@kya-os/cli 2.0.0 → 2.0.3

package/dist/sidecar/sidecar/src/ssh-key.js

@@ -0,0 +1,297 @@
+import { createHash, createPrivateKey, createPublicKey, sign } from "crypto";
+/**
+ * Conversion of a raw Ed25519 seed (as stored in .mcpi/identity.json) into
+ * OpenSSH key material usable as a git SSH signing key.
+ *
+ * The OpenSSH private key container format is documented in OpenSSH's
+ * PROTOCOL.key file. For an unencrypted Ed25519 key it is:
+ *
+ *   "openssh-key-v1\0"
+ *   string   ciphername  ("none")
+ *   string   kdfname     ("none")
+ *   string   kdfoptions  ("")
+ *   uint32   number of keys (1)
+ *   string   public key blob:  string "ssh-ed25519" + string pub(32)
+ *   string   private section:
+ *              uint32 checkint, uint32 checkint (identical)
+ *              string "ssh-ed25519"
+ *              string pub(32)
+ *              string seed||pub (64)
+ *              string comment
+ *              padding bytes 0x01 0x02 ... up to a multiple of 8
+ */
+const OPENSSH_MAGIC = "openssh-key-v1\0";
+const KEY_TYPE = "ssh-ed25519";
+// DER prefix that turns a raw 32-byte Ed25519 seed into a PKCS8 private key.
+const ED25519_PKCS8_PREFIX = Buffer.from("302e020100300506032b657004220420", "hex");
+function sshString(data) {
+    const buf = typeof data === "string" ? Buffer.from(data, "utf8") : data;
+    const len = Buffer.alloc(4);
+    len.writeUInt32BE(buf.length, 0);
+    return Buffer.concat([len, buf]);
+}
+function uint32(value) {
+    const buf = Buffer.alloc(4);
+    buf.writeUInt32BE(value >>> 0, 0);
+    return buf;
+}
+/**
+ * Turn a raw 32-byte Ed25519 seed into a Node private key.
+ *
+ * Exported because there is now a second consumer: the orchestrator daemon signs
+ * a proof-of-possession with this same key when it attaches to a coordination hub.
+ * One conversion, one length check, one DER prefix -- a second implementation of
+ * this is how a repo ends up with fifteen base58 decoders that disagree at the
+ * edges.
+ */
+export function ed25519PrivateKeyFromSeed(seed) {
+    if (seed.length !== 32) {
+        throw new Error(`Ed25519 seed must be 32 bytes, got ${seed.length} bytes`);
+    }
+    const pkcs8 = Buffer.concat([ED25519_PKCS8_PREFIX, seed]);
+    return createPrivateKey({ key: pkcs8, format: "der", type: "pkcs8" });
+}
+/** Derive the Ed25519 public key from a raw 32-byte seed using Node crypto. */
+export function deriveEd25519PublicKey(seed) {
+    const privateKey = ed25519PrivateKeyFromSeed(seed);
+    const jwk = createPublicKey(privateKey).export({ format: "jwk" });
+    // v8 ignore: Node always emits x for an Ed25519 public JWK; this guard
+    // only exists to fail loudly if that contract ever changes.
+    /* v8 ignore start */
+    if (!jwk.x) {
+        throw new Error("Failed to derive Ed25519 public key from seed");
+    }
+    /* v8 ignore stop */
+    return Buffer.from(jwk.x, "base64url");
+}
+function publicKeyBlob(publicKey) {
+    return Buffer.concat([sshString(KEY_TYPE), sshString(publicKey)]);
+}
+function buildPrivateKeyPem(seed, publicKey, comment, checkBytes) {
+    const check = checkBytes.subarray(0, 4);
+    let privateSection = Buffer.concat([
+        check,
+        check,
+        sshString(KEY_TYPE),
+        sshString(publicKey),
+        sshString(Buffer.concat([seed, publicKey])),
+        sshString(comment),
+    ]);
+    // Pad with 1, 2, 3, ... to the cipher block size (8 for "none").
+    const padLength = (8 - (privateSection.length % 8)) % 8;
+    if (padLength > 0) {
+        const padding = Buffer.alloc(padLength);
+        for (let i = 0; i < padLength; i++) {
+            padding[i] = i + 1;
+        }
+        privateSection = Buffer.concat([privateSection, padding]);
+    }
+    const body = Buffer.concat([
+        Buffer.from(OPENSSH_MAGIC, "utf8"),
+        sshString("none"),
+        sshString("none"),
+        sshString(""),
+        uint32(1),
+        sshString(publicKeyBlob(publicKey)),
+        sshString(privateSection),
+    ]);
+    const base64 = body.toString("base64");
+    const chunks = [];
+    for (let i = 0; i < base64.length; i += 70) {
+        chunks.push(base64.slice(i, i + 70));
+    }
+    const wrapped = chunks.join("\n");
+    return `-----BEGIN OPENSSH PRIVATE KEY-----\n${wrapped}\n-----END OPENSSH PRIVATE KEY-----\n`;
+}
+export function sshFingerprint(publicKey) {
+    const digest = createHash("sha256").update(publicKeyBlob(publicKey)).digest();
+    return `SHA256:${digest.toString("base64").replace(/=+$/, "")}`;
+}
+/**
+ * Fingerprint an already-on-disk authorized_keys style public key line
+ * (`"ssh-ed25519 AAAA... comment"`), without deriving it from a private key
+ * first. Used by `dco setup <slug>`, which wires signing for an
+ * agent's EXISTING key material instead of converting one from
+ * `.mcpi/identity.json` (that mode never reads a private key at all).
+ *
+ * The base64 body of an authorized_keys line already IS the SSH wire-format
+ * blob (`string "ssh-ed25519" + string pub(32)`) that `sshFingerprint` hashes
+ * for a freshly-derived key, so hashing it directly here reproduces the same
+ * fingerprint `dco setup`'s normal path would report for the same key.
+ */
+export function sshFingerprintFromPublicKeyLine(publicKeyLine) {
+    const body = publicKeyLine.trim().split(/\s+/)[1];
+    if (!body) {
+        throw new Error("Public key line has no base64 body");
+    }
+    const blob = Buffer.from(body, "base64");
+    const digest = createHash("sha256").update(blob).digest();
+    return `SHA256:${digest.toString("base64").replace(/=+$/, "")}`;
+}
+/**
+ * Decode a stored Ed25519 public key into its raw 32 bytes, tolerating the two
+ * encodings that appear across the ecosystem:
+ *  - raw base64 (32 bytes) as written by the local mcp-i IdentityManager, and
+ *  - multibase base64url with an "m" prefix as returned by the KTA registry
+ *    (see know-that-ai cli-register `encodePublicKey`).
+ * Returns null when the value is neither, so a defense-in-depth cross-check can
+ * skip rather than reject an unrecognized format. Disambiguation is exact: a
+ * raw 32-byte key always base64-decodes to 32 bytes, while a 44-char multibase
+ * string decodes to 33 under raw base64, so only the "m" branch yields 32.
+ */
+export function decodeEd25519PublicKey(value) {
+    const raw = Buffer.from(value, "base64");
+    if (raw.length === 32) {
+        return raw;
+    }
+    if (value.startsWith("m")) {
+        const multibase = Buffer.from(value.slice(1), "base64url");
+        if (multibase.length === 32) {
+            return multibase;
+        }
+    }
+    return null;
+}
+export function sshPublicKeyLine(publicKey, comment) {
+    return `${KEY_TYPE} ${publicKeyBlob(publicKey).toString("base64")} ${comment}`.trim();
+}
+/**
+ * Convert a base64 Ed25519 private key from identity.json into OpenSSH
+ * signing key material. Accepts either a 32-byte seed or a 64-byte
+ * libsodium-style secret key (seed || public key).
+ */
+export function convertEd25519ToSshKey(privateKeyBase64, comment, options = {}) {
+    const decoded = Buffer.from(privateKeyBase64, "base64");
+    let seed;
+    if (decoded.length === 32) {
+        seed = decoded;
+    }
+    else if (decoded.length === 64) {
+        seed = decoded.subarray(0, 32);
+    }
+    else {
+        throw new Error(`Unsupported Ed25519 private key length: ${decoded.length} bytes (expected 32 or 64)`);
+    }
+    const publicKey = deriveEd25519PublicKey(seed);
+    if (decoded.length === 64) {
+        const embedded = decoded.subarray(32);
+        if (!embedded.equals(publicKey)) {
+            throw new Error("Ed25519 private key is corrupt: embedded public key does not match the seed");
+        }
+    }
+    if (options.expectedPublicKeyBase64) {
+        // The stored key may be raw base64 (mcp-i) or multibase (KTA registry).
+        // Only reject on a decodable-but-different key; an unrecognized encoding
+        // is skipped because the seed-derived key is authoritative for signing.
+        const expected = decodeEd25519PublicKey(options.expectedPublicKeyBase64);
+        if (expected && !expected.equals(publicKey)) {
+            throw new Error("Identity file mismatch: derived public key does not match the stored public key");
+        }
+    }
+    // Derive the OpenSSH checkint deterministically from the public key rather
+    // than randomly, so the same identity always yields byte-identical key
+    // material. That lets callers detect a corrupt on-disk key by comparison
+    // and rewrite it (self-heal) while staying idempotent for a valid key. The
+    // checkint is an internal consistency marker, not security-sensitive.
+    const checkBytes = options.checkBytes ??
+        createHash("sha256").update(publicKey).digest().subarray(0, 4);
+    return {
+        privateKeyPem: buildPrivateKeyPem(seed, publicKey, comment, checkBytes),
+        publicKeyLine: sshPublicKeyLine(publicKey, comment),
+        fingerprint: sshFingerprint(publicKey),
+        publicKeyBase64: publicKey.toString("base64"),
+    };
+}
+/** Reads a length-prefixed SSH wire-format string (uint32 big-endian length + bytes). */
+function readSshString(buf, offset) {
+    const len = buf.readUInt32BE(offset.pos);
+    offset.pos += 4;
+    if (offset.pos + len > buf.length) {
+        throw new Error("Truncated OpenSSH private key");
+    }
+    const value = buf.subarray(offset.pos, offset.pos + len);
+    offset.pos += len;
+    return value;
+}
+function readSshUint32(buf, offset) {
+    const value = buf.readUInt32BE(offset.pos);
+    offset.pos += 4;
+    return value;
+}
+/**
+ * Inverse of `buildPrivateKeyPem`: recover the raw 32-byte Ed25519 seed (and
+ * public key) from an unencrypted OpenSSH private key of the exact shape
+ * this module writes. Used by `dco fix` (`fix.ts`) to sign a fix
+ * attestation's raw Ed25519 proof from the SAME file `signingKeyPath(slug)`
+ * already holds for git SSH commit signing, instead of requiring a second
+ * copy of the seed to exist on disk (agent-slug mode never has one — see
+ * `setup.ts`'s doc comment on that mode).
+ *
+ * Only supports the unencrypted single-key form this module itself
+ * produces (cipher "none", one key, type "ssh-ed25519"): refusing anything
+ * else is a deliberate fail-closed guard against parsing a key this code
+ * did not create, per the wire format documented at the top of this file.
+ */
+export function parseEd25519SshPrivateKeyPem(pem) {
+    const body = pem
+        .replace(/-----BEGIN OPENSSH PRIVATE KEY-----/, "")
+        .replace(/-----END OPENSSH PRIVATE KEY-----/, "")
+        .replace(/\s+/g, "");
+    const buf = Buffer.from(body, "base64");
+    const offset = { pos: 0 };
+    const magic = buf.subarray(0, OPENSSH_MAGIC.length).toString("utf8");
+    offset.pos = OPENSSH_MAGIC.length;
+    if (magic !== OPENSSH_MAGIC) {
+        throw new Error("Not an OpenSSH private key (bad magic)");
+    }
+    const cipherName = readSshString(buf, offset).toString("utf8");
+    const kdfName = readSshString(buf, offset).toString("utf8");
+    readSshString(buf, offset); // kdfoptions, unused for cipher "none"
+    const numKeys = readSshUint32(buf, offset);
+    if (cipherName !== "none" || kdfName !== "none" || numKeys !== 1) {
+        throw new Error("Unsupported OpenSSH private key: expected exactly one unencrypted key");
+    }
+    readSshString(buf, offset); // public key blob; the private section repeats this
+    const privateSection = readSshString(buf, offset);
+    const pOffset = { pos: 0 };
+    const check1 = readSshUint32(privateSection, pOffset);
+    const check2 = readSshUint32(privateSection, pOffset);
+    if (check1 !== check2) {
+        throw new Error("Corrupt OpenSSH private key: checkint mismatch");
+    }
+    const keyType = readSshString(privateSection, pOffset).toString("utf8");
+    if (keyType !== KEY_TYPE) {
+        throw new Error(`Unsupported OpenSSH private key type: ${keyType}`);
+    }
+    const publicKey = readSshString(privateSection, pOffset);
+    const seedAndPublic = readSshString(privateSection, pOffset);
+    if (seedAndPublic.length !== 64) {
+        throw new Error("Malformed Ed25519 private key section");
+    }
+    const seed = Buffer.from(seedAndPublic.subarray(0, 32));
+    const embeddedPublic = seedAndPublic.subarray(32);
+    if (!embeddedPublic.equals(publicKey)) {
+        throw new Error("Corrupt OpenSSH private key: embedded public key does not match the seed");
+    }
+    return { seed, publicKey: Buffer.from(publicKey) };
+}
+/**
+ * Sign `data` with a raw 32-byte Ed25519 seed via `node:crypto`'s native
+ * Ed25519 support (same PKCS8 DER wrapping `deriveEd25519PublicKey` uses to
+ * derive the public half). Companion to `parseEd25519SshPrivateKeyPem`: the
+ * only two places in `utils/dco/` that ever touch raw Ed25519 key material,
+ * so the signing itself stays confined to this module.
+ */
+export function signWithEd25519Seed(seed, data) {
+    if (seed.length !== 32) {
+        throw new Error(`Ed25519 seed must be 32 bytes, got ${seed.length} bytes`);
+    }
+    const pkcs8 = Buffer.concat([ED25519_PKCS8_PREFIX, seed]);
+    const privateKey = createPrivateKey({
+        key: pkcs8,
+        format: "der",
+        type: "pkcs8",
+    });
+    return sign(null, data, privateKey);
+}
+//# sourceMappingURL=ssh-key.js.map

package/dist/sidecar/sidecar/src/ssh-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssh-key.js","sourceRoot":"","sources":["../../../../sidecar/src/ssh-key.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAE7E;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,MAAM,aAAa,GAAG,kBAAkB,CAAC;AACzC,MAAM,QAAQ,GAAG,aAAa,CAAC;AAE/B,6EAA6E;AAC7E,MAAM,oBAAoB,GAAG,MAAM,CAAC,IAAI,CACtC,kCAAkC,EAClC,KAAK,CACN,CAAC;AAaF,SAAS,SAAS,CAAC,IAAqB;IACtC,MAAM,GAAG,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxE,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC5B,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACjC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC5B,GAAG,CAAC,aAAa,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAClC,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAY;IACpD,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,sCAAsC,IAAI,CAAC,MAAM,QAAQ,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC,CAAC;IAC1D,OAAO,gBAAgB,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,MAAM,UAAU,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAE/D,CAAC;IACF,uEAAuE;IACvE,4DAA4D;IAC5D,qBAAqB;IACrB,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,oBAAoB;IACpB,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,aAAa,CAAC,SAAiB;IACtC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,kBAAkB,CACzB,IAAY,EACZ,SAAiB,EACjB,OAAe,EACf,UAAkB;IAElB,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACxC,IAAI,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC;QACjC,KAAK;QACL,KAAK;QACL,SAAS,CAAC,QAAQ,CAAC;QACnB,SAAS,CAAC,SAAS,CAAC;QACpB,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;QAC3C,SAAS,CAAC,OAAO,CAAC;KACnB,CAAC,CAAC;IAEH,iEAAiE;IACjE,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACxD,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QAClB,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;YACnC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;QACD,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC;QAClC,SAAS,CAAC,MAAM,CAAC;QACjB,SAAS,CAAC,MAAM,CAAC;QACjB,SAAS,CAAC,EAAE,CAAC;QACb,MAAM,CAAC,CAAC,CAAC;QACT,SAAS,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QACnC,SAAS,CAAC,cAAc,CAAC;KAC1B,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACvC,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClC,OAAO,wCAAwC,OAAO,uCAAuC,CAAC;AAChG,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,SAAiB;IAC9C,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC9E,OAAO,UAAU,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC;AAClE,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,+BAA+B,CAAC,aAAqB;IACnE,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;IAC1D,OAAO,UAAU,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC;AAClE,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAa;IAClD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACzC,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACtB,OAAO,GAAG,CAAC;IACb,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;QAC3D,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YAC5B,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,SAAiB,EAAE,OAAe;IACjE,OAAO,GAAG,QAAQ,IAAI,aAAa,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,EAAE,CAAC,IAAI,EAAE,CAAC;AACxF,CAAC;AAaD;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,gBAAwB,EACxB,OAAe,EACf,UAA0B,EAAE;IAE5B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;IACxD,IAAI,IAAY,CAAC;IACjB,IAAI,OAAO,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC1B,IAAI,GAAG,OAAO,CAAC;IACjB,CAAC;SAAM,IAAI,OAAO,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACjC,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACjC,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CACb,2CAA2C,OAAO,CAAC,MAAM,4BAA4B,CACtF,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAE/C,IAAI,OAAO,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACtC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CACb,6EAA6E,CAC9E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;QACpC,wEAAwE;QACxE,yEAAyE;QACzE,wEAAwE;QACxE,MAAM,QAAQ,GAAG,sBAAsB,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;QACzE,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CACb,iFAAiF,CAClF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,uEAAuE;IACvE,yEAAyE;IACzE,2EAA2E;IAC3E,sEAAsE;IACtE,MAAM,UAAU,GACd,OAAO,CAAC,UAAU;QAClB,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAEjE,OAAO;QACL,aAAa,EAAE,kBAAkB,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,CAAC;QACvE,aAAa,EAAE,gBAAgB,CAAC,SAAS,EAAE,OAAO,CAAC;QACnD,WAAW,EAAE,cAAc,CAAC,SAAS,CAAC;QACtC,eAAe,EAAE,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;KAC9C,CAAC;AACJ,CAAC;AAED,yFAAyF;AACzF,SAAS,aAAa,CAAC,GAAW,EAAE,MAAuB;IACzD,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;IAChB,IAAI,MAAM,CAAC,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC;IACzD,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC;IAClB,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,GAAW,EAAE,MAAuB;IACzD,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3C,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;IAChB,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,4BAA4B,CAAC,GAAW;IAItD,MAAM,IAAI,GAAG,GAAG;SACb,OAAO,CAAC,qCAAqC,EAAE,EAAE,CAAC;SAClD,OAAO,CAAC,mCAAmC,EAAE,EAAE,CAAC;SAChD,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IAE1B,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACrE,MAAM,CAAC,GAAG,GAAG,aAAa,CAAC,MAAM,CAAC;IAClC,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5D,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,uCAAuC;IACnE,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC3C,IAAI,UAAU,KAAK,MAAM,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CACb,uEAAuE,CACxE,CAAC;IACJ,CAAC;IAED,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,oDAAoD;IAChF,MAAM,cAAc,GAAG,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,aAAa,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,aAAa,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IACtD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,OAAO,GAAG,aAAa,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACxE,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,yCAAyC,OAAO,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,SAAS,GAAG,aAAa,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IACzD,MAAM,aAAa,GAAG,aAAa,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IAC7D,IAAI,aAAa,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACxD,MAAM,cAAc,GAAG,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAClD,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,0EAA0E,CAC3E,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;AACrD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,IAAY;IAC5D,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,sCAAsC,IAAI,CAAC,MAAM,QAAQ,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,gBAAgB,CAAC;QAClC,GAAG,EAAE,KAAK;QACV,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,OAAO;KACd,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;AACtC,CAAC"}

package/node_modules/@kya-os/contracts/dist/agent-deployment-utils.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Managed Agent Deployment Utilities
+ *
+ * Crypto-dependent functions (didToSlug, didToFlyApp) isolated here
+ * to keep the main schema module (agent-deployment.ts) free of Node.js
+ * dependencies. This ensures pure Zod schemas like DidStringSchema and
+ * FlyRegionSchema remain portable across all runtimes.
+ *
+ * **Node.js only** — uses `crypto.createHash`. See JSDoc on each function.
+ *
+ * @package @kya-os/contracts/agent-deployment
+ */
+/**
+ * Derive a short, deterministic, DNS-safe slug from an agent DID.
+ *
+ * Format: "kya-{first 16 chars of SHA-256 hex}"
+ * Example: did:key:z6MkhaXg... -> "kya-a3f2b1c9d4e5f6a7"
+ *
+ * Collision probability: ~1 in 4.3 billion (16 hex chars = 64 bits, birthday bound).
+ * Safe for millions of agents.
+ *
+ * **Note**: Uses Node.js `crypto.createHash` intentionally. This function runs
+ * server-side only (AgentShield + deploy services), never in browser or edge runtimes.
+ * If edge support is needed in the future, swap to Web Crypto `subtle.digest`.
+ *
+ * @param did - The agent DID string (must start with "did:")
+ * @returns DNS-safe slug matching /^kya-[a-f0-9]{16}$/ (20 chars total)
+ * @throws {Error} If `did` is empty or does not start with "did:"
+ */
+export declare function didToSlug(did: string): string;
+/**
+ * Derive Fly app name from agent DID.
+ * Fly app names must be: lowercase, alphanumeric + hyphens, 1-30 chars.
+ * Our slugs are 20 chars — well within the limit.
+ *
+ * **Note**: Uses Node.js `crypto.createHash` via `didToSlug`. See `didToSlug` JSDoc
+ * for portability notes.
+ *
+ * @param did - The agent DID string (must start with "did:")
+ * @throws {Error} If `did` is empty or does not start with "did:"
+ */
+export declare function didToFlyApp(did: string): string;
+/**
+ * Derive a readable, DNS-safe Fly app name from an agent name + DID.
+ *
+ * Format: "kya-{name[:19]}-{first 6 hex chars of SHA-256 of DID}"
+ * Example: ("researcher", "did:key:z6Mk...") → "kya-researcher-a3f2b1"
+ *
+ * Constraints:
+ *   "kya-" (4) + name[:19] (≤19) + "-" (1) + hash[:6] (6) = ≤30 chars
+ *   Fly app name hard limit: 30 chars ✓
+ *
+ * Uniqueness: 6 hex chars = 24 bits → birthday collision at ~4,096 agents
+ * sharing the exact same human name. Safe for production scale.
+ *
+ * Node.js only — same crypto constraint as didToSlug.
+ *
+ * @param name - Human-readable agent name from the deploy request
+ * @param did  - The agent DID string (must start with "did:")
+ * @throws {Error} If DID is invalid or name sanitizes to empty string
+ */
+export declare function nameToFlySlug(name: string, did: string): string;

package/node_modules/@kya-os/contracts/dist/agent-deployment-utils.js

@@ -0,0 +1,92 @@
+"use strict";
+/**
+ * Managed Agent Deployment Utilities
+ *
+ * Crypto-dependent functions (didToSlug, didToFlyApp) isolated here
+ * to keep the main schema module (agent-deployment.ts) free of Node.js
+ * dependencies. This ensures pure Zod schemas like DidStringSchema and
+ * FlyRegionSchema remain portable across all runtimes.
+ *
+ * **Node.js only** — uses `crypto.createHash`. See JSDoc on each function.
+ *
+ * @package @kya-os/contracts/agent-deployment
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.didToSlug = didToSlug;
+exports.didToFlyApp = didToFlyApp;
+exports.nameToFlySlug = nameToFlySlug;
+const crypto_1 = require("crypto");
+/**
+ * Derive a short, deterministic, DNS-safe slug from an agent DID.
+ *
+ * Format: "kya-{first 16 chars of SHA-256 hex}"
+ * Example: did:key:z6MkhaXg... -> "kya-a3f2b1c9d4e5f6a7"
+ *
+ * Collision probability: ~1 in 4.3 billion (16 hex chars = 64 bits, birthday bound).
+ * Safe for millions of agents.
+ *
+ * **Note**: Uses Node.js `crypto.createHash` intentionally. This function runs
+ * server-side only (AgentShield + deploy services), never in browser or edge runtimes.
+ * If edge support is needed in the future, swap to Web Crypto `subtle.digest`.
+ *
+ * @param did - The agent DID string (must start with "did:")
+ * @returns DNS-safe slug matching /^kya-[a-f0-9]{16}$/ (20 chars total)
+ * @throws {Error} If `did` is empty or does not start with "did:"
+ */
+function didToSlug(did) {
+    if (!did || typeof did !== "string" || !did.startsWith("did:")) {
+        throw new Error('didToSlug: expected a valid DID string starting with "did:"');
+    }
+    const hash = (0, crypto_1.createHash)("sha256").update(did).digest("hex");
+    return `kya-${hash.substring(0, 16)}`;
+}
+/**
+ * Derive Fly app name from agent DID.
+ * Fly app names must be: lowercase, alphanumeric + hyphens, 1-30 chars.
+ * Our slugs are 20 chars — well within the limit.
+ *
+ * **Note**: Uses Node.js `crypto.createHash` via `didToSlug`. See `didToSlug` JSDoc
+ * for portability notes.
+ *
+ * @param did - The agent DID string (must start with "did:")
+ * @throws {Error} If `did` is empty or does not start with "did:"
+ */
+function didToFlyApp(did) {
+    return didToSlug(did);
+}
+/**
+ * Derive a readable, DNS-safe Fly app name from an agent name + DID.
+ *
+ * Format: "kya-{name[:19]}-{first 6 hex chars of SHA-256 of DID}"
+ * Example: ("researcher", "did:key:z6Mk...") → "kya-researcher-a3f2b1"
+ *
+ * Constraints:
+ *   "kya-" (4) + name[:19] (≤19) + "-" (1) + hash[:6] (6) = ≤30 chars
+ *   Fly app name hard limit: 30 chars ✓
+ *
+ * Uniqueness: 6 hex chars = 24 bits → birthday collision at ~4,096 agents
+ * sharing the exact same human name. Safe for production scale.
+ *
+ * Node.js only — same crypto constraint as didToSlug.
+ *
+ * @param name - Human-readable agent name from the deploy request
+ * @param did  - The agent DID string (must start with "did:")
+ * @throws {Error} If DID is invalid or name sanitizes to empty string
+ */
+function nameToFlySlug(name, did) {
+    if (!did || typeof did !== "string" || !did.startsWith("did:")) {
+        throw new Error('nameToFlySlug: expected a valid DID string starting with "did:"');
+    }
+    const hash = (0, crypto_1.createHash)("sha256").update(did).digest("hex").substring(0, 6);
+    const slug = name
+        .toLowerCase()
+        .replace(/[^a-z0-9-]/g, "-") // non-alphanumeric → hyphen
+        .replace(/-{2,}/g, "-") // collapse consecutive hyphens
+        .replace(/^-+|-+$/g, "") // strip leading/trailing hyphens
+        .substring(0, 19)
+        .replace(/-+$/, ""); // strip trailing hyphens after truncation
+    if (!slug) {
+        throw new Error("nameToFlySlug: name sanitized to empty string");
+    }
+    return `kya-${slug}-${hash}`;
+}