
+ */
+export declare const NONCE_TTL_MS: number;
+/**
+ * Resume token TTL in milliseconds (10 minutes)
+ */
+export declare const RESUME_TOKEN_TTL_MS: number;
+/**
+ * StatusList2021 cache TTL in seconds (1 minute)
+ */
+export declare const STATUSLIST_CACHE_SEC = 60;
+/**
+ * DID resolution timeout in milliseconds (500ms)
+ */
+export declare const DID_RESOLVE_TIMEOUT_MS = 500;
+/**
+ * Default session TTL in minutes (30 minutes)
+ */
+export declare const DEFAULT_SESSION_TTL_MINUTES = 30;
+/**
+ * Maximum timestamp skew in seconds (2 minutes)
+ */
+export declare const MAX_TIMESTAMP_SKEW_SEC = 120;
+/**
+ * Maximum delegation chain depth
+ */
+export declare const MAX_DELEGATION_CHAIN_DEPTH = 10;
+/**
+ * Maximum status list size (1 million entries)
+ */
+export declare const MAX_STATUSLIST_SIZE = 1000000;
+/**
+ * Proof archive TTL in seconds (30 days)
+ */
+export declare const PROOF_ARCHIVE_TTL_SEC: number;
+/**
+ * Key rotation grace period in seconds (24 hours)
+ */
+export declare const KEY_ROTATION_GRACE_PERIOD_SEC: number;

package/node_modules/@kya-os/contracts/dist/env/constants.js

@@ -0,0 +1,59 @@
+"use strict";
+/**
+ * Environment Constants
+ *
+ * System-wide constants for algorithms, TTLs, and limits
+ *
+ * Related Spec: MCP-I §8
+ * Python Reference: All service documentation files
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KEY_ROTATION_GRACE_PERIOD_SEC = exports.PROOF_ARCHIVE_TTL_SEC = exports.MAX_STATUSLIST_SIZE = exports.MAX_DELEGATION_CHAIN_DEPTH = exports.MAX_TIMESTAMP_SKEW_SEC = exports.DEFAULT_SESSION_TTL_MINUTES = exports.DID_RESOLVE_TIMEOUT_MS = exports.STATUSLIST_CACHE_SEC = exports.RESUME_TOKEN_TTL_MS = exports.NONCE_TTL_MS = exports.SIG_ALGOS = exports.HASH_ALGO = void 0;
+/**
+ * Hash algorithm for cryptographic operations
+ */
+exports.HASH_ALGO = 'SHA-256';
+/**
+ * Supported signature algorithms
+ */
+exports.SIG_ALGOS = ['Ed25519', 'ES256'];
+/**
+ * Nonce TTL in milliseconds (5 minutes)
+ */
+exports.NONCE_TTL_MS = 5 * 60 * 1000;
+/**
+ * Resume token TTL in milliseconds (10 minutes)
+ */
+exports.RESUME_TOKEN_TTL_MS = 10 * 60 * 1000;
+/**
+ * StatusList2021 cache TTL in seconds (1 minute)
+ */
+exports.STATUSLIST_CACHE_SEC = 60;
+/**
+ * DID resolution timeout in milliseconds (500ms)
+ */
+exports.DID_RESOLVE_TIMEOUT_MS = 500;
+/**
+ * Default session TTL in minutes (30 minutes)
+ */
+exports.DEFAULT_SESSION_TTL_MINUTES = 30;
+/**
+ * Maximum timestamp skew in seconds (2 minutes)
+ */
+exports.MAX_TIMESTAMP_SKEW_SEC = 120;
+/**
+ * Maximum delegation chain depth
+ */
+exports.MAX_DELEGATION_CHAIN_DEPTH = 10;
+/**
+ * Maximum status list size (1 million entries)
+ */
+exports.MAX_STATUSLIST_SIZE = 1000000;
+/**
+ * Proof archive TTL in seconds (30 days)
+ */
+exports.PROOF_ARCHIVE_TTL_SEC = 30 * 24 * 60 * 60;
+/**
+ * Key rotation grace period in seconds (24 hours)
+ */
+exports.KEY_ROTATION_GRACE_PERIOD_SEC = 24 * 60 * 60;

package/node_modules/@kya-os/contracts/dist/env/index.d.ts

@@ -0,0 +1,4 @@
+/**
+ * Environment Constants Module
+ */
+export * from './constants.js';

package/node_modules/@kya-os/contracts/dist/env/index.js

@@ -0,0 +1,20 @@
+"use strict";
+/**
+ * Environment Constants Module
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./constants.js"), exports);

package/node_modules/@kya-os/contracts/dist/fleet/index.d.ts

@@ -0,0 +1,17 @@
+export interface FleetPrincipal {
+    orgId: string;
+    subject: string;
+}
+export type FleetAuthenticator = (authorization: string | undefined) => FleetPrincipal | null;
+export interface FleetAgentIdentity {
+    did: string;
+    name: string;
+    capabilities?: readonly string[];
+}
+/**
+ * Build a fail-closed authenticator from deployment-managed credential hashes.
+ * Plaintext bearer tokens are never stored in configuration or logs.
+ */
+export declare function createFleetAuthenticator(rawConfiguration: string | undefined): FleetAuthenticator;
+/** Resolve a target only within an already tenant-filtered agent collection. */
+export declare function resolveFleetAgent(agents: readonly FleetAgentIdentity[], target: string): string | null;

package/node_modules/@kya-os/contracts/dist/fleet/index.js

@@ -0,0 +1,69 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createFleetAuthenticator = createFleetAuthenticator;
+exports.resolveFleetAgent = resolveFleetAgent;
+const node_crypto_1 = require("node:crypto");
+/**
+ * Build a fail-closed authenticator from deployment-managed credential hashes.
+ * Plaintext bearer tokens are never stored in configuration or logs.
+ */
+function createFleetAuthenticator(rawConfiguration) {
+    if (!rawConfiguration) {
+        throw new Error("FLEET_MCP_CREDENTIALS_JSON is required");
+    }
+    let decoded;
+    try {
+        decoded = JSON.parse(rawConfiguration);
+    }
+    catch {
+        throw new Error("FLEET_MCP_CREDENTIALS_JSON must be valid JSON");
+    }
+    if (!Array.isArray(decoded) || decoded.length === 0) {
+        throw new Error("FLEET_MCP_CREDENTIALS_JSON must contain at least one credential");
+    }
+    const credentials = new Map();
+    for (const [index, candidate] of decoded.entries()) {
+        if (!isRecord(candidate)) {
+            throw new Error(`Fleet credential ${index} must be an object`);
+        }
+        const tokenSha256 = candidate.tokenSha256;
+        const orgId = candidate.orgId;
+        const subject = candidate.subject;
+        if (typeof tokenSha256 !== "string" ||
+            !/^[a-f0-9]{64}$/.test(tokenSha256)) {
+            throw new Error(`Fleet credential ${index} tokenSha256 must be lowercase SHA-256 hex`);
+        }
+        if (typeof orgId !== "string" || orgId.trim().length === 0) {
+            throw new Error(`Fleet credential ${index} orgId must be non-empty`);
+        }
+        if (typeof subject !== "string" || subject.trim().length === 0) {
+            throw new Error(`Fleet credential ${index} subject must be non-empty`);
+        }
+        if (credentials.has(tokenSha256)) {
+            throw new Error("Duplicate Fleet credential hash");
+        }
+        credentials.set(tokenSha256, {
+            orgId: orgId.trim(),
+            subject: subject.trim(),
+        });
+    }
+    return (authorization) => {
+        const match = authorization?.match(/^Bearer ([^\s]+)$/);
+        if (!match || match[1].length < 32 || match[1].length > 512)
+            return null;
+        const digest = (0, node_crypto_1.createHash)("sha256").update(match[1], "utf8").digest("hex");
+        const principal = credentials.get(digest);
+        return principal ? { ...principal } : null;
+    };
+}
+/** Resolve a target only within an already tenant-filtered agent collection. */
+function resolveFleetAgent(agents, target) {
+    const normalized = target.toLowerCase();
+    return (agents.find((agent) => agent.did === target)?.did ??
+        agents.find((agent) => agent.name.toLowerCase() === normalized)?.did ??
+        agents.find((agent) => agent.capabilities?.some((capability) => capability.toLowerCase() === normalized))?.did ??
+        null);
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}

package/node_modules/@kya-os/contracts/dist/gateway/agents.d.ts

@@ -0,0 +1,21 @@
+import { z } from "zod";
+export declare const agentEntrySchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodOptional<z.ZodString>;
+    model: z.ZodOptional<z.ZodString>;
+    defaultModel: z.ZodOptional<z.ZodString>;
+    persona: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    id: string;
+    name?: string | undefined;
+    model?: string | undefined;
+    defaultModel?: string | undefined;
+    persona?: string | undefined;
+}, {
+    id: string;
+    name?: string | undefined;
+    model?: string | undefined;
+    defaultModel?: string | undefined;
+    persona?: string | undefined;
+}>;
+export type AgentEntry = z.infer<typeof agentEntrySchema>;

package/node_modules/@kya-os/contracts/dist/gateway/agents.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.agentEntrySchema = void 0;
+const zod_1 = require("zod");
+// ── agents.list ──
+exports.agentEntrySchema = zod_1.z.object({
+    id: zod_1.z.string(),
+    name: zod_1.z.string().optional(),
+    model: zod_1.z.string().optional(),
+    defaultModel: zod_1.z.string().optional(),
+    persona: zod_1.z.string().optional(),
+});

package/node_modules/@kya-os/contracts/dist/gateway/cron.d.ts

@@ -0,0 +1,33 @@
+import { z } from "zod";
+export declare const cronJobSchema: z.ZodObject<{
+    name: z.ZodString;
+    schedule: z.ZodOptional<z.ZodString>;
+    enabled: z.ZodBoolean;
+    lastRunAt: z.ZodNullable<z.ZodOptional<z.ZodNumber>>;
+    nextRunAt: z.ZodNullable<z.ZodOptional<z.ZodNumber>>;
+    lastStatus: z.ZodNullable<z.ZodOptional<z.ZodString>>;
+    agentId: z.ZodOptional<z.ZodString>;
+    model: z.ZodNullable<z.ZodOptional<z.ZodString>>;
+    task: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    name: string;
+    enabled: boolean;
+    agentId?: string | undefined;
+    model?: string | null | undefined;
+    schedule?: string | undefined;
+    lastRunAt?: number | null | undefined;
+    nextRunAt?: number | null | undefined;
+    lastStatus?: string | null | undefined;
+    task?: string | undefined;
+}, {
+    name: string;
+    enabled: boolean;
+    agentId?: string | undefined;
+    model?: string | null | undefined;
+    schedule?: string | undefined;
+    lastRunAt?: number | null | undefined;
+    nextRunAt?: number | null | undefined;
+    lastStatus?: string | null | undefined;
+    task?: string | undefined;
+}>;
+export type CronJob = z.infer<typeof cronJobSchema>;

package/node_modules/@kya-os/contracts/dist/gateway/cron.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.cronJobSchema = void 0;
+const zod_1 = require("zod");
+// ── cron.list ──
+exports.cronJobSchema = zod_1.z.object({
+    name: zod_1.z.string(),
+    schedule: zod_1.z.string().optional(),
+    enabled: zod_1.z.boolean(),
+    lastRunAt: zod_1.z.number().optional().nullable(),
+    nextRunAt: zod_1.z.number().optional().nullable(),
+    lastStatus: zod_1.z.string().optional().nullable(),
+    agentId: zod_1.z.string().optional(),
+    model: zod_1.z.string().optional().nullable(),
+    task: zod_1.z.string().optional(),
+});

package/node_modules/@kya-os/contracts/dist/gateway/index.d.ts

@@ -0,0 +1,20 @@
+/**
+ * OpenClaw Gateway WebSocket RPC Response Types
+ *
+ * Shared schemas for OpenClaw gateway WS method responses.
+ * Used by both @kya-os/compute (agent-side) and Checkpoint (dashboard-side).
+ *
+ * Source of truth for gateway WS integration types.
+ * When adding a new gateway method integration:
+ * 1. Add Zod schema + TypeScript type here
+ * 2. Bump @kya-os/contracts version
+ * 3. Vendor into checkpoint, add handler in openclaw-handler.ts
+ * 4. Surface in the relevant dashboard component
+ *
+ * @package @kya-os/contracts/gateway
+ */
+export { skillRequirementsSchema, skillConfigCheckSchema, skillInstallOptionSchema, skillStatusEntrySchema, skillStatusReportSchema, type SkillRequirements, type SkillConfigCheck, type SkillInstallOption, type SkillStatusEntry, type SkillStatusReport, } from "./skills.js";
+export { sessionEntrySchema, type SessionEntry, } from "./sessions.js";
+export { cronJobSchema, type CronJob, } from "./cron.js";
+export { agentEntrySchema, type AgentEntry, } from "./agents.js";
+export { usageCostSchema, type UsageCost, } from "./usage.js";

package/node_modules/@kya-os/contracts/dist/gateway/index.js

@@ -0,0 +1,37 @@
+"use strict";
+/**
+ * OpenClaw Gateway WebSocket RPC Response Types
+ *
+ * Shared schemas for OpenClaw gateway WS method responses.
+ * Used by both @kya-os/compute (agent-side) and Checkpoint (dashboard-side).
+ *
+ * Source of truth for gateway WS integration types.
+ * When adding a new gateway method integration:
+ * 1. Add Zod schema + TypeScript type here
+ * 2. Bump @kya-os/contracts version
+ * 3. Vendor into checkpoint, add handler in openclaw-handler.ts
+ * 4. Surface in the relevant dashboard component
+ *
+ * @package @kya-os/contracts/gateway
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.usageCostSchema = exports.agentEntrySchema = exports.cronJobSchema = exports.sessionEntrySchema = exports.skillStatusReportSchema = exports.skillStatusEntrySchema = exports.skillInstallOptionSchema = exports.skillConfigCheckSchema = exports.skillRequirementsSchema = void 0;
+var skills_js_1 = require("./skills.js");
+// skills.status
+Object.defineProperty(exports, "skillRequirementsSchema", { enumerable: true, get: function () { return skills_js_1.skillRequirementsSchema; } });
+Object.defineProperty(exports, "skillConfigCheckSchema", { enumerable: true, get: function () { return skills_js_1.skillConfigCheckSchema; } });
+Object.defineProperty(exports, "skillInstallOptionSchema", { enumerable: true, get: function () { return skills_js_1.skillInstallOptionSchema; } });
+Object.defineProperty(exports, "skillStatusEntrySchema", { enumerable: true, get: function () { return skills_js_1.skillStatusEntrySchema; } });
+Object.defineProperty(exports, "skillStatusReportSchema", { enumerable: true, get: function () { return skills_js_1.skillStatusReportSchema; } });
+var sessions_js_1 = require("./sessions.js");
+// sessions.list
+Object.defineProperty(exports, "sessionEntrySchema", { enumerable: true, get: function () { return sessions_js_1.sessionEntrySchema; } });
+var cron_js_1 = require("./cron.js");
+// cron.list
+Object.defineProperty(exports, "cronJobSchema", { enumerable: true, get: function () { return cron_js_1.cronJobSchema; } });
+var agents_js_1 = require("./agents.js");
+// agents.list
+Object.defineProperty(exports, "agentEntrySchema", { enumerable: true, get: function () { return agents_js_1.agentEntrySchema; } });
+var usage_js_1 = require("./usage.js");
+// usage.cost
+Object.defineProperty(exports, "usageCostSchema", { enumerable: true, get: function () { return usage_js_1.usageCostSchema; } });

package/node_modules/@kya-os/contracts/dist/gateway/sessions.d.ts

@@ -0,0 +1,30 @@
+import { z } from "zod";
+export declare const sessionEntrySchema: z.ZodObject<{
+    key: z.ZodString;
+    agentId: z.ZodOptional<z.ZodString>;
+    label: z.ZodOptional<z.ZodString>;
+    channel: z.ZodOptional<z.ZodString>;
+    kind: z.ZodOptional<z.ZodString>;
+    createdAt: z.ZodOptional<z.ZodNumber>;
+    updatedAt: z.ZodOptional<z.ZodNumber>;
+    messageCount: z.ZodOptional<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    key: string;
+    createdAt?: number | undefined;
+    updatedAt?: number | undefined;
+    agentId?: string | undefined;
+    kind?: string | undefined;
+    label?: string | undefined;
+    channel?: string | undefined;
+    messageCount?: number | undefined;
+}, {
+    key: string;
+    createdAt?: number | undefined;
+    updatedAt?: number | undefined;
+    agentId?: string | undefined;
+    kind?: string | undefined;
+    label?: string | undefined;
+    channel?: string | undefined;
+    messageCount?: number | undefined;
+}>;
+export type SessionEntry = z.infer<typeof sessionEntrySchema>;

package/node_modules/@kya-os/contracts/dist/gateway/sessions.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sessionEntrySchema = void 0;
+const zod_1 = require("zod");
+// ── sessions.list ──
+exports.sessionEntrySchema = zod_1.z.object({
+    key: zod_1.z.string(),
+    agentId: zod_1.z.string().optional(),
+    label: zod_1.z.string().optional(),
+    channel: zod_1.z.string().optional(),
+    kind: zod_1.z.string().optional(),
+    createdAt: zod_1.z.number().optional(),
+    updatedAt: zod_1.z.number().optional(),
+    messageCount: zod_1.z.number().optional(),
+});