@shield-agent/kya 0.1.1 → 0.1.3

package/dist/dash/entitlement.d.ts

@@ -0,0 +1,35 @@
+/**
+ * TUI plan: FREE (individual / PLG) vs ENTERPRISE (licensed).
+ * Fail-closed: missing or invalid license never elevates; parse errors stay FREE.
+ */
+export type DashPlan = "free" | "enterprise";
+export declare const ENTERPRISE_PANES: readonly ["dashboard", "cases", "metrics", "edge", "settings"];
+export declare const FREE_PANES: readonly ["home", "policy", "agents", "approvals", "sessions", "orr", "mcp"];
+export type FreePane = (typeof FREE_PANES)[number];
+export type EnterprisePane = (typeof ENTERPRISE_PANES)[number];
+export type DashPane = FreePane | EnterprisePane;
+export interface Entitlement {
+    readonly plan: DashPlan;
+    readonly source: "env" | "license" | "plane" | "default";
+    readonly locked: readonly EnterprisePane[];
+}
+export interface PlaneEntitlement {
+    readonly plan?: unknown;
+    readonly dash?: unknown;
+    readonly features?: unknown;
+}
+export interface ResolveEntitlementInput {
+    readonly env: NodeJS.ProcessEnv;
+    readonly cwd: string;
+    readonly plane?: PlaneEntitlement;
+    readonly now?: Date;
+    readonly licensePublicKeyPem?: string;
+}
+/** Placeholder verify key — real issuers replace via KYA_LICENSE_PUBKEY. */
+export declare const DEFAULT_LICENSE_PUBKEY_PEM = "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEA//////////////////////////////////////////8=\n-----END PUBLIC KEY-----\n";
+export declare function isEnterprisePane(pane: string): pane is EnterprisePane;
+export declare function paneAllowed(ent: Entitlement, pane: DashPane): boolean;
+export declare function resolveEntitlement(input: ResolveEntitlementInput): Entitlement;
+export declare function planeGrantsEnterprise(plane?: PlaneEntitlement): boolean;
+export declare function licenseGrantsEnterprise(raw: string, now: Date, publicKeyPem?: string): boolean;
+//# sourceMappingURL=entitlement.d.ts.map

package/dist/dash/entitlement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entitlement.d.ts","sourceRoot":"","sources":["../../src/dash/entitlement.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,YAAY,CAAC;AAE7C,eAAO,MAAM,gBAAgB,gEAAiE,CAAC;AAC/F,eAAO,MAAM,UAAU,8EAQb,CAAC;AAEX,MAAM,MAAM,QAAQ,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;AACnD,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAC/D,MAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG,cAAc,CAAC;AAEjD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,KAAK,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,CAAC;IACzD,QAAQ,CAAC,MAAM,EAAE,SAAS,cAAc,EAAE,CAAC;CAC5C;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;CACvC;AAED,4EAA4E;AAC5E,eAAO,MAAM,0BAA0B,yHAGtC,CAAC;AAIF,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,IAAI,cAAc,CAErE;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,CAGrE;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,uBAAuB,GAAG,WAAW,CAkC9E;AAED,wBAAgB,qBAAqB,CAAC,KAAK,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAKvE;AAED,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,IAAI,EACT,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CA6BT"}

package/dist/dash/entitlement.js

@@ -0,0 +1,120 @@
+/**
+ * TUI plan: FREE (individual / PLG) vs ENTERPRISE (licensed).
+ * Fail-closed: missing or invalid license never elevates; parse errors stay FREE.
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { createPublicKey, verify } from "node:crypto";
+import { join } from "node:path";
+export const ENTERPRISE_PANES = ["dashboard", "cases", "metrics", "edge", "settings"];
+export const FREE_PANES = [
+    "home",
+    "policy",
+    "agents",
+    "approvals",
+    "sessions",
+    "orr",
+    "mcp",
+];
+/** Placeholder verify key — real issuers replace via KYA_LICENSE_PUBKEY. */
+export const DEFAULT_LICENSE_PUBKEY_PEM = `-----BEGIN PUBLIC KEY-----
+MCowBQYDK2VwAyEA//////////////////////////////////////////8=
+-----END PUBLIC KEY-----
+`;
+const FREE = { plan: "free", source: "default", locked: [...ENTERPRISE_PANES] };
+export function isEnterprisePane(pane) {
+    return ENTERPRISE_PANES.includes(pane);
+}
+export function paneAllowed(ent, pane) {
+    if (!isEnterprisePane(pane))
+        return true;
+    return ent.plan === "enterprise";
+}
+export function resolveEntitlement(input) {
+    try {
+        const envPlan = String(input.env.KYA_DASH_PLAN ?? "")
+            .trim()
+            .toLowerCase();
+        if (envPlan === "enterprise") {
+            return { plan: "enterprise", source: "env", locked: [] };
+        }
+        if (envPlan === "free") {
+            return { plan: "free", source: "env", locked: [...ENTERPRISE_PANES] };
+        }
+        const licensePath = String(input.env.KYA_LICENSE ?? "").trim() || join(input.cwd, ".kya", "license");
+        if (existsSync(licensePath)) {
+            let raw = "";
+            try {
+                raw = readFileSync(licensePath, "utf8");
+            }
+            catch {
+                return FREE;
+            }
+            const pubkey = input.licensePublicKeyPem ?? input.env.KYA_LICENSE_PUBKEY;
+            if (licenseGrantsEnterprise(raw, input.now ?? new Date(), pubkey)) {
+                return { plan: "enterprise", source: "license", locked: [] };
+            }
+        }
+        if (planeGrantsEnterprise(input.plane)) {
+            return { plan: "enterprise", source: "plane", locked: [] };
+        }
+    }
+    catch {
+        return FREE;
+    }
+    return FREE;
+}
+export function planeGrantsEnterprise(plane) {
+    if (!plane || typeof plane !== "object")
+        return false;
+    if (plane.dash === "enterprise")
+        return true;
+    if (typeof plane.plan === "string" && plane.plan.toUpperCase() === "SCALE")
+        return true;
+    return Array.isArray(plane.features) && plane.features.includes("enterprise_tui");
+}
+export function licenseGrantsEnterprise(raw, now, publicKeyPem) {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return false;
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+        return false;
+    const rec = parsed;
+    const plan = typeof rec.plan === "string" ? rec.plan.toLowerCase() : "";
+    const features = Array.isArray(rec.features) ? rec.features : [];
+    const entitled = plan === "enterprise" || features.includes("enterprise_tui");
+    if (!entitled)
+        return false;
+    if (typeof rec.exp === "string") {
+        const exp = Date.parse(rec.exp);
+        if (!Number.isFinite(exp) || exp <= now.getTime())
+            return false;
+    }
+    const sig = rec.sig;
+    if (typeof sig !== "string" || sig.length === 0)
+        return false;
+    const { sig: _omit, ...body } = rec;
+    void _omit;
+    const payload = Buffer.from(canonicalJson(body), "utf8");
+    const pem = publicKeyPem ?? DEFAULT_LICENSE_PUBKEY_PEM;
+    try {
+        const key = createPublicKey(pem);
+        return verify(null, payload, key, Buffer.from(sig, "base64"));
+    }
+    catch {
+        return false;
+    }
+}
+function canonicalJson(value) {
+    if (value === null || typeof value !== "object")
+        return JSON.stringify(value);
+    if (Array.isArray(value))
+        return `[${value.map(canonicalJson).join(",")}]`;
+    const obj = value;
+    const keys = Object.keys(obj).sort();
+    return `{${keys.map((k) => `${JSON.stringify(k)}:${canonicalJson(obj[k])}`).join(",")}}`;
+}
+//# sourceMappingURL=entitlement.js.map

package/dist/dash/entitlement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entitlement.js","sourceRoot":"","sources":["../../src/dash/entitlement.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAIjC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,CAAU,CAAC;AAC/F,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,WAAW;IACX,UAAU;IACV,KAAK;IACL,KAAK;CACG,CAAC;AA0BX,4EAA4E;AAC5E,MAAM,CAAC,MAAM,0BAA0B,GAAG;;;CAGzC,CAAC;AAEF,MAAM,IAAI,GAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,GAAG,gBAAgB,CAAC,EAAE,CAAC;AAE7F,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAQ,gBAAsC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAgB,EAAE,IAAc;IAC1D,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,OAAO,GAAG,CAAC,IAAI,KAAK,YAAY,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAA8B;IAC/D,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC;aAClD,IAAI,EAAE;aACN,WAAW,EAAE,CAAC;QACjB,IAAI,OAAO,KAAK,YAAY,EAAE,CAAC;YAC7B,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QAC3D,CAAC;QACD,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;YACvB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,GAAG,gBAAgB,CAAC,EAAE,CAAC;QACxE,CAAC;QAED,MAAM,WAAW,GACf,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QACnF,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5B,IAAI,GAAG,GAAG,EAAE,CAAC;YACb,IAAI,CAAC;gBACH,GAAG,GAAG,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;YAC1C,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,MAAM,GAAG,KAAK,CAAC,mBAAmB,IAAI,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC;YACzE,IAAI,uBAAuB,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC;gBAClE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;YAC/D,CAAC;QACH,CAAC;QAED,IAAI,qBAAqB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACvC,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QAC7D,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAwB;IAC5D,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,IAAI,CAAC;IAC7C,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IACxF,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;AACpF,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,GAAW,EACX,GAAS,EACT,YAAqB;IAErB,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IACjF,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,MAAM,QAAQ,GAAG,IAAI,KAAK,YAAY,IAAI,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IAC9E,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,EAAE;YAAE,OAAO,KAAK,CAAC;IAClE,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;IACpB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,GAAG,CAAC;IACpC,KAAK,KAAK,CAAC;IACX,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,YAAY,IAAI,0BAA0B,CAAC;IACvD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACjC,OAAO,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9E,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAC3E,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAC3F,CAAC"}

package/dist/dash/input.d.ts

@@ -0,0 +1,7 @@
+import type { DashPane } from "./entitlement.js";
+export interface KeyAction {
+    readonly type: "pane" | "refresh" | "offline" | "quit" | "help" | "noop";
+    readonly pane?: DashPane;
+}
+export declare function mapKey(raw: string): KeyAction;
+//# sourceMappingURL=input.d.ts.map

package/dist/dash/input.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"input.d.ts","sourceRoot":"","sources":["../../src/dash/input.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAEjD,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IACzE,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC;CAC1B;AAoBD,wBAAgB,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAW7C"}

package/dist/dash/input.js

@@ -0,0 +1,36 @@
+const DIGIT = {
+    "1": "home",
+    "2": "policy",
+    "3": "agents",
+    "4": "approvals",
+    "5": "sessions",
+    "6": "orr",
+    "7": "mcp",
+};
+const LETTER = {
+    d: "dashboard",
+    c: "cases",
+    m: "metrics",
+    e: "edge",
+    s: "settings",
+};
+export function mapKey(raw) {
+    if (raw === "q" || raw === "\u0003")
+        return { type: "quit" };
+    if (raw === "r")
+        return { type: "refresh" };
+    if (raw === "o")
+        return { type: "offline" };
+    if (raw === "?" || raw === "h")
+        return { type: "help" };
+    if (raw === "\t")
+        return { type: "noop" };
+    const digit = DIGIT[raw];
+    if (digit)
+        return { type: "pane", pane: digit };
+    const letter = LETTER[raw];
+    if (letter)
+        return { type: "pane", pane: letter };
+    return { type: "noop" };
+}
+//# sourceMappingURL=input.js.map

package/dist/dash/input.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"input.js","sourceRoot":"","sources":["../../src/dash/input.ts"],"names":[],"mappings":"AAOA,MAAM,KAAK,GAA6B;IACtC,GAAG,EAAE,MAAM;IACX,GAAG,EAAE,QAAQ;IACb,GAAG,EAAE,QAAQ;IACb,GAAG,EAAE,WAAW;IAChB,GAAG,EAAE,UAAU;IACf,GAAG,EAAE,KAAK;IACV,GAAG,EAAE,KAAK;CACX,CAAC;AAEF,MAAM,MAAM,GAA6B;IACvC,CAAC,EAAE,WAAW;IACd,CAAC,EAAE,OAAO;IACV,CAAC,EAAE,SAAS;IACZ,CAAC,EAAE,MAAM;IACT,CAAC,EAAE,UAAU;CACd,CAAC;AAEF,MAAM,UAAU,MAAM,CAAC,GAAW;IAChC,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC7D,IAAI,GAAG,KAAK,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC5C,IAAI,GAAG,KAAK,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC5C,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACxD,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAChD,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAClD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC1B,CAAC"}

package/dist/dash/render.d.ts

@@ -0,0 +1,18 @@
+import type { DashPane, Entitlement } from "./entitlement.js";
+export declare const COLS = 78;
+export interface StatusStrip {
+    readonly plan: "FREE" | "ENTERPRISE";
+    readonly host: string;
+    readonly plane: string;
+    readonly pane: DashPane;
+}
+export declare function hline(ch?: string): string;
+export declare function clip(text: string, width?: number): string;
+export declare function table(headers: readonly string[], rows: readonly (readonly string[])[]): string[];
+export declare function navLine(_ent: Entitlement, active: DashPane): string;
+export declare function enterpriseNavLine(ent: Entitlement, active: DashPane): string;
+export declare function lockedPane(pane: DashPane): string[];
+export declare function frame(status: StatusStrip, ent: Entitlement, body: readonly string[]): string;
+export declare function assertNoSecrets(text: string, extra?: string): void;
+export declare function paneAllowedOrLocked(ent: Entitlement, pane: DashPane, live: () => readonly string[]): readonly string[];
+//# sourceMappingURL=render.d.ts.map

package/dist/dash/render.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"render.d.ts","sourceRoot":"","sources":["../../src/dash/render.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAG9D,eAAO,MAAM,IAAI,KAAK,CAAC;AAEvB,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,CAAC;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;CACzB;AAED,wBAAgB,KAAK,CAAC,EAAE,SAAM,GAAG,MAAM,CAEtC;AAED,wBAAgB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,SAAO,GAAG,MAAM,CAGvD;AAED,wBAAgB,KAAK,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE,GAAG,MAAM,EAAE,CAiBhG;AAED,wBAAgB,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,GAAG,MAAM,CAGnE;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,GAAG,MAAM,CAS5E;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,QAAQ,GAAG,MAAM,EAAE,CAOnD;AAED,wBAAgB,KAAK,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAe5F;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAclE;AAED,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,WAAW,EAChB,IAAI,EAAE,QAAQ,EACd,IAAI,EAAE,MAAM,SAAS,MAAM,EAAE,GAC5B,SAAS,MAAM,EAAE,CAGnB"}

package/dist/dash/render.js

@@ -0,0 +1,81 @@
+import { FREE_PANES, paneAllowed } from "./entitlement.js";
+export const COLS = 78;
+export function hline(ch = "─") {
+    return ch.repeat(COLS);
+}
+export function clip(text, width = COLS) {
+    if (text.length <= width)
+        return text;
+    return `${text.slice(0, Math.max(0, width - 1))}…`;
+}
+export function table(headers, rows) {
+    const widths = headers.map((h, i) => Math.max(h.length, ...rows.map((r) => (r[i] ?? "").length), 4));
+    const line = (cells) => clip(cells
+        .map((c, i) => (c ?? "").padEnd(widths[i] ?? 0))
+        .join("  "));
+    const out = [line(headers), clip(widths.map((w) => "─".repeat(w)).join("  "))];
+    if (rows.length === 0) {
+        out.push("(empty)");
+    }
+    else {
+        for (const r of rows)
+            out.push(line(r));
+    }
+    return out;
+}
+export function navLine(_ent, active) {
+    const free = FREE_PANES.map((p) => (p === active ? `[${p.toUpperCase()}]` : p)).join("  ");
+    return clip(`free: ${free}`);
+}
+export function enterpriseNavLine(ent, active) {
+    if (ent.plan === "enterprise") {
+        return clip(`ent:  ${["dashboard", "cases", "metrics", "edge", "settings"]
+            .map((p) => (p === active ? `[${p.toUpperCase()}]` : p))
+            .join("  ")}`);
+    }
+    return clip("ent:  dashboard  cases  metrics  edge  settings  (licensed)");
+}
+export function lockedPane(pane) {
+    return [
+        `${pane} requires an enterprise license.`,
+        "This pane matches the web console and is not part of the free individual plan.",
+        "Unlock: KYA_DASH_PLAN=enterprise  or  SCALE plane  or  .kya/license",
+        "Docs: docs/operations/kya-tui-license.md",
+    ];
+}
+export function frame(status, ent, body) {
+    const head = [
+        hline("═"),
+        clip(`kya dash  ·  ${status.plan}  ·  host=${status.host}  ·  plane=${status.plane}  ·  pane=${status.pane}`),
+        navLine(ent, status.pane),
+        enterpriseNavLine(ent, status.pane),
+        hline(),
+    ];
+    const foot = [
+        hline(),
+        clip("1-7 panes  d/c/m/e/s enterprise  r refresh  o offline  q quit  ? help"),
+    ];
+    return [...head, ...body.map((l) => clip(l)), ...foot].join("\n");
+}
+export function assertNoSecrets(text, extra) {
+    const hay = extra ? `${text}\n${extra}` : text;
+    const pats = [
+        /npm_[A-Za-z0-9]{8,}/,
+        /Bearer\s+\S{8,}/i,
+        /sk_live_[A-Za-z0-9]+/,
+        /sk_test_[A-Za-z0-9]+/,
+        /ghp_[A-Za-z0-9]+/,
+        /github_pat_[A-Za-z0-9_]+/,
+    ];
+    for (const p of pats) {
+        if (p.test(text))
+            throw new Error("dashboard frame leaked a secret");
+    }
+    void hay;
+}
+export function paneAllowedOrLocked(ent, pane, live) {
+    if (!paneAllowed(ent, pane))
+        return lockedPane(pane);
+    return live();
+}
+//# sourceMappingURL=render.js.map

package/dist/dash/render.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"render.js","sourceRoot":"","sources":["../../src/dash/render.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE3D,MAAM,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;AASvB,MAAM,UAAU,KAAK,CAAC,EAAE,GAAG,GAAG;IAC5B,OAAO,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,IAAY,EAAE,KAAK,GAAG,IAAI;IAC7C,IAAI,IAAI,CAAC,MAAM,IAAI,KAAK;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,KAAK,CAAC,OAA0B,EAAE,IAAoC;IACpF,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAClC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAC/D,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,KAAwB,EAAE,EAAE,CACxC,IAAI,CACF,KAAK;SACF,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;SAC/C,IAAI,CAAC,IAAI,CAAC,CACd,CAAC;IACJ,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/E,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACtB,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,CAAC,IAAI,IAAI;YAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,IAAiB,EAAE,MAAgB;IACzD,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3F,OAAO,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAgB,EAAE,MAAgB;IAClE,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QAC9B,OAAO,IAAI,CACT,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC;aAC3D,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;aACvD,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC,6DAA6D,CAAC,CAAC;AAC7E,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAc;IACvC,OAAO;QACL,GAAG,IAAI,kCAAkC;QACzC,gFAAgF;QAChF,qEAAqE;QACrE,0CAA0C;KAC3C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,KAAK,CAAC,MAAmB,EAAE,GAAgB,EAAE,IAAuB;IAClF,MAAM,IAAI,GAAG;QACX,KAAK,CAAC,GAAG,CAAC;QACV,IAAI,CACF,gBAAgB,MAAM,CAAC,IAAI,aAAa,MAAM,CAAC,IAAI,cAAc,MAAM,CAAC,KAAK,aAAa,MAAM,CAAC,IAAI,EAAE,CACxG;QACD,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC;QACzB,iBAAiB,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC;QACnC,KAAK,EAAE;KACR,CAAC;IACF,MAAM,IAAI,GAAG;QACX,KAAK,EAAE;QACP,IAAI,CAAC,uEAAuE,CAAC;KAC9E,CAAC;IACF,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,KAAc;IAC1D,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/C,MAAM,IAAI,GAAG;QACX,qBAAqB;QACrB,kBAAkB;QAClB,sBAAsB;QACtB,sBAAsB;QACtB,kBAAkB;QAClB,0BAA0B;KAC3B,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACvE,CAAC;IACD,KAAK,GAAG,CAAC;AACX,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,GAAgB,EAChB,IAAc,EACd,IAA6B;IAE7B,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC;QAAE,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;IACrD,OAAO,IAAI,EAAE,CAAC;AAChB,CAAC"}

package/dist/dash/screens/enterprise.d.ts

@@ -0,0 +1,18 @@
+export declare function dashboardBody(k: {
+    pendingApprovals: number;
+    agentCount: number;
+    sessionCount?: number;
+    highRiskSessions?: number;
+    policyDeny?: number;
+    approveRequired?: number;
+    approveGranted?: number;
+}): string[];
+export declare function casesBody(rows: readonly {
+    id: string;
+    status?: string;
+    amount?: string;
+}[]): string[];
+export declare function metricsBody(m: Record<string, string | number | boolean>): string[];
+export declare function edgeBody(flags: Record<string, string | boolean | number>): string[];
+export declare function settingsBody(lines: readonly string[]): string[];
+//# sourceMappingURL=enterprise.d.ts.map

package/dist/dash/screens/enterprise.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"enterprise.d.ts","sourceRoot":"","sources":["../../../src/dash/screens/enterprise.ts"],"names":[],"mappings":"AAEA,wBAAgB,aAAa,CAAC,CAAC,EAAE;IAC/B,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,GAAG,MAAM,EAAE,CAmBX;AAED,wBAAgB,SAAS,CACvB,IAAI,EAAE,SAAS;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,EAAE,GAChE,MAAM,EAAE,CASV;AAED,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,GAAG,MAAM,EAAE,CASlF;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC,GAAG,MAAM,EAAE,CASnF;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAM/D"}

package/dist/dash/screens/enterprise.js

@@ -0,0 +1,47 @@
+import { table } from "../render.js";
+export function dashboardBody(k) {
+    return [
+        "Enterprise dashboard (web parity KPIs).",
+        "",
+        ...table(["kpi", "value"], [
+            ["pending approvals", String(k.pendingApprovals)],
+            ["agents registered", Number.isFinite(k.agentCount) ? String(k.agentCount) : "—"],
+            ["observed sessions", String(k.sessionCount ?? "—")],
+            ["high-risk sessions", String(k.highRiskSessions ?? "—")],
+            ["policy denies", String(k.policyDeny ?? "—")],
+            ["approve required", String(k.approveRequired ?? "—")],
+            ["approve granted", String(k.approveGranted ?? "—")],
+        ]),
+        "",
+        "Actions that change production still wait for a person.",
+    ];
+}
+export function casesBody(rows) {
+    return [
+        "Evidence & cases (optional disputes pack). Observational — does not approve submit.",
+        "",
+        ...table(["id", "status", "amount"], rows.map((c) => [c.id, c.status ?? "", c.amount ?? ""])),
+    ];
+}
+export function metricsBody(m) {
+    return [
+        "Metrics (process counters). Kill SLO target < 60s.",
+        "",
+        ...table(["metric", "value"], Object.entries(m).map(([k, v]) => [k, String(v)])),
+    ];
+}
+export function edgeBody(flags) {
+    return [
+        "Edge / Gatekeeper (read-only). Complement — not a second PEP.",
+        "",
+        ...table(["flag", "value"], Object.entries(flags).map(([k, v]) => [k, String(v)])),
+    ];
+}
+export function settingsBody(lines) {
+    return [
+        "Settings (licensed). Team / SSO / keys / billing — same surfaces as the web console.",
+        "",
+        ...(lines.length ? lines : ["Connect a plane to load tenant settings."]),
+    ];
+}
+//# sourceMappingURL=enterprise.js.map

package/dist/dash/screens/enterprise.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enterprise.js","sourceRoot":"","sources":["../../../src/dash/screens/enterprise.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAErC,MAAM,UAAU,aAAa,CAAC,CAQ7B;IACC,OAAO;QACL,yCAAyC;QACzC,EAAE;QACF,GAAG,KAAK,CACN,CAAC,KAAK,EAAE,OAAO,CAAC,EAChB;YACE,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;YACjD,CAAC,mBAAmB,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;YACjF,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC,CAAC,YAAY,IAAI,GAAG,CAAC,CAAC;YACpD,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC,CAAC,gBAAgB,IAAI,GAAG,CAAC,CAAC;YACzD,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC;YAC9C,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC,CAAC,eAAe,IAAI,GAAG,CAAC,CAAC;YACtD,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC,CAAC,cAAc,IAAI,GAAG,CAAC,CAAC;SACrD,CACF;QACD,EAAE;QACF,yDAAyD;KAC1D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS,CACvB,IAAiE;IAEjE,OAAO;QACL,qFAAqF;QACrF,EAAE;QACF,GAAG,KAAK,CACN,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAC1B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CACxD;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,CAA4C;IACtE,OAAO;QACL,oDAAoD;QACpD,EAAE;QACF,GAAG,KAAK,CACN,CAAC,QAAQ,EAAE,OAAO,CAAC,EACnB,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAClD;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,KAAgD;IACvE,OAAO;QACL,+DAA+D;QAC/D,EAAE;QACF,GAAG,KAAK,CACN,CAAC,MAAM,EAAE,OAAO,CAAC,EACjB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CACtD;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAwB;IACnD,OAAO;QACL,sFAAsF;QACtF,EAAE;QACF,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,0CAA0C,CAAC,CAAC;KACzE,CAAC;AACJ,CAAC"}

package/dist/dash/screens/free.d.ts

@@ -0,0 +1,42 @@
+import type { PolicyEvaluateResponse } from "../../client.js";
+export declare function homeBody(input: {
+    readonly version: string;
+    readonly offline: boolean;
+    readonly hasApiKey: boolean;
+    readonly baseUrl: string;
+    readonly agentId?: string;
+    readonly lastEval?: {
+        toolId: string;
+        verdict: string;
+        reasonCode: string;
+    };
+}): string[];
+export declare function policyOfflineBody(): string[];
+export declare function policyLiveBody(evals: readonly PolicyEvaluateResponse[]): string[];
+export declare function agentsOfflineBody(agentId?: string): string[];
+export declare function agentsLiveBody(rows: readonly {
+    id: string;
+    name: string;
+    status?: string;
+}[]): string[];
+export declare function needsPlaneBody(pane: string): string[];
+export declare function approvalsLiveBody(rows: readonly {
+    id: string;
+    status: string;
+    action?: string;
+}[]): string[];
+export declare function sessionsLiveBody(rows: readonly {
+    id: string;
+    risk?: string;
+    host?: string;
+}[]): string[];
+export declare function orrBody(summary?: {
+    overall?: string;
+    disposition?: string;
+    path?: string;
+}): string[];
+export declare function mcpBody(input: {
+    host: string;
+    hasApiKey: boolean;
+}): string[];
+//# sourceMappingURL=free.d.ts.map

package/dist/dash/screens/free.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"free.d.ts","sourceRoot":"","sources":["../../../src/dash/screens/free.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAG9D,wBAAgB,QAAQ,CAAC,KAAK,EAAE;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7E,GAAG,MAAM,EAAE,CAoBX;AAED,wBAAgB,iBAAiB,IAAI,MAAM,EAAE,CA0B5C;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,SAAS,sBAAsB,EAAE,GAAG,MAAM,EAAE,CAejF;AAED,wBAAgB,iBAAiB,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAS5D;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,EAAE,GAAG,MAAM,EAAE,CASvG;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAMrD;AAED,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,SAAS;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,EAAE,GAC/D,MAAM,EAAE,CAUV;AAED,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,SAAS;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,EAAE,GAC5D,MAAM,EAAE,CASV;AAED,wBAAgB,OAAO,CAAC,OAAO,CAAC,EAAE;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GAAG,MAAM,EAAE,CASX;AAED,wBAAgB,OAAO,CAAC,KAAK,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,EAAE,CAS7E"}

package/dist/dash/screens/free.js

@@ -0,0 +1,118 @@
+import { evaluateOffline } from "../../offline-evaluate.js";
+import { SAMPLE_TOOLS } from "../../sample-tools.js";
+import { table } from "../render.js";
+export function homeBody(input) {
+    const lines = [
+        "Individual free plan — local PEP playground, observe, ORR, MCP gate.",
+        "Enterprise web-parity panes stay locked until licensed.",
+        "",
+        `cli          ${input.version}`,
+        `offline      ${input.offline ? "yes (sample tools, not production PEP)" : "no"}`,
+        `api key      ${input.hasApiKey ? "set" : "empty (fail-closed on live panes)"}`,
+        `plane        ${input.offline ? "offline" : input.baseUrl}`,
+        `agentId      ${input.agentId ?? "(none — kya register-agent)"}`,
+        "",
+        "Next: 2 policy  ·  6 orr  ·  7 mcp  ·  eval-tool --offline",
+    ];
+    if (input.lastEval) {
+        lines.push("", `last eval    ${input.lastEval.toolId} → ${input.lastEval.verdict} (${input.lastEval.reasonCode})`);
+    }
+    return lines;
+}
+export function policyOfflineBody() {
+    const deny = evaluateOffline({
+        toolId: "org.sample.never.event",
+        irreversible: true,
+        env: { host: "ide" },
+    });
+    const ra = evaluateOffline({
+        toolId: "org.sample.data.write",
+        irreversible: true,
+        env: { host: "ide" },
+    });
+    return [
+        "Policy playground (offline sample — not the production PEP).",
+        "Sole PEP in production is Shield HTTP evaluate.",
+        "",
+        ...table(["tool", "verdict", "reason"], [
+            ["org.sample.never.event", deny.verdict, deny.reasonCode],
+            ["org.sample.data.write", ra.verdict, ra.reasonCode],
+        ]),
+        "",
+        `catalog      ${SAMPLE_TOOLS.length} sample tools (packs optional)`,
+        "live         set KYA_BASE_URL + KYA_API_KEY and drop --offline",
+    ];
+}
+export function policyLiveBody(evals) {
+    if (evals.length === 0) {
+        return [
+            "Policy playground (live plane).",
+            "No evaluations this session. Press r after wiring KYA_API_KEY.",
+        ];
+    }
+    return [
+        "Policy playground (live plane — Shield is sole PEP).",
+        "",
+        ...table(["tool", "verdict", "reason"], evals.map((e) => [e.toolId ?? "?", e.verdict, e.reasonCode])),
+    ];
+}
+export function agentsOfflineBody(agentId) {
+    return [
+        "Agents (free).",
+        "Offline mode cannot list the plane registry.",
+        agentId
+            ? `local agentId  ${agentId}`
+            : "No local agentId. Run: kya register-agent --name solo --version-hash dev",
+        "Needs plane: list / kill / passport.",
+    ];
+}
+export function agentsLiveBody(rows) {
+    return [
+        "Agents (free — register / inspect / kill).",
+        "",
+        ...table(["id", "name", "status"], rows.map((a) => [a.id, a.name, a.status ?? ""])),
+    ];
+}
+export function needsPlaneBody(pane) {
+    return [
+        `${pane} needs a control plane.`,
+        "Set KYA_BASE_URL + KYA_API_KEY (local-free :8090 or hosted).",
+        "Empty key is fail-closed — this pane will not fake data.",
+    ];
+}
+export function approvalsLiveBody(rows) {
+    return [
+        "Approvals (free — human queue). Approve/reject is the same PEP path as the web.",
+        "TUI never auto-approves.",
+        "",
+        ...table(["id", "status", "action"], rows.map((a) => [a.id, a.status, String(a.action ?? "")])),
+    ];
+}
+export function sessionsLiveBody(rows) {
+    return [
+        "Sessions (observe). Risk only raises policy; it cannot auto-allow.",
+        "",
+        ...table(["id", "risk", "host"], rows.map((s) => [s.id, s.risk ?? "", s.host ?? ""])),
+    ];
+}
+export function orrBody(summary) {
+    return [
+        "ORR board (reporting only — not a second PEP).",
+        "Scanners are evidence. Sole PEP remains Shield KYA.",
+        "",
+        summary
+            ? `last run     ${summary.overall ?? "?"} / ${summary.disposition ?? "?"}  ${summary.path ?? ""}`
+            : "Run: kya orr run --path . --out ./orr-report --skip-optional-producers",
+    ];
+}
+export function mcpBody(input) {
+    return [
+        "Local MCP gate (free).",
+        "  kya serve-mcp --stdio",
+        "  tools: kya.policy_evaluate | kya.session_ingest | kya.request_approval",
+        `host         ${input.host}`,
+        `api key      ${input.hasApiKey ? "set" : "empty — serve-mcp will fail-closed"}`,
+        "No irreversible side effect without APPROVED.",
+    ];
+}
+//# sourceMappingURL=free.js.map

package/dist/dash/screens/free.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"free.js","sourceRoot":"","sources":["../../../src/dash/screens/free.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAErD,OAAO,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAErC,MAAM,UAAU,QAAQ,CAAC,KAOxB;IACC,MAAM,KAAK,GAAG;QACZ,sEAAsE;QACtE,yDAAyD;QACzD,EAAE;QACF,gBAAgB,KAAK,CAAC,OAAO,EAAE;QAC/B,gBAAgB,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,wCAAwC,CAAC,CAAC,CAAC,IAAI,EAAE;QACjF,gBAAgB,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,mCAAmC,EAAE;QAC/E,gBAAgB,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE;QAC3D,gBAAgB,KAAK,CAAC,OAAO,IAAI,6BAA6B,EAAE;QAChE,EAAE;QACF,4DAA4D;KAC7D,CAAC;IACF,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnB,KAAK,CAAC,IAAI,CACR,EAAE,EACF,gBAAgB,KAAK,CAAC,QAAQ,CAAC,MAAM,MAAM,KAAK,CAAC,QAAQ,CAAC,OAAO,KAAK,KAAK,CAAC,QAAQ,CAAC,UAAU,GAAG,CACnG,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,MAAM,IAAI,GAAG,eAAe,CAAC;QAC3B,MAAM,EAAE,wBAAwB;QAChC,YAAY,EAAE,IAAI;QAClB,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE;KACrB,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,eAAe,CAAC;QACzB,MAAM,EAAE,uBAAuB;QAC/B,YAAY,EAAE,IAAI;QAClB,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE;KACrB,CAAC,CAAC;IACH,OAAO;QACL,8DAA8D;QAC9D,iDAAiD;QACjD,EAAE;QACF,GAAG,KAAK,CACN,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,EAC7B;YACE,CAAC,wBAAwB,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC;YACzD,CAAC,uBAAuB,EAAE,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC;SACrD,CACF;QACD,EAAE;QACF,gBAAgB,YAAY,CAAC,MAAM,gCAAgC;QACnE,gEAAgE;KACjE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAwC;IACrE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO;YACL,iCAAiC;YACjC,gEAAgE;SACjE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,sDAAsD;QACtD,EAAE;QACF,GAAG,KAAK,CACN,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,EAC7B,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAC7D;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAgB;IAChD,OAAO;QACL,gBAAgB;QAChB,8CAA8C;QAC9C,OAAO;YACL,CAAC,CAAC,kBAAkB,OAAO,EAAE;YAC7B,CAAC,CAAC,0EAA0E;QAC9E,sCAAsC;KACvC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAA8D;IAC3F,OAAO;QACL,4CAA4C;QAC5C,EAAE;QACF,GAAG,KAAK,CACN,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EACxB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAChD;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO;QACL,GAAG,IAAI,yBAAyB;QAChC,8DAA8D;QAC9D,0DAA0D;KAC3D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,IAAgE;IAEhE,OAAO;QACL,iFAAiF;QACjF,0BAA0B;QAC1B,EAAE;QACF,GAAG,KAAK,CACN,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAC1B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,CAC1D;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,IAA6D;IAE7D,OAAO;QACL,oEAAoE;QACpE,EAAE;QACF,GAAG,KAAK,CACN,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EACtB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CACpD;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,OAIvB;IACC,OAAO;QACL,gDAAgD;QAChD,qDAAqD;QACrD,EAAE;QACF,OAAO;YACL,CAAC,CAAC,gBAAgB,OAAO,CAAC,OAAO,IAAI,GAAG,MAAM,OAAO,CAAC,WAAW,IAAI,GAAG,KAAK,OAAO,CAAC,IAAI,IAAI,EAAE,EAAE;YACjG,CAAC,CAAC,wEAAwE;KAC7E,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,KAA2C;IACjE,OAAO;QACL,wBAAwB;QACxB,yBAAyB;QACzB,0EAA0E;QAC1E,gBAAgB,KAAK,CAAC,IAAI,EAAE;QAC5B,gBAAgB,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,oCAAoC,EAAE;QAChF,+CAA+C;KAChD,CAAC;AACJ,CAAC"}

package/dist/mcp/http.d.ts

@@ -7,6 +7,8 @@ export interface HttpMcpOptions {
     readonly client: KyaHttpClient;
     readonly kyaHost: Host;
     readonly agentId?: string;
+    /** Optional shared secret; also read from KYA_MCP_HTTP_TOKEN. */
+    readonly sharedSecret?: string;
 }
 export interface HttpMcpServer {
     readonly server: Server;
@@ -14,13 +16,5 @@ export interface HttpMcpServer {
     readonly url: string;
     close(): Promise<void>;
 }
-/**
- * Lightweight HTTP MCP gate for local smoke / non-stdio hosts.
- * - GET  /health
- * - GET  /connectors/mcp.json  (descriptor)
- * - GET  /mcp/tools
- * - POST /mcp                  (JSON-RPC)
- * - POST /mcp/tools/:name      (direct tool call)
- */
 export declare function startHttpMcp(options: HttpMcpOptions): Promise<HttpMcpServer>;
 //# sourceMappingURL=http.d.ts.map

package/dist/mcp/http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/mcp/http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsC,KAAK,MAAM,EAAuB,MAAM,WAAW,CAAC;AACjG,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAUzC,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CA6B5E"}
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/mcp/http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsC,KAAK,MAAM,EAAuB,MAAM,WAAW,CAAC;AACjG,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAUzC,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,iEAAiE;IACjE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAaD,wBAAgB,YAAY,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CAkC5E"}