@shield-agent/kya 0.22.0 → 0.23.0

package/dist/commands/gate.js

@@ -1,5 +1,5 @@
 /**
- * `kya gate` — local MCP gateway: govern + audit tool calls to any MCP server.
+ * `kya gate` - local MCP gateway: govern + audit tool calls to any MCP server.
  *
  *   init    scaffold .kya/gateways.json (recipes for the well-known servers)
  *   setup   install the pinned gateway binary to .kya/bin (only downloader)
@@ -36,7 +36,7 @@ export function runGateInit(env = process.env) {
         created: r.created,
         next: r.created
             ? "move a recipe into \"servers\" and fill its placeholders, then `kya gate setup && kya gate run`"
-            : "gateways.json already exists — edit it, then `kya gate run`",
+            : "gateways.json already exists - edit it, then `kya gate run`",
     };
 }
 export async function runGateSetup(env = process.env) {
@@ -54,7 +54,7 @@ export function bindScopeFromYaml(env) {
         yaml = readFileSync(gateYamlPath(env), "utf8");
     }
     catch {
-        return { loopbackOnly: false, detail: "no generated config yet — `kya gate run` generates one" };
+        return { loopbackOnly: false, detail: "no generated config yet - `kya gate run` generates one" };
     }
     const hasRule = yaml.includes("networkAuthorization:") && yaml.includes("127.0.0.0/8") && yaml.includes("::1");
     const listenersOff = yaml.includes('statsAddr: "off"') && yaml.includes('readinessAddr: "off"');
@@ -63,7 +63,7 @@ export function bindScopeFromYaml(env) {
         loopbackOnly,
         detail: loopbackOnly
             ? "loopback-only (L4 allowlist 127.0.0.0/8 + ::1; stats/readiness/admin listeners off)"
-            : "WARNING: generated config is missing the loopback allowlist or listener offs — re-run `kya gate run`",
+            : "WARNING: generated config is missing the loopback allowlist or listener offs - re-run `kya gate run`",
     };
 }
 async function probeListener(state) {
@@ -102,7 +102,7 @@ export async function runGateDoctor(env = process.env) {
 }
 /**
  * Generate the gateway YAML from gateways.json, then spawn the detached
- * supervisor (OTLP receiver + gateway binary child). Requires the binary —
+ * supervisor (OTLP receiver + gateway binary child). Requires the binary -
  * never downloads; `kya gate setup` is the only downloader. Success is
  * reported only after the listener actually answers.
  */
@@ -110,7 +110,7 @@ export async function runGateRun(config, input = {}) {
     const env = input.env ?? process.env;
     const bin = inspectGateBinary(env);
     if (!bin.present) {
-        throw new KyaError(`gateway binary not installed — run \`kya gate setup\` first (expected at ${gateBinaryPath(env)})`, "GATE_BINARY_MISSING");
+        throw new KyaError(`gateway binary not installed - run \`kya gate setup\` first (expected at ${gateBinaryPath(env)})`, "GATE_BINARY_MISSING");
     }
     const gateways = readGateways(env);
     const yaml = generateGatewayYaml(gateways);
@@ -127,7 +127,7 @@ export async function runGateRun(config, input = {}) {
     };
     const existing = readGateState(env);
     if (existing && pidAlive(existing.pid) && isGateDaemonProcess(existing.pid)) {
-        // Never rewrite gate.yaml under a live process — the gateway watches the
+        // Never rewrite gate.yaml under a live process - the gateway watches the
         // file. Compare and report drift instead.
         let drift = false;
         try {
@@ -153,8 +153,8 @@ export async function runGateRun(config, input = {}) {
             reused: true,
             ...(drift ? { drift } : {}),
             next: drift
-                ? "config changed since gateway started — `kya gate stop && kya gate run` to apply"
-                : "gateway already running — `kya gate stop` first to reload config",
+                ? "config changed since gateway started - `kya gate stop && kya gate run` to apply"
+                : "gateway already running - `kya gate stop` first to reload config",
         };
     }
     clearGateState(env);
@@ -174,7 +174,7 @@ export async function runGateRun(config, input = {}) {
     const fail = async () => {
         await killGateProcessTree(pid, readGateState(env)?.childPid);
         clearGateState(env);
-        throw new KyaError(`gateway failed to start — see ${logPath}`, "GATE_START_FAILED");
+        throw new KyaError(`gateway failed to start - see ${logPath}`, "GATE_START_FAILED");
     };
     let probingSince = -1;
     for (let waited = 0; waited < 10_000; waited += 100) {
@@ -204,7 +204,7 @@ export async function runGateRun(config, input = {}) {
                 configPath: gateYamlPath(env),
                 logPath,
                 reused: false,
-                next: `point your host at ${state.url}/mcp (server key shield-kya-gate) — ` +
+                next: `point your host at ${state.url}/mcp (server key shield-kya-gate) - ` +
                     "`kya connect <host> --gate` wires it; `kya gate stop` stops everything.",
             };
         }
@@ -259,7 +259,7 @@ export async function runGateStop(env = process.env, input = {}) {
         return { stopped: false };
     }
     if (pidAlive(state.pid) && !isGateDaemonProcess(state.pid)) {
-        // Planted or recycled pid — never signal a foreign process.
+        // Planted or recycled pid - never signal a foreign process.
         clearGateState(env);
         triggerHostedSyncFromEnv({ cwd: input.cwd ?? process.cwd(), env, state: "configured-stopped" });
         return { stopped: false, pid: state.pid, stale: true };
@@ -287,12 +287,12 @@ export function formatGateDoctorHuman(r) {
         "KYA gate doctor",
         r.binary.present
             ? `binary: ${r.binary.path}${r.binary.version ? ` (${r.binary.version})` : ""}`
-            : `binary: missing — run \`kya gate setup\``,
+            : `binary: missing - run \`kya gate setup\``,
         `config: ${r.config.path} (${r.config.servers} server${r.config.servers === 1 ? "" : "s"})`,
         `bind scope: ${r.bindScope.detail}`,
         r.listener.running
             ? `listener: ${r.listener.url} (${r.listener.healthy ? "healthy" : "not answering"})`
-            : "listener: not running — `kya gate run`",
+            : "listener: not running - `kya gate run`",
         syncLine,
     ].join("\n");
 }
@@ -300,13 +300,13 @@ function formatLastSync(last) {
     if (!last)
         return "";
     const status = last.ok ? "ok" : "failed";
-    const detail = last.error ? ` — ${last.error}` : "";
+    const detail = last.error ? ` - ${last.error}` : "";
     return ` (last sync: ${status}${detail})`;
 }
 export function gateSubcommand(parsed) {
     const sub = parsed.positionals[0];
     if (sub === "init" || sub === "setup" || sub === "doctor" || sub === "status" || sub === "run" || sub === "stop") {
-        // `status` is an alias for `doctor` — same output, hosted sync line included.
+        // `status` is an alias for `doctor` - same output, hosted sync line included.
         return sub === "status" ? "doctor" : sub;
     }
     throw new UsageError("Usage: kya gate <init|setup|doctor|status|run|stop>");

package/dist/commands/hook.d.ts

@@ -5,7 +5,7 @@ export interface HookInput {
     readonly stdinText: string;
     readonly env: NodeJS.ProcessEnv;
     readonly cwd: string;
-    /** Test seam — defaults to the offline runEvalTool path. */
+    /** Test seam - defaults to the offline runEvalTool path. */
     readonly evaluate?: (toolId: string, args: unknown) => Promise<PolicyEvaluateResponse>;
 }
 export interface HookResult {

package/dist/commands/hook.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hook.d.ts","sourceRoot":"","sources":["../../src/commands/hook.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAK3D,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,4DAA4D;IAC5D,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;CACxF;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAuDD,wBAAsB,OAAO,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAsDnE"}
+{"version":3,"file":"hook.d.ts","sourceRoot":"","sources":["../../src/commands/hook.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAM3D,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,4DAA4D;IAC5D,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;CACxF;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAwFD,wBAAsB,OAAO,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAqEnE"}

package/dist/commands/hook.js

@@ -1,5 +1,5 @@
 /**
- * kya hook — PreToolUse interception for hosts with native hooks
+ * kya hook - PreToolUse interception for hosts with native hooks
  * (Claude Code, Grok, Kimi Code). Offline local evaluate only: no network,
  * sub-second, fail-open on any internal error. DENY (local never-list)
  * blocks; REQUIRE_APPROVE records advisory unless --strict.
@@ -7,7 +7,27 @@
 import { resolveConfig } from "../config.js";
 import { runEvalTool } from "./eval-tool.js";
 import { appendTrail, defaultSessionId, hostToProduct } from "../trail.js";
-import { deriveTargetPath, deriveTrailSummary } from "../trail-summary.js";
+import { deriveWireChangeFields } from "../diff-preview.js";
+import { maybeSpawnNotifyFlush } from "../notify/dispatch.js";
+function tokenCount(v) {
+    return typeof v === "number" && Number.isFinite(v) && v >= 0
+        ? Math.floor(v)
+        : undefined;
+}
+/** Accept input_tokens/output_tokens (Claude/Kimi) and inputTokens/outputTokens. */
+function readUsageShape(raw) {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw))
+        return undefined;
+    const u = raw;
+    const tokensIn = tokenCount(u.input_tokens ?? u.inputTokens);
+    const tokensOut = tokenCount(u.output_tokens ?? u.outputTokens);
+    if (tokensIn === undefined && tokensOut === undefined)
+        return undefined;
+    return {
+        ...(tokensIn !== undefined ? { tokensIn } : {}),
+        ...(tokensOut !== undefined ? { tokensOut } : {}),
+    };
+}
 /** Accept snake_case (Claude/Kimi) and camelCase (Grok) envelopes. */
 function parsePayload(stdinText) {
     let raw;
@@ -23,6 +43,11 @@ function parsePayload(stdinText) {
     const event = (typeof p.hook_event_name === "string" && p.hook_event_name) ||
         (typeof p.hookEventName === "string" && p.hookEventName) ||
         undefined;
+    const toolResponse = p.tool_response && typeof p.tool_response === "object" && !Array.isArray(p.tool_response)
+        ? p.tool_response
+        : p.toolResponse && typeof p.toolResponse === "object" && !Array.isArray(p.toolResponse)
+            ? p.toolResponse
+            : undefined;
     return {
         event,
         sessionId: (typeof p.session_id === "string" && p.session_id) ||
@@ -33,6 +58,7 @@ function parsePayload(stdinText) {
             (typeof p.toolName === "string" && p.toolName) ||
             undefined,
         toolInput: p.tool_input ?? p.toolInput,
+        usage: readUsageShape(p.usage) ?? readUsageShape(toolResponse?.usage),
     };
 }
 const ALLOW = { exitCode: 0, stdout: "", stderr: "" };
@@ -70,28 +96,39 @@ export async function runHook(input) {
             (async (toolId, args) => (await runEvalTool(config, { toolId, args, offline: true })).response);
         const response = await evaluate(payload.toolName, payload.toolInput ?? {});
         // payload.cwd is host-supplied and only feeds the project-basename stamp;
-        // the trail path itself comes from env/KYA_HOME — no traversal risk.
+        // the trail path itself comes from env/KYA_HOME - no traversal risk.
         const trailCwd = payload.cwd?.trim() || input.cwd;
-        const targetPath = deriveTargetPath(payload.toolInput ?? {});
+        // Wire change fields (summary, diffPreview, targetPath) feed the receipt's
+        // Changes tab; redaction + opt-out live inside deriveWireChangeFields.
+        const changeFields = deriveWireChangeFields(payload.toolName, payload.toolInput ?? {}, input.env);
+        const trailEvent = {
+            ts: new Date().toISOString(),
+            sessionId: payload.sessionId ?? defaultSessionId(input.env),
+            host: config.host,
+            product: hostToProduct(input.host),
+            toolId: response.toolId ?? payload.toolName,
+            verdict: response.verdict,
+            reasonCode: response.reasonCode ?? "",
+            mode: "offline",
+            neverEvent: response.reasonCode === "NEVER_EVENT",
+            argsHash: response.argsHash,
+            ...(changeFields ?? {}),
+            ...(payload.usage?.tokensIn !== undefined
+                ? { tokensIn: payload.usage.tokensIn }
+                : {}),
+            ...(payload.usage?.tokensOut !== undefined
+                ? { tokensOut: payload.usage.tokensOut }
+                : {}),
+        };
         try {
-            appendTrail(trailCwd, {
-                ts: new Date().toISOString(),
-                sessionId: payload.sessionId ?? defaultSessionId(input.env),
-                host: config.host,
-                product: hostToProduct(input.host),
-                toolId: response.toolId ?? payload.toolName,
-                verdict: response.verdict,
-                reasonCode: response.reasonCode ?? "",
-                mode: "offline",
-                neverEvent: response.reasonCode === "NEVER_EVENT",
-                argsHash: response.argsHash,
-                summary: deriveTrailSummary(payload.toolName, payload.toolInput ?? {}),
-                ...(targetPath ? { targetPath } : {}),
-            }, input.env);
+            appendTrail(trailCwd, trailEvent, input.env);
         }
         catch {
             /* observe path never breaks the gate */
         }
+        // Webhooks + OTLP export ride a detached helper; the hook never waits on
+        // the network. No-op unless a sink is configured.
+        maybeSpawnNotifyFlush({ env: input.env, cwd: trailCwd, event: trailEvent });
         if (response.verdict === "DENY") {
             return deny(`KYA denied ${payload.toolName}: ${response.reasonCode}`);
         }

package/dist/commands/hook.js.map

@@ -1 +1 @@
-{"version":3,"file":"hook.js","sourceRoot":"","sources":["../../src/commands/hook.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AA0B3E,sEAAsE;AACtE,SAAS,YAAY,CAAC,SAAiB;IACrC,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5E,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,MAAM,KAAK,GACT,CAAC,OAAO,CAAC,CAAC,eAAe,KAAK,QAAQ,IAAI,CAAC,CAAC,eAAe,CAAC;QAC5D,CAAC,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ,IAAI,CAAC,CAAC,aAAa,CAAC;QACxD,SAAS,CAAC;IACZ,OAAO;QACL,KAAK;QACL,SAAS,EACP,CAAC,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC;YAClD,CAAC,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,CAAC;YAChD,SAAS;QACX,GAAG,EAAE,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;QAClD,QAAQ,EACN,CAAC,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,CAAC;YAChD,CAAC,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC;YAC9C,SAAS;QACX,SAAS,EAAE,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,SAAS;KACvC,CAAC;AACJ,CAAC;AAED,MAAM,KAAK,GAAe,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AAElE,SAAS,IAAI,CAAC,MAAc;IAC1B,OAAO;QACL,QAAQ,EAAE,CAAC;QACX,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC;YACxB,kBAAkB,EAAE;gBAClB,aAAa,EAAE,YAAY;gBAC3B,kBAAkB,EAAE,MAAM;gBAC1B,wBAAwB,EAAE,MAAM;aACjC;SACF,CAAC,IAAI;QACN,MAAM,EAAE,GAAG,MAAM,IAAI;KACtB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,KAAgB;IAC5C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAC3B,IAAI,OAAO,CAAC,KAAK,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACvF,IAAI,CAAC,OAAO,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAEpC,MAAM,MAAM,GAAG,aAAa,CAAC;YAC3B,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,KAAK,EAAE,EAAE;YACT,kBAAkB,EAAE,IAAI;YACxB,aAAa,EAAE,KAAK;YACpB,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QACH,MAAM,QAAQ,GACZ,KAAK,CAAC,QAAQ;YACd,CAAC,KAAK,EAAE,MAAc,EAAE,IAAa,EAAE,EAAE,CACvC,CAAC,MAAM,WAAW,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC3E,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;QAE3E,0EAA0E;QAC1E,qEAAqE;QACrE,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,KAAK,CAAC,GAAG,CAAC;QAClD,MAAM,UAAU,GAAG,gBAAgB,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC;YACH,WAAW,CAAC,QAAQ,EAAE;gBACpB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBAC5B,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC;gBAC3D,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC;gBAClC,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,OAAO,CAAC,QAAQ;gBAC3C,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,UAAU,EAAE,QAAQ,CAAC,UAAU,IAAI,EAAE;gBACrC,IAAI,EAAE,SAAS;gBACf,UAAU,EAAE,QAAQ,CAAC,UAAU,KAAK,aAAa;gBACjD,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,OAAO,EAAE,kBAAkB,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;gBACtE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACtC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,wCAAwC;QAC1C,CAAC;QAED,IAAI,QAAQ,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC,cAAc,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,IAAI,QAAQ,CAAC,OAAO,KAAK,iBAAiB,EAAE,CAAC;YAC3D,OAAO,IAAI,CAAC,oBAAoB,OAAO,CAAC,QAAQ,uBAAuB,QAAQ,CAAC,UAAU,GAAG,CAAC,CAAC;QACjG,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC,CAAC,2DAA2D;IAC3E,CAAC;AACH,CAAC"}
+{"version":3,"file":"hook.js","sourceRoot":"","sources":["../../src/commands/hook.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAiC9D,SAAS,UAAU,CAAC,CAAU;IAC5B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAC1D,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACf,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,oFAAoF;AACpF,SAAS,cAAc,CAAC,GAAY;IAClC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5E,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,WAAW,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC;IAChE,IAAI,QAAQ,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxE,OAAO;QACL,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClD,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,SAAS,YAAY,CAAC,SAAiB;IACrC,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5E,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,MAAM,KAAK,GACT,CAAC,OAAO,CAAC,CAAC,eAAe,KAAK,QAAQ,IAAI,CAAC,CAAC,eAAe,CAAC;QAC5D,CAAC,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ,IAAI,CAAC,CAAC,aAAa,CAAC;QACxD,SAAS,CAAC;IACZ,MAAM,YAAY,GAChB,CAAC,CAAC,aAAa,IAAI,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC;QACvF,CAAC,CAAE,CAAC,CAAC,aAAyC;QAC9C,CAAC,CAAC,CAAC,CAAC,YAAY,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC;YACtF,CAAC,CAAE,CAAC,CAAC,YAAwC;YAC7C,CAAC,CAAC,SAAS,CAAC;IAClB,OAAO;QACL,KAAK;QACL,SAAS,EACP,CAAC,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC;YAClD,CAAC,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,CAAC;YAChD,SAAS;QACX,GAAG,EAAE,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;QAClD,QAAQ,EACN,CAAC,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,CAAC;YAChD,CAAC,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC;YAC9C,SAAS;QACX,SAAS,EAAE,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,SAAS;QACtC,KAAK,EAAE,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,cAAc,CAAC,YAAY,EAAE,KAAK,CAAC;KACtE,CAAC;AACJ,CAAC;AAED,MAAM,KAAK,GAAe,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AAElE,SAAS,IAAI,CAAC,MAAc;IAC1B,OAAO;QACL,QAAQ,EAAE,CAAC;QACX,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC;YACxB,kBAAkB,EAAE;gBAClB,aAAa,EAAE,YAAY;gBAC3B,kBAAkB,EAAE,MAAM;gBAC1B,wBAAwB,EAAE,MAAM;aACjC;SACF,CAAC,IAAI;QACN,MAAM,EAAE,GAAG,MAAM,IAAI;KACtB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,KAAgB;IAC5C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAC3B,IAAI,OAAO,CAAC,KAAK,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACvF,IAAI,CAAC,OAAO,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAEpC,MAAM,MAAM,GAAG,aAAa,CAAC;YAC3B,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,KAAK,EAAE,EAAE;YACT,kBAAkB,EAAE,IAAI;YACxB,aAAa,EAAE,KAAK;YACpB,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QACH,MAAM,QAAQ,GACZ,KAAK,CAAC,QAAQ;YACd,CAAC,KAAK,EAAE,MAAc,EAAE,IAAa,EAAE,EAAE,CACvC,CAAC,MAAM,WAAW,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC3E,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;QAE3E,0EAA0E;QAC1E,qEAAqE;QACrE,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,KAAK,CAAC,GAAG,CAAC;QAClD,2EAA2E;QAC3E,uEAAuE;QACvE,MAAM,YAAY,GAAG,sBAAsB,CACzC,OAAO,CAAC,QAAQ,EAChB,OAAO,CAAC,SAAS,IAAI,EAAE,EACvB,KAAK,CAAC,GAAG,CACV,CAAC;QACF,MAAM,UAAU,GAAG;YACjB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC;YAC3D,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC;YAClC,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,OAAO,CAAC,QAAQ;YAC3C,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,UAAU,EAAE,QAAQ,CAAC,UAAU,IAAI,EAAE;YACrC,IAAI,EAAE,SAAkB;YACxB,UAAU,EAAE,QAAQ,CAAC,UAAU,KAAK,aAAa;YACjD,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC;YACvB,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,KAAK,SAAS;gBACvC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE;gBACtC,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,KAAK,SAAS;gBACxC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE;gBACxC,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;QACF,IAAI,CAAC;YACH,WAAW,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,wCAAwC;QAC1C,CAAC;QACD,yEAAyE;QACzE,kDAAkD;QAClD,qBAAqB,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;QAE5E,IAAI,QAAQ,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC,cAAc,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,IAAI,QAAQ,CAAC,OAAO,KAAK,iBAAiB,EAAE,CAAC;YAC3D,OAAO,IAAI,CAAC,oBAAoB,OAAO,CAAC,QAAQ,uBAAuB,QAAQ,CAAC,UAAU,GAAG,CAAC,CAAC;QACjG,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC,CAAC,2DAA2D;IAC3E,CAAC;AACH,CAAC"}

package/dist/commands/import-traces.d.ts

@@ -0,0 +1,16 @@
+/**
+ * kya import - convert foreign trace exports (LangSmith, Langfuse, Phoenix,
+ * OTel JSON) into local trail events so the receipt/certify sees them.
+ */
+import type { ParsedArgs } from "../parse-args.js";
+import { type ImportSource } from "../importers/index.js";
+export interface ImportCliOptions {
+    readonly from: ImportSource | undefined;
+    readonly file: string | undefined;
+}
+export declare function importOptionsFromArgs(parsed: ParsedArgs): ImportCliOptions;
+export declare function runImport(opts: ImportCliOptions, io: {
+    log: (s: string) => void;
+    error: (s: string) => void;
+}, cwd: string, env: NodeJS.ProcessEnv): Promise<number>;
+//# sourceMappingURL=import-traces.d.ts.map

package/dist/commands/import-traces.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"import-traces.d.ts","sourceRoot":"","sources":["../../src/commands/import-traces.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnD,OAAO,EAGL,KAAK,YAAY,EAClB,MAAM,uBAAuB,CAAC;AAI/B,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,YAAY,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,UAAU,GAAG,gBAAgB,CAI1E;AAED,wBAAsB,SAAS,CAC7B,IAAI,EAAE,gBAAgB,EACtB,EAAE,EAAE;IAAE,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,EAC5D,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,CAAC,UAAU,GACrB,OAAO,CAAC,MAAM,CAAC,CAQjB"}

package/dist/commands/import-traces.js

@@ -0,0 +1,18 @@
+import { flagString } from "../parse-args.js";
+import { importTraces, renderImportSummary, } from "../importers/index.js";
+const SOURCES = ["langsmith", "langfuse", "phoenix", "otel"];
+export function importOptionsFromArgs(parsed) {
+    const rawFrom = flagString(parsed.flags, "from")?.toLowerCase();
+    const from = SOURCES.find((s) => s === rawFrom);
+    return { from, file: parsed.positionals[0] };
+}
+export async function runImport(opts, io, cwd, env) {
+    if (!opts.from || !opts.file) {
+        io.error("Usage: kya import --from <langsmith|langfuse|phoenix|otel> <file>");
+        return 2;
+    }
+    const result = await importTraces({ from: opts.from, file: opts.file, cwd, env });
+    io.log(renderImportSummary(result));
+    return result.imported === 0 && result.errors.length > 0 ? 1 : 0;
+}
+//# sourceMappingURL=import-traces.js.map

package/dist/commands/import-traces.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"import-traces.js","sourceRoot":"","sources":["../../src/commands/import-traces.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EACL,YAAY,EACZ,mBAAmB,GAEpB,MAAM,uBAAuB,CAAC;AAE/B,MAAM,OAAO,GAA4B,CAAC,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;AAOtF,MAAM,UAAU,qBAAqB,CAAC,MAAkB;IACtD,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC;IAChE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC;IAChD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAsB,EACtB,EAA4D,EAC5D,GAAW,EACX,GAAsB;IAEtB,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAC7B,EAAE,CAAC,KAAK,CAAC,mEAAmE,CAAC,CAAC;QAC9E,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;IAClF,EAAE,CAAC,GAAG,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;IACpC,OAAO,MAAM,CAAC,QAAQ,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACnE,CAAC"}

package/dist/commands/init.js

@@ -45,7 +45,7 @@ export function initFromArgs(parsed, cwd = process.cwd()) {
     const force = parsed.flags["force"] === true || parsed.flags["force"] === "true";
     return runInit({ cwd, baseUrl, host, force });
 }
-const ENV_EXAMPLE = `# Shield KYA light install — copy to .env (never commit secrets)
+const ENV_EXAMPLE = `# Shield KYA light install - copy to .env (never commit secrets)
 # Docs: docs/guides/kya-light-install.md
 
 # Control plane origin (hosted or local free console)

package/dist/commands/investigate.d.ts

@@ -0,0 +1,13 @@
+/**
+ * kya investigate - deterministic detectors over the local trail: incident
+ * grouping plus markdown fix briefs shaped for coding agents. No LLM calls.
+ */
+import type { ParsedArgs } from "../parse-args.js";
+export interface InvestigateCliOptions {
+    readonly json: boolean;
+}
+export declare function investigateOptionsFromArgs(parsed: ParsedArgs): InvestigateCliOptions;
+export declare function runInvestigate(opts: InvestigateCliOptions, io: {
+    log: (s: string) => void;
+}, cwd: string, env: NodeJS.ProcessEnv): Promise<number>;
+//# sourceMappingURL=investigate.d.ts.map

package/dist/commands/investigate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"investigate.d.ts","sourceRoot":"","sources":["../../src/commands/investigate.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAQnD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CACxB;AAED,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,UAAU,GAAG,qBAAqB,CAEpF;AAED,wBAAsB,cAAc,CAClC,IAAI,EAAE,qBAAqB,EAC3B,EAAE,EAAE;IAAE,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,EAChC,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,CAAC,UAAU,GACrB,OAAO,CAAC,MAAM,CAAC,CAmBjB"}

package/dist/commands/investigate.js

@@ -0,0 +1,22 @@
+import { flagBool } from "../parse-args.js";
+import { readTrail } from "../trail.js";
+import { investigateTrail, renderInvestigateReport, } from "../investigate/index.js";
+export function investigateOptionsFromArgs(parsed) {
+    return { json: flagBool(parsed.flags, "json") };
+}
+export async function runInvestigate(opts, io, cwd, env) {
+    const events = readTrail(cwd, env);
+    const result = investigateTrail(events);
+    if (opts.json) {
+        io.log(JSON.stringify({
+            findings: result.findings,
+            incidents: result.incidents,
+            briefs: Object.fromEntries(result.briefs),
+        }, null, 2));
+    }
+    else {
+        io.log(renderInvestigateReport(result));
+    }
+    return 0;
+}
+//# sourceMappingURL=investigate.js.map

package/dist/commands/investigate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"investigate.js","sourceRoot":"","sources":["../../src/commands/investigate.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EACL,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AAMjC,MAAM,UAAU,0BAA0B,CAAC,MAAkB;IAC3D,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;AAClD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAA2B,EAC3B,EAAgC,EAChC,GAAW,EACX,GAAsB;IAEtB,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,EAAE,CAAC,GAAG,CACJ,IAAI,CAAC,SAAS,CACZ;YACE,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC;SAC1C,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,EAAE,CAAC,GAAG,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/commands/notify-flush.d.ts

@@ -0,0 +1,2 @@
+export declare function runNotifyFlush(env: NodeJS.ProcessEnv, cwd: string): Promise<number>;
+//# sourceMappingURL=notify-flush.d.ts.map

package/dist/commands/notify-flush.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"notify-flush.d.ts","sourceRoot":"","sources":["../../src/commands/notify-flush.ts"],"names":[],"mappings":"AAWA,wBAAsB,cAAc,CAClC,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,CAqCjB"}

package/dist/commands/notify-flush.js

@@ -0,0 +1,47 @@
+/**
+ * kya notify-flush - internal helper spawned detached by hook/wrap (see
+ * src/notify/dispatch.ts). Delivers the event handed over in KYA_NOTIFY_EVENT
+ * to configured webhooks and the OTLP exporter, then exits. Never prints,
+ * never fails hard: it is a best-effort side channel.
+ */
+import { kyaHome, readFileConfig } from "../config.js";
+import { notifyOnTrailEvent } from "../notify/index.js";
+import { exportVerdictSpan, resolveOtlpExportConfig } from "../otel/exporter.js";
+export async function runNotifyFlush(env, cwd) {
+    const raw = env.KYA_NOTIFY_EVENT;
+    if (!raw)
+        return 0;
+    let event;
+    try {
+        const parsed = JSON.parse(raw);
+        if (!parsed || typeof parsed.toolId !== "string" || typeof parsed.verdict !== "string") {
+            return 0;
+        }
+        event = parsed;
+    }
+    catch {
+        return 0;
+    }
+    // Project config wins over the global one (same precedence as resolveConfig).
+    const fileConfig = {
+        ...readFileConfig(kyaHome(env)),
+        ...readFileConfig(cwd),
+    };
+    await notifyOnTrailEvent(event, fileConfig, env).catch(() => undefined);
+    const otlp = resolveOtlpExportConfig(env, fileConfig);
+    if (otlp) {
+        await exportVerdictSpan({
+            ts: event.ts,
+            sessionId: event.sessionId,
+            toolId: event.toolId,
+            verdict: event.verdict,
+            reasonCode: event.reasonCode,
+            mode: event.mode,
+            ...(event.host ? { host: event.host } : {}),
+            ...(event.tokensIn !== undefined ? { tokensIn: event.tokensIn } : {}),
+            ...(event.tokensOut !== undefined ? { tokensOut: event.tokensOut } : {}),
+        }, otlp).catch(() => undefined);
+    }
+    return 0;
+}
+//# sourceMappingURL=notify-flush.js.map

package/dist/commands/notify-flush.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"notify-flush.js","sourceRoot":"","sources":["../../src/commands/notify-flush.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEvD,OAAO,EAAE,kBAAkB,EAAyB,MAAM,oBAAoB,CAAC;AAC/E,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAEjF,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAsB,EACtB,GAAW;IAEX,MAAM,GAAG,GAAG,GAAG,CAAC,gBAAgB,CAAC;IACjC,IAAI,CAAC,GAAG;QAAE,OAAO,CAAC,CAAC;IACnB,IAAI,KAAiB,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAe,CAAC;QAC7C,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACvF,OAAO,CAAC,CAAC;QACX,CAAC;QACD,KAAK,GAAG,MAAM,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;IACD,8EAA8E;IAC9E,MAAM,UAAU,GAAG;QACjB,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/B,GAAG,cAAc,CAAC,GAAG,CAAC;KACH,CAAC;IACtB,MAAM,kBAAkB,CAAC,KAAK,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACxE,MAAM,IAAI,GAAG,uBAAuB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACtD,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,iBAAiB,CACrB;YACE,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzE,EACD,IAAI,CACL,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/commands/orr.d.ts

@@ -1,5 +1,5 @@
 /**
- * kya orr run — Phase O1 read-only ORR board emitter.
+ * kya orr run - Phase O1 read-only ORR board emitter.
  * Reporting orchestrator only: not a second PEP; never mints principals or allows side effects.
  */
 import type { ParsedArgs } from "../parse-args.js";
@@ -72,9 +72,9 @@ export interface OrrRunOptions {
     readonly failOn?: "no_go" | "conditional";
     readonly quiet: boolean;
     readonly jsonStdout: boolean;
-    /** Optional OpenSSF Scorecard / readiness JSON. Evidence only — not a PEP. */
+    /** Optional OpenSSF Scorecard / readiness JSON. Evidence only - not a PEP. */
     readonly scorecardPath?: string;
-    /** Optional AgentShield SecurityReport JSON dump. Evidence only — not a PEP. */
+    /** Optional AgentShield SecurityReport JSON dump. Evidence only - not a PEP. */
     readonly agentshieldJsonPath?: string;
     /** Optional usage JSON (array). Observe-only showback. */
     readonly usagePath?: string;

package/dist/commands/orr.js

@@ -1,5 +1,5 @@
 /**
- * kya orr run — Phase O1 read-only ORR board emitter.
+ * kya orr run - Phase O1 read-only ORR board emitter.
  * Reporting orchestrator only: not a second PEP; never mints principals or allows side effects.
  */
 import { existsSync, mkdirSync, readdirSync, readFileSync, lstatSync, realpathSync, statSync, writeFileSync, } from "node:fs";
@@ -218,7 +218,7 @@ export function readScorecardEvidence(scorecardPath) {
                 category: "enterprise_readiness",
                 severity: "info",
                 title: "Scorecard file not found",
-                detail: `${scorecardPath} was requested as an optional producer. Evidence only — not a PEP.`,
+                detail: `${scorecardPath} was requested as an optional producer. Evidence only - not a PEP.`,
                 evidence: abs,
                 source_tool: "openssf.scorecard",
             },
@@ -346,7 +346,7 @@ export function runSaFirstPartyProbes(root) {
             category: "agent_factory_lifecycle",
             severity: "high",
             title: "Agent create path may be scope-auth only",
-            detail: "Factory doctrine: principal mint should be policy-gated (APPROVED). ORR reports only — does not mint.",
+            detail: "Factory doctrine: principal mint should be policy-gated (APPROVED). ORR reports only - does not mint.",
             evidence: "sa.first_party text probe",
         });
     }
@@ -361,7 +361,7 @@ export function runSaFirstPartyProbes(root) {
             category: "cost_budget_gates",
             severity: "info",
             title: "No in-loop step/token/retry ceilings detected",
-            detail: "Look for max_steps, max_tokens, max_retries, or maxCost in the agent loop. Soft gate only — ORR does not kill spend.",
+            detail: "Look for max_steps, max_tokens, max_retries, or maxCost in the agent loop. Soft gate only - ORR does not kill spend.",
             evidence: "sa.first_party text probe",
         });
     }
@@ -493,7 +493,7 @@ export function formatOrrMarkdown(report) {
             .join("\n");
     const showbackMd = formatShowbackMarkdown(report.showback);
     const cards = report.scorecards
-        .map((s) => `- \`${s.category}\` / \`${s.name}\`: **${s.result}** (${s.hardness})${s.note ? ` — ${s.note}` : ""}`)
+        .map((s) => `- \`${s.category}\` / \`${s.name}\`: **${s.result}** (${s.hardness})${s.note ? ` - ${s.note}` : ""}`)
         .join("\n");
     return `# ORR: ${report.target.name}
 

package/dist/commands/receipt-serve.d.ts

@@ -1,7 +1,7 @@
 /**
  * Hidden daemon entry: runs the live receipt server in the foreground and
  * publishes `.kya/receipt-server.json` (pid, url, token) once listening.
- * Spawned detached by `ensureReceiptDaemon` — never invoked by users directly.
+ * Spawned detached by `ensureReceiptDaemon` - never invoked by users directly.
  */
 import type { ResolvedConfig } from "../config.js";
 export declare function runReceiptServe(config: ResolvedConfig, input: {

package/dist/commands/receipt-serve.js

@@ -17,7 +17,7 @@ export async function runReceiptServe(config, input) {
         await live.waitUntilClosed;
     }
     finally {
-        // Only remove the state file if it is still ours — a successor daemon
+        // Only remove the state file if it is still ours - a successor daemon
         // spawned during our slow shutdown must not lose its state.
         clearDaemonState(config.cwd, process.pid);
     }

package/dist/commands/serve-mcp.js

@@ -19,7 +19,7 @@ export async function runServeMcp(config, options, client) {
             host: config.host,
             agentId: config.agentId,
             // Offline (KYA_OFFLINE=1, as `kya start`/`kya connect` wire for hosts):
-            // start keyless — initialize/tools/list work; tool calls still fail
+            // start keyless - initialize/tools/list work; tool calls still fail
             // closed at call time without a key.
             requireApiKey: !config.offline,
         });

package/dist/commands/start.d.ts

@@ -45,8 +45,8 @@ export interface GateBootstrapDeps {
 export declare function gateBootstrapEnabled(flag: boolean | undefined, env?: NodeJS.ProcessEnv): boolean;
 /**
  * Gate bootstrap for `kya start`: scaffold gateways.json, import third-party
- * servers discovered in host configs, then — only when there is something to
- * govern — install the binary, start the supervisor, and route the source
+ * servers discovered in host configs, then - only when there is something to
+ * govern - install the binary, start the supervisor, and route the source
  * hosts through the gateway (direct entries removed, originals backed up
  * under .kya/backups). Every step warns and continues: start never fails
  * because of the gateway, and host configs are only touched once the