@shield-agent/kya 0.10.1 → 0.12.0

package/dist/commands/stop.js.map

@@ -1 +1 @@
-{"version":3,"file":"stop.js","sourceRoot":"","sources":["../../src/commands/stop.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,gBAAgB,EAChB,qBAAqB,EACrB,sBAAsB,EACtB,kBAAkB,EAClB,QAAQ,EACR,eAAe,GAEhB,MAAM,sBAAsB,CAAC;AAwB9B,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,gBAAgB;IAClB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,GAAW,EAAE,UAAuB,EAAE;IAClE,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9D,4DAA4D;YAC5D,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACtB,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;aAAM,CAAC;YACN,IAAI,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxB,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBACvB,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,GAAG,EAAE,CAAC;oBAC1E,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;gBACnB,CAAC;YACH,CAAC;YACD,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACtB,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;IACH,CAAC;IAED,IAAI,YAA2C,CAAC;IAChD,IAAI,gBAAgB,GAAG,KAAK,CAAC;IAC7B,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;QACtD,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,uEAAuE;YACvE,8DAA8D;YAC9D,gBAAgB,GAAG,IAAI,CAAC;YACxB,YAAY,GAAG,EAAE,CAAC;QACpB,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;YACzC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YAC5D,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,KAAK,MAAM,GAAG,IAAI,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/C,IAAI,OAAO,IAAI,GAAG,KAAK,KAAK,EAAE,GAAG;oBAAE,SAAS,CAAC,wBAAwB;gBACrE,IAAI,CAAC,GAAG,CAAC,CAAC;gBACV,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,KAAK,IAAI,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,GAAG,EAAE,CAAC;oBACpE,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;gBACnB,CAAC;gBACD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAClB,CAAC;YACD,YAAY,GAAG,KAAK,CAAC;QACvB,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO;QACP,GAAG,EAAE,KAAK,EAAE,GAAG;QACf,KAAK,EAAE,KAAK,IAAI,SAAS;QACzB,YAAY;QACZ,gBAAgB,EAAE,gBAAgB,IAAI,SAAS;KAChD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,CAAa;IAC3C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;QACZ,KAAK,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,GAAG,yCAAyC,CAAC,CAAC;IAC1F,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CACR,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,0BAA0B,CAChF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,gBAAgB,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CACR,iHAAiH,CAClH,CAAC;IACJ,CAAC;SAAM,IAAI,CAAC,CAAC,YAAY,EAAE,CAAC;QAC1B,KAAK,CAAC,IAAI,CACR,CAAC,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC;YACvB,CAAC,CAAC,WAAW,CAAC,CAAC,YAAY,CAAC,MAAM,6BAA6B,CAAC,CAAC,YAAY;iBACxE,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,EAAE,CAAC;iBAC1B,IAAI,CAAC,IAAI,CAAC,EAAE;YACjB,CAAC,CAAC,kCAAkC,CACvC,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}
+{"version":3,"file":"stop.js","sourceRoot":"","sources":["../../src/commands/stop.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,gBAAgB,EAChB,qBAAqB,EACrB,sBAAsB,EACtB,kBAAkB,EAClB,QAAQ,EACR,eAAe,GAEhB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AA2BxC,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,gBAAgB;IAClB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,GAAW,EAAE,UAAuB,EAAE;IAClE,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9D,4DAA4D;YAC5D,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACtB,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;aAAM,CAAC;YACN,IAAI,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxB,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBACvB,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,GAAG,EAAE,CAAC;oBAC1E,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;gBACnB,CAAC;YACH,CAAC;YACD,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACtB,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;IACH,CAAC;IAED,IAAI,YAA2C,CAAC;IAChD,IAAI,gBAAgB,GAAG,KAAK,CAAC;IAC7B,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;QACtD,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,uEAAuE;YACvE,8DAA8D;YAC9D,gBAAgB,GAAG,IAAI,CAAC;YACxB,YAAY,GAAG,EAAE,CAAC;QACpB,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;YACzC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YAC5D,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,KAAK,MAAM,GAAG,IAAI,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/C,IAAI,OAAO,IAAI,GAAG,KAAK,KAAK,EAAE,GAAG;oBAAE,SAAS,CAAC,wBAAwB;gBACrE,IAAI,CAAC,GAAG,CAAC,CAAC;gBACV,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,KAAK,IAAI,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,GAAG,EAAE,CAAC;oBACpE,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;gBACnB,CAAC;gBACD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAClB,CAAC;YACD,YAAY,GAAG,KAAK,CAAC;QACvB,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,yEAAyE;IACzE,YAAY;IACZ,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,OAA2B,CAAC;IAChC,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE;YAChD,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,IAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;SAC7D,CAAC,CAAC;QACH,WAAW,GAAG,UAAU,CAAC,OAAO,CAAC;QACjC,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC;QACzB,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;YACzC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,kBAAkB,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC;YACxF,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC;YACxC,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,kBAAkB,CAAC,KAAK,CAAC,EAAE,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBAC/E,IAAI,WAAW,IAAI,CAAC,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,UAAU,CAAC,QAAQ,CAAC;oBAAE,SAAS;gBAC9E,IAAI,CAAC,GAAG,CAAC,CAAC;gBACV,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,KAAK,IAAI,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,GAAG,EAAE,CAAC;oBACpE,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;gBACnB,CAAC;gBACD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAClB,CAAC;YACD,YAAY,GAAG,KAAK,CAAC;QACvB,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO;QACP,GAAG,EAAE,KAAK,EAAE,GAAG;QACf,KAAK,EAAE,KAAK,IAAI,SAAS;QACzB,YAAY;QACZ,gBAAgB,EAAE,gBAAgB,IAAI,SAAS;QAC/C,WAAW,EAAE,WAAW,IAAI,SAAS;QACrC,OAAO;KACR,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,CAAa;IAC3C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;QACZ,KAAK,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,GAAG,yCAAyC,CAAC,CAAC;IAC1F,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CACR,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,0BAA0B,CAChF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,gBAAgB,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CACR,iHAAiH,CAClH,CAAC;IACJ,CAAC;SAAM,IAAI,CAAC,CAAC,YAAY,EAAE,CAAC;QAC1B,KAAK,CAAC,IAAI,CACR,CAAC,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC;YACvB,CAAC,CAAC,WAAW,CAAC,CAAC,YAAY,CAAC,MAAM,6BAA6B,CAAC,CAAC,YAAY;iBACxE,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,EAAE,CAAC;iBAC1B,IAAI,CAAC,IAAI,CAAC,EAAE;YACjB,CAAC,CAAC,kCAAkC,CACvC,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAClB,KAAK,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/gate/binary.d.ts

@@ -0,0 +1,49 @@
+/** Pinned gateway build. Bump only together with the repack workflow input. */
+export declare const GATE_VERSION = "1.5.0";
+export declare function gateBinDir(env?: NodeJS.ProcessEnv): string;
+export declare function gateBinaryPath(env?: NodeJS.ProcessEnv, platform?: NodeJS.Platform): string;
+export interface GatePlatform {
+    readonly os: "linux" | "darwin" | "windows";
+    readonly arch: "amd64" | "arm64";
+}
+export declare function resolveGatePlatform(platform?: NodeJS.Platform, arch?: string): GatePlatform;
+export declare function gateArtifactName(version: string, p: GatePlatform): string;
+export declare function gateArtifactUrl(version: string, p: GatePlatform): string;
+export declare function sha256Hex(buf: Uint8Array): string;
+/** First hex token of a `<sha256>  <name>` checksum file. */
+export declare function parseSha256File(text: string): string;
+export interface GateBinaryStatus {
+    readonly path: string;
+    readonly present: boolean;
+    /** First line of `kya-gate --version`, when readable. */
+    readonly version?: string;
+}
+export declare function inspectGateBinary(env?: NodeJS.ProcessEnv, platform?: NodeJS.Platform): GateBinaryStatus;
+export interface EnsureBinaryDeps {
+    readonly env?: NodeJS.ProcessEnv;
+    readonly platform?: NodeJS.Platform;
+    readonly arch?: string;
+    /** Injectable for tests; defaults to global fetch. */
+    readonly fetchFn?: (url: string) => Promise<{
+        ok: boolean;
+        status: number;
+        arrayBuffer: () => Promise<ArrayBuffer>;
+        text: () => Promise<string>;
+    }>;
+    /** Injectable for tests; defaults to tar extraction via the system tar. */
+    readonly extract?: (tarGzPath: string, destDir: string) => void;
+}
+export interface EnsureBinaryResult {
+    readonly path: string;
+    readonly installed: boolean;
+    readonly version: string;
+}
+/**
+ * Install the pinned gateway binary when absent or stale (reported version ≠
+ * GATE_VERSION). Never silently downloads: this runs only from
+ * `kya gate setup`. A checksum mismatch aborts the install and leaves the
+ * previous binary untouched; the install itself is atomic (temp file +
+ * rename inside the bin dir).
+ */
+export declare function ensureGateBinary(deps?: EnsureBinaryDeps): Promise<EnsureBinaryResult>;
+//# sourceMappingURL=binary.d.ts.map

package/dist/gate/binary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"binary.d.ts","sourceRoot":"","sources":["../../src/gate/binary.ts"],"names":[],"mappings":"AAeA,+EAA+E;AAC/E,eAAO,MAAM,YAAY,UAAU,CAAC;AAIpC,wBAAgB,UAAU,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAEvE;AAED,wBAAgB,cAAc,CAC5B,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,MAAM,CAER;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,OAAO,GAAG,QAAQ,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;CAClC;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,GAAE,MAAM,CAAC,QAA2B,EAC5C,IAAI,GAAE,MAAqB,GAC1B,YAAY,CAWd;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,YAAY,GAAG,MAAM,CAEzE;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,YAAY,GAAG,MAAM,CAExE;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,UAAU,GAAG,MAAM,CAEjD;AAED,6DAA6D;AAC7D,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAIpD;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,yDAAyD;IACzD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,wBAAgB,iBAAiB,CAC/B,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,gBAAgB,CAqBlB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACjC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IACpC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,sDAAsD;IACtD,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,OAAO,CAAC,WAAW,CAAC,CAAC;QAAC,IAAI,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;KAAE,CAAC,CAAC;IACnJ,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACjE;AAMD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,GAAE,gBAAqB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAuD/F"}

package/dist/gate/binary.js

@@ -0,0 +1,129 @@
+/**
+ * Local gateway binary management. `kya gate setup` is the ONLY place a
+ * binary is downloaded: it fetches the pinned repacked artifact from this
+ * repo's own `gate-v*` GitHub release, verifies the published sha256, and
+ * installs to `<global .kya>/bin/kya-gate`. Everything else (run/doctor)
+ * only ever uses the binary already on disk.
+ */
+import { createHash } from "node:crypto";
+import { execFileSync } from "node:child_process";
+import { chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { globalConfigDir } from "../config.js";
+import { KyaError } from "../errors.js";
+/** Pinned gateway build. Bump only together with the repack workflow input. */
+export const GATE_VERSION = "1.5.0";
+const RELEASE_REPO = "The-Pixel-Boys/shield-kya";
+export function gateBinDir(env = process.env) {
+    return join(globalConfigDir(env), "bin");
+}
+export function gateBinaryPath(env = process.env, platform = process.platform) {
+    return join(gateBinDir(env), platform === "win32" ? "kya-gate.exe" : "kya-gate");
+}
+export function resolveGatePlatform(platform = process.platform, arch = process.arch) {
+    const os = platform === "darwin" ? "darwin" : platform === "win32" ? "windows" : platform === "linux" ? "linux" : undefined;
+    const a = arch === "x64" ? "amd64" : arch === "arm64" ? "arm64" : undefined;
+    if (!os || !a) {
+        throw new KyaError(`no gateway build for ${platform}/${arch} — supported: linux, darwin, windows × amd64, arm64`, "GATE_UNSUPPORTED_PLATFORM");
+    }
+    return { os, arch: a };
+}
+export function gateArtifactName(version, p) {
+    return `kya-gate-${version}-${p.os}-${p.arch}.tar.gz`;
+}
+export function gateArtifactUrl(version, p) {
+    return `https://github.com/${RELEASE_REPO}/releases/download/gate-v${version}/${gateArtifactName(version, p)}`;
+}
+export function sha256Hex(buf) {
+    return createHash("sha256").update(buf).digest("hex");
+}
+/** First hex token of a `<sha256>  <name>` checksum file. */
+export function parseSha256File(text) {
+    const m = /^([0-9a-f]{64})/i.exec(text.trim());
+    if (!m)
+        throw new KyaError("checksum file is malformed", "GATE_CHECKSUM_MALFORMED");
+    return m[1].toLowerCase();
+}
+export function inspectGateBinary(env = process.env, platform = process.platform) {
+    const path = gateBinaryPath(env, platform);
+    if (!existsSync(path))
+        return { path, present: false };
+    let version;
+    try {
+        const out = execFileSync(path, ["--version"], {
+            encoding: "utf8",
+            stdio: ["ignore", "pipe", "ignore"],
+            timeout: 5_000,
+        }).trim();
+        // The binary prints a JSON build object; fall back to the first line.
+        try {
+            const parsed = JSON.parse(out);
+            version = typeof parsed.version === "string" ? parsed.version : undefined;
+        }
+        catch {
+            version = out.split("\n")[0]?.trim();
+        }
+    }
+    catch {
+        version = undefined;
+    }
+    return { path, present: true, version: version || undefined };
+}
+function defaultExtract(tarGzPath, destDir) {
+    execFileSync("tar", ["-xzf", tarGzPath, "-C", destDir], { stdio: ["ignore", "ignore", "pipe"] });
+}
+/**
+ * Install the pinned gateway binary when absent or stale (reported version ≠
+ * GATE_VERSION). Never silently downloads: this runs only from
+ * `kya gate setup`. A checksum mismatch aborts the install and leaves the
+ * previous binary untouched; the install itself is atomic (temp file +
+ * rename inside the bin dir).
+ */
+export async function ensureGateBinary(deps = {}) {
+    const env = deps.env ?? process.env;
+    const platform = deps.platform ?? process.platform;
+    const p = resolveGatePlatform(platform, deps.arch ?? process.arch);
+    const path = gateBinaryPath(env, platform);
+    const existing = inspectGateBinary(env, platform);
+    if (existing.present && existing.version === GATE_VERSION) {
+        return { path, installed: false, version: GATE_VERSION };
+    }
+    const fetchFn = deps.fetchFn ??
+        ((url) => fetch(url, { redirect: "follow", signal: AbortSignal.timeout(120_000) }));
+    const name = gateArtifactName(GATE_VERSION, p);
+    const base = gateArtifactUrl(GATE_VERSION, p);
+    const binDir = gateBinDir(env);
+    mkdirSync(binDir, { recursive: true });
+    const stage = mkdtempSync(join(tmpdir(), "kya-gate-"));
+    try {
+        const [tgzRes, sumRes] = [await fetchFn(base), await fetchFn(`${base}.sha256`)];
+        if (!tgzRes.ok || !sumRes.ok) {
+            throw new KyaError(`gateway artifact ${name} not available (HTTP ${!tgzRes.ok ? tgzRes.status : sumRes.status}) — run the repack workflow first or check the release tag gate-v${GATE_VERSION}`, "GATE_DOWNLOAD_FAILED");
+        }
+        const tgz = Buffer.from(await tgzRes.arrayBuffer());
+        const expected = parseSha256File(await sumRes.text());
+        const actual = sha256Hex(tgz);
+        if (actual !== expected) {
+            throw new KyaError(`gateway artifact checksum mismatch (expected ${expected}, got ${actual}) — refusing to install`, "GATE_CHECKSUM_MISMATCH");
+        }
+        const tgzPath = join(stage, name);
+        writeFileSync(tgzPath, tgz);
+        (deps.extract ?? defaultExtract)(tgzPath, stage);
+        const extracted = join(stage, platform === "win32" ? "kya-gate.exe" : "kya-gate");
+        if (!existsSync(extracted)) {
+            throw new KyaError(`gateway artifact ${name} did not contain a kya-gate binary — corrupt repack?`, "GATE_ARTIFACT_INVALID");
+        }
+        // Atomic install: stage beside the target, then rename over it.
+        const tmpTarget = join(binDir, `.kya-gate.${process.pid}.tmp`);
+        writeFileSync(tmpTarget, readFileSync(extracted));
+        if (platform !== "win32")
+            chmodSync(tmpTarget, 0o755);
+        renameSync(tmpTarget, path);
+        return { path, installed: true, version: GATE_VERSION };
+    }
+    finally {
+        rmSync(stage, { recursive: true, force: true });
+    }
+}
+//# sourceMappingURL=binary.js.map

package/dist/gate/binary.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"binary.js","sourceRoot":"","sources":["../../src/gate/binary.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACzH,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAExC,+EAA+E;AAC/E,MAAM,CAAC,MAAM,YAAY,GAAG,OAAO,CAAC;AAEpC,MAAM,YAAY,GAAG,2BAA2B,CAAC;AAEjD,MAAM,UAAU,UAAU,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC7D,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,MAAyB,OAAO,CAAC,GAAG,EACpC,WAA4B,OAAO,CAAC,QAAQ;IAE5C,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;AACnF,CAAC;AAOD,MAAM,UAAU,mBAAmB,CACjC,WAA4B,OAAO,CAAC,QAAQ,EAC5C,OAAe,OAAO,CAAC,IAAI;IAE3B,MAAM,EAAE,GACN,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IACnH,MAAM,CAAC,GAAG,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5E,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;QACd,MAAM,IAAI,QAAQ,CAChB,wBAAwB,QAAQ,IAAI,IAAI,qDAAqD,EAC7F,2BAA2B,CAC5B,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,CAAe;IAC/D,OAAO,YAAY,OAAO,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,SAAS,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,CAAe;IAC9D,OAAO,sBAAsB,YAAY,4BAA4B,OAAO,IAAI,gBAAgB,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC;AACjH,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,GAAe;IACvC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxD,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,MAAM,CAAC,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/C,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,QAAQ,CAAC,4BAA4B,EAAE,yBAAyB,CAAC,CAAC;IACpF,OAAO,CAAC,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,CAAC;AAC7B,CAAC;AASD,MAAM,UAAU,iBAAiB,CAC/B,MAAyB,OAAO,CAAC,GAAG,EACpC,WAA4B,OAAO,CAAC,QAAQ;IAE5C,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC3C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACvD,IAAI,OAA2B,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,WAAW,CAAC,EAAE;YAC5C,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;YACnC,OAAO,EAAE,KAAK;SACf,CAAC,CAAC,IAAI,EAAE,CAAC;QACV,sEAAsE;QACtE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA0B,CAAC;YACxD,OAAO,GAAG,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QACvC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,SAAS,CAAC;IACtB,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,CAAC;AAChE,CAAC;AAYD,SAAS,cAAc,CAAC,SAAiB,EAAE,OAAe;IACxD,YAAY,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;AACnG,CAAC;AAQD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAyB,EAAE;IAChE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACnD,MAAM,CAAC,GAAG,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAClD,IAAI,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO,KAAK,YAAY,EAAE,CAAC;QAC1D,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;IAC3D,CAAC;IAED,MAAM,OAAO,GACX,IAAI,CAAC,OAAO;QACZ,CAAC,CAAC,GAAW,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9F,MAAM,IAAI,GAAG,gBAAgB,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,eAAe,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;IAE9C,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC/B,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC;IACvD,IAAI,CAAC;QACH,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,OAAO,CAAC,GAAG,IAAI,SAAS,CAAC,CAAC,CAAC;QAChF,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YAC7B,MAAM,IAAI,QAAQ,CAChB,oBAAoB,IAAI,wBAAwB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,oEAAoE,YAAY,EAAE,EAC5K,sBAAsB,CACvB,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YACxB,MAAM,IAAI,QAAQ,CAChB,gDAAgD,QAAQ,SAAS,MAAM,yBAAyB,EAChG,wBAAwB,CACzB,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAClC,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC5B,CAAC,IAAI,CAAC,OAAO,IAAI,cAAc,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACjD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QAClF,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,QAAQ,CAChB,oBAAoB,IAAI,sDAAsD,EAC9E,uBAAuB,CACxB,CAAC;QACJ,CAAC;QACD,gEAAgE;QAChE,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,EAAE,aAAa,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC;QAC/D,aAAa,CAAC,SAAS,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC;QAClD,IAAI,QAAQ,KAAK,OAAO;YAAE,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACtD,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC5B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;IAC1D,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC;AACH,CAAC"}

package/dist/gate/config-gen.d.ts

@@ -0,0 +1,24 @@
+import type { GatewayServer, GatewaysConfig } from "./config.js";
+/** Destructive-name family denied on every target, registry or not. */
+export declare const DESTRUCTIVE_PATTERN = "(?:^|_)(?:drop|truncate|purge|transfer)(?:_|$)";
+/** Loopback-only L4 rule for the (wildcard-bound) MCP listener. */
+export declare const LOOPBACK_RULE = "cidr(\"127.0.0.0/8\").containsIP(source.address) || source.address == \"::1\"";
+/** Deny patterns for one server: destructive family + its ADMIN registry rules. */
+export declare function denyPatternsFor(serverId: string): readonly string[];
+/**
+ * Whether an unmatched tool on this server is allowed: the registry
+ * defaultTier — READ and WRITE both map to allow (WRITE is observed, not
+ * blocked); an ADMIN default would deny. Unknown servers allow (local
+ * observe gateway), subject to the destructive deny.
+ */
+export declare function unmatchedAllowed(serverId: string): boolean;
+/** The OR-allow CEL rule for one server target. */
+export declare function celAllowRule(server: GatewayServer): string;
+/**
+ * Standalone gateway YAML: one listener multiplexing every server as an MCP
+ * target behind a loopback-only L4 allowlist, generated CEL authorization,
+ * OTLP/HTTP traces to the local receiver. `failureMode` (gateways.json,
+ * default failOpen) decides whether one broken target takes the gateway down.
+ */
+export declare function generateGatewayYaml(config: GatewaysConfig): string;
+//# sourceMappingURL=config-gen.d.ts.map

package/dist/gate/config-gen.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-gen.d.ts","sourceRoot":"","sources":["../../src/gate/config-gen.ts"],"names":[],"mappings":"AA6BA,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAEjE,uEAAuE;AACvE,eAAO,MAAM,mBAAmB,mDAAmD,CAAC;AAEpF,mEAAmE;AACnE,eAAO,MAAM,aAAa,kFACmD,CAAC;AAE9E,mFAAmF;AACnF,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAGnE;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE1D;AAMD,mDAAmD;AACnD,wBAAgB,YAAY,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,CAS1D;AA0CD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CA0ClE"}

package/dist/gate/config-gen.js

@@ -0,0 +1,146 @@
+/**
+ * Generate the gateway YAML from `.kya/gateways.json` + the MCP server
+ * registry tiers. The CEL authorization rules are always derived from the
+ * registry — never hand-written:
+ *
+ *   - destructive names (drop|truncate|purge|transfer, word-boundary anchored
+ *     so `dropdown_select` is untouched) are denied for every server, and
+ *     this deny always wins (rules are OR-allow, so the deny is expressed as
+ *     "allow … AND NOT matches(deny)");
+ *   - the server's ADMIN-tier registry patterns join the deny set;
+ *   - everything else on the target is allowed: READ → allow, WRITE → allow
+ *     (observe mode — allowed calls are audited, not blocked), and unmatched
+ *     tools follow the server's defaultTier, which for every registered
+ *     server resolves to one of those two allows;
+ *   - unknown servers get the destructive-name deny only.
+ *
+ * A tool whose name matches the deny set has no allow rule, so the gateway
+ * denies the call (and filters it from tools/list).
+ *
+ * Listener hardening: the binary binds UNSPECIFIED with no config knob, so
+ * exposure is cut at L4 — a frontend networkAuthorization allowlist permits
+ * only loopback sources (127.0.0.0/8, ::1) — and the stats/readiness/admin
+ * listeners are turned off entirely. Logging is pinned to warn so module
+ * noise (and upstream build strings) stays out of gate.log.
+ */
+import { mcpServerAdminPatterns, mcpServerDefaultTier, } from "../mcp-servers.js";
+/** Destructive-name family denied on every target, registry or not. */
+export const DESTRUCTIVE_PATTERN = "(?:^|_)(?:drop|truncate|purge|transfer)(?:_|$)";
+/** Loopback-only L4 rule for the (wildcard-bound) MCP listener. */
+export const LOOPBACK_RULE = 'cidr("127.0.0.0/8").containsIP(source.address) || source.address == "::1"';
+/** Deny patterns for one server: destructive family + its ADMIN registry rules. */
+export function denyPatternsFor(serverId) {
+    const admin = mcpServerAdminPatterns(serverId) ?? [];
+    return [...new Set([DESTRUCTIVE_PATTERN, ...admin])];
+}
+/**
+ * Whether an unmatched tool on this server is allowed: the registry
+ * defaultTier — READ and WRITE both map to allow (WRITE is observed, not
+ * blocked); an ADMIN default would deny. Unknown servers allow (local
+ * observe gateway), subject to the destructive deny.
+ */
+export function unmatchedAllowed(serverId) {
+    return mcpServerDefaultTier(serverId) !== "ADMIN";
+}
+function celString(s) {
+    return `'${s.replace(/\\/g, "\\\\").replace(/'/g, "\\'")}'`;
+}
+/** The OR-allow CEL rule for one server target. */
+export function celAllowRule(server) {
+    const target = `mcp.tool.target == ${celString(server.id)}`;
+    const deny = denyPatternsFor(server.id).join("|");
+    if (!unmatchedAllowed(server.id)) {
+        // ADMIN defaultTier: only explicitly non-denied, non-admin tools may run —
+        // allow nothing unmatched (no registered server has this today).
+        return `${target} && false`;
+    }
+    return `${target} && !mcp.tool.name.matches(${celString(deny)})`;
+}
+function q(s) {
+    return JSON.stringify(s);
+}
+function indent(lines, pad) {
+    return lines.map((l) => (l ? pad + l : l));
+}
+function targetYaml(server) {
+    const lines = [`- name: ${q(server.id)}`];
+    if (server.transport === "stdio") {
+        const [cmd, ...args] = server.cmd;
+        lines.push("  stdio:");
+        lines.push(`    cmd: ${q(cmd)}`);
+        if (args.length > 0) {
+            lines.push("    args:");
+            lines.push(...args.map((a) => `      - ${q(a)}`));
+        }
+        if (server.env && Object.keys(server.env).length > 0) {
+            lines.push("    env:");
+            for (const [k, v] of Object.entries(server.env)) {
+                lines.push(`      ${q(k)}: ${q(v)}`);
+            }
+        }
+    }
+    else {
+        lines.push("  mcp:");
+        lines.push(`    host: ${q(server.url)}`);
+        if (server.headers && Object.keys(server.headers).length > 0) {
+            // Transport policy on the http target: static auth headers.
+            lines.push("  policies:");
+            lines.push("    requestHeaderModifier:");
+            lines.push("      set:");
+            for (const [k, v] of Object.entries(server.headers)) {
+                lines.push(`        ${q(k)}: ${q(v)}`);
+            }
+        }
+    }
+    return lines;
+}
+/**
+ * Standalone gateway YAML: one listener multiplexing every server as an MCP
+ * target behind a loopback-only L4 allowlist, generated CEL authorization,
+ * OTLP/HTTP traces to the local receiver. `failureMode` (gateways.json,
+ * default failOpen) decides whether one broken target takes the gateway down.
+ */
+export function generateGatewayYaml(config) {
+    const lines = [
+        "# Generated by kya gate — regenerate with `kya gate run` (do not edit).",
+        "config:",
+        '  statsAddr: "off"',
+        '  readinessAddr: "off"',
+        '  adminAddr: "off"',
+        "  logging:",
+        '    level: "warn"',
+        "  tracing:",
+        `    otlpEndpoint: ${q(`http://127.0.0.1:${config.otlpPort}`)}`,
+        `    otlpProtocol: "http"`,
+        "    randomSampling: true",
+        "frontendPolicies:",
+        "  networkAuthorization:",
+        "    rules:",
+        `      - allow: ${q(LOOPBACK_RULE)}`,
+        "binds:",
+        `  - port: ${config.port}`,
+        "    listeners:",
+        "      - routes:",
+        "          - backends:",
+        "              - mcp:",
+        `                  failureMode: ${q(config.failureMode)}`,
+    ];
+    if (config.servers.length === 0) {
+        lines.push("                  targets: []");
+        return `${lines.join("\n")}\n`;
+    }
+    lines.push("                  targets:");
+    for (const server of config.servers) {
+        lines.push(...indent(targetYaml(server), "                    "));
+    }
+    // Backend-level policies: sibling of `mcp`, applies to the whole target set
+    // (per-target rules match on mcp.tool.target inside the CEL).
+    lines.push("                policies:");
+    lines.push("                  mcpAuthorization:");
+    lines.push("                    rules:");
+    for (const server of config.servers) {
+        lines.push(`                      - ${q(celAllowRule(server))}`);
+    }
+    return `${lines.join("\n")}\n`;
+}
+//# sourceMappingURL=config-gen.js.map

package/dist/gate/config-gen.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-gen.js","sourceRoot":"","sources":["../../src/gate/config-gen.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EACL,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAG3B,uEAAuE;AACvE,MAAM,CAAC,MAAM,mBAAmB,GAAG,gDAAgD,CAAC;AAEpF,mEAAmE;AACnE,MAAM,CAAC,MAAM,aAAa,GACxB,2EAA2E,CAAC;AAE9E,mFAAmF;AACnF,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,MAAM,KAAK,GAAG,sBAAsB,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IACrD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,mBAAmB,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;AACvD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,OAAO,oBAAoB,CAAC,QAAQ,CAAC,KAAK,OAAO,CAAC;AACpD,CAAC;AAED,SAAS,SAAS,CAAC,CAAS;IAC1B,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC;AAC9D,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,YAAY,CAAC,MAAqB;IAChD,MAAM,MAAM,GAAG,sBAAsB,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;IAC5D,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClD,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;QACjC,2EAA2E;QAC3E,iEAAiE;QACjE,OAAO,GAAG,MAAM,WAAW,CAAC;IAC9B,CAAC;IACD,OAAO,GAAG,MAAM,8BAA8B,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC;AACnE,CAAC;AAED,SAAS,CAAC,CAAC,CAAS;IAClB,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,MAAM,CAAC,KAAe,EAAE,GAAW;IAC1C,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,UAAU,CAAC,MAAqB;IACvC,MAAM,KAAK,GAAa,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACpD,IAAI,MAAM,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC,GAAI,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,GAAI,CAAC,EAAE,CAAC,CAAC;QAClC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpB,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrD,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACvB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;gBAChD,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACvC,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrB,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,GAAI,CAAC,EAAE,CAAC,CAAC;QAC1C,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7D,4DAA4D;YAC5D,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAC1B,KAAK,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;YACzC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACzB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;gBACpD,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAsB;IACxD,MAAM,KAAK,GAAa;QACtB,yEAAyE;QACzE,SAAS;QACT,oBAAoB;QACpB,wBAAwB;QACxB,oBAAoB;QACpB,YAAY;QACZ,mBAAmB;QACnB,YAAY;QACZ,qBAAqB,CAAC,CAAC,oBAAoB,MAAM,CAAC,QAAQ,EAAE,CAAC,EAAE;QAC/D,0BAA0B;QAC1B,0BAA0B;QAC1B,mBAAmB;QACnB,yBAAyB;QACzB,YAAY;QACZ,kBAAkB,CAAC,CAAC,aAAa,CAAC,EAAE;QACpC,QAAQ;QACR,aAAa,MAAM,CAAC,IAAI,EAAE;QAC1B,gBAAgB;QAChB,iBAAiB;QACjB,uBAAuB;QACvB,sBAAsB;QACtB,kCAAkC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE;KAC1D,CAAC;IACF,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;QAC5C,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;IACjC,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IACzC,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,sBAAsB,CAAC,CAAC,CAAC;IACpE,CAAC;IACD,4EAA4E;IAC5E,8DAA8D;IAC9D,KAAK,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IACxC,KAAK,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;IAClD,KAAK,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IACzC,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC"}

package/dist/gate/config.d.ts

@@ -0,0 +1,39 @@
+export interface GatewayServer {
+    readonly id: string;
+    readonly transport: "stdio" | "http";
+    readonly cmd?: readonly string[];
+    readonly url?: string;
+    readonly env?: Readonly<Record<string, string>>;
+    /** http only: request headers for the remote server (auth tokens go here). */
+    readonly headers?: Readonly<Record<string, string>>;
+}
+export type GateFailureMode = "failOpen" | "failClosed";
+export interface GatewaysConfig {
+    /** Listener port on 127.0.0.1 (default 3930). */
+    readonly port: number;
+    /** Local OTLP/HTTP receiver port (default 3931). */
+    readonly otlpPort: number;
+    /**
+     * Gateway behavior when a target fails to initialize: failOpen serves the
+     * healthy targets (default, better local UX); failClosed takes the whole
+     * gateway down (strict — a silently missing server is impossible).
+     */
+    readonly failureMode: GateFailureMode;
+    readonly servers: readonly GatewayServer[];
+}
+export declare const GATE_DEFAULT_PORT = 3930;
+export declare const GATE_DEFAULT_OTLP_PORT = 3931;
+export declare function gatewaysPath(env?: NodeJS.ProcessEnv): string;
+/** Validate raw parsed JSON into a GatewaysConfig. Unknown top-level keys (recipes) are ignored. */
+export declare function validateGateways(raw: unknown): GatewaysConfig;
+export declare function readGateways(env?: NodeJS.ProcessEnv): GatewaysConfig;
+/**
+ * Scaffold `.kya/gateways.json`: an empty active `servers` list plus the
+ * `recipes` catalog — move a recipe object into `servers` and fill its
+ * placeholders to enable it. Idempotent: an existing file is left alone.
+ */
+export declare function scaffoldGateways(env?: NodeJS.ProcessEnv): {
+    path: string;
+    created: boolean;
+};
+//# sourceMappingURL=config.d.ts.map

package/dist/gate/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/gate/config.ts"],"names":[],"mappings":"AAYA,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,OAAO,GAAG,MAAM,CAAC;IACrC,QAAQ,CAAC,GAAG,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAChD,8EAA8E;IAC9E,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACrD;AAED,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,YAAY,CAAC;AAExD,MAAM,WAAW,cAAc;IAC7B,iDAAiD;IACjD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oDAAoD;IACpD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,eAAe,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,CAAC;CAC5C;AAED,eAAO,MAAM,iBAAiB,OAAO,CAAC;AACtC,eAAO,MAAM,sBAAsB,OAAO,CAAC;AAE3C,wBAAgB,YAAY,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAEzE;AAsFD,oGAAoG;AACpG,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG,cAAc,CAuB7D;AAED,wBAAgB,YAAY,CAC1B,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,cAAc,CAYhB;AA6BD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAepC"}

package/dist/gate/config.js

@@ -0,0 +1,177 @@
+/**
+ * `.kya/gateways.json` — the upstream MCP servers the local kya gateway
+ * federates. Strict JSON (hand-editable, merge-safe); `kya gate init` seeds
+ * it with a `recipes` catalog of ready-to-move entries for the well-known
+ * servers from the MCP server registry.
+ */
+import { existsSync, mkdirSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { globalConfigDir } from "../config.js";
+import { UsageError } from "../errors.js";
+import { atomicWriteSync } from "../fs-atomic.js";
+export const GATE_DEFAULT_PORT = 3930;
+export const GATE_DEFAULT_OTLP_PORT = 3931;
+export function gatewaysPath(env = process.env) {
+    return join(globalConfigDir(env), "gateways.json");
+}
+const TARGET_ID_RE = /^[a-z0-9][a-z0-9-]*$/;
+function isPlainObject(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function parsePort(raw, key, fallback) {
+    if (raw === undefined)
+        return fallback;
+    if (typeof raw !== "number" || !Number.isInteger(raw) || raw < 1 || raw > 65535) {
+        throw new UsageError(`gateways.json: "${key}" must be an integer port 1-65535`);
+    }
+    return raw;
+}
+function parseServer(raw, index) {
+    const where = `gateways.json: servers[${index}]`;
+    if (!isPlainObject(raw))
+        throw new UsageError(`${where} must be an object`);
+    const id = raw.id;
+    if (typeof id !== "string" || !TARGET_ID_RE.test(id)) {
+        throw new UsageError(`${where}.id must match ${TARGET_ID_RE} (the gateway rejects underscores in target names)`);
+    }
+    const transport = raw.transport;
+    if (transport !== "stdio" && transport !== "http") {
+        throw new UsageError(`${where}.transport must be "stdio" or "http"`);
+    }
+    let cmd;
+    if (raw.cmd !== undefined) {
+        if (!Array.isArray(raw.cmd) ||
+            raw.cmd.length === 0 ||
+            raw.cmd.some((c) => typeof c !== "string" || c.length === 0)) {
+            throw new UsageError(`${where}.cmd must be a non-empty array of strings`);
+        }
+        cmd = raw.cmd;
+    }
+    let url;
+    if (raw.url !== undefined) {
+        if (typeof raw.url !== "string" || !/^https?:\/\//.test(raw.url)) {
+            throw new UsageError(`${where}.url must be an http(s) URL`);
+        }
+        url = raw.url;
+    }
+    let env;
+    if (raw.env !== undefined) {
+        if (!isPlainObject(raw.env) || Object.values(raw.env).some((v) => typeof v !== "string")) {
+            throw new UsageError(`${where}.env must be an object of string values`);
+        }
+        env = raw.env;
+    }
+    let headers;
+    if (raw.headers !== undefined) {
+        if (!isPlainObject(raw.headers) || Object.values(raw.headers).some((v) => typeof v !== "string")) {
+            throw new UsageError(`${where}.headers must be an object of string values`);
+        }
+        headers = raw.headers;
+    }
+    if (transport === "stdio" && !cmd) {
+        throw new UsageError(`${where}: transport "stdio" requires "cmd"`);
+    }
+    if (transport === "http" && !url) {
+        throw new UsageError(`${where}: transport "http" requires "url"`);
+    }
+    if (transport === "http" && env) {
+        // The gateway's http targets have no env concept; auth travels as headers.
+        throw new UsageError(`${where}: transport "http" does not support "env" — use "headers" (e.g. {"authorization": "Bearer …"})`);
+    }
+    if (transport === "stdio" && headers) {
+        throw new UsageError(`${where}: "headers" only applies to transport "http"`);
+    }
+    return {
+        id,
+        transport,
+        ...(cmd ? { cmd } : {}),
+        ...(url ? { url } : {}),
+        ...(env ? { env } : {}),
+        ...(headers ? { headers } : {}),
+    };
+}
+/** Validate raw parsed JSON into a GatewaysConfig. Unknown top-level keys (recipes) are ignored. */
+export function validateGateways(raw) {
+    if (!isPlainObject(raw))
+        throw new UsageError("gateways.json must be a JSON object");
+    const port = parsePort(raw.port, "port", GATE_DEFAULT_PORT);
+    const otlpPort = parsePort(raw.otlpPort, "otlpPort", GATE_DEFAULT_OTLP_PORT);
+    let failureMode = "failOpen";
+    if (raw.failureMode !== undefined) {
+        if (raw.failureMode !== "failOpen" && raw.failureMode !== "failClosed") {
+            throw new UsageError('gateways.json: "failureMode" must be "failOpen" or "failClosed"');
+        }
+        failureMode = raw.failureMode;
+    }
+    if (raw.servers !== undefined && !Array.isArray(raw.servers)) {
+        throw new UsageError('gateways.json: "servers" must be an array');
+    }
+    const servers = (raw.servers ?? []).map(parseServer);
+    const seen = new Set();
+    for (const s of servers) {
+        if (seen.has(s.id)) {
+            throw new UsageError(`gateways.json: duplicate server id "${s.id}"`);
+        }
+        seen.add(s.id);
+    }
+    return { port, otlpPort, failureMode, servers };
+}
+export function readGateways(env = process.env) {
+    const path = gatewaysPath(env);
+    if (!existsSync(path)) {
+        return { port: GATE_DEFAULT_PORT, otlpPort: GATE_DEFAULT_OTLP_PORT, failureMode: "failOpen", servers: [] };
+    }
+    let raw;
+    try {
+        raw = JSON.parse(readFileSync(path, "utf8"));
+    }
+    catch {
+        throw new UsageError(`${path} is not valid JSON — fix it by hand, then re-run kya gate run`);
+    }
+    return validateGateways(raw);
+}
+const RECIPES = [
+    { id: "playwright", transport: "stdio", cmd: ["npx", "-y", "@playwright/mcp@latest"], note: "Browser automation" },
+    { id: "github", transport: "http", url: "https://api.githubcopilot.com/mcp/", headers: { authorization: "Bearer <github-pat>" }, note: "GitHub (remote; auth travels as a header — the gateway's http targets have no env)" },
+    { id: "slack", transport: "stdio", cmd: ["npx", "-y", "@modelcontextprotocol/server-slack"], env: { SLACK_BOT_TOKEN: "<xoxb-…>", SLACK_TEAM_ID: "<T…>" }, note: "Slack workspace" },
+    { id: "postgresql", transport: "stdio", cmd: ["npx", "-y", "@modelcontextprotocol/server-postgres", "postgresql://localhost/mydb"], note: "PostgreSQL (pass the connection string as the last arg)" },
+    { id: "filesystem", transport: "stdio", cmd: ["npx", "-y", "@modelcontextprotocol/server-filesystem", "."], note: "Local filesystem (scope = last args)" },
+    { id: "context7", transport: "http", url: "https://mcp.context7.com/mcp", note: "Library docs" },
+    { id: "figma", transport: "http", url: "https://mcp.figma.com/mcp", note: "Figma Dev Mode (remote)" },
+    { id: "browser-use", transport: "stdio", cmd: ["uvx", "browser-use", "--mcp"], note: "Browser Use agent" },
+    { id: "chrome-devtools", transport: "stdio", cmd: ["npx", "-y", "chrome-devtools-mcp@latest"], note: "Chrome DevTools" },
+    { id: "atlassian", transport: "http", url: "https://mcp.atlassian.com/v1/sse", note: "Jira/Confluence (remote, OAuth)" },
+    { id: "notion", transport: "http", url: "https://mcp.notion.com/mcp", note: "Notion (remote)" },
+    { id: "supabase", transport: "stdio", cmd: ["npx", "-y", "@supabase/mcp-server-supabase@latest"], env: { SUPABASE_ACCESS_TOKEN: "<sbp_…>" }, note: "Supabase projects" },
+    { id: "firecrawl", transport: "stdio", cmd: ["npx", "-y", "firecrawl-mcp"], env: { FIRECRAWL_API_KEY: "<fc-…>" }, note: "Web scraping" },
+    { id: "sequential-thinking", transport: "stdio", cmd: ["npx", "-y", "@modelcontextprotocol/server-sequential-thinking"], note: "Reasoning scratchpad" },
+    { id: "n8n", transport: "stdio", cmd: ["npx", "-y", "n8n-mcp"], note: "n8n workflows" },
+    { id: "linear", transport: "http", url: "https://mcp.linear.app/sse", note: "Linear (remote, OAuth)" },
+    { id: "serena", transport: "stdio", cmd: ["uvx", "--from", "git+https://github.com/oraios/serena", "serena-mcp-server"], note: "Code navigation" },
+    { id: "sentry", transport: "http", url: "https://mcp.sentry.dev/mcp", note: "Sentry (remote, OAuth)" },
+    { id: "zapier", transport: "http", url: "https://mcp.zapier.com/api/mcp/mcp", note: "Zapier actions (use your own MCP URL)" },
+    { id: "exa", transport: "http", url: "https://mcp.exa.ai/mcp", note: "Web search" },
+];
+/**
+ * Scaffold `.kya/gateways.json`: an empty active `servers` list plus the
+ * `recipes` catalog — move a recipe object into `servers` and fill its
+ * placeholders to enable it. Idempotent: an existing file is left alone.
+ */
+export function scaffoldGateways(env = process.env) {
+    const path = gatewaysPath(env);
+    if (existsSync(path))
+        return { path, created: false };
+    mkdirSync(globalConfigDir(env), { recursive: true });
+    const doc = {
+        port: GATE_DEFAULT_PORT,
+        // failOpen: one broken target never takes the gateway down (a missing
+        // server then fails silently — its tools just vanish). failClosed is the
+        // strict choice: any broken target stops the whole gateway.
+        failureMode: "failOpen",
+        servers: [],
+        recipes: RECIPES.map(({ note, ...entry }) => ({ note, ...entry })),
+    };
+    atomicWriteSync(path, `${JSON.stringify(doc, null, 2)}\n`);
+    return { path, created: true };
+}
+//# sourceMappingURL=config.js.map