@shield-agent/kya 0.1.0

package/dist/mcp/protocol.js

@@ -0,0 +1,282 @@
+/**
+ * MCP tool surface for local gate — proxies to Shield KYA (sole PEP).
+ * Does not execute irreversible side effects; only evaluate / ingest / request approval.
+ * Host-agnostic: stdio or HTTP transport.
+ */
+import { randomUUID } from "node:crypto";
+import { computeArgsHash } from "../hash.js";
+import { findSampleTool } from "../sample-tools.js";
+export const MCP_SERVER_INFO = {
+    name: "shield-kya",
+    version: "0.1.0",
+    title: "Shield Agent AI (KYA)",
+    description: "Know Your Agent control plane: policy evaluate, session observe, and high-stakes gates. Standard MCP tools; no proprietary client protocol.",
+};
+export const MCP_TOOLS = [
+    {
+        name: "kya.policy_evaluate",
+        description: "Evaluate ALLOW | DENY | REQUIRE_APPROVE for an agent action at the tool boundary. Sole PEP is Shield KYA; missing APPROVED means no irreversible side effect.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                action: { type: "string", description: "Action or toolId" },
+                toolId: { type: "string", description: "Stable tool id (preferred)" },
+                agentId: { type: "string" },
+                irreversible: { type: "boolean" },
+                sessionRisk: { type: "string", enum: ["LOW", "MEDIUM", "HIGH"] },
+                approvalStatus: {
+                    type: "string",
+                    enum: ["NONE", "PENDING", "APPROVED", "REJECTED"],
+                },
+                args: { type: "object", description: "Tool args (hashed, not logged raw)" },
+                argsHash: { type: "string" },
+                host: { type: "string", enum: ["ide", "runtime"] },
+                context: { type: "object" },
+            },
+            required: [],
+        },
+    },
+    {
+        name: "kya.session_ingest",
+        description: "Ingest an AgentEvent-compatible session observation for raise-only risk. Risk may only raise severity, never auto-ALLOW.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                session: { type: "object" },
+                sessionId: { type: "string" },
+                host: { type: "string", enum: ["ide", "runtime"] },
+                riskLevel: { type: "string", enum: ["LOW", "MEDIUM", "HIGH"] },
+                hitCodes: { type: "array", items: { type: "string" } },
+                source: { type: "string" },
+                model: { type: "string" },
+                payload: { type: "object" },
+            },
+            required: [],
+        },
+    },
+    {
+        name: "kya.request_approval",
+        description: "Open a human approval request for a high-stakes side effect. Does not execute the side effect.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                action: { type: "string" },
+                toolId: { type: "string" },
+                agentId: { type: "string" },
+                resourceId: {
+                    type: "string",
+                    description: "Work-item / correlation UUID (mapped to disputeId binding)",
+                },
+                summary: { type: "string" },
+                packVersion: { type: "string" },
+            },
+            required: ["action"],
+        },
+    },
+];
+export async function handleMcpToolCall(name, args, ctx) {
+    const a = args ?? {};
+    try {
+        switch (name) {
+            case "kya.policy_evaluate":
+                return await callPolicyEvaluate(a, ctx);
+            case "kya.session_ingest":
+                return await callSessionIngest(a, ctx);
+            case "kya.request_approval":
+                return await callRequestApproval(a, ctx);
+            default:
+                return textResult({ error: `unknown tool: ${name}` }, true);
+        }
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return textResult({ error: message }, true);
+    }
+}
+async function callPolicyEvaluate(a, ctx) {
+    const toolId = str(a.toolId) ?? str(a.action);
+    if (!toolId) {
+        return textResult({ error: "action or toolId required" }, true);
+    }
+    const sample = findSampleTool(toolId);
+    const host = parseHost(str(a.host), ctx.host);
+    const argsObj = a.args && typeof a.args === "object" && !Array.isArray(a.args)
+        ? a.args
+        : {};
+    const argsHash = str(a.argsHash) ?? computeArgsHash(argsObj);
+    const irreversible = typeof a.irreversible === "boolean"
+        ? a.irreversible
+        : (sample?.irreversible ?? false);
+    const response = await ctx.client.evaluatePolicy({
+        toolId,
+        action: toolId,
+        argsHash,
+        irreversible,
+        actionClass: sample?.actionClass,
+        dataClass: sample?.dataClass,
+        sessionRisk: str(a.sessionRisk) ?? "LOW",
+        approvalStatus: str(a.approvalStatus) ?? "NONE",
+        env: {
+            host,
+            agentId: str(a.agentId) ?? ctx.agentId,
+        },
+    });
+    return textResult(response);
+}
+async function callSessionIngest(a, ctx) {
+    const session = a.session && typeof a.session === "object" && !Array.isArray(a.session)
+        ? a.session
+        : {};
+    const sessionId = str(a.sessionId) ??
+        str(session.sessionId) ??
+        str(session.id) ??
+        randomUUID();
+    const host = parseHost(str(a.host) ?? str(session.host), ctx.host);
+    const riskLevel = str(a.riskLevel) ??
+        str(session.riskLevel) ??
+        str(session.riskHint) ??
+        "LOW";
+    const hitCodes = Array.isArray(a.hitCodes)
+        ? a.hitCodes
+        : Array.isArray(session.hitCodes)
+            ? session.hitCodes
+            : undefined;
+    const payload = a.payload ??
+        session.payload ??
+        (session.tools
+            ? { tools: session.tools }
+            : undefined);
+    const response = await ctx.client.ingestSession({
+        sessionId,
+        source: str(a.source) ?? str(session.source) ?? "mcp-gate",
+        model: str(a.model) ?? str(session.model),
+        riskLevel,
+        hitCodes,
+        payload,
+        host,
+    });
+    return textResult(response);
+}
+async function callRequestApproval(a, ctx) {
+    const action = str(a.action) ?? str(a.toolId);
+    if (!action) {
+        return textResult({ error: "action required" }, true);
+    }
+    const agentId = str(a.agentId) ?? ctx.agentId;
+    if (!agentId) {
+        return textResult({
+            error: "agentId required (set KYA_AGENT_ID or pass agentId; run register-agent first)",
+        }, true);
+    }
+    const resourceId = str(a.resourceId) ?? randomUUID();
+    // Server expects UUID for disputeId work-item binding
+    const disputeId = isUuid(resourceId) ? resourceId : randomUUID();
+    const response = await ctx.client.requestApproval({
+        agentId,
+        disputeId,
+        toolId: str(a.toolId) ?? action,
+        action,
+        packVersion: str(a.packVersion) ?? "generic",
+    });
+    return textResult({
+        ...response,
+        note: "Approval opened only — no side effect executed (fail closed until APPROVED)",
+        summary: str(a.summary),
+    });
+}
+function textResult(data, isError = false) {
+    return {
+        content: [{ type: "text", text: JSON.stringify(data, null, 2) }],
+        isError,
+        structuredContent: data,
+    };
+}
+function str(v) {
+    if (typeof v === "string" && v.length > 0)
+        return v;
+    return undefined;
+}
+function parseHost(raw, fallback) {
+    if (raw === "ide" || raw === "runtime")
+        return raw;
+    return fallback;
+}
+function isUuid(s) {
+    return /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(s);
+}
+export async function handleJsonRpc(msg, ctx) {
+    const id = msg.id ?? null;
+    // notifications (no id) — process but no response for some
+    try {
+        switch (msg.method) {
+            case "initialize":
+                return {
+                    jsonrpc: "2.0",
+                    id,
+                    result: {
+                        protocolVersion: "2024-11-05",
+                        capabilities: { tools: {} },
+                        serverInfo: {
+                            name: MCP_SERVER_INFO.name,
+                            version: MCP_SERVER_INFO.version,
+                        },
+                    },
+                };
+            case "notifications/initialized":
+            case "initialized":
+                return null;
+            case "ping":
+                return { jsonrpc: "2.0", id, result: {} };
+            case "tools/list":
+                return {
+                    jsonrpc: "2.0",
+                    id,
+                    result: {
+                        tools: MCP_TOOLS.map((t) => ({
+                            name: t.name,
+                            description: t.description,
+                            inputSchema: t.inputSchema,
+                        })),
+                    },
+                };
+            case "tools/call": {
+                const params = (msg.params ?? {});
+                if (!params.name) {
+                    return {
+                        jsonrpc: "2.0",
+                        id,
+                        error: { code: -32602, message: "tools/call requires name" },
+                    };
+                }
+                const result = await handleMcpToolCall(params.name, params.arguments, ctx);
+                return {
+                    jsonrpc: "2.0",
+                    id,
+                    result: {
+                        content: result.content,
+                        isError: result.isError ?? false,
+                    },
+                };
+            }
+            default:
+                if (msg.id === undefined)
+                    return null;
+                return {
+                    jsonrpc: "2.0",
+                    id,
+                    error: { code: -32601, message: `Method not found: ${msg.method}` },
+                };
+        }
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        if (msg.id === undefined)
+            return null;
+        return {
+            jsonrpc: "2.0",
+            id,
+            error: { code: -32000, message },
+        };
+    }
+}
+//# sourceMappingURL=protocol.js.map

package/dist/mcp/protocol.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol.js","sourceRoot":"","sources":["../../src/mcp/protocol.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEpD,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,IAAI,EAAE,YAAY;IAClB,OAAO,EAAE,OAAO;IAChB,KAAK,EAAE,uBAAuB;IAC9B,WAAW,EACT,6IAA6I;CACvI,CAAC;AAQX,MAAM,CAAC,MAAM,SAAS,GAA0B;IAC9C;QACE,IAAI,EAAE,qBAAqB;QAC3B,WAAW,EACT,+JAA+J;QACjK,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,kBAAkB,EAAE;gBAC3D,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,4BAA4B,EAAE;gBACrE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC3B,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;gBACjC,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE;gBAChE,cAAc,EAAE;oBACd,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,CAAC;iBAClD;gBACD,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,oCAAoC,EAAE;gBAC3E,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC5B,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE;gBAClD,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;aAC5B;YACD,QAAQ,EAAE,EAAE;SACb;KACF;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,WAAW,EACT,0HAA0H;QAC5H,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC3B,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC7B,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE;gBAClD,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE;gBAC9D,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;gBACtD,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC1B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACzB,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;aAC5B;YACD,QAAQ,EAAE,EAAE;SACb;KACF;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,WAAW,EACT,gGAAgG;QAClG,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC1B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC1B,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC3B,UAAU,EAAE;oBACV,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,4DAA4D;iBAC1E;gBACD,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC3B,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;aAChC;YACD,QAAQ,EAAE,CAAC,QAAQ,CAAC;SACrB;KACF;CACO,CAAC;AAcX,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAY,EACZ,IAAyC,EACzC,GAAsB;IAEtB,MAAM,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,qBAAqB;gBACxB,OAAO,MAAM,kBAAkB,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAC1C,KAAK,oBAAoB;gBACvB,OAAO,MAAM,iBAAiB,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACzC,KAAK,sBAAsB;gBACzB,OAAO,MAAM,mBAAmB,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAC3C;gBACE,OAAO,UAAU,CAAC,EAAE,KAAK,EAAE,iBAAiB,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,UAAU,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,IAAI,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,CAA0B,EAC1B,GAAsB;IAEtB,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,UAAU,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,EAAE,IAAI,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,OAAO,GACX,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5D,CAAC,CAAE,CAAC,CAAC,IAAgC;QACrC,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,CAAC;IAC7D,MAAM,YAAY,GAChB,OAAO,CAAC,CAAC,YAAY,KAAK,SAAS;QACjC,CAAC,CAAC,CAAC,CAAC,YAAY;QAChB,CAAC,CAAC,CAAC,MAAM,EAAE,YAAY,IAAI,KAAK,CAAC,CAAC;IAEtC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC;QAC/C,MAAM;QACN,MAAM,EAAE,MAAM;QACd,QAAQ;QACR,YAAY;QACZ,WAAW,EAAE,MAAM,EAAE,WAAW;QAChC,SAAS,EAAE,MAAM,EAAE,SAAS;QAC5B,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,KAAK;QACxC,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,MAAM;QAC/C,GAAG,EAAE;YACH,IAAI;YACJ,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,OAAO;SACvC;KACF,CAAC,CAAC;IACH,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,CAA0B,EAC1B,GAAsB;IAEtB,MAAM,OAAO,GACX,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QACrE,CAAC,CAAE,CAAC,CAAC,OAAmC;QACxC,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,SAAS,GACb,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;QAChB,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC;QACtB,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACf,UAAU,EAAE,CAAC;IACf,MAAM,IAAI,GAAG,SAAS,CACpB,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAChC,GAAG,CAAC,IAAI,CACT,CAAC;IACF,MAAM,SAAS,GACb,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;QAChB,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC;QACtB,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC;QACrB,KAAK,CAAC;IACR,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;QACxC,CAAC,CAAE,CAAC,CAAC,QAAqB;QAC1B,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC;YAC/B,CAAC,CAAE,OAAO,CAAC,QAAqB;YAChC,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,OAAO,GACV,CAAC,CAAC,OAA+C;QACjD,OAAO,CAAC,OAA+C;QACxD,CAAC,OAAO,CAAC,KAAK;YACZ,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE;YAC1B,CAAC,CAAC,SAAS,CAAC,CAAC;IAEjB,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC;QAC9C,SAAS;QACT,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,UAAU;QAC1D,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC;QACzC,SAAS;QACT,QAAQ;QACR,OAAO;QACP,IAAI;KACL,CAAC,CAAC;IACH,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,CAA0B,EAC1B,GAAsB;IAEtB,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,UAAU,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,IAAI,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC;IAC9C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,UAAU,CACf;YACE,KAAK,EACH,+EAA+E;SAClF,EACD,IAAI,CACL,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,UAAU,EAAE,CAAC;IACrD,sDAAsD;IACtD,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;IAEjE,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC;QAChD,OAAO;QACP,SAAS;QACT,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,MAAM;QAC/B,MAAM;QACN,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,SAAS;KAC7C,CAAC,CAAC;IAEH,OAAO,UAAU,CAAC;QAChB,GAAG,QAAQ;QACX,IAAI,EAAE,6EAA6E;QACnF,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;KACxB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CAAC,IAAa,EAAE,OAAO,GAAG,KAAK;IAChD,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QAChE,OAAO;QACP,iBAAiB,EAAE,IAAI;KACxB,CAAC;AACJ,CAAC;AAED,SAAS,GAAG,CAAC,CAAU;IACrB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC;IACpD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,SAAS,CAAC,GAAuB,EAAE,QAAc;IACxD,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC;IACnD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,MAAM,CAAC,CAAS;IACvB,OAAO,4EAA4E,CAAC,IAAI,CACtF,CAAC,CACF,CAAC;AACJ,CAAC;AAmBD,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAmB,EACnB,GAAsB;IAEtB,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC;IAC1B,2DAA2D;IAC3D,IAAI,CAAC;QACH,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;YACnB,KAAK,YAAY;gBACf,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,EAAE;oBACF,MAAM,EAAE;wBACN,eAAe,EAAE,YAAY;wBAC7B,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;wBAC3B,UAAU,EAAE;4BACV,IAAI,EAAE,eAAe,CAAC,IAAI;4BAC1B,OAAO,EAAE,eAAe,CAAC,OAAO;yBACjC;qBACF;iBACF,CAAC;YACJ,KAAK,2BAA2B,CAAC;YACjC,KAAK,aAAa;gBAChB,OAAO,IAAI,CAAC;YACd,KAAK,MAAM;gBACT,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;YAC5C,KAAK,YAAY;gBACf,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,EAAE;oBACF,MAAM,EAAE;wBACN,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;4BAC3B,IAAI,EAAE,CAAC,CAAC,IAAI;4BACZ,WAAW,EAAE,CAAC,CAAC,WAAW;4BAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;yBAC3B,CAAC,CAAC;qBACJ;iBACF,CAAC;YACJ,KAAK,YAAY,CAAC,CAAC,CAAC;gBAClB,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAG/B,CAAC;gBACF,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;oBACjB,OAAO;wBACL,OAAO,EAAE,KAAK;wBACd,EAAE;wBACF,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,0BAA0B,EAAE;qBAC7D,CAAC;gBACJ,CAAC;gBACD,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;gBAC3E,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,EAAE;oBACF,MAAM,EAAE;wBACN,OAAO,EAAE,MAAM,CAAC,OAAO;wBACvB,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,KAAK;qBACjC;iBACF,CAAC;YACJ,CAAC;YACD;gBACE,IAAI,GAAG,CAAC,EAAE,KAAK,SAAS;oBAAE,OAAO,IAAI,CAAC;gBACtC,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,EAAE;oBACF,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,qBAAqB,GAAG,CAAC,MAAM,EAAE,EAAE;iBACpE,CAAC;QACN,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,IAAI,GAAG,CAAC,EAAE,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACtC,OAAO;YACL,OAAO,EAAE,KAAK;YACd,EAAE;YACF,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE;SACjC,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/mcp/stdio.d.ts

@@ -0,0 +1,22 @@
+import type { KyaHttpClient } from "../client.js";
+import type { Host } from "../config.js";
+export interface StdioMcpOptions {
+    readonly client: KyaHttpClient;
+    readonly kyaHost: Host;
+    readonly agentId?: string;
+    readonly input?: NodeJS.ReadableStream;
+    readonly output?: NodeJS.WritableStream;
+    /** When true, do not attach process signal handlers (tests). */
+    readonly bare?: boolean;
+}
+export interface StdioMcpHandle {
+    /** Resolve when stream ends. */
+    readonly done: Promise<void>;
+    close(): void;
+}
+/**
+ * MCP over stdio — newline-delimited JSON-RPC 2.0 (common host shape).
+ * Also accepts Content-Length framed messages (LSP-style) when headers present.
+ */
+export declare function startStdioMcp(options: StdioMcpOptions): StdioMcpHandle;
+//# sourceMappingURL=stdio.d.ts.map

package/dist/mcp/stdio.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stdio.d.ts","sourceRoot":"","sources":["../../src/mcp/stdio.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAOzC,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IACvC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IACxC,gEAAgE;IAChE,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,gCAAgC;IAChC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,KAAK,IAAI,IAAI,CAAC;CACf;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,eAAe,GAAG,cAAc,CA4BtE"}

package/dist/mcp/stdio.js

@@ -0,0 +1,67 @@
+import * as readline from "node:readline";
+import { handleJsonRpc, } from "./protocol.js";
+/**
+ * MCP over stdio — newline-delimited JSON-RPC 2.0 (common host shape).
+ * Also accepts Content-Length framed messages (LSP-style) when headers present.
+ */
+export function startStdioMcp(options) {
+    const input = options.input ?? process.stdin;
+    const output = options.output ?? process.stdout;
+    const ctx = {
+        client: options.client,
+        host: options.kyaHost,
+        agentId: options.agentId,
+    };
+    let closed = false;
+    const rl = readline.createInterface({ input, crlfDelay: Infinity });
+    const done = new Promise((resolve) => {
+        rl.on("line", (line) => {
+            void onLine(line.trim(), ctx, output);
+        });
+        rl.on("close", () => {
+            closed = true;
+            resolve();
+        });
+    });
+    return {
+        done,
+        close() {
+            if (!closed)
+                rl.close();
+        },
+    };
+}
+async function onLine(line, ctx, output) {
+    if (!line || line.startsWith("Content-Length:")) {
+        // Content-Length framing without body on same line — skip header-only lines
+        return;
+    }
+    let msg;
+    try {
+        msg = JSON.parse(line);
+    }
+    catch {
+        writeJson(output, {
+            jsonrpc: "2.0",
+            id: null,
+            error: { code: -32700, message: "Parse error" },
+        });
+        return;
+    }
+    if (!msg.method) {
+        writeJson(output, {
+            jsonrpc: "2.0",
+            id: msg.id ?? null,
+            error: { code: -32600, message: "Invalid Request" },
+        });
+        return;
+    }
+    const response = await handleJsonRpc(msg, ctx);
+    if (response !== null) {
+        writeJson(output, response);
+    }
+}
+function writeJson(output, value) {
+    output.write(`${JSON.stringify(value)}\n`);
+}
+//# sourceMappingURL=stdio.js.map

package/dist/mcp/stdio.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stdio.js","sourceRoot":"","sources":["../../src/mcp/stdio.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,eAAe,CAAC;AAG1C,OAAO,EACL,aAAa,GAGd,MAAM,eAAe,CAAC;AAkBvB;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,OAAwB;IACpD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC;IAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAChD,MAAM,GAAG,GAAsB;QAC7B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,IAAI,EAAE,OAAO,CAAC,OAAO;QACrB,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC;IAEF,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;IAEpE,MAAM,IAAI,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QACzC,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YACrB,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;QACH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YAClB,MAAM,GAAG,IAAI,CAAC;YACd,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,IAAI;QACJ,KAAK;YACH,IAAI,CAAC,MAAM;gBAAE,EAAE,CAAC,KAAK,EAAE,CAAC;QAC1B,CAAC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,MAAM,CACnB,IAAY,EACZ,GAAsB,EACtB,MAA6B;IAE7B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAChD,4EAA4E;QAC5E,OAAO;IACT,CAAC;IACD,IAAI,GAAmB,CAAC;IACxB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAmB,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,SAAS,CAAC,MAAM,EAAE;YAChB,OAAO,EAAE,KAAK;YACd,EAAE,EAAE,IAAI;YACR,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE;SAChD,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;QAChB,SAAS,CAAC,MAAM,EAAE;YAChB,OAAO,EAAE,KAAK;YACd,EAAE,EAAE,GAAG,CAAC,EAAE,IAAI,IAAI;YAClB,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE;SACpD,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC/C,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,MAA6B,EAAE,KAAc;IAC9D,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAC7C,CAAC"}

package/dist/offline-evaluate.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Offline sample policy evaluate for light-install demos.
+ * Not a second production PEP — production injects HTTP evaluate against Shield.
+ * Same sample tools as docs/dev/kya-custom-tools-sample.md (R8: packs off).
+ */
+import type { Host } from "./config.js";
+import type { PolicyEvaluateRequest, PolicyEvaluateResponse } from "./client.js";
+import { type PolicyVerdict } from "./sample-tools.js";
+export type SessionRisk = "LOW" | "MEDIUM" | "HIGH";
+/** Raise-only: risk may bump ALLOW → REQUIRE_APPROVE; never lowers DENY/REQUIRE_APPROVE. */
+export declare function applySessionRisk(base: {
+    verdict: PolicyVerdict;
+    reasonCode: string;
+}, risk: SessionRisk | undefined): {
+    verdict: PolicyVerdict;
+    reasonCode: string;
+};
+/**
+ * Local fixture evaluate — day-1 offline demo without paid cloud or full console.
+ * Doctrine: sole production PEP remains Shield HTTP; this is demo/CT only.
+ */
+export declare function evaluateOffline(req: PolicyEvaluateRequest, host?: Host): PolicyEvaluateResponse;
+//# sourceMappingURL=offline-evaluate.d.ts.map

package/dist/offline-evaluate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"offline-evaluate.d.ts","sourceRoot":"","sources":["../src/offline-evaluate.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,KAAK,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EAAkC,KAAK,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEvF,MAAM,MAAM,WAAW,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;AAoCpD,4FAA4F;AAC5F,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE;IAAE,OAAO,EAAE,aAAa,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,EACpD,IAAI,EAAE,WAAW,GAAG,SAAS,GAC5B;IAAE,OAAO,EAAE,aAAa,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAWhD;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,GAAG,EAAE,qBAAqB,EAC1B,IAAI,GAAE,IAAY,GACjB,sBAAsB,CAkBxB"}

package/dist/offline-evaluate.js

@@ -0,0 +1,68 @@
+/**
+ * Offline sample policy evaluate for light-install demos.
+ * Not a second production PEP — production injects HTTP evaluate against Shield.
+ * Same sample tools as docs/dev/kya-custom-tools-sample.md (R8: packs off).
+ */
+import { SAMPLE_TOOLS } from "./sample-tools.js";
+function baseTier(toolId, irreversible, actionClass) {
+    if (!toolId || toolId.trim() === "") {
+        return { verdict: "DENY", reasonCode: "EMPTY_TOOL" };
+    }
+    const known = SAMPLE_TOOLS.find((t) => t.toolId === toolId);
+    if (known?.policyTier) {
+        if (known.policyTier === "DENY") {
+            return { verdict: "DENY", reasonCode: "NEVER_EVENT" };
+        }
+        if (known.policyTier === "REQUIRE_APPROVE") {
+            return { verdict: "REQUIRE_APPROVE", reasonCode: "HIGH_STAKES_WRITE" };
+        }
+        return { verdict: "ALLOW", reasonCode: "ALLOW" };
+    }
+    const ac = (actionClass ?? "");
+    if (ac === "EXTERNAL_SIDE_EFFECT") {
+        return { verdict: "DENY", reasonCode: "UNKNOWN_EXTERNAL_SIDE_EFFECT" };
+    }
+    if (ac === "EXPORT") {
+        return { verdict: "REQUIRE_APPROVE", reasonCode: "UNKNOWN_EXPORT" };
+    }
+    if (irreversible || ac === "WRITE") {
+        return { verdict: "REQUIRE_APPROVE", reasonCode: "UNKNOWN_IRREVERSIBLE" };
+    }
+    return { verdict: "ALLOW", reasonCode: "ALLOW" };
+}
+/** Raise-only: risk may bump ALLOW → REQUIRE_APPROVE; never lowers DENY/REQUIRE_APPROVE. */
+export function applySessionRisk(base, risk) {
+    if (base.verdict === "DENY" || base.verdict === "REQUIRE_APPROVE") {
+        return base;
+    }
+    if (risk === "HIGH") {
+        return { verdict: "REQUIRE_APPROVE", reasonCode: "SESSION_RISK_HIGH" };
+    }
+    if (risk === "MEDIUM") {
+        return { verdict: "REQUIRE_APPROVE", reasonCode: "SESSION_RISK_MEDIUM" };
+    }
+    return base;
+}
+/**
+ * Local fixture evaluate — day-1 offline demo without paid cloud or full console.
+ * Doctrine: sole production PEP remains Shield HTTP; this is demo/CT only.
+ */
+export function evaluateOffline(req, host = "ide") {
+    const irreversible = req.irreversible ?? false;
+    const base = baseTier(req.toolId, irreversible, req.actionClass);
+    const risk = req.sessionRisk ?? "LOW";
+    const final = applySessionRisk(base, risk);
+    const resolvedHost = req.env?.host ?? host;
+    return {
+        verdict: final.verdict,
+        reasonCode: final.reasonCode,
+        toolId: req.toolId,
+        argsHash: req.argsHash,
+        localVerdict: base.verdict,
+        sessionRisk: risk,
+        host: resolvedHost,
+        opaAllow: true,
+        opaReason: "OFFLINE_SAMPLE",
+    };
+}
+//# sourceMappingURL=offline-evaluate.js.map

package/dist/offline-evaluate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"offline-evaluate.js","sourceRoot":"","sources":["../src/offline-evaluate.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EAAE,YAAY,EAAwC,MAAM,mBAAmB,CAAC;AAIvF,SAAS,QAAQ,CACf,MAAc,EACd,YAAqB,EACrB,WAAoB;IAEpB,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACpC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC;IACvD,CAAC;IAED,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IAC5D,IAAI,KAAK,EAAE,UAAU,EAAE,CAAC;QACtB,IAAI,KAAK,CAAC,UAAU,KAAK,MAAM,EAAE,CAAC;YAChC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC;QACxD,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,KAAK,iBAAiB,EAAE,CAAC;YAC3C,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,mBAAmB,EAAE,CAAC;QACzE,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;IACnD,CAAC;IAED,MAAM,EAAE,GAAG,CAAC,WAAW,IAAI,EAAE,CAAyB,CAAC;IACvD,IAAI,EAAE,KAAK,sBAAsB,EAAE,CAAC;QAClC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,8BAA8B,EAAE,CAAC;IACzE,CAAC;IACD,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;QACpB,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,gBAAgB,EAAE,CAAC;IACtE,CAAC;IACD,IAAI,YAAY,IAAI,EAAE,KAAK,OAAO,EAAE,CAAC;QACnC,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,sBAAsB,EAAE,CAAC;IAC5E,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;AACnD,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,gBAAgB,CAC9B,IAAoD,EACpD,IAA6B;IAE7B,IAAI,IAAI,CAAC,OAAO,KAAK,MAAM,IAAI,IAAI,CAAC,OAAO,KAAK,iBAAiB,EAAE,CAAC;QAClE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,mBAAmB,EAAE,CAAC;IACzE,CAAC;IACD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,qBAAqB,EAAE,CAAC;IAC3E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,GAA0B,EAC1B,OAAa,KAAK;IAElB,MAAM,YAAY,GAAG,GAAG,CAAC,YAAY,IAAI,KAAK,CAAC;IAC/C,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;IACjE,MAAM,IAAI,GAAI,GAAG,CAAC,WAAuC,IAAI,KAAK,CAAC;IACnE,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC3C,MAAM,YAAY,GAAG,GAAG,CAAC,GAAG,EAAE,IAAI,IAAI,IAAI,CAAC;IAE3C,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,YAAY,EAAE,IAAI,CAAC,OAAO;QAC1B,WAAW,EAAE,IAAI;QACjB,IAAI,EAAE,YAAY;QAClB,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,gBAAgB;KAC5B,CAAC;AACJ,CAAC"}

package/dist/parse-args.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Minimal argv parser — no external CLI framework.
+ * Supports: flags (--foo), values (--foo bar | --foo=bar), boolean (--stdio), positionals.
+ */
+export interface ParsedArgs {
+    readonly command: string | undefined;
+    readonly positionals: readonly string[];
+    readonly flags: Readonly<Record<string, string | boolean>>;
+}
+export declare function parseArgs(argv: readonly string[]): ParsedArgs;
+export declare function flagString(flags: Readonly<Record<string, string | boolean>>, ...names: string[]): string | undefined;
+export declare function flagBool(flags: Readonly<Record<string, string | boolean>>, ...names: string[]): boolean;
+export declare function flagInt(flags: Readonly<Record<string, string | boolean>>, name: string, fallback: number): number;
+//# sourceMappingURL=parse-args.d.ts.map

package/dist/parse-args.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse-args.d.ts","sourceRoot":"","sources":["../src/parse-args.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;CAC5D;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,UAAU,CAoD7D;AAED,wBAAgB,UAAU,CACxB,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,EACjD,GAAG,KAAK,EAAE,MAAM,EAAE,GACjB,MAAM,GAAG,SAAS,CAMpB;AAED,wBAAgB,QAAQ,CACtB,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,EACjD,GAAG,KAAK,EAAE,MAAM,EAAE,GACjB,OAAO,CAOT;AAED,wBAAgB,OAAO,CACrB,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,EACjD,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,MAAM,CAOR"}

package/dist/parse-args.js

@@ -0,0 +1,86 @@
+/**
+ * Minimal argv parser — no external CLI framework.
+ * Supports: flags (--foo), values (--foo bar | --foo=bar), boolean (--stdio), positionals.
+ */
+export function parseArgs(argv) {
+    const args = [...argv];
+    // drop node + script path when present (cli entry strips itself; tests pass raw)
+    const flags = {};
+    const positionals = [];
+    let command;
+    for (let i = 0; i < args.length; i++) {
+        const token = args[i];
+        if (token === "--") {
+            positionals.push(...args.slice(i + 1));
+            break;
+        }
+        if (token.startsWith("--")) {
+            const eq = token.indexOf("=");
+            if (eq !== -1) {
+                const key = token.slice(2, eq);
+                const value = token.slice(eq + 1);
+                flags[key] = value;
+                continue;
+            }
+            const key = token.slice(2);
+            const next = args[i + 1];
+            if (next !== undefined && !next.startsWith("-")) {
+                // boolean-looking flags stay boolean when next is another command-like word
+                // only consume next if it looks like a value (not a known pattern of pure flag)
+                flags[key] = next;
+                i++;
+            }
+            else {
+                flags[key] = true;
+            }
+            continue;
+        }
+        if (token.startsWith("-") && token.length === 2) {
+            const key = token.slice(1);
+            const next = args[i + 1];
+            if (next !== undefined && !next.startsWith("-")) {
+                flags[key] = next;
+                i++;
+            }
+            else {
+                flags[key] = true;
+            }
+            continue;
+        }
+        if (command === undefined) {
+            command = token;
+        }
+        else {
+            positionals.push(token);
+        }
+    }
+    return { command, positionals, flags };
+}
+export function flagString(flags, ...names) {
+    for (const name of names) {
+        const v = flags[name];
+        if (typeof v === "string" && v.length > 0)
+            return v;
+    }
+    return undefined;
+}
+export function flagBool(flags, ...names) {
+    for (const name of names) {
+        const v = flags[name];
+        if (v === true || v === "true" || v === "1")
+            return true;
+        if (v === false || v === "false" || v === "0")
+            return false;
+    }
+    return false;
+}
+export function flagInt(flags, name, fallback) {
+    const v = flags[name];
+    if (typeof v === "string" && v.length > 0) {
+        const n = Number.parseInt(v, 10);
+        if (Number.isFinite(n))
+            return n;
+    }
+    return fallback;
+}
+//# sourceMappingURL=parse-args.js.map

package/dist/parse-args.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse-args.js","sourceRoot":"","sources":["../src/parse-args.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAQH,MAAM,UAAU,SAAS,CAAC,IAAuB;IAC/C,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;IACvB,iFAAiF;IACjF,MAAM,KAAK,GAAqC,EAAE,CAAC;IACnD,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,IAAI,OAA2B,CAAC;IAEhC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACvB,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,WAAW,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACvC,MAAM;QACR,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC9B,IAAI,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;gBACd,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;gBAClC,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;gBACnB,SAAS;YACX,CAAC;YACD,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACzB,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAChD,4EAA4E;gBAC5E,gFAAgF;gBAChF,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;gBAClB,CAAC,EAAE,CAAC;YACN,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;YACpB,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChD,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACzB,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAChD,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;gBAClB,CAAC,EAAE,CAAC;YACN,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;YACpB,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,GAAG,KAAK,CAAC;QAClB,CAAC;aAAM,CAAC;YACN,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,KAAiD,EACjD,GAAG,KAAe;IAElB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,QAAQ,CACtB,KAAiD,EACjD,GAAG,KAAe;IAElB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QACzD,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC;IAC9D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,OAAO,CACrB,KAAiD,EACjD,IAAY,EACZ,QAAgB;IAEhB,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IACtB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1C,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACjC,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/sample-tools.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Sample custom tools for light install — zero vertical packs (R8).
+ * Same descriptors as docs/dev/kya-custom-tools-sample.md.
+ */
+export type ActionClass = "READ" | "WRITE" | "EXTERNAL_SIDE_EFFECT" | "EXPORT";
+export type PolicyVerdict = "ALLOW" | "DENY" | "REQUIRE_APPROVE";
+export type DataClass = "PUBLIC" | "INTERNAL" | "CONFIDENTIAL" | "RESTRICTED";
+export interface SampleToolDescriptor {
+    readonly toolId: string;
+    readonly displayName: string;
+    readonly actionClass: ActionClass;
+    readonly policyTier: PolicyVerdict;
+    readonly irreversible: boolean;
+    readonly dataClass: DataClass;
+    readonly metadata: Readonly<Record<string, unknown>>;
+}
+export declare const SAMPLE_TOOLS: readonly SampleToolDescriptor[];
+export declare function findSampleTool(toolId: string): SampleToolDescriptor | undefined;
+//# sourceMappingURL=sample-tools.d.ts.map

package/dist/sample-tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sample-tools.d.ts","sourceRoot":"","sources":["../src/sample-tools.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,OAAO,GAAG,sBAAsB,GAAG,QAAQ,CAAC;AAC/E,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,MAAM,GAAG,iBAAiB,CAAC;AACjE,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,UAAU,GAAG,cAAc,GAAG,YAAY,CAAC;AAE9E,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC;IACnC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACtD;AAED,eAAO,MAAM,YAAY,EAAE,SAAS,oBAAoB,EA4B9C,CAAC;AAEX,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,oBAAoB,GAAG,SAAS,CAE/E"}