@kya-os/cli 2.0.3 → 2.1.0

package/node_modules/@kya-os/contracts/dist/{agentshield-api → checkpoint-api}/schemas.d.ts

@@ -1,16 +1,16 @@
 /**
- * AgentShield/Bouncer API Zod Validation Schemas
+ * Checkpoint/Bouncer API Zod Validation Schemas
  *
  * Runtime validation schemas matching the API contract types.
  * These schemas ensure request/response validation before sending/receiving.
  *
- * @package @kya-os/contracts/agentshield-api
+ * @package @kya-os/contracts/checkpoint-api
  */
 import { z } from "zod";
 /**
  * Standard error schema
  */
-export declare const agentShieldAPIErrorSchema: z.ZodObject<{
+export declare const checkpointAPIErrorSchema: z.ZodObject<{
     code: z.ZodString;
     message: z.ZodString;
     details: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
@@ -26,7 +26,7 @@ export declare const agentShieldAPIErrorSchema: z.ZodObject<{
 /**
  * Standard API response wrapper schema
  */
-export declare const agentShieldAPIResponseSchema: <T extends z.ZodTypeAny>(dataSchema: T) => z.ZodObject<{
+export declare const checkpointAPIResponseSchema: <T extends z.ZodTypeAny>(dataSchema: T) => z.ZodObject<{
     success: z.ZodBoolean;
     data: T;
     metadata: z.ZodOptional<z.ZodObject<{
@@ -5895,10 +5895,10 @@ export declare const verifyDelegationAPIResponseSchema: z.ZodObject<{
     } | undefined;
 }>;
 /**
- * AgentShield tool protection schema (supports both snake_case and camelCase)
+ * Checkpoint tool protection schema (supports both snake_case and camelCase)
  * This is the API-specific format, not the MCP-I spec schema
  */
-export declare const agentShieldToolProtectionSchema: z.ZodObject<{
+export declare const checkpointToolProtectionSchema: z.ZodObject<{
     scopes: z.ZodArray<z.ZodString, "many">;
     requires_delegation: z.ZodOptional<z.ZodBoolean>;
     requiresDelegation: z.ZodOptional<z.ZodBoolean>;
@@ -6120,7 +6120,7 @@ export declare const toolProtectionConfigAPIResponseSchema: z.ZodObject<{
 /**
  * Create delegation request schema
  *
- * Note: AgentShield API accepts a simplified format, not the full DelegationRecord.
+ * Note: Checkpoint API accepts a simplified format, not the full DelegationRecord.
  * The API accepts: agent_did, scopes, expires_in_days, expires_at, session_id, project_id, user_identifier, custom_fields
  *
  * IMPORTANT: expires_in_days and expires_at are mutually exclusive - use one or the other, not both.
@@ -6176,7 +6176,7 @@ export declare const createDelegationRequestSchema: z.ZodEffects<z.ZodObject<{
  *
  * Canonical format returned by POST /api/v1/bouncer/delegations
  *
- * As of AgentShield v2.x, delegation_token (JWT) IS returned for stateless verification.
+ * As of Checkpoint v2.x, delegation_token (JWT) IS returned for stateless verification.
  * The JWT enables MCP-I servers to verify delegations without database lookups.
  */
 export declare const createDelegationResponseSchema: z.ZodObject<{
@@ -6476,7 +6476,6 @@ export declare const registerSessionRequestSchema: z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
     session_id: string;
     agent_did: string;
-    project_id: string;
     created_at: number;
     client_info: {
         name: string;
@@ -6485,6 +6484,7 @@ export declare const registerSessionRequestSchema: z.ZodObject<{
         vendor?: string | undefined;
         protocol_version?: string | undefined;
     };
+    project_id: string;
     agent_name?: string | undefined;
     client_identity?: {
         registered: boolean;
@@ -6496,7 +6496,6 @@ export declare const registerSessionRequestSchema: z.ZodObject<{
 }, {
     session_id: string;
     agent_did: string;
-    project_id: string;
     created_at: number;
     client_info: {
         name: string;
@@ -6505,6 +6504,7 @@ export declare const registerSessionRequestSchema: z.ZodObject<{
         vendor?: string | undefined;
         protocol_version?: string | undefined;
     };
+    project_id: string;
     agent_name?: string | undefined;
     client_identity?: {
         registered: boolean;

package/node_modules/@kya-os/contracts/dist/{agentshield-api → checkpoint-api}/schemas.js

@@ -1,21 +1,21 @@
 "use strict";
 /**
- * AgentShield/Bouncer API Zod Validation Schemas
+ * Checkpoint/Bouncer API Zod Validation Schemas
  *
  * Runtime validation schemas matching the API contract types.
  * These schemas ensure request/response validation before sending/receiving.
  *
- * @package @kya-os/contracts/agentshield-api
+ * @package @kya-os/contracts/checkpoint-api
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.registerSessionAPIResponseSchema = exports.registerSessionResponseSchema = exports.registerSessionRequestSchema = exports.sessionClientIdentitySchema = exports.sessionClientInfoSchema = exports.revokeDelegationAPIResponseSchema = exports.revokeDelegationResponseSchema = exports.revokeDelegationRequestSchema = exports.createDelegationAPIResponseSchema = exports.createDelegationResponseSchema = exports.createDelegationRequestSchema = exports.toolProtectionConfigAPIResponseSchema = exports.toolProtectionConfigResponseSchema = exports.agentShieldToolProtectionSchema = exports.verifyDelegationAPIResponseSchema = exports.verifyDelegationResponseSchema = exports.verifyDelegationRequestSchema = exports.delegationCredentialSchema = exports.proofSubmissionResponseSchema = exports.proofSubmissionRequestSchema = exports.agentShieldAPIResponseSchema = exports.agentShieldAPIErrorSchema = void 0;
+exports.registerSessionAPIResponseSchema = exports.registerSessionResponseSchema = exports.registerSessionRequestSchema = exports.sessionClientIdentitySchema = exports.sessionClientInfoSchema = exports.revokeDelegationAPIResponseSchema = exports.revokeDelegationResponseSchema = exports.revokeDelegationRequestSchema = exports.createDelegationAPIResponseSchema = exports.createDelegationResponseSchema = exports.createDelegationRequestSchema = exports.toolProtectionConfigAPIResponseSchema = exports.toolProtectionConfigResponseSchema = exports.checkpointToolProtectionSchema = exports.verifyDelegationAPIResponseSchema = exports.verifyDelegationResponseSchema = exports.verifyDelegationRequestSchema = exports.delegationCredentialSchema = exports.proofSubmissionResponseSchema = exports.proofSubmissionRequestSchema = exports.checkpointAPIResponseSchema = exports.checkpointAPIErrorSchema = void 0;
 const zod_1 = require("zod");
 const index_js_1 = require("../proof/index.js");
 const index_js_2 = require("../delegation/index.js");
 /**
  * Standard error schema
  */
-exports.agentShieldAPIErrorSchema = zod_1.z.object({
+exports.checkpointAPIErrorSchema = zod_1.z.object({
     code: zod_1.z.string(),
     message: zod_1.z.string(),
     details: zod_1.z.record(zod_1.z.unknown()).optional(),
@@ -23,7 +23,7 @@ exports.agentShieldAPIErrorSchema = zod_1.z.object({
 /**
  * Standard API response wrapper schema
  */
-const agentShieldAPIResponseSchema = (dataSchema) => zod_1.z.object({
+const checkpointAPIResponseSchema = (dataSchema) => zod_1.z.object({
     success: zod_1.z.boolean(),
     data: dataSchema,
     metadata: zod_1.z
@@ -33,12 +33,12 @@ const agentShieldAPIResponseSchema = (dataSchema) => zod_1.z.object({
     })
         .optional(),
 });
-exports.agentShieldAPIResponseSchema = agentShieldAPIResponseSchema;
+exports.checkpointAPIResponseSchema = checkpointAPIResponseSchema;
 // ============================================================================
 // Proof Submission Schemas
 // ============================================================================
 /**
- * Tool Call Context Schema (AgentShield Extension)
+ * Tool Call Context Schema (Checkpoint Extension)
  * Optional plaintext context for dashboard enrichment
  */
 const toolCallContextSchema = zod_1.z.object({
@@ -82,10 +82,10 @@ const consentEventContextSchema = zod_1.z.object({
  * Proof submission request schema
  */
 exports.proofSubmissionRequestSchema = zod_1.z.object({
-    session_id: zod_1.z.string().max(100), // AgentShield session ID (may differ from MCP-I sessionId)
+    session_id: zod_1.z.string().max(100), // Checkpoint session ID (may differ from MCP-I sessionId)
     delegation_id: zod_1.z.string().uuid().nullish(),
     proofs: zod_1.z.array(index_js_1.DetachedProofSchema).min(1),
-    // AgentShield extension: Optional context for dashboard enrichment
+    // Checkpoint extension: Optional context for dashboard enrichment
     context: zod_1.z
         .object({
         toolCalls: zod_1.z.array(toolCallContextSchema).optional(),
@@ -171,21 +171,21 @@ exports.verifyDelegationResponseSchema = zod_1.z.object({
     delegation: index_js_2.DelegationRecordSchema.optional(),
     delegation_id: zod_1.z.string().uuid().optional(),
     credential: exports.delegationCredentialSchema.optional(),
-    error: exports.agentShieldAPIErrorSchema.optional(),
+    error: exports.checkpointAPIErrorSchema.optional(),
     reason: zod_1.z.string().optional(),
 });
 /**
  * Wrapped verification response schema
  */
-exports.verifyDelegationAPIResponseSchema = (0, exports.agentShieldAPIResponseSchema)(exports.verifyDelegationResponseSchema);
+exports.verifyDelegationAPIResponseSchema = (0, exports.checkpointAPIResponseSchema)(exports.verifyDelegationResponseSchema);
 // ============================================================================
 // Tool Protection Configuration Schemas
 // ============================================================================
 /**
- * AgentShield tool protection schema (supports both snake_case and camelCase)
+ * Checkpoint tool protection schema (supports both snake_case and camelCase)
  * This is the API-specific format, not the MCP-I spec schema
  */
-exports.agentShieldToolProtectionSchema = zod_1.z
+exports.checkpointToolProtectionSchema = zod_1.z
     .object({
     scopes: zod_1.z.array(zod_1.z.string()),
     requires_delegation: zod_1.z.boolean().optional(),
@@ -198,7 +198,7 @@ exports.agentShieldToolProtectionSchema = zod_1.z
  */
 exports.toolProtectionConfigResponseSchema = zod_1.z.object({
     agent_did: zod_1.z.string(),
-    tools: zod_1.z.record(zod_1.z.string(), exports.agentShieldToolProtectionSchema),
+    tools: zod_1.z.record(zod_1.z.string(), exports.checkpointToolProtectionSchema),
     reputation_threshold: zod_1.z.number().min(0).max(1).optional(),
     denied_agents: zod_1.z.array(zod_1.z.string()).optional(),
     crisp_budget: zod_1.z
@@ -213,14 +213,14 @@ exports.toolProtectionConfigResponseSchema = zod_1.z.object({
 /**
  * Wrapped config response schema
  */
-exports.toolProtectionConfigAPIResponseSchema = (0, exports.agentShieldAPIResponseSchema)(exports.toolProtectionConfigResponseSchema);
+exports.toolProtectionConfigAPIResponseSchema = (0, exports.checkpointAPIResponseSchema)(exports.toolProtectionConfigResponseSchema);
 // ============================================================================
 // Delegation Management Schemas
 // ============================================================================
 /**
  * Create delegation request schema
  *
- * Note: AgentShield API accepts a simplified format, not the full DelegationRecord.
+ * Note: Checkpoint API accepts a simplified format, not the full DelegationRecord.
  * The API accepts: agent_did, scopes, expires_in_days, expires_at, session_id, project_id, user_identifier, custom_fields
  *
  * IMPORTANT: expires_in_days and expires_at are mutually exclusive - use one or the other, not both.
@@ -233,7 +233,7 @@ exports.createDelegationRequestSchema = zod_1.z
     expires_at: zod_1.z.string().datetime().optional(),
     session_id: zod_1.z.string().optional(),
     project_id: zod_1.z.string().uuid().optional(),
-    user_identifier: zod_1.z.string().max(200).optional(), // Matches AgentShield's max(200)
+    user_identifier: zod_1.z.string().max(200).optional(), // Matches Checkpoint's max(200)
     custom_fields: zod_1.z.record(zod_1.z.unknown()).optional(),
 })
     .passthrough()
@@ -251,7 +251,7 @@ exports.createDelegationRequestSchema = zod_1.z
  *
  * Canonical format returned by POST /api/v1/bouncer/delegations
  *
- * As of AgentShield v2.x, delegation_token (JWT) IS returned for stateless verification.
+ * As of Checkpoint v2.x, delegation_token (JWT) IS returned for stateless verification.
  * The JWT enables MCP-I servers to verify delegations without database lookups.
  */
 exports.createDelegationResponseSchema = zod_1.z.object({
@@ -260,11 +260,11 @@ exports.createDelegationResponseSchema = zod_1.z.object({
     user_id: zod_1.z.string().optional(),
     user_identifier: zod_1.z.string().optional(),
     scopes: zod_1.z.array(zod_1.z.string()),
-    status: zod_1.z.enum(['active', 'expired', 'revoked']), // Matches AgentShield's actual API behavior
+    status: zod_1.z.enum(['active', 'expired', 'revoked']), // Matches Checkpoint's actual API behavior
     issued_at: zod_1.z.string().datetime(),
-    expires_at: zod_1.z.string().datetime().nullable().optional(), // AgentShield allows null values
+    expires_at: zod_1.z.string().datetime().nullable().optional(), // Checkpoint allows null values
     created_at: zod_1.z.string().datetime(),
-    // JWT for stateless verification (added in AgentShield v2.x)
+    // JWT for stateless verification (added in Checkpoint v2.x)
     delegation_token: zod_1.z.string().optional(),
     token_type: zod_1.z.string().optional(), // "Bearer"
     expires_in: zod_1.z.number().int().positive().optional(), // Seconds until token expiry
@@ -272,7 +272,7 @@ exports.createDelegationResponseSchema = zod_1.z.object({
 /**
  * Wrapped creation response schema
  */
-exports.createDelegationAPIResponseSchema = (0, exports.agentShieldAPIResponseSchema)(exports.createDelegationResponseSchema);
+exports.createDelegationAPIResponseSchema = (0, exports.checkpointAPIResponseSchema)(exports.createDelegationResponseSchema);
 /**
  * Revoke delegation request schema
  */
@@ -290,7 +290,7 @@ exports.revokeDelegationResponseSchema = zod_1.z.object({
 /**
  * Wrapped revocation response schema
  */
-exports.revokeDelegationAPIResponseSchema = (0, exports.agentShieldAPIResponseSchema)(exports.revokeDelegationResponseSchema);
+exports.revokeDelegationAPIResponseSchema = (0, exports.checkpointAPIResponseSchema)(exports.revokeDelegationResponseSchema);
 // ============================================================================
 // Session Registration Schemas
 // ============================================================================
@@ -337,4 +337,4 @@ exports.registerSessionResponseSchema = zod_1.z.object({
 /**
  * Wrapped session registration response schema
  */
-exports.registerSessionAPIResponseSchema = (0, exports.agentShieldAPIResponseSchema)(exports.registerSessionResponseSchema);
+exports.registerSessionAPIResponseSchema = (0, exports.checkpointAPIResponseSchema)(exports.registerSessionResponseSchema);

package/node_modules/@kya-os/contracts/dist/{agentshield-api → checkpoint-api}/types.d.ts

@@ -1,17 +1,17 @@
 /**
- * AgentShield/Bouncer API Type Definitions
+ * Checkpoint/Bouncer API Type Definitions
  *
- * TypeScript interfaces matching the AgentShield dashboard API contract.
- * These types ensure parity between xmcp-i clients and the AgentShield service.
+ * TypeScript interfaces matching the Checkpoint dashboard API contract.
+ * These types ensure parity between xmcp-i clients and the Checkpoint service.
  *
- * @package @kya-os/contracts/agentshield-api
+ * @package @kya-os/contracts/checkpoint-api
  */
 import type { DetachedProof } from "../proof/index.js";
 import type { DelegationRecord } from "../delegation/index.js";
 /**
- * Standard AgentShield API response wrapper
+ * Standard Checkpoint API response wrapper
  */
-export interface AgentShieldAPIResponse<T> {
+export interface CheckpointAPIResponse<T> {
     success: boolean;
     data: T;
     metadata?: {
@@ -20,16 +20,16 @@ export interface AgentShieldAPIResponse<T> {
     };
 }
 /**
- * Standard AgentShield API error response structure
- * (Use AgentShieldAPIError class for runtime errors)
+ * Standard Checkpoint API error response structure
+ * (Use CheckpointAPIError class for runtime errors)
  */
-export interface AgentShieldAPIErrorResponse {
+export interface CheckpointAPIErrorResponse {
     code: string;
     message: string;
     details?: Record<string, unknown>;
 }
 /**
- * Tool Call Context (AgentShield Extension to MCP-I)
+ * Tool Call Context (Checkpoint Extension to MCP-I)
  *
  * Optional plaintext context for dashboard enrichment.
  * Links to MCP-I proof via scopeId.
@@ -72,11 +72,11 @@ export interface ConsentEventContext {
 export interface ProofSubmissionRequest {
     /** Delegation ID (nullable, optional - null if no delegation context) */
     delegation_id?: string | null;
-    /** Session ID for grouping proofs (AgentShield session ID, may differ from MCP-I sessionId) */
+    /** Session ID for grouping proofs (Checkpoint session ID, may differ from MCP-I sessionId) */
     session_id: string;
     /** Array of proofs to submit */
     proofs: DetachedProof[];
-    /** AgentShield extension: Optional context for dashboard enrichment */
+    /** Checkpoint extension: Optional context for dashboard enrichment */
     context?: {
         toolCalls?: ToolCallContext[];
         consentEvents?: ConsentEventContext[];
@@ -114,7 +114,7 @@ export interface VerifyDelegationRequest {
     /**
      * User DID for user-scoped delegation verification (RECOMMENDED)
      *
-     * When provided, AgentShield validates that the delegation belongs to this specific user.
+     * When provided, Checkpoint validates that the delegation belongs to this specific user.
      * This prevents cross-user delegation leakage where User B could use User A's delegation.
      *
      * Without user_did, verification relies on delegation_token alone which may not provide
@@ -167,18 +167,18 @@ export interface VerifyDelegationResponse {
     delegation?: DelegationRecord;
     delegation_id?: string;
     credential?: DelegationCredential;
-    error?: AgentShieldAPIErrorResponse;
+    error?: CheckpointAPIErrorResponse;
     reason?: string;
 }
 /**
- * Wrapped verification response (AgentShield wraps in success/data)
+ * Wrapped verification response (Checkpoint wraps in success/data)
  */
-export type VerifyDelegationAPIResponse = AgentShieldAPIResponse<VerifyDelegationResponse>;
+export type VerifyDelegationAPIResponse = CheckpointAPIResponse<VerifyDelegationResponse>;
 /**
- * AgentShield API tool protection format for a single tool
+ * Checkpoint API tool protection format for a single tool
  * This is the API-specific format, not the MCP-I spec type
  */
-export interface AgentShieldToolProtection {
+export interface CheckpointToolProtection {
     scopes: string[];
     requires_delegation?: boolean;
     requiresDelegation?: boolean;
@@ -190,7 +190,7 @@ export interface AgentShieldToolProtection {
  */
 export interface ToolProtectionConfigResponse {
     agent_did: string;
-    tools: Record<string, AgentShieldToolProtection>;
+    tools: Record<string, CheckpointToolProtection>;
     reputation_threshold?: number;
     denied_agents?: string[];
     crisp_budget?: {
@@ -203,12 +203,12 @@ export interface ToolProtectionConfigResponse {
 /**
  * Wrapped config response
  */
-export type ToolProtectionConfigAPIResponse = AgentShieldAPIResponse<ToolProtectionConfigResponse>;
+export type ToolProtectionConfigAPIResponse = CheckpointAPIResponse<ToolProtectionConfigResponse>;
 /**
  * Request body for creating a delegation
  * POST /api/v1/bouncer/delegations
  *
- * Note: AgentShield API accepts a simplified format, not the full DelegationRecord.
+ * Note: Checkpoint API accepts a simplified format, not the full DelegationRecord.
  * The API accepts: agent_did, scopes, expires_in_days, expires_at, session_id, project_id, user_identifier, custom_fields
  *
  * IMPORTANT: expires_in_days and expires_at are mutually exclusive - use one or the other, not both.
@@ -249,7 +249,7 @@ export interface CreateDelegationResponse {
 /**
  * Wrapped creation response
  */
-export type CreateDelegationAPIResponse = AgentShieldAPIResponse<CreateDelegationResponse>;
+export type CreateDelegationAPIResponse = CheckpointAPIResponse<CreateDelegationResponse>;
 /**
  * Request body for revoking a delegation
  * POST /api/v1/bouncer/delegations/{id}/revoke
@@ -268,7 +268,7 @@ export interface RevokeDelegationResponse {
 /**
  * Wrapped revocation response
  */
-export type RevokeDelegationAPIResponse = AgentShieldAPIResponse<RevokeDelegationResponse>;
+export type RevokeDelegationAPIResponse = CheckpointAPIResponse<RevokeDelegationResponse>;
 /**
  * MCP Client information from the initialize message
  */
@@ -306,7 +306,7 @@ export interface RegisterSessionRequest {
     agent_did: string;
     /** Human-readable agent name for dashboard display (optional) */
     agent_name?: string;
-    /** AgentShield project ID */
+    /** Checkpoint project ID */
     project_id: string;
     /** Unix timestamp in milliseconds when session was created */
     created_at: number;
@@ -333,11 +333,11 @@ export interface RegisterSessionResponse {
 /**
  * Wrapped session registration response
  */
-export type RegisterSessionAPIResponse = AgentShieldAPIResponse<RegisterSessionResponse>;
+export type RegisterSessionAPIResponse = CheckpointAPIResponse<RegisterSessionResponse>;
 /**
- * AgentShield API error class
+ * Checkpoint API error class
  */
-export declare class AgentShieldAPIError extends Error {
+export declare class CheckpointAPIError extends Error {
     readonly code: string;
     readonly details?: Record<string, unknown> | undefined;
     constructor(code: string, message: string, details?: Record<string, unknown> | undefined);

package/node_modules/@kya-os/contracts/dist/checkpoint-api/types.js

@@ -0,0 +1,26 @@
+"use strict";
+/**
+ * Checkpoint/Bouncer API Type Definitions
+ *
+ * TypeScript interfaces matching the Checkpoint dashboard API contract.
+ * These types ensure parity between xmcp-i clients and the Checkpoint service.
+ *
+ * @package @kya-os/contracts/checkpoint-api
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CheckpointAPIError = void 0;
+// ============================================================================
+// Error Types
+// ============================================================================
+/**
+ * Checkpoint API error class
+ */
+class CheckpointAPIError extends Error {
+    constructor(code, message, details) {
+        super(message);
+        this.code = code;
+        this.details = details;
+        this.name = "CheckpointAPIError";
+    }
+}
+exports.CheckpointAPIError = CheckpointAPIError;

package/node_modules/@kya-os/contracts/dist/compute.d.ts

@@ -1,7 +1,7 @@
 /**
  * Compute Process Contracts
  *
- * Schemas for the @kya-os/compute <-> AgentShield API communication.
+ * Schemas for the @kya-os/compute <-> Checkpoint API communication.
  * These define the heartbeat protocol, config bundle format,
  * and control server status frames.
  *
@@ -101,7 +101,7 @@ export declare const UpdateVersionCommandSchema: z.ZodObject<{
     };
 }>;
 /**
- * Command that Agent Shield can send to the compute process
+ * Command that Checkpoint can send to the compute process
  * via the heartbeat response.
  *
  * Discriminated union by `type` field:
@@ -149,7 +149,7 @@ export declare const ComputeCommandSchema: z.ZodDiscriminatedUnion<"type", [z.Zo
 }>]>;
 export type ComputeCommand = z.infer<typeof ComputeCommandSchema>;
 /**
- * Heartbeat response from Agent Shield.
+ * Heartbeat response from Checkpoint.
  * Returned by: POST /api/v1/molti/agents/{did}/heartbeat
  */
 export declare const HeartbeatResponseSchema: z.ZodObject<{
@@ -230,7 +230,7 @@ export declare const HeartbeatResponseSchema: z.ZodObject<{
 }>;
 export type HeartbeatResponse = z.infer<typeof HeartbeatResponseSchema>;
 /**
- * Config bundle returned by Agent Shield to the compute process.
+ * Config bundle returned by Checkpoint to the compute process.
  * Fetched on boot: GET /api/v1/molti/deployments/{did}/config-bundle
  * Auth: X-Heartbeat-Token header (for managed) or X-API-Key (for BYOK)
  *
@@ -338,7 +338,7 @@ export declare const ConfigBundleSchema: z.ZodObject<{
         /**
          * Optional base URL override. When set, OpenClaw routes all provider
          * traffic through this URL instead of the provider's default endpoint.
-         * Used by managed deployments where AgentShield issues a per-deployment
+         * Used by managed deployments where Checkpoint issues a per-deployment
          * gateway token and proxies to the upstream provider with budget tracking.
          */
         baseUrl: z.ZodOptional<z.ZodString>;

package/node_modules/@kya-os/contracts/dist/compute.js

@@ -2,7 +2,7 @@
 /**
  * Compute Process Contracts
  *
- * Schemas for the @kya-os/compute <-> AgentShield API communication.
+ * Schemas for the @kya-os/compute <-> Checkpoint API communication.
  * These define the heartbeat protocol, config bundle format,
  * and control server status frames.
  *
@@ -76,7 +76,7 @@ exports.UpdateVersionCommandSchema = zod_1.z
 })
     .strict();
 /**
- * Command that Agent Shield can send to the compute process
+ * Command that Checkpoint can send to the compute process
  * via the heartbeat response.
  *
  * Discriminated union by `type` field:
@@ -90,7 +90,7 @@ exports.ComputeCommandSchema = zod_1.z.discriminatedUnion("type", [
     exports.UpdateVersionCommandSchema,
 ]);
 /**
- * Heartbeat response from Agent Shield.
+ * Heartbeat response from Checkpoint.
  * Returned by: POST /api/v1/molti/agents/{did}/heartbeat
  */
 exports.HeartbeatResponseSchema = zod_1.z.object({
@@ -105,7 +105,7 @@ exports.HeartbeatResponseSchema = zod_1.z.object({
 // Config Bundle
 // ============================================================================
 /**
- * Config bundle returned by Agent Shield to the compute process.
+ * Config bundle returned by Checkpoint to the compute process.
  * Fetched on boot: GET /api/v1/molti/deployments/{did}/config-bundle
  * Auth: X-Heartbeat-Token header (for managed) or X-API-Key (for BYOK)
  *
@@ -164,7 +164,7 @@ exports.ConfigBundleSchema = zod_1.z.object({
         /**
          * Optional base URL override. When set, OpenClaw routes all provider
          * traffic through this URL instead of the provider's default endpoint.
-         * Used by managed deployments where AgentShield issues a per-deployment
+         * Used by managed deployments where Checkpoint issues a per-deployment
          * gateway token and proxies to the upstream provider with budget tracking.
          */
         baseUrl: zod_1.z.string().url().optional(),

package/node_modules/@kya-os/contracts/dist/config/builder.js

@@ -30,6 +30,8 @@ function buildBaseConfig(env) {
             environment,
             devIdentityPath: '.mcpi/identity.json'
         },
+        // Destinations and the verifier keep the former type name 'agentshield':
+        // runtimes released before 'checkpoint' existed read this config too.
         proofing: {
             enabled: true,
             batchQueue: {

package/node_modules/@kya-os/contracts/dist/config/delegation.d.ts

@@ -9,7 +9,7 @@
 /**
  * Delegation verifier types
  */
-export type DelegationVerifierType = 'agentshield' | 'kta' | 'memory' | 'cloudflare-kv' | 'redis' | 'dynamodb' | 'custom';
+export type DelegationVerifierType = 'checkpoint' | 'agentshield' | 'kta' | 'memory' | 'cloudflare-kv' | 'redis' | 'dynamodb' | 'custom';
 /**
  * Delegation verifier configuration
  * Controls how delegations are verified and cached

package/node_modules/@kya-os/contracts/dist/config/identity.d.ts

@@ -357,7 +357,7 @@ export interface OAuthProvider {
     scopes?: string[];
     /** Default scopes to request */
     defaultScopes?: string[];
-    /** Whether provider uses proxy mode (via AgentShield) */
+    /** Whether provider uses proxy mode (via Checkpoint) */
     proxyMode?: boolean;
     /** Custom OAuth parameters to include in authorization URL (e.g., audience, acr_values) */
     customParams?: Record<string, string>;
@@ -382,11 +382,11 @@ export interface OAuthProvider {
 /**
  * OAuth Configuration
  *
- * Configuration for OAuth providers fetched from AgentShield API.
+ * Configuration for OAuth providers fetched from Checkpoint API.
  * Contains all available providers for a project.
  *
  * The `configuredProvider` field indicates which provider (if any) has been
- * explicitly configured in the AgentShield dashboard for this project.
+ * explicitly configured in the Checkpoint dashboard for this project.
  * Phase 2+ requires tools to explicitly specify oauthProvider.
  */
 export interface OAuthConfig {
@@ -394,7 +394,7 @@ export interface OAuthConfig {
     providers: Record<string, OAuthProvider>;
     /**
      * The explicitly configured OAuth provider for this project.
-     * Null if no provider has been configured in AgentShield dashboard.
+     * Null if no provider has been configured in Checkpoint dashboard.
      * Used by ProviderResolver as fallback when tool doesn't specify oauthProvider.
      */
     configuredProvider?: string | null;

package/node_modules/@kya-os/contracts/dist/config/index.d.ts

@@ -24,7 +24,7 @@ export type { ToolExecutionContext, VerifiedDelegation, } from "./tool-context.j
 export type IdentityConfig = RuntimeIdentityConfig;
 export { ProofingConfig, ProofBatchQueueConfig, ProofDestination, ProofDestinationType, } from "./proofing.js";
 export { DelegationConfig, DelegationVerifierConfig, DelegationVerifierType, AuthorizationConfig, DelegationRecord, } from "./delegation.js";
-export { ToolProtection, ToolProtectionMap, ToolProtectionSourceConfig, ToolProtectionSourceType, ToolProtectionServiceConfig, DelegationRequiredErrorData, ToolProtectionResponse, } from "./tool-protection.js";
+export { ToolProtection, ToolProtectionMap, ToolProtectionSourceConfig, ToolProtectionCheckpointConfig, ToolProtectionSourceType, ToolProtectionServiceConfig, DelegationRequiredErrorData, ToolProtectionResponse, } from "./tool-protection.js";
 export { buildBaseConfig } from "./builder.js";
 export { DELEGATION_DENIAL_CODES, type DelegationDenialCode, } from "./delegation-denial.js";
 export { TOOL_REFUSAL_META_KEY, markToolRefusal, readToolRefusal, type ToolRefusal, type ToolRefusalMeta, } from "./tool-refusal.js";

package/node_modules/@kya-os/contracts/dist/config/proofing.d.ts

@@ -9,7 +9,8 @@
 /**
  * Proof destination types
  */
-export type ProofDestinationType = 'agentshield' | 'kta' | 'custom';
+/** `'agentshield'` is the former name of `'checkpoint'` and selects the same destination. */
+export type ProofDestinationType = 'checkpoint' | 'agentshield' | 'kta' | 'custom';
 /**
  * Proof destination configuration
  * Defines where proofs should be submitted
@@ -80,7 +81,7 @@ export interface ProofBatchQueueConfig {
  * Proofing configuration (platform-agnostic)
  *
  * Controls proof generation, batching, and submission to external services
- * like AgentShield or Know That AI (KTA).
+ * like Checkpoint or Know That AI (KTA).
  */
 export interface ProofingConfig {
     /**