@shield-agent/kya 0.11.0 → 0.13.0

package/dist/sdk/govern.d.ts

@@ -0,0 +1,52 @@
+/**
+ * In-process governance shim: evaluate a tool call through the same path
+ * `kya wrap` uses (offline sample evaluate by default — no network, no hosted
+ * plane required), record the trail event, then ALLOW/REQUIRE_APPROVE run the
+ * function while DENY throws KyaDeniedError without running it.
+ *
+ * Importing this module starts nothing: config resolves lazily on first call.
+ *
+ * Deliberate coupling: the trail write is fail-closed — a governance shim
+ * where the audit record cannot be written does not run the action.
+ */
+import type { ResolvedConfig } from "../config.js";
+import { KyaError } from "../errors.js";
+import { type EvalToolResult } from "../commands/eval-tool.js";
+export declare class KyaDeniedError extends KyaError {
+    readonly verdict: string;
+    readonly reasonCode: string;
+    readonly toolId: string;
+    constructor(input: {
+        verdict: string;
+        reasonCode: string;
+        toolId: string;
+    });
+}
+export interface GovernanceOptions {
+    /** MCP server id; toolId becomes `<server>__<toolId>` so the taxonomy lights up. */
+    readonly server?: string;
+    readonly irreversible?: boolean;
+    /** Explicit config (hosted plane honored). Default: lazy offline resolve. */
+    readonly config?: ResolvedConfig;
+}
+export interface GovernedOptions<TArgs, TResult> extends GovernanceOptions {
+    readonly toolId: string;
+    readonly fn: (args: TArgs) => Promise<TResult> | TResult;
+}
+/** `<server>__<name>` when a server is given, else the bare name. */
+export declare function deriveSdkToolId(name: string, server?: string): string;
+export declare function resolveSdkConfig(config?: ResolvedConfig): ResolvedConfig;
+/** Trail parity with wrap: verdict/mode/reasonCode + change fields when derivable. */
+export declare function recordSdkTrail(config: ResolvedConfig, evalResult: EvalToolResult, args: unknown, env?: NodeJS.ProcessEnv): void;
+export interface GateCheckOptions extends GovernanceOptions {
+    readonly toolId: string;
+}
+/**
+ * The evaluate + trail half of governed(), constructed once per wrapped tool
+ * so the lazy config cache hits across calls. Adapters whose execution path
+ * closes over per-call context use this directly and invoke the framework
+ * callable themselves after the check passes.
+ */
+export declare function createGateCheck(options: GateCheckOptions): (args: unknown) => Promise<void>;
+export declare function governed<TArgs, TResult>(options: GovernedOptions<TArgs, TResult>): (args: TArgs) => Promise<TResult>;
+//# sourceMappingURL=govern.d.ts.map

package/dist/sdk/govern.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"govern.d.ts","sourceRoot":"","sources":["../../src/sdk/govern.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEnD,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAe,KAAK,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAI5E,qBAAa,cAAe,SAAQ,QAAQ;IAC1C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEZ,KAAK,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;CAW3E;AAED,MAAM,WAAW,iBAAiB;IAChC,oFAAoF;IACpF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC,6EAA6E;IAC7E,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,CAAC;CAClC;AAED,MAAM,WAAW,eAAe,CAAC,KAAK,EAAE,OAAO,CAAE,SAAQ,iBAAiB;IACxE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,KAAK,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;CAC1D;AAED,qEAAqE;AACrE,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAIrE;AAED,wBAAgB,gBAAgB,CAAC,MAAM,CAAC,EAAE,cAAc,GAAG,cAAc,CAExE;AAED,sFAAsF;AACtF,wBAAgB,cAAc,CAC5B,MAAM,EAAE,cAAc,EACtB,UAAU,EAAE,cAAc,EAC1B,IAAI,EAAE,OAAO,EACb,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,IAAI,CAuBN;AAED,MAAM,WAAW,gBAAiB,SAAQ,iBAAiB;IACzD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,gBAAgB,GACxB,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAqBlC;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,EACrC,OAAO,EAAE,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,GACvC,CAAC,IAAI,EAAE,KAAK,KAAK,OAAO,CAAC,OAAO,CAAC,CAMnC"}

package/dist/sdk/govern.js

@@ -0,0 +1,95 @@
+/**
+ * In-process governance shim: evaluate a tool call through the same path
+ * `kya wrap` uses (offline sample evaluate by default — no network, no hosted
+ * plane required), record the trail event, then ALLOW/REQUIRE_APPROVE run the
+ * function while DENY throws KyaDeniedError without running it.
+ *
+ * Importing this module starts nothing: config resolves lazily on first call.
+ *
+ * Deliberate coupling: the trail write is fail-closed — a governance shim
+ * where the audit record cannot be written does not run the action.
+ */
+import { resolveConfig } from "../config.js";
+import { KyaError } from "../errors.js";
+import { runEvalTool } from "../commands/eval-tool.js";
+import { appendTrail, defaultSessionId } from "../trail.js";
+import { deriveWireChangeFields } from "../diff-preview.js";
+export class KyaDeniedError extends KyaError {
+    verdict;
+    reasonCode;
+    toolId;
+    constructor(input) {
+        super(`kya ${input.verdict}: ${input.toolId} (${input.reasonCode || "no reason"}) — function not executed`, "KYA_DENIED", 1);
+        this.name = "KyaDeniedError";
+        this.verdict = input.verdict;
+        this.reasonCode = input.reasonCode;
+        this.toolId = input.toolId;
+    }
+}
+/** `<server>__<name>` when a server is given, else the bare name. */
+export function deriveSdkToolId(name, server) {
+    const n = name.trim();
+    const s = server?.trim();
+    return s ? `${s}__${n}` : n;
+}
+export function resolveSdkConfig(config) {
+    return config ?? resolveConfig({ offline: true, allowMissingApiKey: true });
+}
+/** Trail parity with wrap: verdict/mode/reasonCode + change fields when derivable. */
+export function recordSdkTrail(config, evalResult, args, env = process.env) {
+    const reason = evalResult.response.reasonCode ?? "";
+    const toolId = evalResult.response.toolId ?? "";
+    const mode = evalResult.offline || config.offline ? "offline" : "observe";
+    const fields = deriveWireChangeFields(toolId, args, env);
+    appendTrail(config.cwd, {
+        ts: new Date().toISOString(),
+        sessionId: defaultSessionId(env),
+        host: config.host,
+        toolId,
+        verdict: evalResult.response.verdict,
+        reasonCode: reason,
+        mode,
+        neverEvent: reason === "NEVER_EVENT",
+        argsHash: evalResult.argsHash,
+        ...(fields?.summary ? { summary: fields.summary } : {}),
+        ...(fields?.diffPreview ? { diffPreview: fields.diffPreview } : {}),
+        ...(fields?.targetPath ? { targetPath: fields.targetPath } : {}),
+    }, env);
+}
+/**
+ * The evaluate + trail half of governed(), constructed once per wrapped tool
+ * so the lazy config cache hits across calls. Adapters whose execution path
+ * closes over per-call context use this directly and invoke the framework
+ * callable themselves after the check passes.
+ */
+export function createGateCheck(options) {
+    const toolId = deriveSdkToolId(options.toolId, options.server);
+    let cached = options.config;
+    return async (args) => {
+        if (!cached)
+            cached = resolveSdkConfig();
+        const evalResult = await runEvalTool(cached, {
+            toolId,
+            args,
+            irreversible: options.irreversible,
+        });
+        recordSdkTrail(cached, evalResult, args);
+        const verdict = (evalResult.response.verdict ?? "").toUpperCase();
+        if (verdict === "ALLOW" || verdict === "REQUIRE_APPROVE") {
+            return;
+        }
+        throw new KyaDeniedError({
+            verdict: verdict || "DENY",
+            reasonCode: evalResult.response.reasonCode ?? "",
+            toolId: evalResult.response.toolId ?? toolId,
+        });
+    };
+}
+export function governed(options) {
+    const check = createGateCheck(options);
+    return async (args) => {
+        await check(args);
+        return options.fn(args);
+    };
+}
+//# sourceMappingURL=govern.js.map

package/dist/sdk/govern.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"govern.js","sourceRoot":"","sources":["../../src/sdk/govern.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,WAAW,EAAuB,MAAM,0BAA0B,CAAC;AAC5E,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAE5D,MAAM,OAAO,cAAe,SAAQ,QAAQ;IACjC,OAAO,CAAS;IAChB,UAAU,CAAS;IACnB,MAAM,CAAS;IAExB,YAAY,KAA8D;QACxE,KAAK,CACH,OAAO,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,UAAU,IAAI,WAAW,2BAA2B,EACpG,YAAY,EACZ,CAAC,CACF,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QAC7B,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;QACnC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC7B,CAAC;CACF;AAeD,qEAAqE;AACrE,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,MAAe;IAC3D,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACtB,MAAM,CAAC,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC;IACzB,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,MAAuB;IACtD,OAAO,MAAM,IAAI,aAAa,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,cAAc,CAC5B,MAAsB,EACtB,UAA0B,EAC1B,IAAa,EACb,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,UAAU,IAAI,EAAE,CAAC;IACpD,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC;IAChD,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1E,MAAM,MAAM,GAAG,sBAAsB,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACzD,WAAW,CACT,MAAM,CAAC,GAAG,EACV;QACE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC5B,SAAS,EAAE,gBAAgB,CAAC,GAAG,CAAC;QAChC,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,MAAM;QACN,OAAO,EAAE,UAAU,CAAC,QAAQ,CAAC,OAAO;QACpC,UAAU,EAAE,MAAM;QAClB,IAAI;QACJ,UAAU,EAAE,MAAM,KAAK,aAAa;QACpC,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjE,EACD,GAAG,CACJ,CAAC;AACJ,CAAC;AAMD;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,OAAyB;IAEzB,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/D,IAAI,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC5B,OAAO,KAAK,EAAE,IAAa,EAAiB,EAAE;QAC5C,IAAI,CAAC,MAAM;YAAE,MAAM,GAAG,gBAAgB,EAAE,CAAC;QACzC,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE;YAC3C,MAAM;YACN,IAAI;YACJ,YAAY,EAAE,OAAO,CAAC,YAAY;SACnC,CAAC,CAAC;QACH,cAAc,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAClE,IAAI,OAAO,KAAK,OAAO,IAAI,OAAO,KAAK,iBAAiB,EAAE,CAAC;YACzD,OAAO;QACT,CAAC;QACD,MAAM,IAAI,cAAc,CAAC;YACvB,OAAO,EAAE,OAAO,IAAI,MAAM;YAC1B,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,UAAU,IAAI,EAAE;YAChD,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,MAAM,IAAI,MAAM;SAC7C,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,QAAQ,CACtB,OAAwC;IAExC,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACvC,OAAO,KAAK,EAAE,IAAW,EAAoB,EAAE;QAC7C,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;QAClB,OAAO,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC,CAAC;AACJ,CAAC"}

package/dist/sdk/index.d.ts

@@ -0,0 +1,14 @@
+/**
+ * @shield-agent/kya/sdk — in-process governance shims for agent frameworks.
+ * Importing this surface starts no daemons, telemetry, or network clients;
+ * evaluation defaults to the offline sample path.
+ */
+export { governed, deriveSdkToolId, KyaDeniedError, type GovernedOptions, type GovernanceOptions, } from "./govern.js";
+export { governA2aSend, type GovernA2aSendOptions, type A2aGateResult, } from "./a2a.js";
+export { governLangGraphTool, type LangGraphToolLike } from "./adapters/langgraph.js";
+export { governVercelAiTool, type VercelAiToolLike, type GovernVercelAiOptions, } from "./adapters/vercel-ai.js";
+export { governMastraTool, type MastraToolLike } from "./adapters/mastra.js";
+export { governOpenAiAgentsTool, type OpenAiAgentsToolLike, } from "./adapters/openai-agents.js";
+export { governClaudeAgentTool, type ClaudeAgentToolLike, } from "./adapters/claude-agent.js";
+export type { ResolvedConfig } from "../config.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/sdk/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sdk/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,QAAQ,EACR,eAAe,EACf,cAAc,EACd,KAAK,eAAe,EACpB,KAAK,iBAAiB,GACvB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,aAAa,EACb,KAAK,oBAAoB,EACzB,KAAK,aAAa,GACnB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,mBAAmB,EAAE,KAAK,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACtF,OAAO,EACL,kBAAkB,EAClB,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,GAC3B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,gBAAgB,EAAE,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC7E,OAAO,EACL,sBAAsB,EACtB,KAAK,oBAAoB,GAC1B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,qBAAqB,EACrB,KAAK,mBAAmB,GACzB,MAAM,4BAA4B,CAAC;AACpC,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC"}

package/dist/sdk/index.js

@@ -0,0 +1,13 @@
+/**
+ * @shield-agent/kya/sdk — in-process governance shims for agent frameworks.
+ * Importing this surface starts no daemons, telemetry, or network clients;
+ * evaluation defaults to the offline sample path.
+ */
+export { governed, deriveSdkToolId, KyaDeniedError, } from "./govern.js";
+export { governA2aSend, } from "./a2a.js";
+export { governLangGraphTool } from "./adapters/langgraph.js";
+export { governVercelAiTool, } from "./adapters/vercel-ai.js";
+export { governMastraTool } from "./adapters/mastra.js";
+export { governOpenAiAgentsTool, } from "./adapters/openai-agents.js";
+export { governClaudeAgentTool, } from "./adapters/claude-agent.js";
+//# sourceMappingURL=index.js.map

package/dist/sdk/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/sdk/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,QAAQ,EACR,eAAe,EACf,cAAc,GAGf,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,aAAa,GAGd,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,mBAAmB,EAA0B,MAAM,yBAAyB,CAAC;AACtF,OAAO,EACL,kBAAkB,GAGnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,gBAAgB,EAAuB,MAAM,sBAAsB,CAAC;AAC7E,OAAO,EACL,sBAAsB,GAEvB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,qBAAqB,GAEtB,MAAM,4BAA4B,CAAC"}

package/droid/README.md

@@ -1,6 +1,6 @@
 # Droid (Factory) + Shield KYA
 
-Preferred path is Droid's own CLI: `droid mcp add shield-kya "npx --no-install @shield-agent/kya@0.11.0 serve-mcp --stdio" --env KYA_BASE_URL=https://shield-agent.com --env KYA_API_KEY=$KYA_API_KEY --env KYA_HOST=ide`.
+Preferred path is Droid's own CLI: `droid mcp add shield-kya "npx --no-install @shield-agent/kya@0.13.0 serve-mcp --stdio" --env KYA_BASE_URL=https://shield-agent.com --env KYA_API_KEY=$KYA_API_KEY --env KYA_HOST=ide`.
 
 `mcp.example.json` shows the expected on-disk shape (`~/.factory/mcp.json`) — **schema not yet verified against a live Droid install**; treat as a starting point and prefer `droid mcp add`.
 

package/droid/mcp.example.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "shield-kya": {
       "command": "npx",
-      "args": ["--no-install", "@shield-agent/kya@0.11.0", "serve-mcp", "--stdio"],
+      "args": ["--no-install", "@shield-agent/kya@0.13.0", "serve-mcp", "--stdio"],
       "env": {
         "KYA_BASE_URL": "https://shield-agent.com",
         "KYA_API_KEY": "${KYA_API_KEY}",

package/gemini/settings.example.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "shield-kya": {
       "command": "npx",
-      "args": ["--no-install", "@shield-agent/kya@0.11.0", "serve-mcp", "--stdio"],
+      "args": ["--no-install", "@shield-agent/kya@0.13.0", "serve-mcp", "--stdio"],
       "env": {
         "KYA_BASE_URL": "https://shield-agent.com",
         "KYA_API_KEY": "${KYA_API_KEY}",

package/grok/README.md

@@ -40,7 +40,7 @@ chat = client.chat.create(
 There is no grok.com stdio path. For a local agent host use the same stdio launch as Claude:
 
 ```bash
-npx --no-install @shield-agent/kya@0.11.0 serve-mcp --stdio
+npx --no-install @shield-agent/kya@0.13.0 serve-mcp --stdio
 ```
 
 Env: `KYA_BASE_URL`, `KYA_API_KEY`, `KYA_HOST`. Codex and Gemini example configs in this package show the full snippets.

package/kilo/kilo.example.json

@@ -2,7 +2,7 @@
   "mcp": {
     "shield-kya": {
       "type": "local",
-      "command": ["npx", "--no-install", "@shield-agent/kya@0.11.0", "serve-mcp", "--stdio"],
+      "command": ["npx", "--no-install", "@shield-agent/kya@0.13.0", "serve-mcp", "--stdio"],
       "enabled": true,
       "environment": {
         "KYA_BASE_URL": "https://shield-agent.com",

package/kimi/mcp.example.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "shield-kya": {
       "command": "npx",
-      "args": ["--no-install", "@shield-agent/kya@0.11.0", "serve-mcp", "--stdio"],
+      "args": ["--no-install", "@shield-agent/kya@0.13.0", "serve-mcp", "--stdio"],
       "env": {
         "KYA_BASE_URL": "https://shield-agent.com",
         "KYA_API_KEY": "${KYA_API_KEY}",

package/kiro/mcp.example.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "shield-kya": {
       "command": "npx",
-      "args": ["--no-install", "@shield-agent/kya@0.11.0", "serve-mcp", "--stdio"],
+      "args": ["--no-install", "@shield-agent/kya@0.13.0", "serve-mcp", "--stdio"],
       "env": {
         "KYA_BASE_URL": "https://shield-agent.com",
         "KYA_API_KEY": "${KYA_API_KEY}",

package/manifest.json

@@ -2,7 +2,7 @@
   "manifest_version": "0.3",
   "name": "shield-kya",
   "display_name": "Shield KYA",
-  "version": "0.11.0",
+  "version": "0.13.0",
   "description": "Know Your Agent MCP gate: ALLOW / DENY / REQUIRE_APPROVE. Sole PEP is Shield.",
   "long_description": "Local Claude Desktop extension that runs the packaged `dist/cli.js serve-mcp --stdio` against your Shield control plane (local or https://shield-agent.com). Tools evaluate policy, ingest session risk, and open Hold tickets. They never execute irreversible side effects.",
   "author": {

package/mastracode/mcp.example.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "shield-kya": {
       "command": "npx",
-      "args": ["--no-install", "@shield-agent/kya@0.11.0", "serve-mcp", "--stdio"],
+      "args": ["--no-install", "@shield-agent/kya@0.13.0", "serve-mcp", "--stdio"],
       "env": {
         "KYA_BASE_URL": "https://shield-agent.com",
         "KYA_API_KEY": "${KYA_API_KEY}",

package/mcp.json

@@ -3,7 +3,7 @@
     "shield-kya": {
       "description": "Know Your Agent local MCP gate: wrap-before-write, named-agent registry, Hold/Clear.",
       "command": "npx",
-      "args": ["--no-install", "@shield-agent/kya@0.11.0", "serve-mcp", "--stdio"],
+      "args": ["--no-install", "@shield-agent/kya@0.13.0", "serve-mcp", "--stdio"],
       "env": {
         "KYA_BASE_URL": "${KYA_BASE_URL}",
         "KYA_API_KEY": "${KYA_API_KEY}",

package/openai/codex.config.example.toml

@@ -11,7 +11,7 @@
 # --- Local stdio (OSS) ---
 [mcp_servers.shield-kya]
 command = "npx"
-args = ["--no-install", "@shield-agent/kya@0.11.0", "serve-mcp", "--stdio"]
+args = ["--no-install", "@shield-agent/kya@0.13.0", "serve-mcp", "--stdio"]
 startup_timeout_sec = 20
 env_vars = ["KYA_BASE_URL", "KYA_API_KEY", "KYA_HOST", "KYA_AGENT_ID"]
 

package/opencode/opencode.example.json

@@ -2,7 +2,7 @@
   "mcp": {
     "shield-kya": {
       "type": "local",
-      "command": ["npx", "--no-install", "@shield-agent/kya@0.11.0", "serve-mcp", "--stdio"],
+      "command": ["npx", "--no-install", "@shield-agent/kya@0.13.0", "serve-mcp", "--stdio"],
       "enabled": true,
       "environment": {
         "KYA_BASE_URL": "https://shield-agent.com",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shield-agent/kya",
-  "version": "0.11.0",
+  "version": "0.13.0",
   "description": "Audit trail & traceability for AI agents — local MCP gate (Allow/Review/Deny), live receipt dashboard, trust-baseline certification.",
   "license": "MIT",
   "type": "module",
@@ -16,6 +16,10 @@
     ".": {
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js"
+    },
+    "./sdk": {
+      "types": "./dist/sdk/index.d.ts",
+      "import": "./dist/sdk/index.js"
     }
   },
   "files": [

package/qwen/settings.example.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "shield-kya": {
       "command": "npx",
-      "args": ["--no-install", "@shield-agent/kya@0.11.0", "serve-mcp", "--stdio"],
+      "args": ["--no-install", "@shield-agent/kya@0.13.0", "serve-mcp", "--stdio"],
       "env": {
         "KYA_BASE_URL": "https://shield-agent.com",
         "KYA_API_KEY": "${KYA_API_KEY}",

package/server.json

@@ -7,12 +7,12 @@
     "url": "https://github.com/The-Pixel-Boys/shield-kya",
     "source": "github"
   },
-  "version": "0.11.0",
+  "version": "0.13.0",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@shield-agent/kya",
-      "version": "0.11.0",
+      "version": "0.13.0",
       "transport": {
         "type": "stdio"
       },