@shield-agent/kya 0.1.0

package/dist/config.d.ts

@@ -0,0 +1,45 @@
+export type Host = "ide" | "runtime";
+export interface KyaFileConfig {
+    readonly baseUrl?: string;
+    readonly host?: Host;
+    readonly agentId?: string;
+    readonly agentName?: string;
+}
+export interface ResolvedConfig {
+    readonly baseUrl: string;
+    readonly apiKey: string;
+    readonly host: Host;
+    readonly agentId: string | undefined;
+    readonly mcpPort: number;
+    readonly tenantHint: string | undefined;
+    readonly cwd: string;
+    readonly configPath: string;
+    readonly json: boolean;
+    /** When true, empty api key is allowed only for pure local file ops (init). */
+    readonly allowMissingApiKey: boolean;
+    /** Offline sample evaluate (demo / CT) — no network, no paid cloud. */
+    readonly offline: boolean;
+}
+export interface ResolveOptions {
+    readonly cwd?: string;
+    readonly env?: NodeJS.ProcessEnv;
+    readonly flags?: Readonly<Record<string, string | boolean>>;
+    /** Skip auth requirement (init, --help). Default false. */
+    readonly allowMissingApiKey?: boolean;
+    /** When true, require non-empty API key (authenticated plane). Default true for network cmds. */
+    readonly requireApiKey?: boolean;
+    /** Force offline evaluate path (no API key required). */
+    readonly offline?: boolean;
+}
+export declare function configDir(cwd: string): string;
+export declare function configFilePath(cwd: string): string;
+export declare function readFileConfig(cwd: string): KyaFileConfig;
+export declare function writeFileConfig(cwd: string, patch: KyaFileConfig): KyaFileConfig;
+/**
+ * Resolve runtime config from flags > env > .kya/config.json.
+ * Fail-closed: empty API key against network commands exits non-zero.
+ */
+export declare function resolveConfig(options?: ResolveOptions): ResolvedConfig;
+/** Ensure parent dir exists for a path. */
+export declare function ensureParentDir(filePath: string): void;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,IAAI,GAAG,KAAK,GAAG,SAAS,CAAC;AAErC,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC;IACrB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,+EAA+E;IAC/E,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC,uEAAuE;IACvE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAC5D,2DAA2D;IAC3D,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IACtC,iGAAiG;IACjG,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC,yDAAyD;IACzD,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B;AAKD,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE7C;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAElD;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,CASzD;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,GAAG,aAAa,CAahF;AAaD;;;GAGG;AACH,wBAAgB,aAAa,CAAC,OAAO,GAAE,cAAmB,GAAG,cAAc,CAiE1E;AAOD,2CAA2C;AAC3C,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAEtD"}

package/dist/config.js

@@ -0,0 +1,105 @@
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { AuthRequiredError, UsageError } from "./errors.js";
+const DEFAULT_HOST = "ide";
+const DEFAULT_MCP_PORT = 3920;
+export function configDir(cwd) {
+    return join(cwd, ".kya");
+}
+export function configFilePath(cwd) {
+    return join(configDir(cwd), "config.json");
+}
+export function readFileConfig(cwd) {
+    const path = configFilePath(cwd);
+    if (!existsSync(path))
+        return {};
+    try {
+        const raw = JSON.parse(readFileSync(path, "utf8"));
+        return raw ?? {};
+    }
+    catch {
+        return {};
+    }
+}
+export function writeFileConfig(cwd, patch) {
+    const dir = configDir(cwd);
+    mkdirSync(dir, { recursive: true });
+    const path = configFilePath(cwd);
+    const prev = readFileConfig(cwd);
+    const next = {
+        ...prev,
+        ...Object.fromEntries(Object.entries(patch).filter(([, v]) => v !== undefined)),
+    };
+    writeFileSync(path, `${JSON.stringify(next, null, 2)}\n`, "utf8");
+    return next;
+}
+function parseHost(raw) {
+    if (raw === undefined || raw === "")
+        return DEFAULT_HOST;
+    const h = raw.trim().toLowerCase();
+    if (h === "ide" || h === "runtime")
+        return h;
+    throw new UsageError(`invalid host "${raw}" (expected ide|runtime)`);
+}
+function stripTrailingSlash(url) {
+    return url.endsWith("/") ? url.slice(0, -1) : url;
+}
+/**
+ * Resolve runtime config from flags > env > .kya/config.json.
+ * Fail-closed: empty API key against network commands exits non-zero.
+ */
+export function resolveConfig(options = {}) {
+    const cwd = options.cwd ?? process.cwd();
+    const env = options.env ?? process.env;
+    const flags = options.flags ?? {};
+    const file = readFileConfig(cwd);
+    const baseUrlRaw = str(flags["base-url"]) ??
+        env.KYA_BASE_URL ??
+        file.baseUrl ??
+        "http://127.0.0.1:8090";
+    const baseUrl = stripTrailingSlash(baseUrlRaw.trim());
+    const apiKey = str(flags["api-key"]) ?? env.KYA_API_KEY ?? env.SHIELD_API_KEY ?? "";
+    const host = parseHost(str(flags["host"]) ?? env.KYA_HOST ?? file.host ?? DEFAULT_HOST);
+    const agentId = str(flags["agent-id"]) ?? env.KYA_AGENT_ID ?? file.agentId ?? undefined;
+    const mcpPort = Number.parseInt(str(flags["port"]) ?? env.KYA_MCP_PORT ?? String(DEFAULT_MCP_PORT), 10);
+    const tenantHint = env.KYA_TENANT_HINT;
+    const json = flags["json"] === true || flags["json"] === "true";
+    const offline = options.offline === true ||
+        flags["offline"] === true ||
+        flags["offline"] === "true" ||
+        env.KYA_OFFLINE === "1" ||
+        env.KYA_OFFLINE === "true";
+    // Offline sample evaluate never hits the control plane — no API key required.
+    const requireApiKey = offline
+        ? false
+        : (options.requireApiKey ?? !options.allowMissingApiKey);
+    if (requireApiKey && (!apiKey || apiKey.trim() === "")) {
+        throw new AuthRequiredError("KYA_API_KEY is empty or missing — refuse silent allow-all against control plane (use --offline for local sample evaluate)");
+    }
+    if (!baseUrl && !offline) {
+        throw new UsageError("KYA_BASE_URL is required");
+    }
+    return {
+        baseUrl: baseUrl || "http://127.0.0.1:8090",
+        apiKey: apiKey.trim(),
+        host,
+        agentId: agentId?.trim() || undefined,
+        mcpPort: Number.isFinite(mcpPort) ? mcpPort : DEFAULT_MCP_PORT,
+        tenantHint,
+        cwd,
+        configPath: configFilePath(cwd),
+        json,
+        allowMissingApiKey: !requireApiKey,
+        offline,
+    };
+}
+function str(v) {
+    if (typeof v === "string" && v.length > 0)
+        return v;
+    return undefined;
+}
+/** Ensure parent dir exists for a path. */
+export function ensureParentDir(filePath) {
+    mkdirSync(dirname(filePath), { recursive: true });
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAuC5D,MAAM,YAAY,GAAS,KAAK,CAAC;AACjC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAE9B,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,OAAO,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,aAAa,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAkB,CAAC;QACpE,OAAO,GAAG,IAAI,EAAE,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAW,EAAE,KAAoB;IAC/D,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC3B,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,IAAI,GAAkB;QAC1B,GAAG,IAAI;QACP,GAAG,MAAM,CAAC,WAAW,CACnB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CACzD;KACF,CAAC;IACF,aAAa,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAClE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,SAAS,CAAC,GAAuB;IACxC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,YAAY,CAAC;IACzD,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACnC,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IAC7C,MAAM,IAAI,UAAU,CAAC,iBAAiB,GAAG,0BAA0B,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAW;IACrC,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;AACpD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,UAA0B,EAAE;IACxD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACzC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAEjC,MAAM,UAAU,GACd,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACtB,GAAG,CAAC,YAAY;QAChB,IAAI,CAAC,OAAO;QACZ,uBAAuB,CAAC;IAC1B,MAAM,OAAO,GAAG,kBAAkB,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;IAEtD,MAAM,MAAM,GACV,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC;IAEvE,MAAM,IAAI,GAAG,SAAS,CACpB,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,GAAG,CAAC,QAAQ,IAAI,IAAI,CAAC,IAAI,IAAI,YAAY,CAChE,CAAC;IAEF,MAAM,OAAO,GACX,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC,OAAO,IAAI,SAAS,CAAC;IAE1E,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAC7B,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,GAAG,CAAC,YAAY,IAAI,MAAM,CAAC,gBAAgB,CAAC,EAClE,EAAE,CACH,CAAC;IAEF,MAAM,UAAU,GAAG,GAAG,CAAC,eAAe,CAAC;IACvC,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC;IAChE,MAAM,OAAO,GACX,OAAO,CAAC,OAAO,KAAK,IAAI;QACxB,KAAK,CAAC,SAAS,CAAC,KAAK,IAAI;QACzB,KAAK,CAAC,SAAS,CAAC,KAAK,MAAM;QAC3B,GAAG,CAAC,WAAW,KAAK,GAAG;QACvB,GAAG,CAAC,WAAW,KAAK,MAAM,CAAC;IAE7B,8EAA8E;IAC9E,MAAM,aAAa,GACjB,OAAO;QACL,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC7D,IAAI,aAAa,IAAI,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,iBAAiB,CACzB,2HAA2H,CAC5H,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;QACzB,MAAM,IAAI,UAAU,CAAC,0BAA0B,CAAC,CAAC;IACnD,CAAC;IAED,OAAO;QACL,OAAO,EAAE,OAAO,IAAI,uBAAuB;QAC3C,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE;QACrB,IAAI;QACJ,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,SAAS;QACrC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB;QAC9D,UAAU;QACV,GAAG;QACH,UAAU,EAAE,cAAc,CAAC,GAAG,CAAC;QAC/B,IAAI;QACJ,kBAAkB,EAAE,CAAC,aAAa;QAClC,OAAO;KACR,CAAC;AACJ,CAAC;AAED,SAAS,GAAG,CAAC,CAA+B;IAC1C,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC;IACpD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,2CAA2C;AAC3C,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AACpD,CAAC"}

package/dist/errors.d.ts

@@ -0,0 +1,18 @@
+/** Fail-closed CLI / client errors — never silent allow-all. */
+export declare class KyaError extends Error {
+    readonly code: string;
+    readonly exitCode: number;
+    constructor(message: string, code?: string, exitCode?: number);
+}
+export declare class AuthRequiredError extends KyaError {
+    constructor(message?: string);
+}
+export declare class HttpError extends KyaError {
+    readonly status: number;
+    readonly body: unknown;
+    constructor(status: number, message: string, body?: unknown);
+}
+export declare class UsageError extends KyaError {
+    constructor(message: string);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAEhE,qBAAa,QAAS,SAAQ,KAAK;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;gBAEd,OAAO,EAAE,MAAM,EAAE,IAAI,SAAc,EAAE,QAAQ,SAAI;CAM9D;AAED,qBAAa,iBAAkB,SAAQ,QAAQ;gBACjC,OAAO,SAAmE;CAIvF;AAED,qBAAa,SAAU,SAAQ,QAAQ;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;gBAEX,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO;CAM5D;AAED,qBAAa,UAAW,SAAQ,QAAQ;gBAC1B,OAAO,EAAE,MAAM;CAI5B"}

package/dist/errors.js

@@ -0,0 +1,34 @@
+/** Fail-closed CLI / client errors — never silent allow-all. */
+export class KyaError extends Error {
+    code;
+    exitCode;
+    constructor(message, code = "KYA_ERROR", exitCode = 1) {
+        super(message);
+        this.name = "KyaError";
+        this.code = code;
+        this.exitCode = exitCode;
+    }
+}
+export class AuthRequiredError extends KyaError {
+    constructor(message = "KYA_API_KEY is required against an authenticated control plane") {
+        super(message, "AUTH_REQUIRED", 1);
+        this.name = "AuthRequiredError";
+    }
+}
+export class HttpError extends KyaError {
+    status;
+    body;
+    constructor(status, message, body) {
+        super(message, `HTTP_${status}`, 1);
+        this.name = "HttpError";
+        this.status = status;
+        this.body = body;
+    }
+}
+export class UsageError extends KyaError {
+    constructor(message) {
+        super(message, "USAGE", 2);
+        this.name = "UsageError";
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAEhE,MAAM,OAAO,QAAS,SAAQ,KAAK;IACxB,IAAI,CAAS;IACb,QAAQ,CAAS;IAE1B,YAAY,OAAe,EAAE,IAAI,GAAG,WAAW,EAAE,QAAQ,GAAG,CAAC;QAC3D,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;CACF;AAED,MAAM,OAAO,iBAAkB,SAAQ,QAAQ;IAC7C,YAAY,OAAO,GAAG,gEAAgE;QACpF,KAAK,CAAC,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED,MAAM,OAAO,SAAU,SAAQ,QAAQ;IAC5B,MAAM,CAAS;IACf,IAAI,CAAU;IAEvB,YAAY,MAAc,EAAE,OAAe,EAAE,IAAc;QACzD,KAAK,CAAC,OAAO,EAAE,QAAQ,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;QACxB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,MAAM,OAAO,UAAW,SAAQ,QAAQ;IACtC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QAC3B,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;IAC3B,CAAC;CACF"}

package/dist/hash.d.ts

@@ -0,0 +1,5 @@
+/** Canonical JSON: sorted keys, no insignificant whitespace (tool-wrap §1.2). */
+export declare function canonicalJson(value: unknown): string;
+/** argsHash = hex(sha256(canonical_json(args))) */
+export declare function computeArgsHash(args: unknown): string;
+//# sourceMappingURL=hash.d.ts.map

package/dist/hash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hash.d.ts","sourceRoot":"","sources":["../src/hash.ts"],"names":[],"mappings":"AAEA,iFAAiF;AACjF,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEpD;AAiBD,mDAAmD;AACnD,wBAAgB,eAAe,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAGrD"}

package/dist/hash.js

@@ -0,0 +1,25 @@
+import { createHash } from "node:crypto";
+/** Canonical JSON: sorted keys, no insignificant whitespace (tool-wrap §1.2). */
+export function canonicalJson(value) {
+    return JSON.stringify(sortKeys(value));
+}
+function sortKeys(value) {
+    if (value === null || typeof value !== "object") {
+        return value;
+    }
+    if (Array.isArray(value)) {
+        return value.map(sortKeys);
+    }
+    const obj = value;
+    const out = {};
+    for (const key of Object.keys(obj).sort()) {
+        out[key] = sortKeys(obj[key]);
+    }
+    return out;
+}
+/** argsHash = hex(sha256(canonical_json(args))) */
+export function computeArgsHash(args) {
+    const payload = canonicalJson(args === undefined ? {} : args);
+    return createHash("sha256").update(payload, "utf8").digest("hex");
+}
+//# sourceMappingURL=hash.js.map

package/dist/hash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hash.js","sourceRoot":"","sources":["../src/hash.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,iFAAiF;AACjF,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7B,CAAC;IACD,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC1C,GAAG,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,eAAe,CAAC,IAAa;IAC3C,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC9D,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACpE,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,21 @@
+/**
+ * @shield-agent/kya — light install library surface + CLI helpers.
+ * Zero vertical packs required (R8). Provider-agnostic MCP / HTTP path.
+ */
+export { runCli, type CliIo } from "./cli.js";
+export { parseArgs, flagString, flagBool, flagInt, type ParsedArgs } from "./parse-args.js";
+export { resolveConfig, readFileConfig, writeFileConfig, configDir, configFilePath, type Host, type KyaFileConfig, type ResolvedConfig, type ResolveOptions, } from "./config.js";
+export { KyaHttpClient, buildEvaluateFromToolArgs, type KyaClientOptions, type PolicyEvaluateRequest, type PolicyEvaluateResponse, type RegisterAgentRequest, type AgentResponse, type SessionIngestRequest, type CreateApprovalRequest, type FetchLike, } from "./client.js";
+export { computeArgsHash, canonicalJson } from "./hash.js";
+export { SAMPLE_TOOLS, findSampleTool, type SampleToolDescriptor } from "./sample-tools.js";
+export { KyaError, AuthRequiredError, HttpError, UsageError } from "./errors.js";
+export { runInit, initFromArgs, type InitResult } from "./commands/init.js";
+export { runRegisterAgent, registerAgentInputFromArgs, type RegisterAgentResult, } from "./commands/register-agent.js";
+export { runEvalTool, evalToolInputFromArgs, formatEvalHuman, type EvalToolResult, } from "./commands/eval-tool.js";
+export { runServeMcp, serveMcpOptionsFromArgs, type ServeMcpOptions, type ServeMcpResult, } from "./commands/serve-mcp.js";
+export { runOrr, orrRunOptionsFromArgs, runSaFirstPartyProbes, formatOrrMarkdown, type OrrReport, type OrrRunOptions, type OrrRunResult, } from "./commands/orr.js";
+export { evaluateOffline, applySessionRisk, type SessionRisk, } from "./offline-evaluate.js";
+export { MCP_TOOLS, MCP_SERVER_INFO, handleMcpToolCall, handleJsonRpc, type McpHandlerContext, type McpCallResult, } from "./mcp/protocol.js";
+export { startHttpMcp, type HttpMcpServer } from "./mcp/http.js";
+export { startStdioMcp } from "./mcp/stdio.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,MAAM,EAAE,KAAK,KAAK,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC5F,OAAO,EACL,aAAa,EACb,cAAc,EACd,eAAe,EACf,SAAS,EACT,cAAc,EACd,KAAK,IAAI,EACT,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,cAAc,GACpB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,aAAa,EACb,yBAAyB,EACzB,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,SAAS,GACf,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,KAAK,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAC5F,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EACL,gBAAgB,EAChB,0BAA0B,EAC1B,KAAK,mBAAmB,GACzB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,WAAW,EACX,qBAAqB,EACrB,eAAe,EACf,KAAK,cAAc,GACpB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,WAAW,EACX,uBAAuB,EACvB,KAAK,eAAe,EACpB,KAAK,cAAc,GACpB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,MAAM,EACN,qBAAqB,EACrB,qBAAqB,EACrB,iBAAiB,EACjB,KAAK,SAAS,EACd,KAAK,aAAa,EAClB,KAAK,YAAY,GAClB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,KAAK,WAAW,GACjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,SAAS,EACT,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,KAAK,iBAAiB,EACtB,KAAK,aAAa,GACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/index.js

@@ -0,0 +1,21 @@
+/**
+ * @shield-agent/kya — light install library surface + CLI helpers.
+ * Zero vertical packs required (R8). Provider-agnostic MCP / HTTP path.
+ */
+export { runCli } from "./cli.js";
+export { parseArgs, flagString, flagBool, flagInt } from "./parse-args.js";
+export { resolveConfig, readFileConfig, writeFileConfig, configDir, configFilePath, } from "./config.js";
+export { KyaHttpClient, buildEvaluateFromToolArgs, } from "./client.js";
+export { computeArgsHash, canonicalJson } from "./hash.js";
+export { SAMPLE_TOOLS, findSampleTool } from "./sample-tools.js";
+export { KyaError, AuthRequiredError, HttpError, UsageError } from "./errors.js";
+export { runInit, initFromArgs } from "./commands/init.js";
+export { runRegisterAgent, registerAgentInputFromArgs, } from "./commands/register-agent.js";
+export { runEvalTool, evalToolInputFromArgs, formatEvalHuman, } from "./commands/eval-tool.js";
+export { runServeMcp, serveMcpOptionsFromArgs, } from "./commands/serve-mcp.js";
+export { runOrr, orrRunOptionsFromArgs, runSaFirstPartyProbes, formatOrrMarkdown, } from "./commands/orr.js";
+export { evaluateOffline, applySessionRisk, } from "./offline-evaluate.js";
+export { MCP_TOOLS, MCP_SERVER_INFO, handleMcpToolCall, handleJsonRpc, } from "./mcp/protocol.js";
+export { startHttpMcp } from "./mcp/http.js";
+export { startStdioMcp } from "./mcp/stdio.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,MAAM,EAAc,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAmB,MAAM,iBAAiB,CAAC;AAC5F,OAAO,EACL,aAAa,EACb,cAAc,EACd,eAAe,EACf,SAAS,EACT,cAAc,GAKf,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,aAAa,EACb,yBAAyB,GAS1B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,cAAc,EAA6B,MAAM,mBAAmB,CAAC;AAC5F,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EAAE,OAAO,EAAE,YAAY,EAAmB,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EACL,gBAAgB,EAChB,0BAA0B,GAE3B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,WAAW,EACX,qBAAqB,EACrB,eAAe,GAEhB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,WAAW,EACX,uBAAuB,GAGxB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,MAAM,EACN,qBAAqB,EACrB,qBAAqB,EACrB,iBAAiB,GAIlB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,eAAe,EACf,gBAAgB,GAEjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,SAAS,EACT,eAAe,EACf,iBAAiB,EACjB,aAAa,GAGd,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,YAAY,EAAsB,MAAM,eAAe,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/mcp/http.d.ts

@@ -0,0 +1,26 @@
+import { type Server } from "node:http";
+import type { KyaHttpClient } from "../client.js";
+import type { Host } from "../config.js";
+export interface HttpMcpOptions {
+    readonly host?: string;
+    readonly port: number;
+    readonly client: KyaHttpClient;
+    readonly kyaHost: Host;
+    readonly agentId?: string;
+}
+export interface HttpMcpServer {
+    readonly server: Server;
+    readonly port: number;
+    readonly url: string;
+    close(): Promise<void>;
+}
+/**
+ * Lightweight HTTP MCP gate for local smoke / non-stdio hosts.
+ * - GET  /health
+ * - GET  /connectors/mcp.json  (descriptor)
+ * - GET  /mcp/tools
+ * - POST /mcp                  (JSON-RPC)
+ * - POST /mcp/tools/:name      (direct tool call)
+ */
+export declare function startHttpMcp(options: HttpMcpOptions): Promise<HttpMcpServer>;
+//# sourceMappingURL=http.d.ts.map

package/dist/mcp/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/mcp/http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsC,KAAK,MAAM,EAAuB,MAAM,WAAW,CAAC;AACjG,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAUzC,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CA6B5E"}

package/dist/mcp/http.js

@@ -0,0 +1,118 @@
+import { createServer } from "node:http";
+import { handleJsonRpc, handleMcpToolCall, MCP_SERVER_INFO, MCP_TOOLS, } from "./protocol.js";
+/**
+ * Lightweight HTTP MCP gate for local smoke / non-stdio hosts.
+ * - GET  /health
+ * - GET  /connectors/mcp.json  (descriptor)
+ * - GET  /mcp/tools
+ * - POST /mcp                  (JSON-RPC)
+ * - POST /mcp/tools/:name      (direct tool call)
+ */
+export function startHttpMcp(options) {
+    const listenHost = options.host ?? "127.0.0.1";
+    const ctx = {
+        client: options.client,
+        host: options.kyaHost,
+        agentId: options.agentId,
+    };
+    const server = createServer((req, res) => {
+        void handleHttp(req, res, ctx);
+    });
+    return new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(options.port, listenHost, () => {
+            const addr = server.address();
+            const port = typeof addr === "object" && addr ? addr.port : options.port;
+            resolve({
+                server,
+                port,
+                url: `http://${listenHost}:${port}`,
+                close: () => new Promise((resClose, rejClose) => {
+                    server.close((err) => (err ? rejClose(err) : resClose()));
+                }),
+            });
+        });
+    });
+}
+async function handleHttp(req, res, ctx) {
+    const url = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
+    const path = url.pathname;
+    const method = req.method ?? "GET";
+    try {
+        if (method === "GET" && (path === "/health" || path === "/")) {
+            return json(res, 200, {
+                ok: true,
+                server: MCP_SERVER_INFO.name,
+                version: MCP_SERVER_INFO.version,
+            });
+        }
+        if (method === "GET" && path === "/connectors/mcp.json") {
+            return json(res, 200, {
+                name: MCP_SERVER_INFO.name,
+                title: MCP_SERVER_INFO.title,
+                description: MCP_SERVER_INFO.description,
+                protocol: "mcp",
+                tools: MCP_TOOLS.map((t) => ({
+                    name: t.name,
+                    description: t.description,
+                    inputSchema: t.inputSchema,
+                })),
+                http: {
+                    policyEvaluate: "/api/v1/kya/policy/evaluate",
+                    sessionIngest: "/api/v1/kya/sessions/ingest",
+                    mcp: "/mcp",
+                },
+            });
+        }
+        if (method === "GET" && path === "/mcp/tools") {
+            return json(res, 200, {
+                tools: MCP_TOOLS.map((t) => ({
+                    name: t.name,
+                    description: t.description,
+                    inputSchema: t.inputSchema,
+                })),
+            });
+        }
+        if (method === "POST" && path === "/mcp") {
+            const body = await readBody(req);
+            const msg = JSON.parse(body || "{}");
+            const response = await handleJsonRpc(msg, ctx);
+            if (response === null) {
+                res.writeHead(204);
+                res.end();
+                return;
+            }
+            return json(res, 200, response);
+        }
+        const toolMatch = path.match(/^\/mcp\/tools\/([^/]+)$/);
+        if (method === "POST" && toolMatch) {
+            const name = decodeURIComponent(toolMatch[1]);
+            const body = await readBody(req);
+            const args = body ? JSON.parse(body) : {};
+            const result = await handleMcpToolCall(name, args, ctx);
+            return json(res, result.isError ? 400 : 200, result);
+        }
+        json(res, 404, { error: "not found" });
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        json(res, 500, { error: message });
+    }
+}
+function json(res, status, body) {
+    const payload = JSON.stringify(body);
+    res.writeHead(status, {
+        "Content-Type": "application/json; charset=utf-8",
+        "Content-Length": Buffer.byteLength(payload),
+    });
+    res.end(payload);
+}
+function readBody(req) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        req.on("data", (c) => chunks.push(c));
+        req.on("end", () => resolve(Buffer.concat(chunks).toString("utf8")));
+        req.on("error", reject);
+    });
+}
+//# sourceMappingURL=http.js.map

package/dist/mcp/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/mcp/http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAC;AAGjG,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,SAAS,GAGV,MAAM,eAAe,CAAC;AAiBvB;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,OAAuB;IAClD,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;IAC/C,MAAM,GAAG,GAAsB;QAC7B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,IAAI,EAAE,OAAO,CAAC,OAAO;QACrB,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC;IAEF,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACvC,KAAK,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE;YAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9B,MAAM,IAAI,GACR,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;YAC9D,OAAO,CAAC;gBACN,MAAM;gBACN,IAAI;gBACJ,GAAG,EAAE,UAAU,UAAU,IAAI,IAAI,EAAE;gBACnC,KAAK,EAAE,GAAG,EAAE,CACV,IAAI,OAAO,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE;oBACjC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;gBAC5D,CAAC,CAAC;aACL,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,GAAoB,EACpB,GAAmB,EACnB,GAAsB;IAEtB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC,CAAC;IACjF,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC1B,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC;IAEnC,IAAI,CAAC;QACH,IAAI,MAAM,KAAK,KAAK,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YAC7D,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;gBACpB,EAAE,EAAE,IAAI;gBACR,MAAM,EAAE,eAAe,CAAC,IAAI;gBAC5B,OAAO,EAAE,eAAe,CAAC,OAAO;aACjC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,sBAAsB,EAAE,CAAC;YACxD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;gBACpB,IAAI,EAAE,eAAe,CAAC,IAAI;gBAC1B,KAAK,EAAE,eAAe,CAAC,KAAK;gBAC5B,WAAW,EAAE,eAAe,CAAC,WAAW;gBACxC,QAAQ,EAAE,KAAK;gBACf,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBAC3B,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,WAAW,EAAE,CAAC,CAAC,WAAW;oBAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;iBAC3B,CAAC,CAAC;gBACH,IAAI,EAAE;oBACJ,cAAc,EAAE,6BAA6B;oBAC7C,aAAa,EAAE,6BAA6B;oBAC5C,GAAG,EAAE,MAAM;iBACZ;aACF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;gBACpB,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBAC3B,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,WAAW,EAAE,CAAC,CAAC,WAAW;oBAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;iBAC3B,CAAC,CAAC;aACJ,CAAC,CAAC;QACL,CAAC;QAED,IAAI,MAAM,KAAK,MAAM,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAmB,CAAC;YACvD,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC/C,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACtB,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,EAAE,CAAC;gBACV,OAAO;YACT,CAAC;YACD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;QAClC,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACxD,IAAI,MAAM,KAAK,MAAM,IAAI,SAAS,EAAE,CAAC;YACnC,MAAM,IAAI,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAE,CAAC,CAAC;YAC/C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAA6B,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YACxD,OAAO,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACvD,CAAC;QAED,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IACrC,CAAC;AACH,CAAC;AAED,SAAS,IAAI,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa;IAC9D,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACrC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE;QACpB,cAAc,EAAE,iCAAiC;QACjD,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;KAC7C,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACnB,CAAC;AAED,SAAS,QAAQ,CAAC,GAAoB;IACpC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACrE,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/mcp/protocol.d.ts

@@ -0,0 +1,53 @@
+/**
+ * MCP tool surface for local gate — proxies to Shield KYA (sole PEP).
+ * Does not execute irreversible side effects; only evaluate / ingest / request approval.
+ * Host-agnostic: stdio or HTTP transport.
+ */
+import type { KyaHttpClient } from "../client.js";
+import type { Host } from "../config.js";
+export declare const MCP_SERVER_INFO: {
+    readonly name: "shield-kya";
+    readonly version: "0.1.0";
+    readonly title: "Shield Agent AI (KYA)";
+    readonly description: "Know Your Agent control plane: policy evaluate, session observe, and high-stakes gates. Standard MCP tools; no proprietary client protocol.";
+};
+export interface McpToolDef {
+    readonly name: string;
+    readonly description: string;
+    readonly inputSchema: Record<string, unknown>;
+}
+export declare const MCP_TOOLS: readonly McpToolDef[];
+export interface McpCallResult {
+    readonly content: readonly {
+        type: "text";
+        text: string;
+    }[];
+    readonly isError?: boolean;
+    readonly structuredContent?: unknown;
+}
+export interface McpHandlerContext {
+    readonly client: KyaHttpClient;
+    readonly host: Host;
+    readonly agentId?: string;
+}
+export declare function handleMcpToolCall(name: string, args: Record<string, unknown> | undefined, ctx: McpHandlerContext): Promise<McpCallResult>;
+/** JSON-RPC 2.0 helpers for MCP stdio. */
+export type JsonRpcId = string | number | null;
+export interface JsonRpcRequest {
+    jsonrpc: "2.0";
+    id?: JsonRpcId;
+    method: string;
+    params?: unknown;
+}
+export interface JsonRpcResponse {
+    jsonrpc: "2.0";
+    id: JsonRpcId;
+    result?: unknown;
+    error?: {
+        code: number;
+        message: string;
+        data?: unknown;
+    };
+}
+export declare function handleJsonRpc(msg: JsonRpcRequest, ctx: McpHandlerContext): Promise<JsonRpcResponse | null>;
+//# sourceMappingURL=protocol.d.ts.map

package/dist/mcp/protocol.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol.d.ts","sourceRoot":"","sources":["../../src/mcp/protocol.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAIzC,eAAO,MAAM,eAAe;;;;;CAMlB,CAAC;AAEX,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/C;AAED,eAAO,MAAM,SAAS,EAAE,SAAS,UAAU,EAgEjC,CAAC;AAEX,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,SAAS;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC5D,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;CACtC;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EACzC,GAAG,EAAE,iBAAiB,GACrB,OAAO,CAAC,aAAa,CAAC,CAiBxB;AAkJD,0CAA0C;AAC1C,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;AAE/C,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,CAAC,EAAE,SAAS,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,EAAE,SAAS,CAAC;IACd,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CAC3D;AAED,wBAAsB,aAAa,CACjC,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,iBAAiB,GACrB,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CA0EjC"}