@kya-os/contracts 1.10.0 → 1.12.1

package/dist/agentshield-api/schemas.d.ts

@@ -87,6 +87,8 @@ export declare const proofSubmissionRequestSchema: z.ZodObject<{
             scopeId: z.ZodOptional<z.ZodString>;
             delegationRef: z.ZodOptional<z.ZodString>;
             clientDid: z.ZodOptional<z.ZodString>;
+            toolName: z.ZodOptional<z.ZodString>;
+            submissionOutcome: z.ZodOptional<z.ZodEnum<["success", "failure", "denied"]>>;
         }, "strip", z.ZodTypeAny, {
             did: string;
             kid: string;
@@ -100,6 +102,8 @@ export declare const proofSubmissionRequestSchema: z.ZodObject<{
             delegationRef?: string | undefined;
             outcome?: "allowed" | "denied" | "step_up_required" | "needs_authorization" | undefined;
             scopeId?: string | undefined;
+            toolName?: string | undefined;
+            submissionOutcome?: "success" | "denied" | "failure" | undefined;
         }, {
             did: string;
             kid: string;
@@ -113,6 +117,8 @@ export declare const proofSubmissionRequestSchema: z.ZodObject<{
             delegationRef?: string | undefined;
             outcome?: "allowed" | "denied" | "step_up_required" | "needs_authorization" | undefined;
             scopeId?: string | undefined;
+            toolName?: string | undefined;
+            submissionOutcome?: "success" | "denied" | "failure" | undefined;
         }>;
     }, "strip", z.ZodTypeAny, {
         jws: string;
@@ -129,6 +135,8 @@ export declare const proofSubmissionRequestSchema: z.ZodObject<{
             delegationRef?: string | undefined;
             outcome?: "allowed" | "denied" | "step_up_required" | "needs_authorization" | undefined;
             scopeId?: string | undefined;
+            toolName?: string | undefined;
+            submissionOutcome?: "success" | "denied" | "failure" | undefined;
         };
     }, {
         jws: string;
@@ -145,6 +153,8 @@ export declare const proofSubmissionRequestSchema: z.ZodObject<{
             delegationRef?: string | undefined;
             outcome?: "allowed" | "denied" | "step_up_required" | "needs_authorization" | undefined;
             scopeId?: string | undefined;
+            toolName?: string | undefined;
+            submissionOutcome?: "success" | "denied" | "failure" | undefined;
         };
     }>, "many">;
     context: z.ZodOptional<z.ZodObject<{
@@ -293,6 +303,8 @@ export declare const proofSubmissionRequestSchema: z.ZodObject<{
             delegationRef?: string | undefined;
             outcome?: "allowed" | "denied" | "step_up_required" | "needs_authorization" | undefined;
             scopeId?: string | undefined;
+            toolName?: string | undefined;
+            submissionOutcome?: "success" | "denied" | "failure" | undefined;
         };
     }[];
     delegation_id?: string | null | undefined;
@@ -340,6 +352,8 @@ export declare const proofSubmissionRequestSchema: z.ZodObject<{
             delegationRef?: string | undefined;
             outcome?: "allowed" | "denied" | "step_up_required" | "needs_authorization" | undefined;
             scopeId?: string | undefined;
+            toolName?: string | undefined;
+            submissionOutcome?: "success" | "denied" | "failure" | undefined;
         };
     }[];
     delegation_id?: string | null | undefined;

package/dist/cli.d.ts

@@ -431,3 +431,96 @@ export declare const CLI_EXIT_CODES: {
     readonly CONFIG: 25;
     readonly RUNTIME: 26;
 };
+export declare const CliProjectProvisionRequestSchema: z.ZodObject<{
+    /** Stable per-repo slug so re-running provisioning is idempotent. */
+    resourceId: z.ZodString;
+    /** Defaults server-side to the caller's package.json name when omitted. */
+    projectName: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    resourceId: string;
+    projectName?: string | undefined;
+}, {
+    resourceId: string;
+    projectName?: string | undefined;
+}>;
+export declare const CliProjectProvisionAnonymousResponseSchema: z.ZodObject<{
+    apiKey: z.ZodString;
+    projectId: z.ZodString;
+    claimUrl: z.ZodEffects<z.ZodString, string, string>;
+    pollToken: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    projectId: string;
+    claimUrl: string;
+    apiKey: string;
+    pollToken: string;
+}, {
+    projectId: string;
+    claimUrl: string;
+    apiKey: string;
+    pollToken: string;
+}>;
+export declare const CliProjectProvisionAuthenticatedResponseSchema: z.ZodObject<{
+    apiKey: z.ZodString;
+    projectId: z.ZodString;
+    organizationId: z.ZodString;
+    dashboardUrl: z.ZodEffects<z.ZodString, string, string>;
+}, "strip", z.ZodTypeAny, {
+    projectId: string;
+    apiKey: string;
+    organizationId: string;
+    dashboardUrl: string;
+}, {
+    projectId: string;
+    apiKey: string;
+    organizationId: string;
+    dashboardUrl: string;
+}>;
+export declare const CliClaimStatusPendingSchema: z.ZodObject<{
+    status: z.ZodLiteral<"pending">;
+}, "strip", z.ZodTypeAny, {
+    status: "pending";
+}, {
+    status: "pending";
+}>;
+export declare const CliClaimStatusClaimedSchema: z.ZodObject<{
+    status: z.ZodLiteral<"claimed">;
+    cliToken: z.ZodString;
+    orgId: z.ZodString;
+    projectId: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    status: "claimed";
+    projectId: string;
+    cliToken: string;
+    orgId: string;
+}, {
+    status: "claimed";
+    projectId: string;
+    cliToken: string;
+    orgId: string;
+}>;
+export declare const CliClaimStatusResponseSchema: z.ZodDiscriminatedUnion<"status", [z.ZodObject<{
+    status: z.ZodLiteral<"pending">;
+}, "strip", z.ZodTypeAny, {
+    status: "pending";
+}, {
+    status: "pending";
+}>, z.ZodObject<{
+    status: z.ZodLiteral<"claimed">;
+    cliToken: z.ZodString;
+    orgId: z.ZodString;
+    projectId: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    status: "claimed";
+    projectId: string;
+    cliToken: string;
+    orgId: string;
+}, {
+    status: "claimed";
+    projectId: string;
+    cliToken: string;
+    orgId: string;
+}>]>;
+export type CliProjectProvisionRequest = z.infer<typeof CliProjectProvisionRequestSchema>;
+export type CliProjectProvisionAnonymousResponse = z.infer<typeof CliProjectProvisionAnonymousResponseSchema>;
+export type CliProjectProvisionAuthenticatedResponse = z.infer<typeof CliProjectProvisionAuthenticatedResponseSchema>;
+export type CliClaimStatusResponse = z.infer<typeof CliClaimStatusResponseSchema>;

package/dist/cli.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CLI_EXIT_CODES = exports.ERROR_CODES = exports.ScaffolderResultSchema = exports.ScaffolderOptionsSchema = exports.DoctorResultSchema = exports.CacheInfoSchema = exports.KTAInfoSchema = exports.EnvironmentInfoSchema = exports.XMCPUpstreamInfoSchema = exports.PackageInfoSchema = exports.StatusReportSchema = exports.KeyRotationResultSchema = exports.CLIIdentityFileSchema = exports.KTARegistrationSchema = void 0;
+exports.CliClaimStatusResponseSchema = exports.CliClaimStatusClaimedSchema = exports.CliClaimStatusPendingSchema = exports.CliProjectProvisionAuthenticatedResponseSchema = exports.CliProjectProvisionAnonymousResponseSchema = exports.CliProjectProvisionRequestSchema = exports.CLI_EXIT_CODES = exports.ERROR_CODES = exports.ScaffolderResultSchema = exports.ScaffolderOptionsSchema = exports.DoctorResultSchema = exports.CacheInfoSchema = exports.KTAInfoSchema = exports.EnvironmentInfoSchema = exports.XMCPUpstreamInfoSchema = exports.PackageInfoSchema = exports.StatusReportSchema = exports.KeyRotationResultSchema = exports.CLIIdentityFileSchema = exports.KTARegistrationSchema = void 0;
 const zod_1 = require("zod");
 const identity_js_1 = require("./config/identity.js");
 /**
@@ -143,3 +143,110 @@ exports.CLI_EXIT_CODES = {
     CONFIG: 25,
     RUNTIME: 26,
 };
+/**
+ * `/api/v1/cli/*` wire schemas: Checkpoint's CLI provisioning API (the
+ * KYA-1003 init-CLI epic, Phase 1). Anonymous provisioning mints an
+ * unclaimed, observe-only project with a single-use claim URL; a caller
+ * holding a claimed `cliToken` provisions directly into its org.
+ *
+ * First-pass contract, drafted from the checkpoint plan doc so the CLI
+ * side (packages/cli's utils/cli-kit/claim-polling.ts, packages/id's future
+ * `init` command) has a stable shape to build against; the checkpoint
+ * route handlers (owned separately) must validate against these same
+ * schemas so the two sides can't drift — see CLAUDE.md's API parity
+ * requirements before changing either side.
+ *
+ * SECURITY NOTE for the route-handler implementer (checkpoint plan doc
+ * Phase 1F already calls for a security review of the unclaimed-project
+ * lifecycle before shipping — this is that review's starting checklist,
+ * not a substitute for it): the anonymous request below is unauthenticated
+ * and idempotent on `resourceId` alone, and `resourceId` is typically a
+ * public, guessable value (a repo slug). Re-provisioning must not hand out
+ * the SAME apiKey/claimUrl/pollToken to a second caller who merely guesses
+ * an existing `resourceId` — bind idempotency to something the original
+ * caller holds (e.g. re-require the previously-issued `pollToken`), not to
+ * `resourceId` in isolation. Likewise the claim-status poll has no request
+ * schema here because it's a GET keyed on `pollToken` as a bearer value;
+ * treat it accordingly (short TTL, single active token per project, rate
+ * limited) rather than adding a body schema that implies otherwise.
+ */
+// Mirrors -- without importing, since @kya-os/contracts must stay
+// dependency-free and packages/cli already depends on contracts, making
+// the reverse import circular -- API_KEY_RE / PROJECT_ID_RE / isHttpUrl
+// in packages/cli/src/utils/checkpoint-api.ts (the sibling KYA-1037
+// checkpoint-init claim flow's parse-time guards, added there after a
+// Bugbot review on PR #658 for this exact newline-injection /
+// non-http-scheme shape). Keep both in sync if either side's shape
+// changes.
+//
+// The two live API-key formats the server mints (credentials.mdx): sk_...
+// for current keys, as_... as a real legacy format some paths still
+// generate.
+const CLI_API_KEY_RE = /^(sk|as)_[A-Za-z0-9._-]+$/;
+// Shared "safe opaque token" shape for projectId/cliToken/pollToken: once
+// the Checkpoint CLI writes these into a .env file or a scaffold snippet,
+// an unvalidated newline could inject a rogue env line or break out of
+// the snippet, so the charset is restricted to what can never do that.
+const CLI_OPAQUE_TOKEN_RE = /^[A-Za-z0-9._-]+$/;
+/**
+ * True for an http(s) URL only -- never file:, vscode:, or any other
+ * scheme an OS protocol handler might act on unexpectedly.
+ */
+function isHttpUrl(value) {
+    try {
+        const protocol = new URL(value).protocol;
+        return protocol === "http:" || protocol === "https:";
+    }
+    catch {
+        return false;
+    }
+}
+exports.CliProjectProvisionRequestSchema = zod_1.z.object({
+    /** Stable per-repo slug so re-running provisioning is idempotent. */
+    resourceId: zod_1.z.string().min(1),
+    /** Defaults server-side to the caller's package.json name when omitted. */
+    projectName: zod_1.z.string().min(1).optional(),
+});
+exports.CliProjectProvisionAnonymousResponseSchema = zod_1.z.object({
+    apiKey: zod_1.z.string().min(1).regex(CLI_API_KEY_RE, "Malformed apiKey"),
+    projectId: zod_1.z
+        .string()
+        .min(1)
+        .regex(CLI_OPAQUE_TOKEN_RE, "Malformed projectId"),
+    claimUrl: zod_1.z
+        .string()
+        .url()
+        .refine(isHttpUrl, "claimUrl must be an http(s) URL"),
+    pollToken: zod_1.z
+        .string()
+        .min(1)
+        .regex(CLI_OPAQUE_TOKEN_RE, "Malformed pollToken"),
+});
+exports.CliProjectProvisionAuthenticatedResponseSchema = zod_1.z.object({
+    apiKey: zod_1.z.string().min(1).regex(CLI_API_KEY_RE, "Malformed apiKey"),
+    projectId: zod_1.z
+        .string()
+        .min(1)
+        .regex(CLI_OPAQUE_TOKEN_RE, "Malformed projectId"),
+    organizationId: zod_1.z.string().min(1),
+    dashboardUrl: zod_1.z
+        .string()
+        .url()
+        .refine(isHttpUrl, "dashboardUrl must be an http(s) URL"),
+});
+exports.CliClaimStatusPendingSchema = zod_1.z.object({
+    status: zod_1.z.literal("pending"),
+});
+exports.CliClaimStatusClaimedSchema = zod_1.z.object({
+    status: zod_1.z.literal("claimed"),
+    cliToken: zod_1.z.string().min(1).regex(CLI_OPAQUE_TOKEN_RE, "Malformed cliToken"),
+    orgId: zod_1.z.string().min(1),
+    projectId: zod_1.z
+        .string()
+        .min(1)
+        .regex(CLI_OPAQUE_TOKEN_RE, "Malformed projectId"),
+});
+exports.CliClaimStatusResponseSchema = zod_1.z.discriminatedUnion("status", [
+    exports.CliClaimStatusPendingSchema,
+    exports.CliClaimStatusClaimedSchema,
+]);

package/dist/handshake.d.ts

@@ -406,4 +406,81 @@ export type NonceCacheConfig = z.infer<typeof NonceCacheConfigSchema>;
 export declare const DEFAULT_SESSION_TTL_MINUTES = 30;
 export declare const DEFAULT_TIMESTAMP_SKEW_SECONDS = 120;
 export declare const NONCE_LENGTH_BYTES = 16;
+/**
+ * JWS `typ` header for a DIDComm proof-of-possession.
+ *
+ * A verifier MUST reject a proof whose `typ` differs. Without that check a JWS
+ * minted for some other purpose — an API token, a delegation credential — could
+ * be replayed as a possession proof, since both are signed by the same key.
+ */
+export declare const DIDCOMM_POP_TYP = "didcomm-pop+jwt";
+/** Signature algorithm. Ed25519 throughout the platform. */
+export declare const DIDCOMM_POP_ALG = "EdDSA";
+/**
+ * Claims a proof carries.
+ *
+ * `nonce` is the hub's challenge, which makes the proof fresh and single-use.
+ * `sub` binds it to the DID that presented the key, so a valid proof for one DID
+ * cannot be replayed as another's.
+ */
+export declare const DIDCommPopClaimsSchema: z.ZodObject<{
+    /** The exact nonce the hub issued. */
+    nonce: z.ZodString;
+    /** The DID being proven. */
+    sub: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    nonce: string;
+    sub: string;
+}, {
+    nonce: string;
+    sub: string;
+}>;
+export type DIDCommPopClaims = z.infer<typeof DIDCommPopClaimsSchema>;
+/**
+ * The `observe` frame an observer sends to attach to a hub.
+ *
+ * `did` and `publicKey` are optional on the wire because a hub may admit a
+ * loopback observer without them. When the hub requires authentication, both are
+ * needed: the DID to bind the proof to, and the key to verify the binding before
+ * a challenge is spent.
+ */
+export declare const ObserverHelloSchema: z.ZodObject<{
+    type: z.ZodLiteral<"observe">;
+    did: z.ZodOptional<z.ZodString>;
+    /** JSON-serialised public JWK. */
+    publicKey: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    type: "observe";
+    did?: string | undefined;
+    publicKey?: string | undefined;
+}, {
+    type: "observe";
+    did?: string | undefined;
+    publicKey?: string | undefined;
+}>;
+export type ObserverHello = z.infer<typeof ObserverHelloSchema>;
+/** The hub's challenge, and the answer to it. */
+export declare const DIDCommChallengeSchema: z.ZodObject<{
+    type: z.ZodLiteral<"challenge">;
+    nonce: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    type: "challenge";
+    nonce: string;
+}, {
+    type: "challenge";
+    nonce: string;
+}>;
+export type DIDCommChallenge = z.infer<typeof DIDCommChallengeSchema>;
+export declare const DIDCommProofSchema: z.ZodObject<{
+    type: z.ZodLiteral<"proof">;
+    /** Compact JWS over {@link DIDCommPopClaimsSchema}. */
+    jws: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    type: "proof";
+    jws: string;
+}, {
+    type: "proof";
+    jws: string;
+}>;
+export type DIDCommProof = z.infer<typeof DIDCommProofSchema>;
 export {};

package/dist/handshake.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.NONCE_LENGTH_BYTES = exports.DEFAULT_TIMESTAMP_SKEW_SECONDS = exports.DEFAULT_SESSION_TTL_MINUTES = exports.NonceCacheConfigSchema = exports.NonceCacheEntrySchema = exports.SessionContextSchema = exports.HandshakeRequestSchema = exports.MCPClientSessionInfoSchema = exports.MCPClientInfoSchema = exports.SessionIdentityStateSchema = void 0;
+exports.DIDCommProofSchema = exports.DIDCommChallengeSchema = exports.ObserverHelloSchema = exports.DIDCommPopClaimsSchema = exports.DIDCOMM_POP_ALG = exports.DIDCOMM_POP_TYP = exports.NONCE_LENGTH_BYTES = exports.DEFAULT_TIMESTAMP_SKEW_SECONDS = exports.DEFAULT_SESSION_TTL_MINUTES = exports.NonceCacheConfigSchema = exports.NonceCacheEntrySchema = exports.SessionContextSchema = exports.HandshakeRequestSchema = exports.MCPClientSessionInfoSchema = exports.MCPClientInfoSchema = exports.SessionIdentityStateSchema = void 0;
 const zod_1 = require("zod");
 /**
  * OAuth Identity schema (inlined to avoid ESM/CJS boundary issues with @kya-os/consent)
@@ -128,3 +128,75 @@ exports.NonceCacheConfigSchema = zod_1.z.object({
 exports.DEFAULT_SESSION_TTL_MINUTES = 30;
 exports.DEFAULT_TIMESTAMP_SKEW_SECONDS = 120;
 exports.NONCE_LENGTH_BYTES = 16; // 128-bit
+/* ────────────────────────────────────────────────────────────────────────────
+ * DIDComm proof-of-possession
+ *
+ * The wire format a connector uses to prove it holds the private half of the key
+ * it presented at handshake. The coordination hub challenges with a nonce; the
+ * connector returns a compact JWS over it.
+ *
+ * Lives here, on the `./handshake` subpath, rather than under `./proof`. Both
+ * `src/proof.ts` and `src/proof/index.ts` exist, so `@kya-os/contracts/proof` is
+ * ambiguous: Node follows the exports map to `dist/proof/index.js` while tsc
+ * resolves the flat `dist/proof.d.ts`, and a symbol added to only one of them
+ * type-checks in the dev config and fails the build. `./handshake` has no
+ * directory twin, and this IS handshake material.
+ *
+ * Shared because there are two implementors: the hub in @kya-os/compute verifies
+ * these, and @kya-os/cli produces one when its orchestrator daemon attaches as an
+ * observer. The CLI cannot depend on compute -- compute is PID 1 in a Fly worker,
+ * the CLI is a published package -- so without a shared spec the format would
+ * exist twice and drift the first time either side touched a header.
+ *
+ * Only the FORMAT is here; signing and verification stay with the sides holding
+ * keys, which is why this adds no crypto dependency.
+ *
+ * Related: #3147 (hello proof-of-possession)
+ * ──────────────────────────────────────────────────────────────────────────── */
+/**
+ * JWS `typ` header for a DIDComm proof-of-possession.
+ *
+ * A verifier MUST reject a proof whose `typ` differs. Without that check a JWS
+ * minted for some other purpose — an API token, a delegation credential — could
+ * be replayed as a possession proof, since both are signed by the same key.
+ */
+exports.DIDCOMM_POP_TYP = 'didcomm-pop+jwt';
+/** Signature algorithm. Ed25519 throughout the platform. */
+exports.DIDCOMM_POP_ALG = 'EdDSA';
+/**
+ * Claims a proof carries.
+ *
+ * `nonce` is the hub's challenge, which makes the proof fresh and single-use.
+ * `sub` binds it to the DID that presented the key, so a valid proof for one DID
+ * cannot be replayed as another's.
+ */
+exports.DIDCommPopClaimsSchema = zod_1.z.object({
+    /** The exact nonce the hub issued. */
+    nonce: zod_1.z.string().min(1),
+    /** The DID being proven. */
+    sub: zod_1.z.string().min(1),
+});
+/**
+ * The `observe` frame an observer sends to attach to a hub.
+ *
+ * `did` and `publicKey` are optional on the wire because a hub may admit a
+ * loopback observer without them. When the hub requires authentication, both are
+ * needed: the DID to bind the proof to, and the key to verify the binding before
+ * a challenge is spent.
+ */
+exports.ObserverHelloSchema = zod_1.z.object({
+    type: zod_1.z.literal('observe'),
+    did: zod_1.z.string().min(1).optional(),
+    /** JSON-serialised public JWK. */
+    publicKey: zod_1.z.string().min(1).optional(),
+});
+/** The hub's challenge, and the answer to it. */
+exports.DIDCommChallengeSchema = zod_1.z.object({
+    type: zod_1.z.literal('challenge'),
+    nonce: zod_1.z.string().min(1),
+});
+exports.DIDCommProofSchema = zod_1.z.object({
+    type: zod_1.z.literal('proof'),
+    /** Compact JWS over {@link DIDCommPopClaimsSchema}. */
+    jws: zod_1.z.string().min(1),
+});

package/dist/index.js

@@ -60,3 +60,4 @@ exports.SUPPORTED_XMCP_I_VERSION = "^1.0.0";
 // import { ... } from '@kya-os/contracts/identity'  // Phase 5: Identity resolution
 // import { ... } from '@kya-os/contracts/reputation' // Reputation scoring system
 // import { ... } from '@kya-os/contracts/policy'     // Agent policy configuration
+// import { ... } from '@kya-os/contracts/review'     // PR review verdicts

package/dist/molti/schemas.d.ts

@@ -76,8 +76,8 @@ export declare const moltiDeployRequestSchema: z.ZodObject<{
     enableReputation: z.ZodDefault<z.ZodBoolean>;
 }, "strip", z.ZodTypeAny, {
     projectName: string;
-    enableReputation: boolean;
     organizationId: string;
+    enableReputation: boolean;
     agentName?: string | undefined;
     agentDescription?: string | undefined;
     instanceType?: "basic" | "lite" | "standard-1" | "standard-2" | "standard-3" | "standard-4" | undefined;