@kya-os/cli 2.0.0 → 2.0.2

package/dist/sidecar/sidecar/src/conformance/reference/runner.js

@@ -0,0 +1,126 @@
+/*
+MIT License
+
+Copyright (c) 2026 KYA-OS
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+*/
+// Vendored reference harness; see PROVENANCE.json and LICENSE. Public-package import adaptations only.
+/**
+ * KYA-OS Conformance Runner.
+ *
+ * Feeds each loaded vector to the supplied {@link ConformanceAdapter}, compares
+ * the adapter's accept/reject outcome to the vector's `expected`, and aggregates
+ * a {@link ConformanceReport}. A vector PASSES the suite when the adapter's
+ * outcome equals `expected` — so a `fail` vector (a tampered proof, broken chain,
+ * revoked credential, malformed DID) passes the suite only when the
+ * implementation correctly REJECTS it.
+ *
+ * The runner is implementation-agnostic: it never imports `@kya-os/mcp`. To run
+ * the reference implementation, pass {@link ./reference-adapter}; a third party
+ * passes their own adapter (see CONFORMANCE.md).
+ */
+/** Dispatch a single vector to the adapter method for its category. */
+async function dispatch(adapter, vector) {
+    switch (vector.category) {
+        case 'signed-proof':
+            return adapter.verifySignedProof(vector.input);
+        case 'delegation-chain':
+            return adapter.verifyDelegationChain(vector.input);
+        case 'status-list':
+            return adapter.verifyStatusList(vector.input);
+        case 'did-key-resolution':
+            return adapter.resolveDidKey(vector.input);
+        case 'did-web-resolution':
+            return adapter.resolveDidWeb(vector.input);
+        case 'card-proof':
+            return adapter.verifyCardProof(vector.input);
+        case 'entity-card':
+            return adapter.verifyEntityCard(vector.input);
+        case 'audit-integrity':
+            return adapter.verifyAuditIntegrity(vector.input);
+        case 'negotiation':
+            return adapter.evaluateNegotiation(vector.input);
+        default: {
+            const exhaustive = vector.category;
+            throw new Error(`Unknown vector category: ${String(exhaustive)}`);
+        }
+    }
+}
+/**
+ * Run every vector through the adapter and aggregate the report.
+ *
+ * A thrown error from an adapter method is recorded as `actual: 'error'` and
+ * counts as a mismatch — adapters are required to be fail-closed and return
+ * `{ outcome: 'fail' }` rather than throw.
+ */
+export async function runConformance(adapter, vectors) {
+    const results = [];
+    for (const vector of vectors) {
+        let actual;
+        let detail;
+        try {
+            const result = await dispatch(adapter, vector);
+            actual = result.outcome;
+            detail = result.detail;
+        }
+        catch (error) {
+            actual = 'error';
+            detail = `adapter threw: ${error instanceof Error ? error.message : String(error)}`;
+        }
+        const ok = actual === vector.expected;
+        results.push({
+            id: vector.id,
+            category: vector.category,
+            description: vector.description,
+            expected: vector.expected,
+            actual,
+            ok,
+            detail,
+        });
+    }
+    const passed = results.filter((r) => r.ok).length;
+    const failed = results.length - passed;
+    return {
+        adapter: adapter.name,
+        total: results.length,
+        passed,
+        failed,
+        results,
+        allMatched: failed === 0,
+    };
+}
+/** Render a human-readable report suitable for CI logs. */
+export function formatReport(report) {
+    const lines = [];
+    lines.push(`KYA-OS Conformance — adapter: ${report.adapter}`);
+    lines.push('');
+    for (const r of report.results) {
+        const mark = r.ok ? 'PASS' : 'FAIL';
+        lines.push(`  [${mark}] ${r.id} (${r.category}) — expected ${r.expected}, got ${r.actual}`);
+        if (!r.ok && r.detail) {
+            lines.push(`         ${r.detail}`);
+        }
+    }
+    lines.push('');
+    lines.push(`Total: ${report.total}  Passed: ${report.passed}  Failed: ${report.failed}`);
+    lines.push(report.allMatched ? 'RESULT: PASS (all vectors matched)' : 'RESULT: FAIL');
+    return lines.join('\n');
+}
+//# sourceMappingURL=runner.js.map

package/dist/sidecar/sidecar/src/conformance/reference/runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner.js","sourceRoot":"","sources":["../../../../../../sidecar/src/conformance/reference/runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;EAsBE;AACF,uGAAuG;AACvG;;;;;;;;;;;;;GAaG;AAqCH,uEAAuE;AACvE,KAAK,UAAU,QAAQ,CACrB,OAA2B,EAC3B,MAAyB;IAEzB,QAAQ,MAAM,CAAC,QAAQ,EAAE,CAAC;QACxB,KAAK,cAAc;YACjB,OAAO,OAAO,CAAC,iBAAiB,CAAC,MAAM,CAAC,KAAyB,CAAC,CAAC;QACrE,KAAK,kBAAkB;YACrB,OAAO,OAAO,CAAC,qBAAqB,CAAC,MAAM,CAAC,KAA6B,CAAC,CAAC;QAC7E,KAAK,aAAa;YAChB,OAAO,OAAO,CAAC,gBAAgB,CAAC,MAAM,CAAC,KAAwB,CAAC,CAAC;QACnE,KAAK,oBAAoB;YACvB,OAAO,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,KAA2B,CAAC,CAAC;QACnE,KAAK,oBAAoB;YACvB,OAAO,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,KAA2B,CAAC,CAAC;QACnE,KAAK,YAAY;YACf,OAAO,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,KAAuB,CAAC,CAAC;QACjE,KAAK,aAAa;YAChB,OAAO,OAAO,CAAC,gBAAgB,CAAC,MAAM,CAAC,KAAwB,CAAC,CAAC;QACnE,KAAK,iBAAiB;YACpB,OAAO,OAAO,CAAC,oBAAoB,CAAC,MAAM,CAAC,KAA4B,CAAC,CAAC;QAC3E,KAAK,aAAa;YAChB,OAAO,OAAO,CAAC,mBAAmB,CAAC,MAAM,CAAC,KAAyB,CAAC,CAAC;QACvE,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,MAAM,CAAC,QAAQ,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,4BAA4B,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAA2B,EAC3B,OAA4B;IAE5B,MAAM,OAAO,GAAsB,EAAE,CAAC;IAEtC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAiC,CAAC;QACtC,IAAI,MAA0B,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC/C,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC;YACxB,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,OAAO,CAAC;YACjB,MAAM,GAAG,kBAAkB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACtF,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,KAAK,MAAM,CAAC,QAAQ,CAAC;QACtC,OAAO,CAAC,IAAI,CAAC;YACX,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM;YACN,EAAE;YACF,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC;IAClD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC;IAEvC,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,IAAI;QACrB,KAAK,EAAE,OAAO,CAAC,MAAM;QACrB,MAAM;QACN,MAAM;QACN,OAAO;QACP,UAAU,EAAE,MAAM,KAAK,CAAC;KACzB,CAAC;AACJ,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,YAAY,CAAC,MAAyB;IACpD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,iCAAiC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9D,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;QACpC,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,QAAQ,gBAAgB,CAAC,CAAC,QAAQ,SAAS,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5F,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;YACtB,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CACR,UAAU,MAAM,CAAC,KAAK,aAAa,MAAM,CAAC,MAAM,aAAa,MAAM,CAAC,MAAM,EAAE,CAC7E,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,oCAAoC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;IACtF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/sidecar/sidecar/src/conformance/reference/types.js

@@ -0,0 +1,40 @@
+/*
+MIT License
+
+Copyright (c) 2026 KYA-OS
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+*/
+// Vendored reference harness; see PROVENANCE.json and LICENSE. Public-package import adaptations only.
+/**
+ * KYA-OS Conformance Harness — shared types and the implementation-agnostic
+ * adapter contract.
+ *
+ * The harness is independent of the reference implementation: it reads versioned
+ * JSON test vectors (`conformance/vectors/*.json`) and runs each one through a
+ * {@link ConformanceAdapter}. A third party brings their OWN implementation by
+ * implementing this single interface — every primitive a vector exercises maps to
+ * one adapter method. The reference adapter
+ * ({@link ./reference-adapter.ReferenceConformanceAdapter}) wires these methods to
+ * `@kya-os/mcp`'s PUBLIC verify primitives and does not fork their logic.
+ *
+ * See CONFORMANCE.md § "Running the harness against your implementation".
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/sidecar/sidecar/src/conformance/reference/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../../../sidecar/src/conformance/reference/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;EAsBE;AACF,uGAAuG;AACvG;;;;;;;;;;;;;GAaG"}

package/dist/sidecar/sidecar/src/daemon.js

@@ -0,0 +1,151 @@
+import { createConnection, createServer } from "node:net";
+import { lstatSync, mkdirSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+import { encodeMessage, MessageDecoder } from "./framing.js";
+export class StaleSocketError extends Error {
+    constructor() {
+        super("existing sidecar socket was not reachable; inspect its owner before removing a confirmed stale socket");
+        this.name = "StaleSocketError";
+    }
+}
+function canConnect(socketPath) {
+    return new Promise((resolve) => {
+        const probe = createConnection(socketPath);
+        probe.once("connect", () => {
+            probe.end();
+            resolve(true);
+        });
+        probe.once("error", () => resolve(false));
+    });
+}
+async function handleRequest(raw, socket, handlers) {
+    let request;
+    try {
+        request = JSON.parse(raw.toString("utf8"));
+    }
+    catch {
+        return; // Malformed frame; nothing to reply to without an id.
+    }
+    try {
+        // Reserved transport negotiation is available before any identity operation.
+        const handler = request.op === "system.protocol"
+            ? async () => ({ protocol: "kya.sidecar", version: 1, framing: "u32be-json" })
+            : Object.prototype.hasOwnProperty.call(handlers, request.op) ? handlers[request.op] : undefined;
+        if (!handler) {
+            throw new Error(`unknown op: ${request.op}`);
+        }
+        const result = await handler(request.params);
+        socket.write(encodeMessage(Buffer.from(JSON.stringify({ id: request.id, ok: true, result }))));
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        socket.write(encodeMessage(Buffer.from(JSON.stringify({ id: request.id, ok: false, error: { code: "op_failed", message } }))));
+    }
+}
+/**
+ * Binds the sidecar's Unix socket and serves `handlers` until `idleMs`
+ * elapses with no active connections, at which point `onIdle` fires.
+ * Never calls `process.exit` itself, so it's directly unit-testable —
+ * the real binary's entrypoint (index.ts) owns that decision.
+ */
+export async function startDaemon(opts) {
+    mkdirSync(dirname(opts.socketPath), { recursive: true });
+    // Capture the path once before the probe. A second independent existence
+    // check can observe a winner that bound after our first check and unlink
+    // its live socket without ever probing it.
+    let observed;
+    try {
+        observed = lstatSync(opts.socketPath);
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+    }
+    if (observed) {
+        if (!observed.isSocket())
+            throw new StaleSocketError();
+        if (await canConnect(opts.socketPath))
+            return { outcome: "already-running" };
+        // Failure to connect is not proof that the owner is dead. Even checking
+        // the inode again cannot make check-then-unlink atomic with a peer bind.
+        // Preserve the path and require explicit reconciliation after a crash.
+        throw new StaleSocketError();
+    }
+    const connections = new Set();
+    let idleTimer;
+    const resetIdleTimer = () => {
+        clearTimeout(idleTimer);
+        idleTimer = setTimeout(() => {
+            if (connections.size === 0) {
+                opts.onIdle();
+            }
+            else {
+                resetIdleTimer();
+            }
+        }, opts.idleMs);
+    };
+    const server = createServer((socket) => {
+        connections.add(socket);
+        clearTimeout(idleTimer);
+        const decoder = new MessageDecoder();
+        socket.on("data", (chunk) => {
+            try {
+                decoder.push(chunk);
+                let message;
+                while ((message = decoder.next()) !== null) {
+                    void handleRequest(message, socket, opts.handlers);
+                }
+            }
+            catch (error) {
+                // A malformed length prefix (e.g. over MAX_MESSAGE_LEN) throws out
+                // of MessageDecoder.next() -- uncaught here, that's an uncaught
+                // exception in this shared, long-lived daemon's "data" listener,
+                // which crashes the whole process and drops every other client's
+                // in-flight signing/identity calls. Only this one connection is at
+                // fault, so only it gets torn down.
+                const message = error instanceof Error ? error.message : String(error);
+                console.error(`sidecar: closing connection after a malformed frame: ${message}`);
+                socket.destroy();
+            }
+        });
+        socket.on("close", () => {
+            connections.delete(socket);
+            resetIdleTimer();
+        });
+        socket.on("error", () => connections.delete(socket));
+    });
+    // Closing after a failed startup-control write must not leave the idle
+    // timer holding the child alive for another ten minutes.
+    server.once("close", () => clearTimeout(idleTimer));
+    try {
+        await new Promise((resolve, reject) => {
+            server.once("error", reject);
+            server.listen(opts.socketPath, () => resolve());
+        });
+    }
+    catch (error) {
+        const code = error.code;
+        // A losing racer's bind can surface as EADDRINUSE or EEXIST depending
+        // on exactly how far the winner's bind got first -- both mean "the
+        // socket path is already spoken for," so both get the same
+        // is-someone-actually-listening check rather than only EADDRINUSE.
+        if (code === "EADDRINUSE" || code === "EEXIST") {
+            if (await canConnect(opts.socketPath))
+                return { outcome: "already-running" };
+            throw new StaleSocketError();
+        }
+        throw error;
+    }
+    try {
+        writeFileSync(opts.pidPath, String(process.pid));
+    }
+    catch (error) {
+        // Ownership has not reached index.ts yet. Close our listener here so a
+        // failed PID-file write cannot retain a child and its socket indefinitely.
+        await new Promise((resolve) => server.close(() => resolve()));
+        throw error;
+    }
+    resetIdleTimer();
+    return { outcome: "started", server };
+}
+//# sourceMappingURL=daemon.js.map

package/dist/sidecar/sidecar/src/daemon.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon.js","sourceRoot":"","sources":["../../../../sidecar/src/daemon.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAA4B,MAAM,UAAU,CAAC;AACpF,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAc,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAkB7D,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACzC;QACE,KAAK,CAAC,uGAAuG,CAAC,CAAC;QAC/G,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAMD,SAAS,UAAU,CAAC,UAAkB;IACpC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAW,gBAAgB,CAAC,UAAU,CAAC,CAAC;QACnD,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE;YACzB,KAAK,CAAC,GAAG,EAAE,CAAC;YACZ,OAAO,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,GAAW,EACX,MAAc,EACd,QAAmC;IAEnC,IAAI,OAAmB,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,sDAAsD;IAChE,CAAC;IAED,IAAI,CAAC;QACH,6EAA6E;QAC7E,MAAM,OAAO,GAAG,OAAO,CAAC,EAAE,KAAK,iBAAiB;YAC9C,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;YAC9E,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAClG,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,eAAe,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/C,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,CAAC,KAAK,CACV,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CACjF,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,CAAC,KAAK,CACV,aAAa,CACX,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,CAClG,CACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAmB;IACnD,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEzD,yEAAyE;IACzE,yEAAyE;IACzE,2CAA2C;IAC3C,IAAI,QAA2B,CAAC;IAChC,IAAI,CAAC;QACH,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAC;IACtE,CAAC;IACD,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE;YAAE,MAAM,IAAI,gBAAgB,EAAE,CAAC;QACvD,IAAI,MAAM,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;QAC7E,wEAAwE;QACxE,yEAAyE;QACzE,uEAAuE;QACvE,MAAM,IAAI,gBAAgB,EAAE,CAAC;IAC/B,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,IAAI,SAAyB,CAAC;IAE9B,MAAM,cAAc,GAAG,GAAG,EAAE;QAC1B,YAAY,CAAC,SAAS,CAAC,CAAC;QACxB,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE;YAC1B,IAAI,WAAW,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBAC3B,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,CAAC;iBAAM,CAAC;gBACN,cAAc,EAAE,CAAC;YACnB,CAAC;QACH,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAClB,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,MAAM,EAAE,EAAE;QACrC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACxB,YAAY,CAAC,SAAS,CAAC,CAAC;QACxB,MAAM,OAAO,GAAG,IAAI,cAAc,EAAE,CAAC;QAErC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;YAC1B,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACpB,IAAI,OAAsB,CAAC;gBAC3B,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;oBAC3C,KAAK,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACrD,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,mEAAmE;gBACnE,gEAAgE;gBAChE,iEAAiE;gBACjE,iEAAiE;gBACjE,mEAAmE;gBACnE,oCAAoC;gBACpC,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACvE,OAAO,CAAC,KAAK,CAAC,wDAAwD,OAAO,EAAE,CAAC,CAAC;gBACjF,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,CAAC;QACH,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACtB,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC3B,cAAc,EAAE,CAAC;QACnB,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,uEAAuE;IACvE,yDAAyD;IACzD,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC;IAEpD,IAAI,CAAC;QACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC7B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAC;QACnD,sEAAsE;QACtE,mEAAmE;QACnE,2DAA2D;QAC3D,mEAAmE;QACnE,IAAI,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC/C,IAAI,MAAM,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;gBAAE,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;YAC7E,MAAM,IAAI,gBAAgB,EAAE,CAAC;QAC/B,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,uEAAuE;QACvE,2EAA2E;QAC3E,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACpE,MAAM,KAAK,CAAC;IACd,CAAC;IACD,cAAc,EAAE,CAAC;IACjB,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;AACxC,CAAC"}

package/dist/sidecar/sidecar/src/framing.js

@@ -0,0 +1,36 @@
+export const MAX_MESSAGE_LEN = 16 * 1024 * 1024; // 16 MiB, mirrors ipc/framing.rs
+export function encodeMessage(payload) {
+    const len = Buffer.alloc(4);
+    len.writeUInt32BE(payload.length, 0);
+    return Buffer.concat([len, payload]);
+}
+/**
+ * Incrementally accumulates bytes pushed from a socket's `data` events and
+ * yields complete length-prefixed messages as they become available. Call
+ * `push` with each chunk, then drain `next()` in a loop until it returns
+ * null (either "need more bytes" or "nothing left").
+ */
+export class MessageDecoder {
+    constructor() {
+        this.buffer = Buffer.alloc(0);
+    }
+    push(chunk) {
+        this.buffer = Buffer.concat([this.buffer, chunk]);
+    }
+    next() {
+        if (this.buffer.length < 4) {
+            return null;
+        }
+        const len = this.buffer.readUInt32BE(0);
+        if (len > MAX_MESSAGE_LEN) {
+            throw new Error(`message too large: ${len} bytes`);
+        }
+        if (this.buffer.length < 4 + len) {
+            return null;
+        }
+        const payload = Buffer.from(this.buffer.subarray(4, 4 + len));
+        this.buffer = this.buffer.subarray(4 + len);
+        return payload;
+    }
+}
+//# sourceMappingURL=framing.js.map

package/dist/sidecar/sidecar/src/framing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"framing.js","sourceRoot":"","sources":["../../../../sidecar/src/framing.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,iCAAiC;AAElF,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC5B,GAAG,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACrC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;AACvC,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,cAAc;IAA3B;QACU,WAAM,GAAW,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAqB3C,CAAC;IAnBC,IAAI,CAAC,KAAa;QAChB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;IACpD,CAAC;IAED,IAAI;QACF,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACxC,IAAI,GAAG,GAAG,eAAe,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,sBAAsB,GAAG,QAAQ,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,GAAG,GAAG,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;QAC5C,OAAO,OAAO,CAAC;IACjB,CAAC;CACF"}

package/dist/sidecar/sidecar/src/identity-manager.js

@@ -0,0 +1,73 @@
+/**
+ * Loads the current agent identity for the sidecar's `sign` op.
+ *
+ * Relocated here (from the now-deleted `src/utils/identity-manager.ts`)
+ * as part of the Rust rewrite's TypeScript-deletion pass -- it's the only
+ * export from that file any live sidecar op actually imports
+ * (`ops/sign.ts`). The file's other exports (`generateKeyPair`,
+ * `generateDID`, `archiveOldKey`, `generateNewIdentity`,
+ * `saveIdentityToDev`, `clearDevIdentity`, `generateAuditLine`) existed
+ * only for the old `keys rotate` command's own key generation, which is
+ * a CONFIRMED-WRONG format for this codebase: raw `node:crypto`
+ * PKCS8/SPKI DER Ed25519 keypairs with a sha256-prefix `key-XXXXXXXX`
+ * kid, incompatible with `CLIIdentityFileSchema`'s 44-base64-char
+ * (32-raw-byte) key shape every other identity-writing path in this
+ * codebase actually produces. The Rust port of `keys rotate`
+ * (`commands/rotate.rs`) deliberately does NOT reproduce that bug --
+ * it generates keys through a new sidecar op instead -- so those
+ * functions were dropped rather than carried forward into working code
+ * nobody should call. See the design spec's own note on this and the
+ * `xmcp-i-rust-cli-rewrite-full-scope` memory file's "keys rotate"
+ * entries for the full history.
+ *
+ * `commands/rotate.rs`/`commands/verify.rs` (Rust) each have their own
+ * NATIVE reimplementation of this same load logic
+ * (`load_dev_identity`/`load_prod_identity`) for CLI-side use with no
+ * sidecar round-trip -- this TS copy exists because `ops/sign.ts` runs
+ * inside the sidecar process and can't call back into the Rust binary.
+ * A small, deliberate duplication across the process boundary, not an
+ * oversight.
+ */
+import { existsSync, readFileSync } from "fs";
+import { join } from "path";
+/**
+ * Load current identity from file or environment.
+ */
+export function loadCurrentIdentity(cwd = process.cwd()) {
+    const isDev = !process.env.AGENT_PRIVATE_KEY;
+    if (isDev) {
+        // Load from .mcpi/identity.json
+        const identityFile = join(cwd, ".mcpi", "identity.json");
+        if (!existsSync(identityFile)) {
+            return null;
+        }
+        try {
+            const data = JSON.parse(readFileSync(identityFile, "utf-8"));
+            return data;
+        }
+        catch (error) {
+            console.warn(`Warning: Could not load identity file: ${error}`);
+            return null;
+        }
+    }
+    else {
+        // Load from environment variables
+        const privateKey = process.env.AGENT_PRIVATE_KEY;
+        const kid = process.env.AGENT_KEY_ID;
+        const did = process.env.AGENT_DID;
+        if (!privateKey || !kid || !did) {
+            return null;
+        }
+        // We don't have public key in env, but we can derive it from private key if needed
+        return {
+            version: "1.0",
+            did,
+            kid,
+            privateKey,
+            publicKey: "", // Not available from env
+            createdAt: new Date().toISOString(),
+            lastRotated: new Date().toISOString(),
+        };
+    }
+}
+//# sourceMappingURL=identity-manager.js.map

package/dist/sidecar/sidecar/src/identity-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-manager.js","sourceRoot":"","sources":["../../../../sidecar/src/identity-manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAc,OAAO,CAAC,GAAG,EAAE;IAC7D,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAE7C,IAAI,KAAK,EAAE,CAAC;QACV,gCAAgC;QAChC,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,eAAe,CAAC,CAAC;QACzD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;YAC7D,OAAO,IAAuB,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CAAC,0CAA0C,KAAK,EAAE,CAAC,CAAC;YAChE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;SAAM,CAAC;QACN,kCAAkC;QAClC,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;QACjD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QACrC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;QAElC,IAAI,CAAC,UAAU,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,mFAAmF;QACnF,OAAO;YACL,OAAO,EAAE,KAAK;YACd,GAAG;YACH,GAAG;YACH,UAAU;YACV,SAAS,EAAE,EAAE,EAAE,yBAAyB;YACxC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACtC,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/sidecar/sidecar/src/index.js

@@ -0,0 +1,80 @@
+#!/usr/bin/env node
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { startDaemon, StaleSocketError } from "./daemon.js";
+import { convertToSsh } from "./ops/convert-to-ssh.js";
+import { echo } from "./ops/echo.js";
+import { ensureIdentity } from "./ops/ensure-identity.js";
+import { rotateIdentity } from "./ops/rotate-identity.js";
+import { sign } from "./ops/sign.js";
+import { resolveIdentity } from "./ops/resolve-identity.js";
+import { verifyAuditBundle } from "./ops/verify-audit-bundle.js";
+import { runConformanceSuite } from "./ops/run-conformance.js";
+import { signWithEd25519Seed } from "./ops/sign-with-ed25519-seed.js";
+function defaultSocketPath() {
+    return join(homedir(), ".mcpi", "sidecar.sock");
+}
+function defaultPidPath() {
+    return join(homedir(), ".mcpi", "sidecar.pid");
+}
+let ownedServer;
+// A timed-out parent may close its control pipe before this child finishes
+// loading. Handle EPIPE without crashing with a newly owned socket left behind.
+process.stdout.on("error", () => {
+    process.exitCode = 1;
+    ownedServer?.close();
+});
+function writeControlLine(line) {
+    return new Promise((resolve, reject) => {
+        process.stdout.write(`${line}\n`, (error) => error ? reject(error) : resolve());
+    });
+}
+async function main() {
+    const socketPath = process.env.MCPI_SIDECAR_SOCKET_PATH ?? defaultSocketPath();
+    const pidPath = process.env.MCPI_SIDECAR_PID_PATH ?? defaultPidPath();
+    const idleMs = Number(process.env.MCPI_SIDECAR_IDLE_MS ?? 10 * 60 * 1000);
+    const result = await startDaemon({
+        socketPath,
+        pidPath,
+        idleMs,
+        handlers: { echo, sign, convertToSsh, signWithEd25519Seed, ensureIdentity, rotateIdentity, resolveIdentity, verifyAuditBundle, runConformanceSuite },
+        // close() unlinks this listener's socket. Natural exit flushes stdout;
+        // process.exit() alone would leave a stale socket after every idle run.
+        onIdle: () => ownedServer?.close(),
+    });
+    if (result.outcome === "started")
+        ownedServer = result.server;
+    // The Rust client blocks on this exact line appearing on stdout before
+    // it connects — see connect_or_spawn in Task 5. Print it for
+    // "already-running" too: startDaemon only reports that outcome after
+    // confirming (via canConnect) that some daemon is live on socketPath, so
+    // this process's own child-spawn race loser still owes its waiting
+    // parent a ready signal, even though the daemon it's reporting on isn't
+    // itself.
+    //
+    // Wait for the write callback, not just the write() call, before
+    // exiting: stdout writes are asynchronous on POSIX when connected to a
+    // pipe (as it is here -- the Rust parent spawns with a piped stdout),
+    // so process.exit() right after write() can kill the process before
+    // the line ever reaches the pipe, leaving the waiting parent's
+    // connect_or_spawn timing out on a daemon that's actually up.
+    await writeControlLine("SIDECAR_READY");
+    if (result.outcome === "already-running") {
+        process.exit(0);
+    }
+}
+main().catch(async (error) => {
+    if (error instanceof StaleSocketError) {
+        // Fixed protocol signal; Rust deliberately discards daemon stderr.
+        try {
+            await writeControlLine("SIDECAR_STALE_SOCKET");
+        }
+        catch {
+            // Parent already gone. The stdout handler closes only our own server.
+        }
+    }
+    console.error(`sidecar: fatal error: ${error instanceof Error ? error.message : error}`);
+    ownedServer?.close();
+    process.exitCode = 1;
+});
+//# sourceMappingURL=index.js.map

package/dist/sidecar/sidecar/src/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../sidecar/src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE5D,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACrC,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACrC,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAEtE,SAAS,iBAAiB;IACxB,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,cAAc;IACrB,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;AACjD,CAAC;AAED,IAAI,WAA+B,CAAC;AAEpC,2EAA2E;AAC3E,gFAAgF;AAChF,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;IAC9B,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACrB,WAAW,EAAE,KAAK,EAAE,CAAC;AACvB,CAAC,CAAC,CAAC;AAEH,SAAS,gBAAgB,CAAC,IAAY;IACpC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,iBAAiB,EAAE,CAAC;IAC/E,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,cAAc,EAAE,CAAC;IACtE,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAE1E,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC;QAC/B,UAAU;QACV,OAAO;QACP,MAAM;QACN,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,mBAAmB,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe,EAAE,iBAAiB,EAAE,mBAAmB,EAAE;QACpJ,uEAAuE;QACvE,wEAAwE;QACxE,MAAM,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE,KAAK,EAAE;KACnC,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS;QAAE,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC;IAE9D,uEAAuE;IACvE,6DAA6D;IAC7D,qEAAqE;IACrE,yEAAyE;IACzE,mEAAmE;IACnE,wEAAwE;IACxE,UAAU;IACV,EAAE;IACF,iEAAiE;IACjE,uEAAuE;IACvE,sEAAsE;IACtE,oEAAoE;IACpE,+DAA+D;IAC/D,8DAA8D;IAC9D,MAAM,gBAAgB,CAAC,eAAe,CAAC,CAAC;IAExC,IAAI,MAAM,CAAC,OAAO,KAAK,iBAAiB,EAAE,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;IAC3B,IAAI,KAAK,YAAY,gBAAgB,EAAE,CAAC;QACtC,mEAAmE;QACnE,IAAI,CAAC;YACH,MAAM,gBAAgB,CAAC,sBAAsB,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,sEAAsE;QACxE,CAAC;IACH,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,yBAAyB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IACzF,WAAW,EAAE,KAAK,EAAE,CAAC;IACrB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC,CAAC,CAAC"}

package/dist/sidecar/sidecar/src/ops/convert-to-ssh.js

@@ -0,0 +1,11 @@
+import { convertEd25519ToSshKey } from "../ssh-key.js";
+export async function convertToSsh(params) {
+    const { privateKeyBase64, comment, expectedPublicKeyBase64 } = params;
+    if (typeof privateKeyBase64 !== "string" || typeof comment !== "string") {
+        throw new Error("convertToSsh: privateKeyBase64 and comment are required");
+    }
+    return convertEd25519ToSshKey(privateKeyBase64, comment, {
+        expectedPublicKeyBase64: typeof expectedPublicKeyBase64 === "string" ? expectedPublicKeyBase64 : undefined,
+    });
+}
+//# sourceMappingURL=convert-to-ssh.js.map

package/dist/sidecar/sidecar/src/ops/convert-to-ssh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"convert-to-ssh.js","sourceRoot":"","sources":["../../../../../sidecar/src/ops/convert-to-ssh.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAuB,MAAM,eAAe,CAAC;AAQ5E,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAe;IAChD,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,uBAAuB,EAAE,GAAG,MAA4B,CAAC;IAC5F,IAAI,OAAO,gBAAgB,KAAK,QAAQ,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,sBAAsB,CAAC,gBAAgB,EAAE,OAAO,EAAE;QACvD,uBAAuB,EACrB,OAAO,uBAAuB,KAAK,QAAQ,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,SAAS;KACpF,CAAC,CAAC;AACL,CAAC"}

package/dist/sidecar/sidecar/src/ops/echo.js

@@ -0,0 +1,5 @@
+/** Trivial op used to prove the dispatch pipeline end to end. */
+export async function echo(params) {
+    return params;
+}
+//# sourceMappingURL=echo.js.map

package/dist/sidecar/sidecar/src/ops/echo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"echo.js","sourceRoot":"","sources":["../../../../../sidecar/src/ops/echo.ts"],"names":[],"mappings":"AAAA,iEAAiE;AACjE,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,MAAe;IACxC,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/sidecar/sidecar/src/ops/ensure-identity.js

@@ -0,0 +1,36 @@
+// A thin wrapper around @kya-os/mcp-i's own IdentityManager -- reused
+// as-is, matching ops/sign-with-ed25519-seed.ts's precedent of reusing
+// existing crypto/identity logic rather than reimplementing it. Unlike
+// that op (which reaches up into this package's own src/utils/dco/ via a
+// relative import), @kya-os/mcp-i is a real, already-resolvable npm
+// dependency of @kya-os/cli (verified: packages/cli/node_modules/@kya-os/mcp-i
+// symlinks to the built packages/mcp-i, whose dist/index.js exports
+// IdentityManager), so this imports it as a normal package specifier.
+import { IdentityManager } from "@kya-os/mcp-i";
+/**
+ * Load `identityPath` if it already holds a valid identity, generating a
+ * fresh Ed25519 keypair (and a placeholder `did:web:localhost:3000:agents:*`
+ * DID) otherwise -- IdentityManager.ensureIdentity()'s own exact behavior,
+ * including its corrupted-file-regenerates fallback and its keyId->kid
+ * migration, none of which this wrapper reimplements.
+ *
+ * Deliberately does NOT report whether the identity was newly generated --
+ * see this op's own plan's Global Constraints for why that determination
+ * belongs to a future caller, not here.
+ */
+export async function ensureIdentity(params) {
+    const { identityPath } = params;
+    if (typeof identityPath !== "string" || identityPath.length === 0) {
+        throw new Error("ensureIdentity: identityPath is required");
+    }
+    const manager = new IdentityManager({ environment: "development", devIdentityPath: identityPath });
+    const identity = await manager.ensureIdentity();
+    return {
+        did: identity.did,
+        kid: identity.kid,
+        privateKeyBase64: identity.privateKey,
+        publicKeyBase64: identity.publicKey,
+        createdAt: identity.createdAt,
+    };
+}
+//# sourceMappingURL=ensure-identity.js.map

package/dist/sidecar/sidecar/src/ops/ensure-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ensure-identity.js","sourceRoot":"","sources":["../../../../../sidecar/src/ops/ensure-identity.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,uEAAuE;AACvE,uEAAuE;AACvE,yEAAyE;AACzE,oEAAoE;AACpE,+EAA+E;AAC/E,oEAAoE;AACpE,sEAAsE;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAchD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAe;IAClD,MAAM,EAAE,YAAY,EAAE,GAAG,MAA8B,CAAC;IACxD,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,eAAe,CAAC,EAAE,WAAW,EAAE,aAAa,EAAE,eAAe,EAAE,YAAY,EAAE,CAAC,CAAC;IACnG,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,cAAc,EAAE,CAAC;IAChD,OAAO;QACL,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,gBAAgB,EAAE,QAAQ,CAAC,UAAU;QACrC,eAAe,EAAE,QAAQ,CAAC,SAAS;QACnC,SAAS,EAAE,QAAQ,CAAC,SAAS;KAC9B,CAAC;AACJ,CAAC"}