@kya-os/cli 2.0.0 → 2.0.3

package/node_modules/@kya-os/contracts/dist/cli.js

@@ -0,0 +1,266 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CliClaimStatusResponseSchema = exports.CliClaimStatusClaimedSchema = exports.CliClaimStatusPendingSchema = exports.CliProjectProvisionAuthenticatedResponseSchema = exports.CliProjectProvisionAnonymousResponseSchema = exports.CliProjectProvisionRequestSchema = exports.CLI_OPAQUE_TOKEN_RE = exports.CLI_EXIT_CODES = exports.ERROR_CODES = exports.ScaffolderResultSchema = exports.ScaffolderOptionsSchema = exports.DoctorResultSchema = exports.CacheInfoSchema = exports.KTAInfoSchema = exports.EnvironmentInfoSchema = exports.XMCPUpstreamInfoSchema = exports.PackageInfoSchema = exports.StatusReportSchema = exports.KeyRotationResultSchema = exports.CLIIdentityFileSchema = exports.KTARegistrationSchema = void 0;
+exports.isHttpUrl = isHttpUrl;
+const zod_1 = require("zod");
+const identity_js_1 = require("./config/identity.js");
+/**
+ * CLI command schemas and results
+ */
+// Re-export KTARegistration types for convenience
+var identity_js_2 = require("./config/identity.js");
+Object.defineProperty(exports, "KTARegistrationSchema", { enumerable: true, get: function () { return identity_js_2.KTARegistrationSchema; } });
+/**
+ * CLI Identity File Format Schema
+ *
+ * Format for identity.json files stored on disk.
+ * Used by CLI tools for identity management.
+ */
+exports.CLIIdentityFileSchema = zod_1.z
+    .object({
+    version: zod_1.z.literal("1.0"),
+    did: zod_1.z.string().min(1),
+    // Accept both kid and keyId for backward compatibility with pre-1.3 identity files
+    kid: zod_1.z.string().min(1).optional(),
+    keyId: zod_1.z.string().min(1).optional(),
+    privateKey: zod_1.z
+        .string()
+        .regex(/^[A-Za-z0-9+/]{43}=$/, "Must be a valid base64-encoded Ed25519 private key (44 characters)"),
+    publicKey: zod_1.z
+        .string()
+        .regex(/^[A-Za-z0-9+/]{43}=$/, "Must be a valid base64-encoded Ed25519 public key (44 characters)"),
+    createdAt: zod_1.z.string().datetime(),
+    lastRotated: zod_1.z.string().datetime().optional(),
+    /**
+     * Know That AI registration information
+     * Present when agent is registered with KTA for reputation tracking
+     */
+    kta: identity_js_1.KTARegistrationSchema.optional(),
+})
+    .refine((data) => data.kid || data.keyId, {
+    message: "Either kid or keyId must be provided",
+})
+    .transform((data) => {
+    const result = {
+        version: data.version,
+        did: data.did,
+        kid: data.kid || data.keyId,
+        privateKey: data.privateKey,
+        publicKey: data.publicKey,
+        createdAt: data.createdAt,
+    };
+    if (data.lastRotated) {
+        result.lastRotated = data.lastRotated;
+    }
+    if (data.kta) {
+        result.kta = data.kta;
+    }
+    return result;
+});
+exports.KeyRotationResultSchema = zod_1.z.object({
+    success: zod_1.z.boolean(),
+    oldKeyId: zod_1.z.string().min(1),
+    newKeyId: zod_1.z.string().min(1),
+    did: zod_1.z.string().min(1),
+    mode: zod_1.z.enum(["dev", "prod"]),
+    delegated: zod_1.z.boolean(),
+    forced: zod_1.z.boolean(),
+    auditLine: zod_1.z.string().min(1),
+});
+exports.StatusReportSchema = zod_1.z.object({
+    did: zod_1.z.string().min(1),
+    kid: zod_1.z.string().min(1), // Changed from keyId to kid for spec compliance
+    ktaURL: zod_1.z.string().url(),
+    mirrorStatus: zod_1.z.enum(["pending", "success", "error"]),
+    lastHandshake: zod_1.z.number().int().positive().optional(),
+    environment: zod_1.z.enum(["dev", "prod"]),
+});
+exports.PackageInfoSchema = zod_1.z.object({
+    name: zod_1.z.string(),
+    version: zod_1.z.string(),
+    compatible: zod_1.z.boolean(),
+    issues: zod_1.z.array(zod_1.z.string()).optional(),
+});
+exports.XMCPUpstreamInfoSchema = zod_1.z.object({
+    version: zod_1.z.string(),
+    compatible: zod_1.z.boolean(),
+    issues: zod_1.z.array(zod_1.z.string()).optional(),
+});
+exports.EnvironmentInfoSchema = zod_1.z.object({
+    valid: zod_1.z.boolean(),
+    missing: zod_1.z.array(zod_1.z.string()),
+    issues: zod_1.z.array(zod_1.z.string()).optional(),
+});
+exports.KTAInfoSchema = zod_1.z.object({
+    reachable: zod_1.z.boolean(),
+    authenticated: zod_1.z.boolean(),
+    issues: zod_1.z.array(zod_1.z.string()).optional(),
+});
+exports.CacheInfoSchema = zod_1.z.object({
+    type: zod_1.z.string(),
+    functional: zod_1.z.boolean(),
+    issues: zod_1.z.array(zod_1.z.string()).optional(),
+});
+exports.DoctorResultSchema = zod_1.z.object({
+    packages: zod_1.z.array(exports.PackageInfoSchema),
+    xmcpUpstream: exports.XMCPUpstreamInfoSchema,
+    environment: exports.EnvironmentInfoSchema,
+    kta: exports.KTAInfoSchema,
+    cache: exports.CacheInfoSchema,
+});
+exports.ScaffolderOptionsSchema = zod_1.z.object({
+    projectName: zod_1.z.string().min(1),
+    xmcpVersion: zod_1.z.string().optional(),
+    xmcpChannel: zod_1.z.enum(["latest", "next"]).optional(),
+    noIdentity: zod_1.z.boolean().default(false),
+});
+exports.ScaffolderResultSchema = zod_1.z.object({
+    success: zod_1.z.boolean(),
+    projectPath: zod_1.z.string().min(1),
+    xmcpVersion: zod_1.z.string().min(1),
+    identityEnabled: zod_1.z.boolean(),
+    warnings: zod_1.z.array(zod_1.z.string()).optional(),
+});
+// Error codes as string literal union
+exports.ERROR_CODES = {
+    XMCP_I_EBADPROOF: "XMCP_I_EBADPROOF",
+    XMCP_I_ENOIDENTITY: "XMCP_I_ENOIDENTITY",
+    XMCP_I_EMIRRORPENDING: "XMCP_I_EMIRRORPENDING",
+    XMCP_I_EHANDSHAKE: "XMCP_I_EHANDSHAKE",
+    XMCP_I_ESESSION: "XMCP_I_ESESSION",
+    XMCP_I_ECLAIM: "XMCP_I_ECLAIM",
+    XMCP_I_ECONFIG: "XMCP_I_ECONFIG",
+    XMCP_I_ERUNTIME: "XMCP_I_ERUNTIME",
+};
+// CLI exit codes
+exports.CLI_EXIT_CODES = {
+    SUCCESS: 0,
+    GENERAL_ERROR: 1,
+    BADPROOF: 20,
+    NOIDENTITY: 21,
+    HANDSHAKE: 22,
+    SESSION: 23,
+    CLAIM: 24,
+    CONFIG: 25,
+    RUNTIME: 26,
+};
+/**
+ * `/api/v1/cli/*` wire schemas: Checkpoint's CLI provisioning API (the
+ * KYA-1003 init-CLI epic, Phase 1). Anonymous provisioning mints an
+ * unclaimed, observe-only project with a single-use claim URL; a caller
+ * holding a claimed `cliToken` provisions directly into its org.
+ *
+ * First-pass contract, drafted from the checkpoint plan doc so the CLI
+ * side (packages/cli's utils/cli-kit/claim-polling.ts, packages/id's future
+ * `init` command) has a stable shape to build against; the checkpoint
+ * route handlers (owned separately) must validate against these same
+ * schemas so the two sides can't drift — see CLAUDE.md's API parity
+ * requirements before changing either side.
+ *
+ * SECURITY NOTE for the route-handler implementer (checkpoint plan doc
+ * Phase 1F already calls for a security review of the unclaimed-project
+ * lifecycle before shipping — this is that review's starting checklist,
+ * not a substitute for it): the anonymous request below is unauthenticated
+ * and idempotent on `resourceId` alone, and `resourceId` is typically a
+ * public, guessable value (a repo slug). Re-provisioning must not hand out
+ * the SAME apiKey/claimUrl/pollToken to a second caller who merely guesses
+ * an existing `resourceId` — bind idempotency to something the original
+ * caller holds (e.g. re-require the previously-issued `pollToken`), not to
+ * `resourceId` in isolation. Likewise the claim-status poll has no request
+ * schema here because it's a GET keyed on `pollToken` as a bearer value;
+ * treat it accordingly (short TTL, single active token per project, rate
+ * limited) rather than adding a body schema that implies otherwise.
+ */
+// Mirrors -- without importing, since @kya-os/contracts must stay
+// dependency-free and packages/cli already depends on contracts, making
+// the reverse import circular -- API_KEY_RE / PROJECT_ID_RE / isHttpUrl
+// in packages/cli/src/utils/checkpoint-api.ts (the sibling KYA-1037
+// checkpoint-init claim flow's parse-time guards, added there after a
+// Bugbot review on PR #658 for this exact newline-injection /
+// non-http-scheme shape). Keep both in sync if either side's shape
+// changes.
+//
+// The two live API-key formats the server mints (credentials.mdx): sk_...
+// for current keys, as_... as a real legacy format some paths still
+// generate.
+const CLI_API_KEY_RE = /^(sk|as)_[A-Za-z0-9._-]+$/;
+// Shared "safe opaque token" shape for projectId/cliToken/pollToken: once
+// the Checkpoint CLI writes these into a .env file or a scaffold snippet,
+// an unvalidated newline could inject a rogue env line or break out of
+// the snippet, so the charset is restricted to what can never do that.
+// Exported: `cli-read/projects.ts` reuses this same shape for its own
+// wire-response project id, rather than a second hand-rolled regex for
+// the identical "opaque identifier, no breakout characters" contract.
+exports.CLI_OPAQUE_TOKEN_RE = /^[A-Za-z0-9._-]+$/;
+/**
+ * True for an http(s) URL only -- never file:, vscode:, or any other
+ * scheme an OS protocol handler might act on unexpectedly.
+ *
+ * Exported (an `/sm2` finding on PR #715): `cli-read/settings.ts` had its
+ * own hand-kept copy, justified by the SAME "contracts must stay
+ * dependency-free" reasoning the comment above gives for not importing
+ * `packages/cli/src/utils/checkpoint-api.ts`'s own separate copy -- but
+ * that reasoning is about not reaching OUT of this package into a
+ * downstream consumer, not about two files INSIDE `@kya-os/contracts`
+ * importing from each other. `CLI_OPAQUE_TOKEN_RE` right above already
+ * gets this right: exported once, reused by `cli-read/projects.ts`
+ * rather than hand-rolled a second time.
+ */
+function isHttpUrl(value) {
+    try {
+        const protocol = new URL(value).protocol;
+        return protocol === "http:" || protocol === "https:";
+    }
+    catch {
+        return false;
+    }
+}
+exports.CliProjectProvisionRequestSchema = zod_1.z.object({
+    /** Stable per-repo slug so re-running provisioning is idempotent. */
+    resourceId: zod_1.z.string().min(1),
+    /** Defaults server-side to the caller's package.json name when omitted. */
+    projectName: zod_1.z.string().min(1).optional(),
+});
+exports.CliProjectProvisionAnonymousResponseSchema = zod_1.z.object({
+    apiKey: zod_1.z.string().min(1).regex(CLI_API_KEY_RE, "Malformed apiKey"),
+    projectId: zod_1.z
+        .string()
+        .min(1)
+        .regex(exports.CLI_OPAQUE_TOKEN_RE, "Malformed projectId"),
+    claimUrl: zod_1.z
+        .string()
+        .url()
+        .refine(isHttpUrl, "claimUrl must be an http(s) URL"),
+    pollToken: zod_1.z
+        .string()
+        .min(1)
+        .regex(exports.CLI_OPAQUE_TOKEN_RE, "Malformed pollToken"),
+});
+exports.CliProjectProvisionAuthenticatedResponseSchema = zod_1.z.object({
+    apiKey: zod_1.z.string().min(1).regex(CLI_API_KEY_RE, "Malformed apiKey"),
+    projectId: zod_1.z
+        .string()
+        .min(1)
+        .regex(exports.CLI_OPAQUE_TOKEN_RE, "Malformed projectId"),
+    organizationId: zod_1.z.string().min(1),
+    dashboardUrl: zod_1.z
+        .string()
+        .url()
+        .refine(isHttpUrl, "dashboardUrl must be an http(s) URL"),
+});
+exports.CliClaimStatusPendingSchema = zod_1.z.object({
+    status: zod_1.z.literal("pending"),
+});
+exports.CliClaimStatusClaimedSchema = zod_1.z.object({
+    status: zod_1.z.literal("claimed"),
+    cliToken: zod_1.z.string().min(1).regex(exports.CLI_OPAQUE_TOKEN_RE, "Malformed cliToken"),
+    orgId: zod_1.z.string().min(1),
+    projectId: zod_1.z
+        .string()
+        .min(1)
+        .regex(exports.CLI_OPAQUE_TOKEN_RE, "Malformed projectId"),
+});
+exports.CliClaimStatusResponseSchema = zod_1.z.discriminatedUnion("status", [
+    exports.CliClaimStatusPendingSchema,
+    exports.CliClaimStatusClaimedSchema,
+]);

package/node_modules/@kya-os/contracts/dist/compute-binding.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Compute Binding Contracts
+ *
+ * Defines the interface for pluggable runtime bindings.
+ * The compute process is agnostic to what runs inside —
+ * OpenClaw is the first binding, but LangGraph, CrewAI, etc.
+ * can be added by implementing this interface.
+ *
+ * @package @kya-os/contracts/compute-binding
+ */
+import { z } from "zod";
+/**
+ * Supported compute binding types.
+ * Each binding knows how to install, configure, start, and health-check
+ * a specific agent runtime.
+ */
+export declare const ComputeBindingTypeSchema: z.ZodEnum<["openclaw", "langgraph", "crewai", "custom"]>;
+export type ComputeBindingType = z.infer<typeof ComputeBindingTypeSchema>;
+/**
+ * Runtime capabilities declaration.
+ * Each binding declares what it supports so the dashboard can
+ * show/hide UI features accordingly.
+ */
+export declare const RuntimeCapabilitiesSchema: z.ZodObject<{
+    /** Supports interactive chat */
+    chat: z.ZodBoolean;
+    /** Supports messaging channels (Telegram, Discord, Slack) */
+    channels: z.ZodBoolean;
+    /** Supports MCP tool use */
+    tools: z.ZodBoolean;
+    /** Supports personality/soul customization */
+    personality: z.ZodBoolean;
+    /** Supports persistent memory */
+    memory: z.ZodBoolean;
+}, "strip", z.ZodTypeAny, {
+    chat: boolean;
+    channels: boolean;
+    tools: boolean;
+    personality: boolean;
+    memory: boolean;
+}, {
+    chat: boolean;
+    channels: boolean;
+    tools: boolean;
+    personality: boolean;
+    memory: boolean;
+}>;
+export type RuntimeCapabilities = z.infer<typeof RuntimeCapabilitiesSchema>;

package/node_modules/@kya-os/contracts/dist/compute-binding.js

@@ -0,0 +1,42 @@
+"use strict";
+/**
+ * Compute Binding Contracts
+ *
+ * Defines the interface for pluggable runtime bindings.
+ * The compute process is agnostic to what runs inside —
+ * OpenClaw is the first binding, but LangGraph, CrewAI, etc.
+ * can be added by implementing this interface.
+ *
+ * @package @kya-os/contracts/compute-binding
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RuntimeCapabilitiesSchema = exports.ComputeBindingTypeSchema = void 0;
+const zod_1 = require("zod");
+/**
+ * Supported compute binding types.
+ * Each binding knows how to install, configure, start, and health-check
+ * a specific agent runtime.
+ */
+exports.ComputeBindingTypeSchema = zod_1.z.enum([
+    "openclaw",
+    "langgraph",
+    "crewai",
+    "custom",
+]);
+/**
+ * Runtime capabilities declaration.
+ * Each binding declares what it supports so the dashboard can
+ * show/hide UI features accordingly.
+ */
+exports.RuntimeCapabilitiesSchema = zod_1.z.object({
+    /** Supports interactive chat */
+    chat: zod_1.z.boolean(),
+    /** Supports messaging channels (Telegram, Discord, Slack) */
+    channels: zod_1.z.boolean(),
+    /** Supports MCP tool use */
+    tools: zod_1.z.boolean(),
+    /** Supports personality/soul customization */
+    personality: zod_1.z.boolean(),
+    /** Supports persistent memory */
+    memory: zod_1.z.boolean(),
+});