@shield-agent/kya 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 The Pixel Boys / Shield Agent
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,108 @@
+# `@shield-agent/kya`
+
+Light install CLI and local MCP gate for **Know Your Agent** (Shield KYA).
+
+```bash
+npx @shield-agent/kya@latest --help
+```
+
+- **Provider-agnostic** — no core lock to a single collab host, cloud, or LLM.
+- **Zero vertical packs required** (R8) — disputes is optional.
+- **Sole PEP** — Shield evaluates; this gate never auto-approves irreversible side effects.
+- **Fail-closed** — empty `KYA_API_KEY` against an authenticated plane → non-zero exit.
+- **Offline demo** — `--offline` sample evaluate (DENY → REQUIRE_APPROVE) without paid cloud.
+
+## 15-minute path
+
+```bash
+# Offline demo (no account, no monorepo)
+npx @shield-agent/kya eval-tool --offline --tool-id org.sample.never.event --irreversible
+# → verdict: DENY
+npx @shield-agent/kya eval-tool --offline --tool-id org.sample.data.write --irreversible
+# → verdict: REQUIRE_APPROVE
+
+# Scaffold + local plane
+npx @shield-agent/kya init
+npx @shield-agent/kya register-agent --name solo-builder --version-hash dev-local
+npx @shield-agent/kya eval-tool --tool-id org.sample.never.event --irreversible
+npx @shield-agent/kya serve-mcp --stdio
+```
+
+Install hub: [https://shield-agent.com/install](https://shield-agent.com/install)
+
+## Dual plane
+
+```
+ host=ide (authoring)          host=runtime (production)
+        │                              │
+        └────────── same agent ────────┘
+                    identity
+                    policy evaluate  → ALLOW | DENY | REQUIRE_APPROVE
+                    approval + trail
+```
+
+Tag sessions with `KYA_HOST=ide` or `KYA_HOST=runtime`. Same sole PEP either way.
+
+## Environment
+
+| Variable | Required | Meaning |
+|----------|----------|---------|
+| `KYA_BASE_URL` | Yes (network cmds) | Control plane origin |
+| `KYA_API_KEY` | When auth is on | Bearer token |
+| `KYA_HOST` | No (default `ide`) | `ide` \| `runtime` |
+| `KYA_AGENT_ID` | After register | Agent principal id |
+| `KYA_MCP_PORT` | No (default `3920`) | HTTP MCP listen port |
+| `KYA_OFFLINE` | No | `1`/`true` for sample evaluate |
+
+## MCP tools
+
+| Tool | Role |
+|------|------|
+| `kya.policy_evaluate` | `ALLOW` \| `DENY` \| `REQUIRE_APPROVE` |
+| `kya.session_ingest` | Observe / raise-only risk |
+| `kya.request_approval` | Open human gate — **does not** execute side effect |
+
+MCP Registry: `server.json` + package `mcpName` `io.github.the-pixel-boys/shield-kya`.
+
+```json
+{
+  "mcpServers": {
+    "shield-kya": {
+      "command": "npx",
+      "args": ["-y", "@shield-agent/kya", "serve-mcp", "--stdio"],
+      "env": {
+        "KYA_BASE_URL": "http://127.0.0.1:8090",
+        "KYA_API_KEY": "${KYA_API_KEY}",
+        "KYA_HOST": "ide"
+      }
+    }
+  }
+}
+```
+
+## ORR (reporting only)
+
+```bash
+npx @shield-agent/kya orr run --path . --out ./orr-report --skip-optional-producers
+```
+
+ORR is a **reporting orchestrator**. Scanners are evidence. They never ALLOW high-stakes side effects (no dual PEP).
+
+## Enterprise (distinct tier)
+
+Pin private registry builds, multi-tenant density, ORR board ops, and support — **never** required for the day-1 npx path above.
+
+## Develop
+
+```bash
+pnpm install
+pnpm test
+pnpm build
+```
+
+## Docs
+
+- [Light install](../../docs/guides/kya-light-install.md)
+- [MCP snippets](../../docs/guides/kya-mcp-snippet.md)
+- [Local free console](../../docs/guides/kya-local-free.md)
+- [Public baseline](../../public/kya-baseline/README.md)

package/dist/cli.d.ts

@@ -0,0 +1,15 @@
+#!/usr/bin/env node
+/**
+ * @shield-agent/kya — light install CLI
+ * Commands: init | register-agent | eval-tool | serve-mcp | orr run
+ * Fail-closed: empty KYA_API_KEY against auth plane → non-zero exit.
+ * Offline sample: eval-tool --offline (demo only; not production PEP).
+ */
+export interface CliIo {
+    readonly log: (msg: string) => void;
+    readonly error: (msg: string) => void;
+    readonly exit: (code: number) => void;
+}
+/** Testable entry — does not call process.exit when custom io.exit is provided that throws. */
+export declare function runCli(argv: readonly string[], io?: CliIo, env?: NodeJS.ProcessEnv, cwd?: string): Promise<number>;
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;GAKG;AA0DH,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACtC,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACvC;AAQD,+FAA+F;AAC/F,wBAAsB,MAAM,CAC1B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,GAAE,KAAiB,EACrB,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,GAAG,GAAE,MAAsB,GAC1B,OAAO,CAAC,MAAM,CAAC,CAqJjB"}

package/dist/cli.js

@@ -0,0 +1,207 @@
+#!/usr/bin/env node
+/**
+ * @shield-agent/kya — light install CLI
+ * Commands: init | register-agent | eval-tool | serve-mcp | orr run
+ * Fail-closed: empty KYA_API_KEY against auth plane → non-zero exit.
+ * Offline sample: eval-tool --offline (demo only; not production PEP).
+ */
+import { realpathSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { resolveConfig } from "./config.js";
+import { KyaError } from "./errors.js";
+import { parseArgs } from "./parse-args.js";
+import { initFromArgs } from "./commands/init.js";
+import { registerAgentInputFromArgs, runRegisterAgent, } from "./commands/register-agent.js";
+import { evalToolInputFromArgs, formatEvalHuman, runEvalTool, } from "./commands/eval-tool.js";
+import { runServeMcp, serveMcpOptionsFromArgs, } from "./commands/serve-mcp.js";
+import { orrRunOptionsFromArgs, runOrr, } from "./commands/orr.js";
+const HELP = `Shield KYA light CLI — Know Your Agent (provider-agnostic)
+
+Usage:
+  kya <command> [options]
+
+Commands:
+  init              Scaffold .kya/ config + sample tools + .env.example
+  register-agent    POST /api/v1/kya/agents (stores agentId in .kya/config.json)
+  eval-tool         Policy evaluate (HTTP plane or --offline sample)
+  serve-mcp         Local MCP gate (HTTP default; --stdio for hosts)
+  orr run           Read-only ORR board (reporting only — not a second PEP)
+
+Options (shared):
+  --base-url <url>  Control plane origin (or KYA_BASE_URL)
+  --api-key <key>   API key (or KYA_API_KEY) — required for network commands
+  --host <ide|runtime>  Dual-plane host (or KYA_HOST, default ide)
+  --offline         Sample evaluate without network (eval-tool only)
+  --json            Machine-readable output
+  --help, -h        Show help
+
+Examples:
+  npx @shield-agent/kya init --base-url http://127.0.0.1:8090 --host ide
+  npx @shield-agent/kya eval-tool --offline --tool-id org.sample.never.event --irreversible
+  npx @shield-agent/kya eval-tool --offline --tool-id org.sample.data.write --irreversible
+  npx @shield-agent/kya register-agent --name solo-builder --version-hash dev-local
+  npx @shield-agent/kya serve-mcp --stdio
+  npx @shield-agent/kya orr run --path . --out ./orr-report --skip-optional-producers
+
+Docs: https://shield-agent.com/install · docs/guides/kya-light-install.md
+Doctrine: sole PEP is Shield; DENY is hard; missing APPROVED ⇒ no irreversible side effect.
+`;
+const defaultIo = {
+    log: (m) => console.log(m),
+    error: (m) => console.error(m),
+    exit: (c) => process.exit(c),
+};
+/** Testable entry — does not call process.exit when custom io.exit is provided that throws. */
+export async function runCli(argv, io = defaultIo, env = process.env, cwd = process.cwd()) {
+    const parsed = parseArgs(argv);
+    if (!parsed.command ||
+        parsed.command === "help" ||
+        parsed.flags["help"] === true ||
+        parsed.flags["h"] === true) {
+        io.log(HELP);
+        return 0;
+    }
+    try {
+        switch (parsed.command) {
+            case "init": {
+                const result = initFromArgs(parsed, cwd);
+                if (parsed.flags["json"] === true || parsed.flags["json"] === "true") {
+                    io.log(JSON.stringify(result, null, 2));
+                }
+                else {
+                    io.log("KYA light scaffold ready (zero vertical packs required)");
+                    for (const p of result.created)
+                        io.log(`  created: ${p}`);
+                    for (const p of result.skipped)
+                        io.log(`  exists:  ${p}`);
+                    io.log("Next: offline demo → npx @shield-agent/kya eval-tool --offline --tool-id org.sample.never.event --irreversible");
+                    io.log("Or: cp .env.example .env && set KYA_API_KEY, then register-agent");
+                }
+                return 0;
+            }
+            case "register-agent": {
+                const config = resolveConfig({
+                    cwd,
+                    env,
+                    flags: parsed.flags,
+                    requireApiKey: true,
+                });
+                const input = registerAgentInputFromArgs(parsed);
+                const result = await runRegisterAgent(config, input);
+                if (config.json) {
+                    io.log(JSON.stringify(result, null, 2));
+                }
+                else {
+                    io.log(`agentId: ${result.agentId}`);
+                    io.log(`name: ${result.agent.name}`);
+                    io.log(`stored: ${result.configPath}`);
+                }
+                return 0;
+            }
+            case "eval-tool": {
+                const input = evalToolInputFromArgs(parsed);
+                const config = resolveConfig({
+                    cwd,
+                    env,
+                    flags: parsed.flags,
+                    requireApiKey: !input.offline,
+                    offline: input.offline,
+                });
+                const result = await runEvalTool(config, input);
+                if (config.json) {
+                    io.log(JSON.stringify({ ...result.response, offline: result.offline }, null, 2));
+                }
+                else {
+                    io.log(formatEvalHuman(result));
+                }
+                return 0;
+            }
+            case "serve-mcp": {
+                const config = resolveConfig({
+                    cwd,
+                    env,
+                    flags: parsed.flags,
+                    requireApiKey: true,
+                });
+                const opts = serveMcpOptionsFromArgs(parsed);
+                const result = await runServeMcp(config, opts);
+                if (result.mode === "http" && result.http) {
+                    io.log(`KYA MCP gate listening on ${result.http.url} (host=${config.host})`);
+                    io.log("  GET  /health");
+                    io.log("  GET  /connectors/mcp.json");
+                    io.log("  GET  /mcp/tools");
+                    io.log("  POST /mcp  (JSON-RPC)");
+                    io.log("  tools: kya.policy_evaluate | kya.session_ingest | kya.request_approval");
+                    io.log("  fail-closed: evaluate/request only — no irreversible side effects without APPROVED");
+                    await new Promise((resolve) => {
+                        const stop = () => {
+                            void result.http?.close().finally(resolve);
+                        };
+                        process.once("SIGINT", stop);
+                        process.once("SIGTERM", stop);
+                    });
+                }
+                else if (result.mode === "stdio" && result.stdio) {
+                    await result.stdio.done;
+                }
+                return 0;
+            }
+            case "orr": {
+                const sub = parsed.positionals[0];
+                if (sub !== "run") {
+                    io.error('Usage: kya orr run --path <dir> [options]');
+                    io.log("ORR is a reporting orchestrator only (not a second PEP). See docs/dev/kya-orr-cli.md");
+                    return 1;
+                }
+                // Re-parse with flags after "orr run" — positionals after subcommand already in flags from original parse
+                const opts = orrRunOptionsFromArgs(parsed);
+                const result = runOrr(opts);
+                if (opts.jsonStdout || parsed.flags["json"] === true) {
+                    io.log(JSON.stringify(result.report, null, 2));
+                }
+                else if (!opts.quiet) {
+                    io.log(`ORR ${result.report.overall} / ${result.report.disposition} → ${result.reportJsonPath ?? result.reportMdPath ?? opts.out}`);
+                    io.log(`(reporting only — sole PEP remains Shield KYA; scanners are evidence)`);
+                }
+                return result.exitCode;
+            }
+            default:
+                io.error(`Unknown command: ${parsed.command}`);
+                io.log(HELP);
+                return 2;
+        }
+    }
+    catch (err) {
+        if (err instanceof KyaError) {
+            io.error(`error: ${err.message} [${err.code}]`);
+            return err.exitCode;
+        }
+        const message = err instanceof Error ? err.message : String(err);
+        io.error(`error: ${message}`);
+        return 1;
+    }
+}
+// Only auto-run when executed as CLI entry (not when imported by tests).
+// Bin links resolve as ".../bin/kya" not ".../cli.js" — compare realpaths.
+function isCliEntry() {
+    if (typeof process.argv[1] !== "string")
+        return false;
+    try {
+        return realpathSync(process.argv[1]) === realpathSync(fileURLToPath(import.meta.url));
+    }
+    catch {
+        const a = process.argv[1];
+        return (a.endsWith("/cli.js") ||
+            a.endsWith("/cli.ts") ||
+            a.endsWith("/kya") ||
+            a.endsWith("/shield-kya") ||
+            a.includes("@shield-agent/kya"));
+    }
+}
+if (isCliEntry()) {
+    void runCli(process.argv.slice(2)).then((code) => {
+        if (code !== 0)
+            process.exit(code);
+    });
+}
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;GAKG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EACL,0BAA0B,EAC1B,gBAAgB,GACjB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,qBAAqB,EACrB,eAAe,EACf,WAAW,GACZ,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,WAAW,EACX,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,qBAAqB,EACrB,MAAM,GACP,MAAM,mBAAmB,CAAC;AAE3B,MAAM,IAAI,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8BZ,CAAC;AAQF,MAAM,SAAS,GAAU;IACvB,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9B,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;CAC7B,CAAC;AAEF,+FAA+F;AAC/F,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,IAAuB,EACvB,KAAY,SAAS,EACrB,MAAyB,OAAO,CAAC,GAAG,EACpC,MAAc,OAAO,CAAC,GAAG,EAAE;IAE3B,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAE/B,IACE,CAAC,MAAM,CAAC,OAAO;QACf,MAAM,CAAC,OAAO,KAAK,MAAM;QACzB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI;QAC7B,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,IAAI,EAC1B,CAAC;QACD,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACb,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,CAAC;QACH,QAAQ,MAAM,CAAC,OAAO,EAAE,CAAC;YACvB,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;gBACzC,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,MAAM,EAAE,CAAC;oBACrE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC1C,CAAC;qBAAM,CAAC;oBACN,EAAE,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC;oBAClE,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO;wBAAE,EAAE,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;oBAC1D,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO;wBAAE,EAAE,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;oBAC1D,EAAE,CAAC,GAAG,CACJ,gHAAgH,CACjH,CAAC;oBACF,EAAE,CAAC,GAAG,CACJ,kEAAkE,CACnE,CAAC;gBACJ,CAAC;gBACD,OAAO,CAAC,CAAC;YACX,CAAC;YAED,KAAK,gBAAgB,CAAC,CAAC,CAAC;gBACtB,MAAM,MAAM,GAAG,aAAa,CAAC;oBAC3B,GAAG;oBACH,GAAG;oBACH,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,aAAa,EAAE,IAAI;iBACpB,CAAC,CAAC;gBACH,MAAM,KAAK,GAAG,0BAA0B,CAAC,MAAM,CAAC,CAAC;gBACjD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;gBACrD,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;oBAChB,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC1C,CAAC;qBAAM,CAAC;oBACN,EAAE,CAAC,GAAG,CAAC,YAAY,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;oBACrC,EAAE,CAAC,GAAG,CAAC,SAAS,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;oBACrC,EAAE,CAAC,GAAG,CAAC,WAAW,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;gBACzC,CAAC;gBACD,OAAO,CAAC,CAAC;YACX,CAAC;YAED,KAAK,WAAW,CAAC,CAAC,CAAC;gBACjB,MAAM,KAAK,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;gBAC5C,MAAM,MAAM,GAAG,aAAa,CAAC;oBAC3B,GAAG;oBACH,GAAG;oBACH,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,aAAa,EAAE,CAAC,KAAK,CAAC,OAAO;oBAC7B,OAAO,EAAE,KAAK,CAAC,OAAO;iBACvB,CAAC,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;gBAChD,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;oBAChB,EAAE,CAAC,GAAG,CACJ,IAAI,CAAC,SAAS,CACZ,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,EAC/C,IAAI,EACJ,CAAC,CACF,CACF,CAAC;gBACJ,CAAC;qBAAM,CAAC;oBACN,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;gBAClC,CAAC;gBACD,OAAO,CAAC,CAAC;YACX,CAAC;YAED,KAAK,WAAW,CAAC,CAAC,CAAC;gBACjB,MAAM,MAAM,GAAG,aAAa,CAAC;oBAC3B,GAAG;oBACH,GAAG;oBACH,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,aAAa,EAAE,IAAI;iBACpB,CAAC,CAAC;gBACH,MAAM,IAAI,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;gBAC7C,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBAC/C,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;oBAC1C,EAAE,CAAC,GAAG,CACJ,6BAA6B,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,MAAM,CAAC,IAAI,GAAG,CACrE,CAAC;oBACF,EAAE,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;oBACzB,EAAE,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;oBACtC,EAAE,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;oBAC5B,EAAE,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;oBAClC,EAAE,CAAC,GAAG,CAAC,0EAA0E,CAAC,CAAC;oBACnF,EAAE,CAAC,GAAG,CACJ,sFAAsF,CACvF,CAAC;oBACF,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;wBAClC,MAAM,IAAI,GAAG,GAAG,EAAE;4BAChB,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;wBAC7C,CAAC,CAAC;wBACF,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;wBAC7B,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;oBAChC,CAAC,CAAC,CAAC;gBACL,CAAC;qBAAM,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;oBACnD,MAAM,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;gBAC1B,CAAC;gBACD,OAAO,CAAC,CAAC;YACX,CAAC;YAED,KAAK,KAAK,CAAC,CAAC,CAAC;gBACX,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;gBAClC,IAAI,GAAG,KAAK,KAAK,EAAE,CAAC;oBAClB,EAAE,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;oBACtD,EAAE,CAAC,GAAG,CACJ,sFAAsF,CACvF,CAAC;oBACF,OAAO,CAAC,CAAC;gBACX,CAAC;gBACD,0GAA0G;gBAC1G,MAAM,IAAI,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;gBAC3C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;gBAC5B,IAAI,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;oBACrD,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;gBACjD,CAAC;qBAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;oBACvB,EAAE,CAAC,GAAG,CACJ,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,MAAM,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,YAAY,IAAI,IAAI,CAAC,GAAG,EAAE,CAC5H,CAAC;oBACF,EAAE,CAAC,GAAG,CACJ,uEAAuE,CACxE,CAAC;gBACJ,CAAC;gBACD,OAAO,MAAM,CAAC,QAAQ,CAAC;YACzB,CAAC;YAED;gBACE,EAAE,CAAC,KAAK,CAAC,oBAAoB,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC/C,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACb,OAAO,CAAC,CAAC;QACb,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,QAAQ,EAAE,CAAC;YAC5B,EAAE,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,OAAO,KAAK,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC;YAChD,OAAO,GAAG,CAAC,QAAQ,CAAC;QACtB,CAAC;QACD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,EAAE,CAAC,KAAK,CAAC,UAAU,OAAO,EAAE,CAAC,CAAC;QAC9B,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,2EAA2E;AAC3E,SAAS,UAAU;IACjB,IAAI,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,YAAY,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACxF,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1B,OAAO,CACL,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;YACrB,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;YACrB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YAClB,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC;YACzB,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAChC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,IAAI,UAAU,EAAE,EAAE,CAAC;IACjB,KAAK,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;QAC/C,IAAI,IAAI,KAAK,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/client.d.ts

@@ -0,0 +1,111 @@
+import type { Host } from "./config.js";
+export type FetchLike = typeof fetch;
+export interface KyaClientOptions {
+    readonly baseUrl: string;
+    readonly apiKey: string;
+    readonly fetch?: FetchLike;
+    readonly host?: Host;
+    readonly agentId?: string;
+    /** When false, skip auth check (tests only). Default true. */
+    readonly requireApiKey?: boolean;
+}
+export interface PolicyEvaluateRequest {
+    readonly toolId: string;
+    readonly action?: string;
+    readonly argsHash?: string;
+    readonly irreversible?: boolean;
+    readonly actionClass?: string;
+    readonly dataClass?: string;
+    readonly sessionRisk?: string;
+    readonly approvalStatus?: string;
+    readonly packId?: string | null;
+    readonly env?: {
+        readonly host: Host;
+        readonly sessionId?: string;
+        readonly agentId?: string;
+        readonly correlationId?: string;
+    };
+}
+export interface PolicyEvaluateResponse {
+    readonly verdict: string;
+    readonly reasonCode: string;
+    readonly toolId?: string;
+    readonly argsHash?: string;
+    readonly localVerdict?: string;
+    readonly sessionRisk?: string;
+    readonly host?: string;
+    readonly opaAllow?: boolean;
+    readonly opaReason?: string;
+}
+export interface RegisterAgentRequest {
+    readonly name: string;
+    readonly versionHash: string;
+}
+export interface AgentResponse {
+    readonly id: string;
+    readonly orgId?: string;
+    readonly name: string;
+    readonly status?: string;
+    readonly versionHash?: string;
+    readonly createdAt?: string;
+}
+export interface SessionIngestRequest {
+    readonly sessionId: string;
+    readonly source?: string;
+    readonly model?: string;
+    readonly hostname?: string;
+    readonly projectPath?: string;
+    readonly riskLevel?: string;
+    readonly hitCodes?: readonly string[];
+    readonly payload?: Readonly<Record<string, unknown>>;
+    readonly host?: Host;
+}
+export interface SessionIngestResponse {
+    readonly id: string;
+    readonly riskLevel: string;
+    readonly host?: string;
+}
+export interface CreateApprovalRequest {
+    readonly agentId: string;
+    readonly disputeId: string;
+    readonly packVersion?: string;
+    readonly action?: string;
+    readonly toolId?: string;
+}
+export interface ApprovalResponse {
+    readonly id: string;
+    readonly status: string;
+    readonly [key: string]: unknown;
+}
+/**
+ * Minimal HTTP client for light CLI / MCP gate.
+ * Base URL is control-plane origin (e.g. http://127.0.0.1:8090).
+ * Paths are absolute under /api/v1/kya/*.
+ */
+export declare class KyaHttpClient {
+    readonly baseUrl: string;
+    readonly host: Host;
+    readonly agentId: string | undefined;
+    private readonly apiKey;
+    private readonly fetchImpl;
+    constructor(options: KyaClientOptions);
+    registerAgent(body: RegisterAgentRequest): Promise<AgentResponse>;
+    evaluatePolicy(req: PolicyEvaluateRequest): Promise<PolicyEvaluateResponse>;
+    ingestSession(req: SessionIngestRequest): Promise<SessionIngestResponse>;
+    requestApproval(req: CreateApprovalRequest): Promise<ApprovalResponse>;
+    request<T>(path: string, options?: {
+        method?: "GET" | "POST" | "PUT" | "DELETE";
+        body?: unknown;
+        headers?: Record<string, string>;
+    }): Promise<T>;
+}
+export declare function buildEvaluateFromToolArgs(input: {
+    toolId: string;
+    args?: unknown;
+    irreversible?: boolean;
+    host: Host;
+    agentId?: string;
+    sessionRisk?: string;
+    approvalStatus?: string;
+}): PolicyEvaluateRequest;
+//# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAIxC,MAAM,MAAM,SAAS,GAAG,OAAO,KAAK,CAAC;AAErC,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC;IACrB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,8DAA8D;IAC9D,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;CAClC;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,GAAG,CAAC,EAAE;QACb,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;QACpB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;KACjC,CAAC;CACH;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACrD,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACjC;AAED;;;;GAIG;AACH,qBAAa,aAAa;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;gBAE1B,OAAO,EAAE,gBAAgB;IAgB/B,aAAa,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,aAAa,CAAC;IAOjE,cAAc,CAAC,GAAG,EAAE,qBAAqB,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAwB3E,aAAa,CAAC,GAAG,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAUxE,eAAe,CAAC,GAAG,EAAE,qBAAqB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAatE,OAAO,CAAC,CAAC,EACb,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE;QACP,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,CAAC;QAC3C,IAAI,CAAC,EAAE,OAAO,CAAC;QACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KAC7B,GACL,OAAO,CAAC,CAAC,CAAC;CAyCd;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,IAAI,EAAE,IAAI,CAAC;IACX,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,GAAG,qBAAqB,CAcxB"}

package/dist/client.js

@@ -0,0 +1,143 @@
+import { AuthRequiredError, HttpError, KyaError } from "./errors.js";
+import { computeArgsHash } from "./hash.js";
+import { findSampleTool } from "./sample-tools.js";
+/**
+ * Minimal HTTP client for light CLI / MCP gate.
+ * Base URL is control-plane origin (e.g. http://127.0.0.1:8090).
+ * Paths are absolute under /api/v1/kya/*.
+ */
+export class KyaHttpClient {
+    baseUrl;
+    host;
+    agentId;
+    apiKey;
+    fetchImpl;
+    constructor(options) {
+        const requireKey = options.requireApiKey !== false;
+        if (requireKey && (!options.apiKey || options.apiKey.trim() === "")) {
+            throw new AuthRequiredError();
+        }
+        this.baseUrl = stripTrailingSlash(options.baseUrl);
+        this.apiKey = options.apiKey.trim();
+        this.host = options.host ?? "ide";
+        this.agentId = options.agentId;
+        const fetchImpl = options.fetch ?? globalThis.fetch;
+        if (typeof fetchImpl !== "function") {
+            throw new KyaError("global fetch unavailable; Node 20+ required", "NO_FETCH");
+        }
+        this.fetchImpl = fetchImpl;
+    }
+    async registerAgent(body) {
+        return this.request("/api/v1/kya/agents", {
+            method: "POST",
+            body,
+        });
+    }
+    async evaluatePolicy(req) {
+        const toolId = req.toolId;
+        const sample = findSampleTool(toolId);
+        const body = {
+            toolId,
+            action: req.action ?? toolId,
+            argsHash: req.argsHash,
+            irreversible: req.irreversible ?? sample?.irreversible ?? false,
+            actionClass: req.actionClass ?? sample?.actionClass,
+            dataClass: req.dataClass ?? sample?.dataClass,
+            sessionRisk: req.sessionRisk ?? "LOW",
+            approvalStatus: req.approvalStatus ?? "NONE",
+            packId: req.packId === undefined ? "generic" : req.packId,
+            env: req.env ?? {
+                host: this.host,
+                agentId: this.agentId,
+            },
+        };
+        return this.request("/api/v1/kya/policy/evaluate", {
+            method: "POST",
+            body,
+        });
+    }
+    async ingestSession(req) {
+        return this.request("/api/v1/kya/sessions/ingest", {
+            method: "POST",
+            body: {
+                ...req,
+                host: req.host ?? this.host,
+            },
+        });
+    }
+    async requestApproval(req) {
+        return this.request("/api/v1/kya/approvals", {
+            method: "POST",
+            body: {
+                agentId: req.agentId,
+                disputeId: req.disputeId,
+                packVersion: req.packVersion ?? "generic",
+                action: req.action ?? req.toolId,
+                toolId: req.toolId ?? req.action,
+            },
+        });
+    }
+    async request(path, options = {}) {
+        const method = options.method ?? "GET";
+        const url = `${this.baseUrl}${path.startsWith("/") ? path : `/${path}`}`;
+        const headers = {
+            Accept: "application/json",
+            "User-Agent": "shield-agent-kya-cli/0.1.0",
+            ...(options.headers ?? {}),
+        };
+        if (this.apiKey) {
+            headers.Authorization = `Bearer ${this.apiKey}`;
+        }
+        let body;
+        if (options.body !== undefined) {
+            headers["Content-Type"] = "application/json; charset=utf-8";
+            body = JSON.stringify(options.body);
+        }
+        const response = await this.fetchImpl(url, { method, headers, body });
+        const text = await response.text();
+        const parsed = parseJsonSafe(text);
+        if (!response.ok) {
+            if (response.status === 401 || response.status === 403) {
+                throw new AuthRequiredError(`control plane rejected credentials (HTTP ${response.status})`);
+            }
+            let msg = `HTTP ${response.status} ${method} ${path}`;
+            if (parsed &&
+                typeof parsed === "object" &&
+                "message" in parsed &&
+                typeof parsed.message === "string") {
+                msg = parsed.message;
+            }
+            throw new HttpError(response.status, msg, parsed);
+        }
+        return parsed;
+    }
+}
+export function buildEvaluateFromToolArgs(input) {
+    const args = input.args ?? {};
+    return {
+        toolId: input.toolId,
+        action: input.toolId,
+        argsHash: computeArgsHash(args),
+        irreversible: input.irreversible,
+        sessionRisk: input.sessionRisk ?? "LOW",
+        approvalStatus: input.approvalStatus ?? "NONE",
+        env: {
+            host: input.host,
+            agentId: input.agentId,
+        },
+    };
+}
+function stripTrailingSlash(url) {
+    return url.endsWith("/") ? url.slice(0, -1) : url;
+}
+function parseJsonSafe(text) {
+    if (!text || text.length === 0)
+        return undefined;
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAErE,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AA0FnD;;;;GAIG;AACH,MAAM,OAAO,aAAa;IACf,OAAO,CAAS;IAChB,IAAI,CAAO;IACX,OAAO,CAAqB;IACpB,MAAM,CAAS;IACf,SAAS,CAAY;IAEtC,YAAY,OAAyB;QACnC,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,KAAK,KAAK,CAAC;QACnD,IAAI,UAAU,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,iBAAiB,EAAE,CAAC;QAChC,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACpC,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,KAAK,CAAC;QAClC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;QACpD,IAAI,OAAO,SAAS,KAAK,UAAU,EAAE,CAAC;YACpC,MAAM,IAAI,QAAQ,CAAC,6CAA6C,EAAE,UAAU,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,IAA0B;QAC5C,OAAO,IAAI,CAAC,OAAO,CAAgB,oBAAoB,EAAE;YACvD,MAAM,EAAE,MAAM;YACd,IAAI;SACL,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,GAA0B;QAC7C,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QAC1B,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG;YACX,MAAM;YACN,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,MAAM;YAC5B,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,YAAY,EAAE,GAAG,CAAC,YAAY,IAAI,MAAM,EAAE,YAAY,IAAI,KAAK;YAC/D,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,MAAM,EAAE,WAAW;YACnD,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,MAAM,EAAE,SAAS;YAC7C,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,KAAK;YACrC,cAAc,EAAE,GAAG,CAAC,cAAc,IAAI,MAAM;YAC5C,MAAM,EAAE,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM;YACzD,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI;gBACd,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB;SACF,CAAC;QACF,OAAO,IAAI,CAAC,OAAO,CAAyB,6BAA6B,EAAE;YACzE,MAAM,EAAE,MAAM;YACd,IAAI;SACL,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,GAAyB;QAC3C,OAAO,IAAI,CAAC,OAAO,CAAwB,6BAA6B,EAAE;YACxE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE;gBACJ,GAAG,GAAG;gBACN,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI;aAC5B;SACF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,GAA0B;QAC9C,OAAO,IAAI,CAAC,OAAO,CAAmB,uBAAuB,EAAE;YAC7D,MAAM,EAAE,MAAM;YACd,IAAI,EAAE;gBACJ,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,SAAS;gBACzC,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM;gBAChC,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM;aACjC;SACF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO,CACX,IAAY,EACZ,UAII,EAAE;QAEN,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC;QACvC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;QACzE,MAAM,OAAO,GAA2B;YACtC,MAAM,EAAE,kBAAkB;YAC1B,YAAY,EAAE,4BAA4B;YAC1C,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;SAC3B,CAAC;QACF,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO,CAAC,aAAa,GAAG,UAAU,IAAI,CAAC,MAAM,EAAE,CAAC;QAClD,CAAC;QACD,IAAI,IAAwB,CAAC;QAC7B,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,CAAC,cAAc,CAAC,GAAG,iCAAiC,CAAC;YAC5D,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACtC,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QAEnC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvD,MAAM,IAAI,iBAAiB,CACzB,4CAA4C,QAAQ,CAAC,MAAM,GAAG,CAC/D,CAAC;YACJ,CAAC;YACD,IAAI,GAAG,GAAG,QAAQ,QAAQ,CAAC,MAAM,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;YACtD,IACE,MAAM;gBACN,OAAO,MAAM,KAAK,QAAQ;gBAC1B,SAAS,IAAI,MAAM;gBACnB,OAAQ,MAA+B,CAAC,OAAO,KAAK,QAAQ,EAC5D,CAAC;gBACD,GAAG,GAAI,MAA8B,CAAC,OAAO,CAAC;YAChD,CAAC;YACD,MAAM,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QACpD,CAAC;QAED,OAAO,MAAW,CAAC;IACrB,CAAC;CACF;AAED,MAAM,UAAU,yBAAyB,CAAC,KAQzC;IACC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;IAC9B,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,eAAe,CAAC,IAAI,CAAC;QAC/B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,KAAK;QACvC,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,MAAM;QAC9C,GAAG,EAAE;YACH,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB;KACF,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAW;IACrC,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;AACpD,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACjD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/commands/eval-tool.d.ts

@@ -0,0 +1,27 @@
+import type { ResolvedConfig } from "../config.js";
+import { KyaHttpClient, type PolicyEvaluateResponse } from "../client.js";
+import type { ParsedArgs } from "../parse-args.js";
+export interface EvalToolResult {
+    readonly response: PolicyEvaluateResponse;
+    readonly toolId: string;
+    readonly argsHash: string | undefined;
+    readonly offline: boolean;
+}
+export declare function runEvalTool(config: ResolvedConfig, input: {
+    toolId: string;
+    args?: unknown;
+    irreversible?: boolean;
+    sessionRisk?: string;
+    approvalStatus?: string;
+    offline?: boolean;
+}, client?: KyaHttpClient): Promise<EvalToolResult>;
+export declare function evalToolInputFromArgs(parsed: ParsedArgs): {
+    toolId: string;
+    args: unknown;
+    irreversible: boolean;
+    sessionRisk?: string;
+    approvalStatus?: string;
+    offline: boolean;
+};
+export declare function formatEvalHuman(result: EvalToolResult): string;
+//# sourceMappingURL=eval-tool.d.ts.map