@shield-agent/kya 0.5.0 → 0.6.0

package/dist/fs-atomic.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Crash-safe write: tmp file in the same directory, then rename onto the
+ * target (atomic on POSIX and win32 within one volume). A mid-write crash
+ * leaves the original config intact; the tmp file is removed best-effort.
+ * An existing target's file mode is carried over — a rename would otherwise
+ * turn a 0600 config into the umask default.
+ */
+export declare function atomicWriteSync(target: string, content: string): void;
+//# sourceMappingURL=fs-atomic.d.ts.map

package/dist/fs-atomic.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fs-atomic.d.ts","sourceRoot":"","sources":["../src/fs-atomic.ts"],"names":[],"mappings":"AAMA;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CA0BrE"}

package/dist/fs-atomic.js

@@ -0,0 +1,44 @@
+/**
+ * Shared crash-safe file write, used by connect/wire-hooks host config writes
+ * and the certify attestation store.
+ */
+import { chmodSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
+/**
+ * Crash-safe write: tmp file in the same directory, then rename onto the
+ * target (atomic on POSIX and win32 within one volume). A mid-write crash
+ * leaves the original config intact; the tmp file is removed best-effort.
+ * An existing target's file mode is carried over — a rename would otherwise
+ * turn a 0600 config into the umask default.
+ */
+export function atomicWriteSync(target, content) {
+    const tmp = `${target}.kya-tmp-${process.pid}`;
+    try {
+        let mode;
+        try {
+            mode = statSync(target).mode;
+        }
+        catch {
+            /* new file — keep default mode */
+        }
+        writeFileSync(tmp, content, "utf8");
+        if (mode !== undefined) {
+            try {
+                chmodSync(tmp, mode);
+            }
+            catch {
+                /* win32 chmod semantics differ; POSIX correctness is what matters */
+            }
+        }
+        renameSync(tmp, target);
+    }
+    catch (err) {
+        try {
+            rmSync(tmp, { force: true });
+        }
+        catch {
+            /* best-effort cleanup */
+        }
+        throw err;
+    }
+}
+//# sourceMappingURL=fs-atomic.js.map

package/dist/fs-atomic.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fs-atomic.js","sourceRoot":"","sources":["../src/fs-atomic.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAEjF;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,OAAe;IAC7D,MAAM,GAAG,GAAG,GAAG,MAAM,YAAY,OAAO,CAAC,GAAG,EAAE,CAAC;IAC/C,IAAI,CAAC;QACH,IAAI,IAAwB,CAAC;QAC7B,IAAI,CAAC;YACH,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,kCAAkC;QACpC,CAAC;QACD,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACpC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,CAAC;gBACH,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACvB,CAAC;YAAC,MAAM,CAAC;gBACP,qEAAqE;YACvE,CAAC;QACH,CAAC;QACD,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,yBAAyB;QAC3B,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/index.d.ts

@@ -4,7 +4,7 @@
  */
 export { runCli, type CliIo } from "./cli.js";
 export { parseArgs, flagString, flagBool, flagInt, type ParsedArgs } from "./parse-args.js";
-export { resolveConfig, readFileConfig, writeFileConfig, configDir, configFilePath, type Host, type KyaFileConfig, type ResolvedConfig, type ResolveOptions, } from "./config.js";
+export { resolveConfig, readFileConfig, writeFileConfig, configDir, configFilePath, resolveGateMode, type GateMode, type Host, type KyaFileConfig, type ResolvedConfig, type ResolveOptions, } from "./config.js";
 export { KyaHttpClient, buildEvaluateFromToolArgs, type KyaClientOptions, type PolicyEvaluateRequest, type PolicyEvaluateResponse, type RegisterAgentRequest, type AgentResponse, type SessionIngestRequest, type CreateApprovalRequest, type FetchLike, isMachineApiKey, } from "./client.js";
 export { computeArgsHash, canonicalJson } from "./hash.js";
 export { SAMPLE_TOOLS, findSampleTool, type SampleToolDescriptor } from "./sample-tools.js";
@@ -21,4 +21,11 @@ export { startHttpMcp, type HttpMcpServer } from "./mcp/http.js";
 export { startStdioMcp } from "./mcp/stdio.js";
 export { buildShowback, parseUsageRecords, SHOWBACK_DISCLAIMER, type UsageRecord, type ShowbackReport, } from "./showback/cost-per-task.js";
 export { estimateRequestUsd, lookupRate, PUBLISHED_MODEL_RATES } from "./showback/rates.js";
+export { runCertify, certifyOptionsFromArgs, formatCertifySummary, countReceipts, type CertifyCliOptions, type CertifyOptions, type CertifyResult, } from "./commands/certify.js";
+export { loadCatalog, validateCatalog, defaultCatalogPath, MAX_CATALOG_BYTES, type Catalog, type CatalogRequirement, type RequirementCheck, type RequirementSeverity, type TrailMatch, } from "./certify/catalog.js";
+export { evaluateRequirement, matchEvent, trailWindow, type CertifyReport, type CertifyRequirementResult, type CertifyTrailStats, type EvidenceContext, type RequirementAttestation, type RequirementStatus, } from "./certify/evaluate.js";
+export { attestationsPath, loadAttestations, recordAttestation, type AttestationRecord, } from "./certify/attest.js";
+export { formatCertifyMarkdown, renderCertifyHtml } from "./certify/render.js";
+export { loadOrrCategoryRatings } from "./receipt/enrich.js";
+export { buildEvidenceBundle, evidenceKeyFromSerialized, evidenceKeyPath, fingerprintSpki, loadOrCreateEvidenceKey, signCanonicalPayload, verifyBundleSignature, EVIDENCE_BUNDLE_FORMAT, EVIDENCE_BUNDLE_VERSION, type BundleAgent, type EvidenceBundleInput, type EvidenceKey, type SerializedEvidenceKey, } from "./sign/evidence-bundle.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,MAAM,EAAE,KAAK,KAAK,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC5F,OAAO,EACL,aAAa,EACb,cAAc,EACd,eAAe,EACf,SAAS,EACT,cAAc,EACd,KAAK,IAAI,EACT,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,cAAc,GACpB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,aAAa,EACb,yBAAyB,EACzB,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,SAAS,EACd,eAAe,GAChB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,KAAK,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAC5F,OAAO,EAAE,gBAAgB,EAAE,KAAK,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EACL,gBAAgB,EAChB,0BAA0B,EAC1B,KAAK,mBAAmB,GACzB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,WAAW,EACX,qBAAqB,EACrB,eAAe,EACf,KAAK,cAAc,GACpB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,WAAW,EACX,uBAAuB,EACvB,KAAK,eAAe,EACpB,KAAK,cAAc,GACpB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,MAAM,EACN,qBAAqB,EACrB,qBAAqB,EACrB,iBAAiB,EACjB,KAAK,SAAS,EACd,KAAK,aAAa,EAClB,KAAK,YAAY,GAClB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,KAAK,WAAW,GACjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,SAAS,EACT,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,KAAK,iBAAiB,EACtB,KAAK,aAAa,GACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,mBAAmB,EACnB,KAAK,WAAW,EAChB,KAAK,cAAc,GACpB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,MAAM,EAAE,KAAK,KAAK,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC5F,OAAO,EACL,aAAa,EACb,cAAc,EACd,eAAe,EACf,SAAS,EACT,cAAc,EACd,eAAe,EACf,KAAK,QAAQ,EACb,KAAK,IAAI,EACT,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,cAAc,GACpB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,aAAa,EACb,yBAAyB,EACzB,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,SAAS,EACd,eAAe,GAChB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,KAAK,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAC5F,OAAO,EAAE,gBAAgB,EAAE,KAAK,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EACL,gBAAgB,EAChB,0BAA0B,EAC1B,KAAK,mBAAmB,GACzB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,WAAW,EACX,qBAAqB,EACrB,eAAe,EACf,KAAK,cAAc,GACpB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,WAAW,EACX,uBAAuB,EACvB,KAAK,eAAe,EACpB,KAAK,cAAc,GACpB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,MAAM,EACN,qBAAqB,EACrB,qBAAqB,EACrB,iBAAiB,EACjB,KAAK,SAAS,EACd,KAAK,aAAa,EAClB,KAAK,YAAY,GAClB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,KAAK,WAAW,GACjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,SAAS,EACT,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,KAAK,iBAAiB,EACtB,KAAK,aAAa,GACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,mBAAmB,EACnB,KAAK,WAAW,EAChB,KAAK,cAAc,GACpB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5F,OAAO,EACL,UAAU,EACV,sBAAsB,EACtB,oBAAoB,EACpB,aAAa,EACb,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,aAAa,GACnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,WAAW,EACX,eAAe,EACf,kBAAkB,EAClB,iBAAiB,EACjB,KAAK,OAAO,EACZ,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACxB,KAAK,UAAU,GAChB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,mBAAmB,EACnB,UAAU,EACV,WAAW,EACX,KAAK,aAAa,EAClB,KAAK,wBAAwB,EAC7B,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,GACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,KAAK,iBAAiB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EACL,mBAAmB,EACnB,yBAAyB,EACzB,eAAe,EACf,eAAe,EACf,uBAAuB,EACvB,oBAAoB,EACpB,qBAAqB,EACrB,sBAAsB,EACtB,uBAAuB,EACvB,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,WAAW,EAChB,KAAK,qBAAqB,GAC3B,MAAM,2BAA2B,CAAC"}

package/dist/index.js

@@ -4,7 +4,7 @@
  */
 export { runCli } from "./cli.js";
 export { parseArgs, flagString, flagBool, flagInt } from "./parse-args.js";
-export { resolveConfig, readFileConfig, writeFileConfig, configDir, configFilePath, } from "./config.js";
+export { resolveConfig, readFileConfig, writeFileConfig, configDir, configFilePath, resolveGateMode, } from "./config.js";
 export { KyaHttpClient, buildEvaluateFromToolArgs, isMachineApiKey, } from "./client.js";
 export { computeArgsHash, canonicalJson } from "./hash.js";
 export { SAMPLE_TOOLS, findSampleTool } from "./sample-tools.js";
@@ -21,4 +21,11 @@ export { startHttpMcp } from "./mcp/http.js";
 export { startStdioMcp } from "./mcp/stdio.js";
 export { buildShowback, parseUsageRecords, SHOWBACK_DISCLAIMER, } from "./showback/cost-per-task.js";
 export { estimateRequestUsd, lookupRate, PUBLISHED_MODEL_RATES } from "./showback/rates.js";
+export { runCertify, certifyOptionsFromArgs, formatCertifySummary, countReceipts, } from "./commands/certify.js";
+export { loadCatalog, validateCatalog, defaultCatalogPath, MAX_CATALOG_BYTES, } from "./certify/catalog.js";
+export { evaluateRequirement, matchEvent, trailWindow, } from "./certify/evaluate.js";
+export { attestationsPath, loadAttestations, recordAttestation, } from "./certify/attest.js";
+export { formatCertifyMarkdown, renderCertifyHtml } from "./certify/render.js";
+export { loadOrrCategoryRatings } from "./receipt/enrich.js";
+export { buildEvidenceBundle, evidenceKeyFromSerialized, evidenceKeyPath, fingerprintSpki, loadOrCreateEvidenceKey, signCanonicalPayload, verifyBundleSignature, EVIDENCE_BUNDLE_FORMAT, EVIDENCE_BUNDLE_VERSION, } from "./sign/evidence-bundle.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,MAAM,EAAc,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAmB,MAAM,iBAAiB,CAAC;AAC5F,OAAO,EACL,aAAa,EACb,cAAc,EACd,eAAe,EACf,SAAS,EACT,cAAc,GAKf,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,aAAa,EACb,yBAAyB,EASzB,eAAe,GAChB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,cAAc,EAA6B,MAAM,mBAAmB,CAAC;AAC5F,OAAO,EAAE,gBAAgB,EAAqB,MAAM,iBAAiB,CAAC;AACtE,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EAAE,OAAO,EAAE,YAAY,EAAmB,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EACL,gBAAgB,EAChB,0BAA0B,GAE3B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,WAAW,EACX,qBAAqB,EACrB,eAAe,GAEhB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,WAAW,EACX,uBAAuB,GAGxB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,MAAM,EACN,qBAAqB,EACrB,qBAAqB,EACrB,iBAAiB,GAIlB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,eAAe,EACf,gBAAgB,GAEjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,SAAS,EACT,eAAe,EACf,iBAAiB,EACjB,aAAa,GAGd,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,YAAY,EAAsB,MAAM,eAAe,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,mBAAmB,GAGpB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,MAAM,EAAc,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAmB,MAAM,iBAAiB,CAAC;AAC5F,OAAO,EACL,aAAa,EACb,cAAc,EACd,eAAe,EACf,SAAS,EACT,cAAc,EACd,eAAe,GAMhB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,aAAa,EACb,yBAAyB,EASzB,eAAe,GAChB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,cAAc,EAA6B,MAAM,mBAAmB,CAAC;AAC5F,OAAO,EAAE,gBAAgB,EAAqB,MAAM,iBAAiB,CAAC;AACtE,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EAAE,OAAO,EAAE,YAAY,EAAmB,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EACL,gBAAgB,EAChB,0BAA0B,GAE3B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,WAAW,EACX,qBAAqB,EACrB,eAAe,GAEhB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,WAAW,EACX,uBAAuB,GAGxB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,MAAM,EACN,qBAAqB,EACrB,qBAAqB,EACrB,iBAAiB,GAIlB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,eAAe,EACf,gBAAgB,GAEjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,SAAS,EACT,eAAe,EACf,iBAAiB,EACjB,aAAa,GAGd,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,YAAY,EAAsB,MAAM,eAAe,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,mBAAmB,GAGpB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5F,OAAO,EACL,UAAU,EACV,sBAAsB,EACtB,oBAAoB,EACpB,aAAa,GAId,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,WAAW,EACX,eAAe,EACf,kBAAkB,EAClB,iBAAiB,GAMlB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,mBAAmB,EACnB,UAAU,EACV,WAAW,GAOZ,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,GAElB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EACL,mBAAmB,EACnB,yBAAyB,EACzB,eAAe,EACf,eAAe,EACf,uBAAuB,EACvB,oBAAoB,EACpB,qBAAqB,EACrB,sBAAsB,EACtB,uBAAuB,GAKxB,MAAM,2BAA2B,CAAC"}

package/dist/receipt/enrich.d.ts

@@ -29,6 +29,12 @@ export interface OrrCard {
 }
 /** Slim ORR card from <cwd>/orr-report/report.json (default orr --out). */
 export declare function loadOrrCard(cwd: string): OrrCard | undefined;
+/**
+ * Per-category ratings from <cwd>/orr-report/report.json — sibling of the slim
+ * OrrCard for consumers that need category granularity (certify). Same
+ * confined-read pattern; invalid entries are dropped, not fatal.
+ */
+export declare function loadOrrCategoryRatings(cwd: string): Record<string, OrrRating> | undefined;
 /** Observe-only showback from .kya/usage.json inside cwd. */
 export declare function loadShowbackCard(cwd: string): ShowbackReport | undefined;
 export type WiredState = "global" | "project" | "both" | "none";

package/dist/receipt/enrich.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"enrich.d.ts","sourceRoot":"","sources":["../../src/receipt/enrich.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAa,MAAM,oBAAoB,CAAC;AAC/E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAIL,KAAK,UAAU,EAChB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAEL,KAAK,cAAc,EACpB,MAAM,8BAA8B,CAAC;AAoDtC;oFACoF;AACpF,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAYnE;AAED,MAAM,WAAW,WAAW;IAC1B,qDAAqD;IACrD,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,SAAS,EAAE,SAAS,aAAa,EAAE,CAAC;CAC9C;AAED,wBAAgB,aAAa,CAC3B,GAAG,EAAE,MAAM,EACX,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,WAAW,CAKb;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC;IACrC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,UAAU,EAAE,kBAAkB,CAAC;CACzC;AASD,2EAA2E;AAC3E,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAgD5D;AAED,6DAA6D;AAC7D,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAUxE;AAED,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;AAEhE,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,yDAAyD;IACzD,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;CACzC;AAyBD,wBAAgB,cAAc,CAC5B,GAAG,EAAE,MAAM,EACX,IAAI,GAAE,MAAkD,EACxD,KAAK,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,GAC1B,YAAY,EAAE,CAuChB"}
+{"version":3,"file":"enrich.d.ts","sourceRoot":"","sources":["../../src/receipt/enrich.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAa,MAAM,oBAAoB,CAAC;AAC/E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAIL,KAAK,UAAU,EAChB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAEL,KAAK,cAAc,EACpB,MAAM,8BAA8B,CAAC;AAoDtC;oFACoF;AACpF,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAYnE;AAED,MAAM,WAAW,WAAW;IAC1B,qDAAqD;IACrD,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,SAAS,EAAE,SAAS,aAAa,EAAE,CAAC;CAC9C;AAED,wBAAgB,aAAa,CAC3B,GAAG,EAAE,MAAM,EACX,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,WAAW,CAKb;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC;IACrC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,UAAU,EAAE,kBAAkB,CAAC;CACzC;AASD,2EAA2E;AAC3E,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAgD5D;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,MAAM,GACV,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,SAAS,CAkBvC;AAED,6DAA6D;AAC7D,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAUxE;AAED,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;AAEhE,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,yDAAyD;IACzD,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;CACzC;AAyBD,wBAAgB,cAAc,CAC5B,GAAG,EAAE,MAAM,EACX,IAAI,GAAE,MAAkD,EACxD,KAAK,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,GAC1B,YAAY,EAAE,CAuChB"}

package/dist/receipt/enrich.js

@@ -127,6 +127,28 @@ export function loadOrrCard(cwd) {
         scorecards: counts,
     };
 }
+/**
+ * Per-category ratings from <cwd>/orr-report/report.json — sibling of the slim
+ * OrrCard for consumers that need category granularity (certify). Same
+ * confined-read pattern; invalid entries are dropped, not fatal.
+ */
+export function loadOrrCategoryRatings(cwd) {
+    const raw = readConfinedJsonFile(cwd, join("orr-report", "report.json"), MAX_ORR_REPORT_BYTES);
+    if (!raw || typeof raw !== "object" || Array.isArray(raw))
+        return undefined;
+    const categories = raw.categories;
+    if (!Array.isArray(categories))
+        return undefined;
+    const out = {};
+    for (const c of categories) {
+        const id = c?.id;
+        const rating = c?.rating;
+        if (typeof id === "string" && typeof rating === "string" && ORR_RATINGS.has(rating)) {
+            out[id] = rating;
+        }
+    }
+    return Object.keys(out).length > 0 ? out : undefined;
+}
 /** Observe-only showback from .kya/usage.json inside cwd. */
 export function loadShowbackCard(cwd) {
     const raw = readConfinedJsonFile(cwd, join(".kya", "usage.json"), MAX_USAGE_FILE_BYTES);

package/dist/receipt/enrich.js.map

@@ -1 +1 @@
-{"version":3,"file":"enrich.js","sourceRoot":"","sources":["../../src/receipt/enrich.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAiB,MAAM,wBAAwB,CAAC;AAGzE,OAAO,EACL,UAAU,EACV,WAAW,EACX,gBAAgB,GAEjB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,aAAa,GAEd,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,2BAA2B,CAAC;AAEnC,MAAM,oBAAoB,GAAG,GAAG,GAAG,IAAI,CAAC;AACxC,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAC/B,MAAM,qBAAqB,GAAG,IAAI,GAAG,IAAI,CAAC;AAE1C,SAAS,UAAU,CAAC,IAAY,EAAE,IAAY;IAC5C,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,MAAM,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;IAC7C,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AACzC,CAAC;AAED,wEAAwE;AACxE,SAAS,YAAY,CAAC,IAAY,EAAE,IAAY;IAC9C,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,EAAE,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE;YAAE,OAAO,SAAS,CAAC;QAC1D,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC;YAAE,OAAO,SAAS,CAAC;QACtD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,mBAAmB,GAAG,IAAI,GAAG,IAAI,CAAC;AAExC;;;GAGG;AACH,SAAS,oBAAoB,CAC3B,GAAW,EACX,OAAe,EACf,QAAgB;IAEhB,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC;IACnD,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,IAAI,CAAC;QACH,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,QAAQ;YAAE,OAAO,SAAS,CAAC;QACrD,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAY,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;oFACoF;AACpF,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,MAAM,GAAG,GAAG,oBAAoB,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,mBAAmB,CAAC,CAAC;IACxF,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5E,MAAM,MAAM,GAAG,GAA8B,CAAC;IAC9C,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,CAAU,EAAE,CAAC;QACvE,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACtB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE;YAAE,SAAS;QACjD,IAAI,GAAG,KAAK,MAAM,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS;QAC/D,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACf,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAE,GAAqB,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1E,CAAC;AAQD,MAAM,UAAU,aAAa,CAC3B,GAAW,EACX,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,OAAO,GAAG,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,SAAS,CAAC;IACnE,MAAM,GAAG,GAAG,oBAAoB,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAAE,mBAAmB,CAAC,CAAC;IAC3F,MAAM,SAAS,GAAoB,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,GAAuB,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAChC,CAAC;AAmBD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAS,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;AAC/D,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAS,CAAC,IAAI,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC;AAEzE,SAAS,KAAK,CAAC,CAAU;IACvB,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACxC,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,GAAG,GAAG,oBAAoB,CAC9B,GAAG,EACH,IAAI,CAAC,YAAY,EAAE,aAAa,CAAC,EACjC,oBAAoB,CACrB,CAAC;IACF,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5E,MAAM,MAAM,GAAG,GAAyB,CAAC;IACzC,IACE,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ;QAClC,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC;QAChC,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ;QACtC,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,EACzC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;IACjE,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QACrC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACrC,QAAS,IAAoC,EAAE,MAAM,EAAE,CAAC;gBACtD,KAAK,MAAM;oBACT,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;oBACjB,MAAM;gBACR,KAAK,MAAM;oBACT,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;oBACjB,MAAM;gBACR,KAAK,SAAS;oBACZ,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC;oBACpB,MAAM;gBACR,KAAK,eAAe;oBAClB,MAAM,CAAC,YAAY,IAAI,CAAC,CAAC;oBACzB,MAAM;YACV,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GACd,MAAM,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ;QACrD,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC;QACjD,CAAC,CAAC,SAAS,CAAC;IAChB,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC;QACnF,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC;QACzE,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC;QACvC,UAAU;QACV,UAAU,EAAE,MAAM;KACnB,CAAC;AACJ,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,MAAM,GAAG,GAAG,oBAAoB,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,oBAAoB,CAAC,CAAC;IACxF,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAC3C,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAcD,SAAS,aAAa,CAAC,IAAY,EAAE,IAAc;IACjD,IAAI,CAAC;QACH,oEAAoE;QACpE,sEAAsE;QACtE,yCAAyC;QACzC,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,IAAI,GAAG,qBAAqB;YAAE,OAAO,KAAK,CAAC;QAClE,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACxC,IAAI,IAAI,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;YAC/B,OAAO,8CAA8C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;QACxC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACxE,MAAM,OAAO,GAAI,GAA+B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC/D,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACtE,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,OAAO,CAAE,OAAmC,CAAC,YAAY,CAAC,CAAC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,GAAW,EACX,OAAe,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,OAAO,EAAE,EACxD,KAA2B;IAE3B,MAAM,OAAO,GAAG,KAAK,IAAI,gBAAgB,EAAE,CAAC;IAC5C,OAAO,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,EAAgB,EAAE;QACvE,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC;QAC9B,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAChE,uEAAuE;QACvE,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,OAAO;gBACL,EAAE;gBACF,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,KAAK,EAAE,MAAM;gBACb,MAAM;gBACN,OAAO,EAAE,SAAS;gBAClB,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU;YACjC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC;YAC5C,CAAC,CAAC,KAAK,CAAC;QACV,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW;YACnC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC;YAC5C,CAAC,CAAC,KAAK,CAAC;QACV,MAAM,KAAK,GACT,WAAW,IAAI,YAAY;YACzB,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,WAAW;gBACX,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,YAAY;oBACZ,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,MAAM,CAAC;QACjB,OAAO;YACL,EAAE;YACF,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,KAAK;YACL,MAAM;YACN,OAAO,EAAE,SAAS;YAClB,UAAU,EAAE,SAAS;SACtB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"enrich.js","sourceRoot":"","sources":["../../src/receipt/enrich.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAiB,MAAM,wBAAwB,CAAC;AAGzE,OAAO,EACL,UAAU,EACV,WAAW,EACX,gBAAgB,GAEjB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,aAAa,GAEd,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,2BAA2B,CAAC;AAEnC,MAAM,oBAAoB,GAAG,GAAG,GAAG,IAAI,CAAC;AACxC,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAC/B,MAAM,qBAAqB,GAAG,IAAI,GAAG,IAAI,CAAC;AAE1C,SAAS,UAAU,CAAC,IAAY,EAAE,IAAY;IAC5C,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,MAAM,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;IAC7C,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AACzC,CAAC;AAED,wEAAwE;AACxE,SAAS,YAAY,CAAC,IAAY,EAAE,IAAY;IAC9C,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,EAAE,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE;YAAE,OAAO,SAAS,CAAC;QAC1D,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC;YAAE,OAAO,SAAS,CAAC;QACtD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,mBAAmB,GAAG,IAAI,GAAG,IAAI,CAAC;AAExC;;;GAGG;AACH,SAAS,oBAAoB,CAC3B,GAAW,EACX,OAAe,EACf,QAAgB;IAEhB,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC;IACnD,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,IAAI,CAAC;QACH,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,QAAQ;YAAE,OAAO,SAAS,CAAC;QACrD,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAY,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;oFACoF;AACpF,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,MAAM,GAAG,GAAG,oBAAoB,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,mBAAmB,CAAC,CAAC;IACxF,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5E,MAAM,MAAM,GAAG,GAA8B,CAAC;IAC9C,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,CAAU,EAAE,CAAC;QACvE,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACtB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE;YAAE,SAAS;QACjD,IAAI,GAAG,KAAK,MAAM,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS;QAC/D,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACf,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAE,GAAqB,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1E,CAAC;AAQD,MAAM,UAAU,aAAa,CAC3B,GAAW,EACX,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,OAAO,GAAG,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,SAAS,CAAC;IACnE,MAAM,GAAG,GAAG,oBAAoB,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAAE,mBAAmB,CAAC,CAAC;IAC3F,MAAM,SAAS,GAAoB,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,GAAuB,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAChC,CAAC;AAmBD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAS,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;AAC/D,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAS,CAAC,IAAI,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC;AAEzE,SAAS,KAAK,CAAC,CAAU;IACvB,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACxC,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,GAAG,GAAG,oBAAoB,CAC9B,GAAG,EACH,IAAI,CAAC,YAAY,EAAE,aAAa,CAAC,EACjC,oBAAoB,CACrB,CAAC;IACF,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5E,MAAM,MAAM,GAAG,GAAyB,CAAC;IACzC,IACE,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ;QAClC,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC;QAChC,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ;QACtC,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,EACzC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;IACjE,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QACrC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACrC,QAAS,IAAoC,EAAE,MAAM,EAAE,CAAC;gBACtD,KAAK,MAAM;oBACT,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;oBACjB,MAAM;gBACR,KAAK,MAAM;oBACT,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;oBACjB,MAAM;gBACR,KAAK,SAAS;oBACZ,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC;oBACpB,MAAM;gBACR,KAAK,eAAe;oBAClB,MAAM,CAAC,YAAY,IAAI,CAAC,CAAC;oBACzB,MAAM;YACV,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GACd,MAAM,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ;QACrD,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC;QACjD,CAAC,CAAC,SAAS,CAAC;IAChB,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC;QACnF,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC;QACzE,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC;QACvC,UAAU;QACV,UAAU,EAAE,MAAM;KACnB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,GAAW;IAEX,MAAM,GAAG,GAAG,oBAAoB,CAC9B,GAAG,EACH,IAAI,CAAC,YAAY,EAAE,aAAa,CAAC,EACjC,oBAAoB,CACrB,CAAC;IACF,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5E,MAAM,UAAU,GAAI,GAA0B,CAAC,UAAU,CAAC;IAC1D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC;QAAE,OAAO,SAAS,CAAC;IACjD,MAAM,GAAG,GAA8B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,MAAM,EAAE,GAAI,CAA6B,EAAE,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAI,CAAiC,EAAE,MAAM,CAAC;QAC1D,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACpF,GAAG,CAAC,EAAE,CAAC,GAAG,MAAmB,CAAC;QAChC,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,MAAM,GAAG,GAAG,oBAAoB,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,oBAAoB,CAAC,CAAC;IACxF,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAC3C,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAcD,SAAS,aAAa,CAAC,IAAY,EAAE,IAAc;IACjD,IAAI,CAAC;QACH,oEAAoE;QACpE,sEAAsE;QACtE,yCAAyC;QACzC,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,IAAI,GAAG,qBAAqB;YAAE,OAAO,KAAK,CAAC;QAClE,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACxC,IAAI,IAAI,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;YAC/B,OAAO,8CAA8C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;QACxC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACxE,MAAM,OAAO,GAAI,GAA+B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC/D,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACtE,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,OAAO,CAAE,OAAmC,CAAC,YAAY,CAAC,CAAC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,GAAW,EACX,OAAe,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,OAAO,EAAE,EACxD,KAA2B;IAE3B,MAAM,OAAO,GAAG,KAAK,IAAI,gBAAgB,EAAE,CAAC;IAC5C,OAAO,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,EAAgB,EAAE;QACvE,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC;QAC9B,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAChE,uEAAuE;QACvE,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,OAAO;gBACL,EAAE;gBACF,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,KAAK,EAAE,MAAM;gBACb,MAAM;gBACN,OAAO,EAAE,SAAS;gBAClB,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU;YACjC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC;YAC5C,CAAC,CAAC,KAAK,CAAC;QACV,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW;YACnC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC;YAC5C,CAAC,CAAC,KAAK,CAAC;QACV,MAAM,KAAK,GACT,WAAW,IAAI,YAAY;YACzB,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,WAAW;gBACX,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,YAAY;oBACZ,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,MAAM,CAAC;QACjB,OAAO;YACL,EAAE;YACF,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,KAAK;YACL,MAAM;YACN,OAAO,EAAE,SAAS;YAClB,UAAU,EAAE,SAAS;SACtB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/sign/evidence-bundle.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Signed evidence bundles (v1) — the OSS half of hosted verification.
+ * Self-signed by a locally generated ed25519 key: proves bundle integrity and
+ * continuity of a key, NOT identity. Identity binding is a hosted claim.
+ * node:crypto only — the package dependency list is locked.
+ */
+import { type KeyObject } from "node:crypto";
+import type { CertifyReport } from "../certify/evaluate.js";
+import type { TrailEvent } from "../trail.js";
+export declare const EVIDENCE_BUNDLE_FORMAT = "shield-kya-evidence-bundle";
+export declare const EVIDENCE_BUNDLE_VERSION = 1;
+export interface EvidenceKey {
+    readonly publicKey: KeyObject;
+    readonly privateKey: KeyObject;
+    /** base64url(SPKI DER) — the `pubkey` field of every bundle. */
+    readonly pubkeyB64u: string;
+    /** First 16 hex chars of sha256(SPKI DER). */
+    readonly fingerprint: string;
+    /** True when this call generated the key (fresh or after a corrupt file). */
+    readonly created: boolean;
+    /** True when generation replaced an unreadable/corrupt key file. */
+    readonly regenerated: boolean;
+}
+export interface SerializedEvidenceKey {
+    readonly version: 1;
+    readonly createdAt: string;
+    readonly publicKeySpki: string;
+    readonly privateKeyPkcs8: string;
+}
+export declare function evidenceKeyPath(env?: NodeJS.ProcessEnv): string;
+export declare function fingerprintSpki(spkiDer: Buffer): string;
+/** Rebuild an EvidenceKey from the on-disk JSON shape. Throws UsageError on corrupt input. */
+export declare function evidenceKeyFromSerialized(raw: unknown): EvidenceKey;
+/** Load the evidence signing key, generating one (mode 0600) on first use. */
+export declare function loadOrCreateEvidenceKey(env?: NodeJS.ProcessEnv): EvidenceKey;
+/** sig = base64url( ed25519_sign( canonicalJson(body) ) ) — canonicalJson from src/hash.ts. */
+export declare function signCanonicalPayload(body: unknown, privateKey: KeyObject): string;
+/** Verify `sig` over canonicalJson(bundle without the `sig` and `pubkey` fields) using the embedded `pubkey`. */
+export declare function verifyBundleSignature(bundle: Record<string, unknown>): boolean;
+export interface BundleAgent {
+    readonly agentId?: string;
+    readonly agentName?: string;
+    readonly host?: "ide" | "runtime";
+    readonly product?: string;
+}
+export interface EvidenceBundleInput {
+    readonly report: CertifyReport;
+    /** Events inside report.window — the digest binds the bundle to the tape. */
+    readonly windowEvents: readonly TrailEvent[];
+    readonly agent?: BundleAgent;
+}
+/**
+ * Build a signed evidence bundle v1 (hard cross-repo contract — see
+ * docs/certify.md). sig = base64url(ed25519_sign(canonicalJson(body))) where
+ * body is the bundle without the sig and pubkey fields (same stripping as
+ * verifyBundleSignature). Self-signed: integrity + key continuity, NOT identity.
+ */
+export declare function buildEvidenceBundle(input: EvidenceBundleInput, key: EvidenceKey): Record<string, unknown>;
+//# sourceMappingURL=evidence-bundle.d.ts.map

package/dist/sign/evidence-bundle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidence-bundle.d.ts","sourceRoot":"","sources":["../../src/sign/evidence-bundle.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAOL,KAAK,SAAS,EACf,MAAM,aAAa,CAAC;AAarB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,eAAO,MAAM,sBAAsB,+BAA+B,CAAC;AACnE,eAAO,MAAM,uBAAuB,IAAI,CAAC;AAEzC,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,gEAAgE;IAChE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,8CAA8C;IAC9C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,6EAA6E;IAC7E,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,oEAAoE;IACpE,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;CAC/B;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAE5E;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,8FAA8F;AAC9F,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,OAAO,GAAG,WAAW,CA6CnE;AAED,8EAA8E;AAC9E,wBAAgB,uBAAuB,CACrC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,WAAW,CAsCb;AAED,+FAA+F;AAC/F,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,GAAG,MAAM,CAGjF;AAED,iHAAiH;AACjH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAsB9E;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,6EAA6E;IAC7E,QAAQ,CAAC,YAAY,EAAE,SAAS,UAAU,EAAE,CAAC;IAC7C,QAAQ,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC;CAC9B;AAeD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,mBAAmB,EAC1B,GAAG,EAAE,WAAW,GACf,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA8CzB"}

package/dist/sign/evidence-bundle.js

@@ -0,0 +1,193 @@
+/**
+ * Signed evidence bundles (v1) — the OSS half of hosted verification.
+ * Self-signed by a locally generated ed25519 key: proves bundle integrity and
+ * continuity of a key, NOT identity. Identity binding is a hosted claim.
+ * node:crypto only — the package dependency list is locked.
+ */
+import { createHash, createPrivateKey, createPublicKey, generateKeyPairSync, sign, verify, } from "node:crypto";
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync, } from "node:fs";
+import { dirname, join } from "node:path";
+import { globalConfigDir } from "../config.js";
+import { assertNoSecrets } from "../dash/render.js";
+import { UsageError } from "../errors.js";
+import { canonicalJson } from "../hash.js";
+export const EVIDENCE_BUNDLE_FORMAT = "shield-kya-evidence-bundle";
+export const EVIDENCE_BUNDLE_VERSION = 1;
+export function evidenceKeyPath(env = process.env) {
+    return join(globalConfigDir(env), "keys", "evidence-ed25519.json");
+}
+export function fingerprintSpki(spkiDer) {
+    return createHash("sha256").update(spkiDer).digest("hex").slice(0, 16);
+}
+/** Rebuild an EvidenceKey from the on-disk JSON shape. Throws UsageError on corrupt input. */
+export function evidenceKeyFromSerialized(raw) {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+        throw new UsageError("evidence key file is not an object");
+    }
+    const rec = raw;
+    if (rec.version !== 1) {
+        throw new UsageError("evidence key file has an unsupported version");
+    }
+    if (typeof rec.privateKeyPkcs8 !== "string" ||
+        typeof rec.publicKeySpki !== "string") {
+        throw new UsageError("evidence key file is missing key material");
+    }
+    try {
+        const privateKey = createPrivateKey({
+            key: Buffer.from(rec.privateKeyPkcs8, "base64url"),
+            format: "der",
+            type: "pkcs8",
+        });
+        const publicKey = createPublicKey({
+            key: Buffer.from(rec.publicKeySpki, "base64url"),
+            format: "der",
+            type: "spki",
+        });
+        const spkiDer = Buffer.from(publicKey.export({ format: "der", type: "spki" }));
+        const derivedSpkiDer = Buffer.from(createPublicKey(privateKey).export({ format: "der", type: "spki" }));
+        if (!derivedSpkiDer.equals(spkiDer)) {
+            throw new Error("pub/private key mismatch");
+        }
+        return {
+            publicKey,
+            privateKey,
+            pubkeyB64u: spkiDer.toString("base64url"),
+            fingerprint: fingerprintSpki(spkiDer),
+            created: false,
+            regenerated: false,
+        };
+    }
+    catch {
+        throw new UsageError("evidence key file is corrupt — regenerating (old bundles stay verifiable only with the old pubkey)");
+    }
+}
+/** Load the evidence signing key, generating one (mode 0600) on first use. */
+export function loadOrCreateEvidenceKey(env = process.env) {
+    const path = evidenceKeyPath(env);
+    let existed = false;
+    if (existsSync(path)) {
+        existed = true;
+        try {
+            return evidenceKeyFromSerialized(JSON.parse(readFileSync(path, "utf8")));
+        }
+        catch {
+            /* corrupt or unreadable key file: regenerate below */
+        }
+    }
+    const { publicKey, privateKey } = generateKeyPairSync("ed25519");
+    const spkiDer = Buffer.from(publicKey.export({ format: "der", type: "spki" }));
+    const pkcs8Der = Buffer.from(privateKey.export({ format: "der", type: "pkcs8" }));
+    const doc = {
+        version: 1,
+        createdAt: new Date().toISOString(),
+        publicKeySpki: spkiDer.toString("base64url"),
+        privateKeyPkcs8: pkcs8Der.toString("base64url"),
+    };
+    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    writeFileSync(path, `${JSON.stringify(doc, null, 2)}\n`, {
+        encoding: "utf8",
+        mode: 0o600,
+    });
+    try {
+        chmodSync(path, 0o600);
+    }
+    catch {
+        /* best-effort on non-POSIX */
+    }
+    return {
+        publicKey,
+        privateKey,
+        pubkeyB64u: doc.publicKeySpki,
+        fingerprint: fingerprintSpki(spkiDer),
+        created: true,
+        regenerated: existed,
+    };
+}
+/** sig = base64url( ed25519_sign( canonicalJson(body) ) ) — canonicalJson from src/hash.ts. */
+export function signCanonicalPayload(body, privateKey) {
+    const payload = Buffer.from(canonicalJson(body), "utf8");
+    return sign(null, payload, privateKey).toString("base64url");
+}
+/** Verify `sig` over canonicalJson(bundle without the `sig` and `pubkey` fields) using the embedded `pubkey`. */
+export function verifyBundleSignature(bundle) {
+    const sig = bundle.sig;
+    const pubkey = bundle.pubkey;
+    if (typeof sig !== "string" || typeof pubkey !== "string")
+        return false;
+    const { sig: _omitSig, pubkey: _omitPubkey, ...body } = bundle;
+    void _omitSig;
+    void _omitPubkey;
+    try {
+        const key = createPublicKey({
+            key: Buffer.from(pubkey, "base64url"),
+            format: "der",
+            type: "spki",
+        });
+        return verify(null, Buffer.from(canonicalJson(body), "utf8"), key, Buffer.from(sig, "base64url"));
+    }
+    catch {
+        return false;
+    }
+}
+const MAX_BUNDLE_EVIDENCE_CHARS = 200;
+/**
+ * Clip to MAX code points (not UTF-16 units): a surrogate-splitting slice
+ * re-encodes differently in Java (`?`) than Node (U+FFFD) → cross-repo sig mismatch.
+ */
+function clipBundleEvidence(evidence) {
+    const chars = Array.from(evidence);
+    return chars.length > MAX_BUNDLE_EVIDENCE_CHARS
+        ? `${chars.slice(0, MAX_BUNDLE_EVIDENCE_CHARS - 1).join("")}…`
+        : evidence;
+}
+/**
+ * Build a signed evidence bundle v1 (hard cross-repo contract — see
+ * docs/certify.md). sig = base64url(ed25519_sign(canonicalJson(body))) where
+ * body is the bundle without the sig and pubkey fields (same stripping as
+ * verifyBundleSignature). Self-signed: integrity + key continuity, NOT identity.
+ */
+export function buildEvidenceBundle(input, key) {
+    const report = input.report;
+    const agent = input.agent && Object.values(input.agent).some((v) => v !== undefined)
+        ? Object.fromEntries(Object.entries(input.agent).filter(([, v]) => v !== undefined))
+        : undefined;
+    const body = {
+        format: EVIDENCE_BUNDLE_FORMAT,
+        version: EVIDENCE_BUNDLE_VERSION,
+        generatedAt: report.generatedAt,
+        ...(agent ? { agent } : {}),
+        catalog: { id: report.catalog.id, version: report.catalog.version },
+        window: {
+            days: report.window.days,
+            since: report.window.since,
+            until: report.window.until,
+        },
+        trail: {
+            eventCount: report.trail.eventCount,
+            digest: createHash("sha256")
+                .update(canonicalJson(input.windowEvents), "utf8")
+                .digest("hex"),
+            verdictMix: report.trail.verdictMix,
+            modes: report.trail.modes,
+        },
+        requirements: report.requirements.map((r) => ({
+            id: r.id,
+            domain: r.domain,
+            status: r.status,
+            evidence: clipBundleEvidence(r.evidence),
+            ...(r.attestation
+                ? { attestation: { text: r.attestation.text, at: r.attestation.at } }
+                : {}),
+        })),
+        overall: report.overall,
+    };
+    // egress-artifact defense-in-depth, same scan as report.json
+    const payload = canonicalJson(body);
+    assertNoSecrets(payload);
+    return {
+        ...body,
+        pubkey: key.pubkeyB64u,
+        sig: sign(null, Buffer.from(payload, "utf8"), key.privateKey).toString("base64url"),
+    };
+}
+//# sourceMappingURL=evidence-bundle.js.map

package/dist/sign/evidence-bundle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidence-bundle.js","sourceRoot":"","sources":["../../src/sign/evidence-bundle.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,IAAI,EACJ,MAAM,GAEP,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,SAAS,EACT,UAAU,EACV,SAAS,EACT,YAAY,EACZ,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAI3C,MAAM,CAAC,MAAM,sBAAsB,GAAG,4BAA4B,CAAC;AACnE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC;AAsBzC,MAAM,UAAU,eAAe,CAAC,MAAyB,OAAO,CAAC,GAAG;IAClE,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,uBAAuB,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACzE,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,yBAAyB,CAAC,GAAY;IACpD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,UAAU,CAAC,oCAAoC,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,GAAG,GAAG,GAA8B,CAAC;IAC3C,IAAI,GAAG,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,UAAU,CAAC,8CAA8C,CAAC,CAAC;IACvE,CAAC;IACD,IACE,OAAO,GAAG,CAAC,eAAe,KAAK,QAAQ;QACvC,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ,EACrC,CAAC;QACD,MAAM,IAAI,UAAU,CAAC,2CAA2C,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,gBAAgB,CAAC;YAClC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,WAAW,CAAC;YAClD,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,OAAO;SACd,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,eAAe,CAAC;YAChC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,WAAW,CAAC;YAChD,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,MAAM;SACb,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QAC/E,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAChC,eAAe,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CACpE,CAAC;QACF,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO;YACL,SAAS;YACT,UAAU;YACV,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;YACzC,WAAW,EAAE,eAAe,CAAC,OAAO,CAAC;YACrC,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,KAAK;SACnB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,UAAU,CAClB,oGAAoG,CACrG,CAAC;IACJ,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,uBAAuB,CACrC,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,OAAO,GAAG,IAAI,CAAC;QACf,IAAI,CAAC;YACH,OAAO,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QAC3E,CAAC;QAAC,MAAM,CAAC;YACP,sDAAsD;QACxD,CAAC;IACH,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAC/E,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAClF,MAAM,GAAG,GAA0B;QACjC,OAAO,EAAE,CAAC;QACV,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,aAAa,EAAE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC5C,eAAe,EAAE,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC;KAChD,CAAC;IACF,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,aAAa,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QACvD,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;IACH,IAAI,CAAC;QACH,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,8BAA8B;IAChC,CAAC;IACD,OAAO;QACL,SAAS;QACT,UAAU;QACV,UAAU,EAAE,GAAG,CAAC,aAAa;QAC7B,WAAW,EAAE,eAAe,CAAC,OAAO,CAAC;QACrC,OAAO,EAAE,IAAI;QACb,WAAW,EAAE,OAAO;KACrB,CAAC;AACJ,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,oBAAoB,CAAC,IAAa,EAAE,UAAqB;IACvE,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;IACzD,OAAO,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/D,CAAC;AAED,iHAAiH;AACjH,MAAM,UAAU,qBAAqB,CAAC,MAA+B;IACnE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;IACvB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACxE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;IAC/D,KAAK,QAAQ,CAAC;IACd,KAAK,WAAW,CAAC;IACjB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,eAAe,CAAC;YAC1B,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC;YACrC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,MAAM;SACb,CAAC,CAAC;QACH,OAAO,MAAM,CACX,IAAI,EACJ,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,EACxC,GAAG,EACH,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAC9B,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAgBD,MAAM,yBAAyB,GAAG,GAAG,CAAC;AAEtC;;;GAGG;AACH,SAAS,kBAAkB,CAAC,QAAgB;IAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnC,OAAO,KAAK,CAAC,MAAM,GAAG,yBAAyB;QAC7C,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,yBAAyB,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG;QAC9D,CAAC,CAAC,QAAQ,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAA0B,EAC1B,GAAgB;IAEhB,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC5B,MAAM,KAAK,GACT,KAAK,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC;QACpE,CAAC,CAAC,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAC/D;QACH,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,IAAI,GAA4B;QACpC,MAAM,EAAE,sBAAsB;QAC9B,OAAO,EAAE,uBAAuB;QAChC,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE;QACnE,MAAM,EAAE;YACN,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI;YACxB,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK;YAC1B,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK;SAC3B;QACD,KAAK,EAAE;YACL,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU;YACnC,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC;iBACzB,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;iBACjD,MAAM,CAAC,KAAK,CAAC;YAChB,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU;YACnC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK;SAC1B;QACD,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5C,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,QAAQ,EAAE,kBAAkB,CAAC,CAAC,CAAC,QAAQ,CAAC;YACxC,GAAG,CAAC,CAAC,CAAC,WAAW;gBACf,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE;gBACrE,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;QACH,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC;IACF,6DAA6D;IAC7D,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACpC,eAAe,CAAC,OAAO,CAAC,CAAC;IACzB,OAAO;QACL,GAAG,IAAI;QACP,MAAM,EAAE,GAAG,CAAC,UAAU;QACtB,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;KACpF,CAAC;AACJ,CAAC"}

package/droid/README.md

@@ -1,6 +1,6 @@
 # Droid (Factory) + Shield KYA
 
-Preferred path is Droid's own CLI: `droid mcp add shield-kya "npx --no-install @shield-agent/kya@0.5.0 serve-mcp --stdio" --env KYA_BASE_URL=https://shield-agent.com --env KYA_API_KEY=$KYA_API_KEY --env KYA_HOST=ide`.
+Preferred path is Droid's own CLI: `droid mcp add shield-kya "npx --no-install @shield-agent/kya@0.6.0 serve-mcp --stdio" --env KYA_BASE_URL=https://shield-agent.com --env KYA_API_KEY=$KYA_API_KEY --env KYA_HOST=ide`.
 
 `mcp.example.json` shows the expected on-disk shape (`~/.factory/mcp.json`) — **schema not yet verified against a live Droid install**; treat as a starting point and prefer `droid mcp add`.
 

package/droid/mcp.example.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "shield-kya": {
       "command": "npx",
-      "args": ["--no-install", "@shield-agent/kya@0.5.0", "serve-mcp", "--stdio"],
+      "args": ["--no-install", "@shield-agent/kya@0.6.0", "serve-mcp", "--stdio"],
       "env": {
         "KYA_BASE_URL": "https://shield-agent.com",
         "KYA_API_KEY": "${KYA_API_KEY}",

package/gemini/settings.example.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "shield-kya": {
       "command": "npx",
-      "args": ["--no-install", "@shield-agent/kya@0.5.0", "serve-mcp", "--stdio"],
+      "args": ["--no-install", "@shield-agent/kya@0.6.0", "serve-mcp", "--stdio"],
       "env": {
         "KYA_BASE_URL": "https://shield-agent.com",
         "KYA_API_KEY": "${KYA_API_KEY}",

package/grok/README.md

@@ -40,7 +40,7 @@ chat = client.chat.create(
 There is no grok.com stdio path. For a local agent host use the same stdio launch as Claude:
 
 ```bash
-npx --no-install @shield-agent/kya@0.5.0 serve-mcp --stdio
+npx --no-install @shield-agent/kya@0.6.0 serve-mcp --stdio
 ```
 
 Env: `KYA_BASE_URL`, `KYA_API_KEY`, `KYA_HOST`. Codex and Gemini example configs in this package show the full snippets.

package/kilo/kilo.example.json

@@ -2,7 +2,7 @@
   "mcp": {
     "shield-kya": {
       "type": "local",
-      "command": ["npx", "--no-install", "@shield-agent/kya@0.5.0", "serve-mcp", "--stdio"],
+      "command": ["npx", "--no-install", "@shield-agent/kya@0.6.0", "serve-mcp", "--stdio"],
       "enabled": true,
       "environment": {
         "KYA_BASE_URL": "https://shield-agent.com",

package/kimi/mcp.example.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "shield-kya": {
       "command": "npx",
-      "args": ["--no-install", "@shield-agent/kya@0.5.0", "serve-mcp", "--stdio"],
+      "args": ["--no-install", "@shield-agent/kya@0.6.0", "serve-mcp", "--stdio"],
       "env": {
         "KYA_BASE_URL": "https://shield-agent.com",
         "KYA_API_KEY": "${KYA_API_KEY}",

package/kiro/mcp.example.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "shield-kya": {
       "command": "npx",
-      "args": ["--no-install", "@shield-agent/kya@0.5.0", "serve-mcp", "--stdio"],
+      "args": ["--no-install", "@shield-agent/kya@0.6.0", "serve-mcp", "--stdio"],
       "env": {
         "KYA_BASE_URL": "https://shield-agent.com",
         "KYA_API_KEY": "${KYA_API_KEY}",

package/manifest.json

@@ -2,7 +2,7 @@
   "manifest_version": "0.3",
   "name": "shield-kya",
   "display_name": "Shield KYA",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "Know Your Agent MCP gate: ALLOW / DENY / REQUIRE_APPROVE. Sole PEP is Shield.",
   "long_description": "Local Claude Desktop extension that runs the packaged `dist/cli.js serve-mcp --stdio` against your Shield control plane (local or https://shield-agent.com). Tools evaluate policy, ingest session risk, and open Hold tickets. They never execute irreversible side effects.",
   "author": {

package/mastracode/mcp.example.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "shield-kya": {
       "command": "npx",
-      "args": ["--no-install", "@shield-agent/kya@0.5.0", "serve-mcp", "--stdio"],
+      "args": ["--no-install", "@shield-agent/kya@0.6.0", "serve-mcp", "--stdio"],
       "env": {
         "KYA_BASE_URL": "https://shield-agent.com",
         "KYA_API_KEY": "${KYA_API_KEY}",

package/mcp.json

@@ -3,7 +3,7 @@
     "shield-kya": {
       "description": "Know Your Agent local MCP gate: wrap-before-write, named-agent registry, Hold/Clear.",
       "command": "npx",
-      "args": ["--no-install", "@shield-agent/kya@0.5.0", "serve-mcp", "--stdio"],
+      "args": ["--no-install", "@shield-agent/kya@0.6.0", "serve-mcp", "--stdio"],
       "env": {
         "KYA_BASE_URL": "${KYA_BASE_URL}",
         "KYA_API_KEY": "${KYA_API_KEY}",

package/openai/codex.config.example.toml

@@ -11,7 +11,7 @@
 # --- Local stdio (OSS) ---
 [mcp_servers.shield-kya]
 command = "npx"
-args = ["--no-install", "@shield-agent/kya@0.5.0", "serve-mcp", "--stdio"]
+args = ["--no-install", "@shield-agent/kya@0.6.0", "serve-mcp", "--stdio"]
 startup_timeout_sec = 20
 env_vars = ["KYA_BASE_URL", "KYA_API_KEY", "KYA_HOST", "KYA_AGENT_ID"]
 

package/opencode/opencode.example.json

@@ -2,7 +2,7 @@
   "mcp": {
     "shield-kya": {
       "type": "local",
-      "command": ["npx", "--no-install", "@shield-agent/kya@0.5.0", "serve-mcp", "--stdio"],
+      "command": ["npx", "--no-install", "@shield-agent/kya@0.6.0", "serve-mcp", "--stdio"],
       "enabled": true,
       "environment": {
         "KYA_BASE_URL": "https://shield-agent.com",