@kya-os/cli 2.0.0 → 2.0.3

package/node_modules/@kya-os/contracts/dist/handshake/github-credential-anchor.d.ts

@@ -0,0 +1,299 @@
+/**
+ * GitHub credential anchor — the hub wire format for review-loop P16
+ * ("single-account GitHub credential onboarding, anchored in the hub").
+ *
+ * The design this schema encodes (see `docs/single-account-github.md` in
+ * `@kya-os/cli` for the full writeup): one GitHub credential per person per
+ * machine, shared by every one of that person's agent profiles. The secret
+ * itself never leaves the machine — what gets anchored in the DIDComm hub is
+ * a signed record of the credential's FINGERPRINT and scope, bound to the
+ * profiles allowed to use it. That gives attribution and revocation
+ * awareness without custody: a hub that stores this anchor never holds
+ * anything that could reconstruct the token or the webhook secret.
+ *
+ * Lives on the `./handshake` subpath (not `./proof` — see the ambiguous-
+ * subpath note atop `handshake/schemas.ts`) because, like the DIDComm
+ * proof-of-possession types above it in that file, this is wire material
+ * shared between two independent implementors: `@kya-os/cli` produces an
+ * anchor and sends it, `@kya-os/compute`'s hub verifies and stores it. Pure
+ * Zod + string canonicalization only — `verifyGithubCredentialAnchorProof`,
+ * which needs `node:crypto`, lives in the separate `./handshake/verify`
+ * subpath instead of here, for the exact reason
+ * `review/verify.ts`'s module doc gives for the same split: `./handshake`
+ * is also imported by `@kya-os/mcp-i-cloudflare` (a Cloudflare Workers
+ * bundle with no `node:crypto`), so a Node-only function must never live in
+ * a file reachable from that barrel.
+ *
+ * @module @kya-os/contracts/handshake/github-credential-anchor
+ */
+import { z } from 'zod';
+export declare const GithubCredentialAnchorSchema: z.ZodObject<{
+    /** The GitHub account's login, e.g. "marshall-borham". Capped at 39 -- GitHub's own login length limit. */
+    githubLogin: z.ZodString;
+    /** sha256 hex digest of the token's raw bytes. Never the token itself. */
+    tokenFingerprint: z.ZodString;
+    /**
+     * sha256 hex digest of the webhook secret's raw bytes, when one has been
+     * generated (it always is at acquisition time — see the CLI's
+     * `github-credential.ts` — but an anchor minted for a rotation that
+     * predates the webhook secret's introduction may omit it).
+     */
+    webhookSecretFingerprint: z.ZodOptional<z.ZodString>;
+    /**
+     * Scopes as actually granted, e.g. ["repo", "admin:repo_hook"]. Array
+     * length capped at 50 -- GitHub's entire classic-scope universe is under
+     * 40 -- the same "cap an array a caller could otherwise submit unbounded"
+     * convention `review/schemas.ts`'s `ReviewVerdictBodySchema.findings` uses
+     * (`.max(500)` there); a real credential's scope list never approaches
+     * this, so hitting it means malformed input, not a thorough grant. Each
+     * element is ALSO capped at 256 chars (the longest real scope/permission
+     * string here, e.g. "Pull requests: Read & Write", is under 30) -- an
+     * authenticated sender otherwise controls each string's length
+     * independently of the array-length bound above.
+     */
+    scopes: z.ZodArray<z.ZodString, "many">;
+    /**
+     * Agent profile DIDs authorized to use this credential. Array length
+     * capped at 50 for the identical reason `scopes` is -- one person's real
+     * agent-profile count stays in the single digits. Each element capped at
+     * 256 chars for the identical per-element reason `scopes` is -- a real
+     * `did:web:...` or `did:key:...` value is well under 100 -- AND matched
+     * against {@link DID}: the length cap alone doesn't restrict character
+     * class, and the regex alone doesn't bound length.
+     */
+    agentDids: z.ZodArray<z.ZodString, "many">;
+    /** ISO-8601 timestamp of when this anchor was minted. */
+    createdAt: z.ZodString;
+    /**
+     * The prior anchor's `tokenFingerprint`, present exactly when this anchor
+     * supersedes a rotated-out credential. Absent for a first-ever anchor.
+     */
+    supersedes: z.ZodOptional<z.ZodString>;
+    /** Detached JWS over `getGithubCredentialAnchorSigningString(anchor)`, signed by one of `agentDids`' keys. */
+    proof: z.ZodObject<{
+        alg: z.ZodEnum<["Ed25519", "ES256"]>;
+        kid: z.ZodOptional<z.ZodString>;
+        signature: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        alg: "Ed25519" | "ES256";
+        signature: string;
+        kid?: string | undefined;
+    }, {
+        alg: "Ed25519" | "ES256";
+        signature: string;
+        kid?: string | undefined;
+    }>;
+}, "strip", z.ZodTypeAny, {
+    scopes: string[];
+    createdAt: string;
+    proof: {
+        alg: "Ed25519" | "ES256";
+        signature: string;
+        kid?: string | undefined;
+    };
+    githubLogin: string;
+    tokenFingerprint: string;
+    agentDids: string[];
+    webhookSecretFingerprint?: string | undefined;
+    supersedes?: string | undefined;
+}, {
+    scopes: string[];
+    createdAt: string;
+    proof: {
+        alg: "Ed25519" | "ES256";
+        signature: string;
+        kid?: string | undefined;
+    };
+    githubLogin: string;
+    tokenFingerprint: string;
+    agentDids: string[];
+    webhookSecretFingerprint?: string | undefined;
+    supersedes?: string | undefined;
+}>;
+export type GithubCredentialAnchor = z.infer<typeof GithubCredentialAnchorSchema>;
+/**
+ * The frame `@kya-os/cli` sends over an authenticated observer connection
+ * (see `hub-observer.ts`'s `ObserverHelloSchema`/challenge/proof framing —
+ * this message rides the SAME already-authenticated socket, after that
+ * handshake completes) to anchor a `GithubCredentialAnchor` in the hub.
+ */
+export declare const GithubCredentialAnchorMessageSchema: z.ZodObject<{
+    type: z.ZodLiteral<"credential_anchor">;
+    anchor: z.ZodObject<{
+        /** The GitHub account's login, e.g. "marshall-borham". Capped at 39 -- GitHub's own login length limit. */
+        githubLogin: z.ZodString;
+        /** sha256 hex digest of the token's raw bytes. Never the token itself. */
+        tokenFingerprint: z.ZodString;
+        /**
+         * sha256 hex digest of the webhook secret's raw bytes, when one has been
+         * generated (it always is at acquisition time — see the CLI's
+         * `github-credential.ts` — but an anchor minted for a rotation that
+         * predates the webhook secret's introduction may omit it).
+         */
+        webhookSecretFingerprint: z.ZodOptional<z.ZodString>;
+        /**
+         * Scopes as actually granted, e.g. ["repo", "admin:repo_hook"]. Array
+         * length capped at 50 -- GitHub's entire classic-scope universe is under
+         * 40 -- the same "cap an array a caller could otherwise submit unbounded"
+         * convention `review/schemas.ts`'s `ReviewVerdictBodySchema.findings` uses
+         * (`.max(500)` there); a real credential's scope list never approaches
+         * this, so hitting it means malformed input, not a thorough grant. Each
+         * element is ALSO capped at 256 chars (the longest real scope/permission
+         * string here, e.g. "Pull requests: Read & Write", is under 30) -- an
+         * authenticated sender otherwise controls each string's length
+         * independently of the array-length bound above.
+         */
+        scopes: z.ZodArray<z.ZodString, "many">;
+        /**
+         * Agent profile DIDs authorized to use this credential. Array length
+         * capped at 50 for the identical reason `scopes` is -- one person's real
+         * agent-profile count stays in the single digits. Each element capped at
+         * 256 chars for the identical per-element reason `scopes` is -- a real
+         * `did:web:...` or `did:key:...` value is well under 100 -- AND matched
+         * against {@link DID}: the length cap alone doesn't restrict character
+         * class, and the regex alone doesn't bound length.
+         */
+        agentDids: z.ZodArray<z.ZodString, "many">;
+        /** ISO-8601 timestamp of when this anchor was minted. */
+        createdAt: z.ZodString;
+        /**
+         * The prior anchor's `tokenFingerprint`, present exactly when this anchor
+         * supersedes a rotated-out credential. Absent for a first-ever anchor.
+         */
+        supersedes: z.ZodOptional<z.ZodString>;
+        /** Detached JWS over `getGithubCredentialAnchorSigningString(anchor)`, signed by one of `agentDids`' keys. */
+        proof: z.ZodObject<{
+            alg: z.ZodEnum<["Ed25519", "ES256"]>;
+            kid: z.ZodOptional<z.ZodString>;
+            signature: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            alg: "Ed25519" | "ES256";
+            signature: string;
+            kid?: string | undefined;
+        }, {
+            alg: "Ed25519" | "ES256";
+            signature: string;
+            kid?: string | undefined;
+        }>;
+    }, "strip", z.ZodTypeAny, {
+        scopes: string[];
+        createdAt: string;
+        proof: {
+            alg: "Ed25519" | "ES256";
+            signature: string;
+            kid?: string | undefined;
+        };
+        githubLogin: string;
+        tokenFingerprint: string;
+        agentDids: string[];
+        webhookSecretFingerprint?: string | undefined;
+        supersedes?: string | undefined;
+    }, {
+        scopes: string[];
+        createdAt: string;
+        proof: {
+            alg: "Ed25519" | "ES256";
+            signature: string;
+            kid?: string | undefined;
+        };
+        githubLogin: string;
+        tokenFingerprint: string;
+        agentDids: string[];
+        webhookSecretFingerprint?: string | undefined;
+        supersedes?: string | undefined;
+    }>;
+}, "strip", z.ZodTypeAny, {
+    type: "credential_anchor";
+    anchor: {
+        scopes: string[];
+        createdAt: string;
+        proof: {
+            alg: "Ed25519" | "ES256";
+            signature: string;
+            kid?: string | undefined;
+        };
+        githubLogin: string;
+        tokenFingerprint: string;
+        agentDids: string[];
+        webhookSecretFingerprint?: string | undefined;
+        supersedes?: string | undefined;
+    };
+}, {
+    type: "credential_anchor";
+    anchor: {
+        scopes: string[];
+        createdAt: string;
+        proof: {
+            alg: "Ed25519" | "ES256";
+            signature: string;
+            kid?: string | undefined;
+        };
+        githubLogin: string;
+        tokenFingerprint: string;
+        agentDids: string[];
+        webhookSecretFingerprint?: string | undefined;
+        supersedes?: string | undefined;
+    };
+}>;
+export type GithubCredentialAnchorMessage = z.infer<typeof GithubCredentialAnchorMessageSchema>;
+/** The hub's reply: whether the anchor was verified and stored. */
+export declare const GithubCredentialAnchorResultSchema: z.ZodObject<{
+    type: z.ZodLiteral<"credential_anchor_result">;
+    ok: z.ZodBoolean;
+    /** Present only when `ok` is false — never leaks anchor contents, just a reason. */
+    error: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    type: "credential_anchor_result";
+    ok: boolean;
+    error?: string | undefined;
+}, {
+    type: "credential_anchor_result";
+    ok: boolean;
+    error?: string | undefined;
+}>;
+export type GithubCredentialAnchorResult = z.infer<typeof GithubCredentialAnchorResultSchema>;
+/**
+ * Field order for the anchor's canonical signing string. Changing this order
+ * changes every existing anchor's signature — same rule `VERDICT_SIGNING_ORDER`
+ * in `review/canonicalize.ts` states for verdicts.
+ */
+export declare const GITHUB_CREDENTIAL_ANCHOR_SIGNING_ORDER: readonly ["domainTag", "githubLogin", "tokenFingerprint", "webhookSecretFingerprint", "scopes", "agentDids", "createdAt", "supersedes"];
+/** Domain-separation tag: the first token of every anchor signing string. */
+export declare const GITHUB_CREDENTIAL_ANCHOR_DOMAIN_TAG = "github-credential-anchor:v1";
+/**
+ * Build the canonical signing string for a `GithubCredentialAnchor` (minus
+ * its own `proof`), in `GITHUB_CREDENTIAL_ANCHOR_SIGNING_ORDER`: a fixed
+ * domain-separation tag, `githubLogin`, `tokenFingerprint`,
+ * `webhookSecretFingerprint` (or `"-"` when absent), sorted `scopes`, sorted
+ * `agentDids`, `createdAt`, and `supersedes` (or `"-"` when absent),
+ * newline-joined. `webhookSecretFingerprint` is covered by the signature for
+ * the same reason every other field is: an anchor that "binds" a webhook
+ * secret's fingerprint from day one (see the module doc) has to actually
+ * bind it -- an unsigned field an attacker could swap in transit without
+ * invalidating the proof would bind nothing.
+ *
+ * ### Worked example
+ *
+ * ```ts
+ * getGithubCredentialAnchorSigningString({
+ *   githubLogin: 'marshall-borham',
+ *   tokenFingerprint: 'a'.repeat(64),
+ *   scopes: ['repo', 'admin:repo_hook'],
+ *   agentDids: [
+ *     'did:web:knowthat.ai:agents:marshall-borham-claude',
+ *     'did:web:knowthat.ai:agents:marshall-borham-codex',
+ *   ],
+ *   createdAt: '2026-08-21T00:00:00.000Z',
+ * })
+ * // =>
+ * // 'github-credential-anchor:v1\n' +
+ * // '"marshall-borham"\n' +
+ * // '"aaaa...aaaa"\n' +                                    // JSON.stringify(tokenFingerprint)
+ * // '-\n' +                                                 // webhookSecretFingerprint absent
+ * // '["admin:repo_hook","repo"]\n' +                        // scopes, sorted then stringified
+ * // '["did:web:knowthat.ai:agents:marshall-borham-claude","did:web:knowthat.ai:agents:marshall-borham-codex"]\n' +
+ * // '"2026-08-21T00:00:00.000Z"\n' +
+ * // '-'                                                      // supersedes absent
+ * ```
+ */
+export declare function getGithubCredentialAnchorSigningString(a: Omit<GithubCredentialAnchor, 'proof'>): string;

package/node_modules/@kya-os/contracts/dist/handshake/github-credential-anchor.js

@@ -0,0 +1,200 @@
+"use strict";
+/**
+ * GitHub credential anchor — the hub wire format for review-loop P16
+ * ("single-account GitHub credential onboarding, anchored in the hub").
+ *
+ * The design this schema encodes (see `docs/single-account-github.md` in
+ * `@kya-os/cli` for the full writeup): one GitHub credential per person per
+ * machine, shared by every one of that person's agent profiles. The secret
+ * itself never leaves the machine — what gets anchored in the DIDComm hub is
+ * a signed record of the credential's FINGERPRINT and scope, bound to the
+ * profiles allowed to use it. That gives attribution and revocation
+ * awareness without custody: a hub that stores this anchor never holds
+ * anything that could reconstruct the token or the webhook secret.
+ *
+ * Lives on the `./handshake` subpath (not `./proof` — see the ambiguous-
+ * subpath note atop `handshake/schemas.ts`) because, like the DIDComm
+ * proof-of-possession types above it in that file, this is wire material
+ * shared between two independent implementors: `@kya-os/cli` produces an
+ * anchor and sends it, `@kya-os/compute`'s hub verifies and stores it. Pure
+ * Zod + string canonicalization only — `verifyGithubCredentialAnchorProof`,
+ * which needs `node:crypto`, lives in the separate `./handshake/verify`
+ * subpath instead of here, for the exact reason
+ * `review/verify.ts`'s module doc gives for the same split: `./handshake`
+ * is also imported by `@kya-os/mcp-i-cloudflare` (a Cloudflare Workers
+ * bundle with no `node:crypto`), so a Node-only function must never live in
+ * a file reachable from that barrel.
+ *
+ * @module @kya-os/contracts/handshake/github-credential-anchor
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GITHUB_CREDENTIAL_ANCHOR_DOMAIN_TAG = exports.GITHUB_CREDENTIAL_ANCHOR_SIGNING_ORDER = exports.GithubCredentialAnchorResultSchema = exports.GithubCredentialAnchorMessageSchema = exports.GithubCredentialAnchorSchema = void 0;
+exports.getGithubCredentialAnchorSigningString = getGithubCredentialAnchorSigningString;
+const zod_1 = require("zod");
+const signing_spec_js_1 = require("../proof/signing-spec.js");
+/** sha256 hex digest — 64 lowercase hex characters. */
+const SHA256_HEX = /^[0-9a-f]{64}$/;
+/**
+ * GitHub's own username rule: alphanumeric segments joined by single
+ * hyphens, never leading/trailing/doubled (a bare `.min(1).max(39)` admits
+ * any content up to that length -- newlines and other control characters
+ * included -- into a value that ends up in a signed wire record and later
+ * hub events; reject-not-sanitize at the schema, the same convention this
+ * package's other identifier fields already use, e.g.
+ * `identity/schemas.ts`'s `user_did`).
+ */
+const GITHUB_LOGIN = /^[a-zA-Z\d](?:[a-zA-Z\d]|-(?=[a-zA-Z\d])){0,38}$/;
+/**
+ * A DID's practical wire charset (`did:<method>:<method-specific-id>`,
+ * matching every `did:key:...`/`did:web:...` value this codebase actually
+ * produces) -- excludes newlines and other control characters for the
+ * identical reason {@link GITHUB_LOGIN} does.
+ */
+const DID = /^did:[a-z0-9]+:[A-Za-z0-9._:%-]+$/;
+exports.GithubCredentialAnchorSchema = zod_1.z.object({
+    /** The GitHub account's login, e.g. "marshall-borham". Capped at 39 -- GitHub's own login length limit. */
+    githubLogin: zod_1.z.string().regex(GITHUB_LOGIN),
+    /** sha256 hex digest of the token's raw bytes. Never the token itself. */
+    tokenFingerprint: zod_1.z.string().regex(SHA256_HEX),
+    /**
+     * sha256 hex digest of the webhook secret's raw bytes, when one has been
+     * generated (it always is at acquisition time — see the CLI's
+     * `github-credential.ts` — but an anchor minted for a rotation that
+     * predates the webhook secret's introduction may omit it).
+     */
+    webhookSecretFingerprint: zod_1.z.string().regex(SHA256_HEX).optional(),
+    /**
+     * Scopes as actually granted, e.g. ["repo", "admin:repo_hook"]. Array
+     * length capped at 50 -- GitHub's entire classic-scope universe is under
+     * 40 -- the same "cap an array a caller could otherwise submit unbounded"
+     * convention `review/schemas.ts`'s `ReviewVerdictBodySchema.findings` uses
+     * (`.max(500)` there); a real credential's scope list never approaches
+     * this, so hitting it means malformed input, not a thorough grant. Each
+     * element is ALSO capped at 256 chars (the longest real scope/permission
+     * string here, e.g. "Pull requests: Read & Write", is under 30) -- an
+     * authenticated sender otherwise controls each string's length
+     * independently of the array-length bound above.
+     */
+    scopes: zod_1.z.array(zod_1.z.string().min(1).max(256)).min(1).max(50),
+    /**
+     * Agent profile DIDs authorized to use this credential. Array length
+     * capped at 50 for the identical reason `scopes` is -- one person's real
+     * agent-profile count stays in the single digits. Each element capped at
+     * 256 chars for the identical per-element reason `scopes` is -- a real
+     * `did:web:...` or `did:key:...` value is well under 100 -- AND matched
+     * against {@link DID}: the length cap alone doesn't restrict character
+     * class, and the regex alone doesn't bound length.
+     */
+    agentDids: zod_1.z.array(zod_1.z.string().max(256).regex(DID)).min(1).max(50),
+    /** ISO-8601 timestamp of when this anchor was minted. */
+    createdAt: zod_1.z.string().datetime(),
+    /**
+     * The prior anchor's `tokenFingerprint`, present exactly when this anchor
+     * supersedes a rotated-out credential. Absent for a first-ever anchor.
+     */
+    supersedes: zod_1.z.string().regex(SHA256_HEX).optional(),
+    /** Detached JWS over `getGithubCredentialAnchorSigningString(anchor)`, signed by one of `agentDids`' keys. */
+    proof: signing_spec_js_1.DetachedJwsSchema,
+});
+/**
+ * The frame `@kya-os/cli` sends over an authenticated observer connection
+ * (see `hub-observer.ts`'s `ObserverHelloSchema`/challenge/proof framing —
+ * this message rides the SAME already-authenticated socket, after that
+ * handshake completes) to anchor a `GithubCredentialAnchor` in the hub.
+ */
+exports.GithubCredentialAnchorMessageSchema = zod_1.z.object({
+    type: zod_1.z.literal('credential_anchor'),
+    anchor: exports.GithubCredentialAnchorSchema,
+});
+/** The hub's reply: whether the anchor was verified and stored. */
+exports.GithubCredentialAnchorResultSchema = zod_1.z.object({
+    type: zod_1.z.literal('credential_anchor_result'),
+    ok: zod_1.z.boolean(),
+    /** Present only when `ok` is false — never leaks anchor contents, just a reason. */
+    error: zod_1.z.string().optional(),
+});
+/**
+ * Field order for the anchor's canonical signing string. Changing this order
+ * changes every existing anchor's signature — same rule `VERDICT_SIGNING_ORDER`
+ * in `review/canonicalize.ts` states for verdicts.
+ */
+exports.GITHUB_CREDENTIAL_ANCHOR_SIGNING_ORDER = [
+    'domainTag',
+    'githubLogin',
+    'tokenFingerprint',
+    'webhookSecretFingerprint',
+    'scopes',
+    'agentDids',
+    'createdAt',
+    'supersedes',
+];
+/** Domain-separation tag: the first token of every anchor signing string. */
+exports.GITHUB_CREDENTIAL_ANCHOR_DOMAIN_TAG = 'github-credential-anchor:v1';
+/**
+ * One canonicalization token: `JSON.stringify` of the value, or the literal
+ * `'-'` for an absent `supersedes`. Mirrors the technique in
+ * `review/canonicalize.ts`'s `canonicalToken` (JSON.stringify makes every
+ * token unambiguous — a raw newline, quote, or control character inside a
+ * string value can never appear literally in the joined output) with one
+ * addition: arrays (`scopes`, `agentDids`) are sorted first, so two anchors
+ * that grant the same set through a different acquisition order sign
+ * identically, then `JSON.stringify`d as a whole array — still unambiguous,
+ * since `JSON.stringify` of an array never collides with any other array's
+ * stringification for a fixed field order.
+ */
+function canonicalToken(value) {
+    if (value === undefined)
+        return '-';
+    if (Array.isArray(value))
+        return JSON.stringify([...value].sort());
+    return JSON.stringify(value);
+}
+/**
+ * Build the canonical signing string for a `GithubCredentialAnchor` (minus
+ * its own `proof`), in `GITHUB_CREDENTIAL_ANCHOR_SIGNING_ORDER`: a fixed
+ * domain-separation tag, `githubLogin`, `tokenFingerprint`,
+ * `webhookSecretFingerprint` (or `"-"` when absent), sorted `scopes`, sorted
+ * `agentDids`, `createdAt`, and `supersedes` (or `"-"` when absent),
+ * newline-joined. `webhookSecretFingerprint` is covered by the signature for
+ * the same reason every other field is: an anchor that "binds" a webhook
+ * secret's fingerprint from day one (see the module doc) has to actually
+ * bind it -- an unsigned field an attacker could swap in transit without
+ * invalidating the proof would bind nothing.
+ *
+ * ### Worked example
+ *
+ * ```ts
+ * getGithubCredentialAnchorSigningString({
+ *   githubLogin: 'marshall-borham',
+ *   tokenFingerprint: 'a'.repeat(64),
+ *   scopes: ['repo', 'admin:repo_hook'],
+ *   agentDids: [
+ *     'did:web:knowthat.ai:agents:marshall-borham-claude',
+ *     'did:web:knowthat.ai:agents:marshall-borham-codex',
+ *   ],
+ *   createdAt: '2026-08-21T00:00:00.000Z',
+ * })
+ * // =>
+ * // 'github-credential-anchor:v1\n' +
+ * // '"marshall-borham"\n' +
+ * // '"aaaa...aaaa"\n' +                                    // JSON.stringify(tokenFingerprint)
+ * // '-\n' +                                                 // webhookSecretFingerprint absent
+ * // '["admin:repo_hook","repo"]\n' +                        // scopes, sorted then stringified
+ * // '["did:web:knowthat.ai:agents:marshall-borham-claude","did:web:knowthat.ai:agents:marshall-borham-codex"]\n' +
+ * // '"2026-08-21T00:00:00.000Z"\n' +
+ * // '-'                                                      // supersedes absent
+ * ```
+ */
+function getGithubCredentialAnchorSigningString(a) {
+    const tokens = {
+        domainTag: exports.GITHUB_CREDENTIAL_ANCHOR_DOMAIN_TAG,
+        githubLogin: canonicalToken(a.githubLogin),
+        tokenFingerprint: canonicalToken(a.tokenFingerprint),
+        webhookSecretFingerprint: canonicalToken(a.webhookSecretFingerprint),
+        scopes: canonicalToken(a.scopes),
+        agentDids: canonicalToken(a.agentDids),
+        createdAt: canonicalToken(a.createdAt),
+        supersedes: canonicalToken(a.supersedes),
+    };
+    return exports.GITHUB_CREDENTIAL_ANCHOR_SIGNING_ORDER.map((field) => tokens[field]).join('\n');
+}

package/node_modules/@kya-os/contracts/dist/handshake/index.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Handshake Module Exports
+ *
+ * Session/handshake schemas, DIDComm proof-of-possession wire frames, agent
+ * harness wrapper wire frames, and the GitHub credential anchor wire format
+ * (folded in from the former flat `src/handshake.ts`, review-loop P20 phase
+ * 0 -- see that file's `@deprecated` shim for why).
+ *
+ * `./verify.ts` (the node:crypto-dependent GitHub credential anchor
+ * verifier) is deliberately NOT re-exported here: this barrel is also
+ * imported by `@kya-os/mcp-i-cloudflare`'s Cloudflare Workers bundle, which
+ * has no `node:crypto`. Import `@kya-os/contracts/handshake/verify` directly
+ * wherever the verify function itself is actually needed.
+ */
+export * from "./schemas.js";
+export * from "./github-credential-anchor.js";

package/node_modules/@kya-os/contracts/dist/handshake/index.js

@@ -0,0 +1,32 @@
+"use strict";
+/**
+ * Handshake Module Exports
+ *
+ * Session/handshake schemas, DIDComm proof-of-possession wire frames, agent
+ * harness wrapper wire frames, and the GitHub credential anchor wire format
+ * (folded in from the former flat `src/handshake.ts`, review-loop P20 phase
+ * 0 -- see that file's `@deprecated` shim for why).
+ *
+ * `./verify.ts` (the node:crypto-dependent GitHub credential anchor
+ * verifier) is deliberately NOT re-exported here: this barrel is also
+ * imported by `@kya-os/mcp-i-cloudflare`'s Cloudflare Workers bundle, which
+ * has no `node:crypto`. Import `@kya-os/contracts/handshake/verify` directly
+ * wherever the verify function itself is actually needed.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./schemas.js"), exports);
+__exportStar(require("./github-credential-anchor.js"), exports);