@attested-intelligence/aga-mcp-server 0.1.0

package/dist/crypto/merkle.js

@@ -0,0 +1,42 @@
+import { sha256Str } from './hash.js';
+function pair(l, r) { return sha256Str(l + r); }
+export function buildMerkleTree(leaves) {
+    if (!leaves.length)
+        throw new Error('Empty leaf set');
+    if (leaves.length === 1)
+        return { root: leaves[0], layers: [leaves] };
+    const layers = [[...leaves]];
+    let cur = leaves;
+    while (cur.length > 1) {
+        const next = [];
+        for (let i = 0; i < cur.length; i += 2) {
+            next.push(pair(cur[i], i + 1 < cur.length ? cur[i + 1] : cur[i]));
+        }
+        layers.push(next);
+        cur = next;
+    }
+    return { root: cur[0], layers };
+}
+export function inclusionProof(leaves, idx) {
+    if (idx < 0 || idx >= leaves.length)
+        throw new RangeError(`Index ${idx} out of [0,${leaves.length})`);
+    const { root, layers } = buildMerkleTree(leaves);
+    const siblings = [];
+    let ci = idx;
+    for (let L = 0; L < layers.length - 1; L++) {
+        const layer = layers[L];
+        const isRight = ci % 2 === 1;
+        const si = isRight ? ci - 1 : (ci + 1 < layer.length ? ci + 1 : ci);
+        siblings.push({ hash: layer[si], position: isRight ? 'left' : 'right' });
+        ci = Math.floor(ci / 2);
+    }
+    return { leafHash: leaves[idx], leafIndex: idx, siblings, root };
+}
+export function verifyProof(proof) {
+    let h = proof.leafHash;
+    for (const s of proof.siblings) {
+        h = s.position === 'left' ? pair(s.hash, h) : pair(h, s.hash);
+    }
+    return h === proof.root;
+}
+//# sourceMappingURL=merkle.js.map

package/dist/crypto/merkle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"merkle.js","sourceRoot":"","sources":["../../src/crypto/merkle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAGtC,SAAS,IAAI,CAAC,CAAU,EAAE,CAAU,IAAa,OAAO,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAE3E,MAAM,UAAU,eAAe,CAAC,MAAiB;IAC/C,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACtD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;IACtE,MAAM,MAAM,GAAgB,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC;IAC1C,IAAI,GAAG,GAAG,MAAM,CAAC;IACjB,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,GAAc,EAAE,CAAC;QAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClB,GAAG,GAAG,IAAI,CAAC;IACb,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAiB,EAAE,GAAW;IAC3D,IAAI,GAAG,GAAG,CAAC,IAAI,GAAG,IAAI,MAAM,CAAC,MAAM;QAAE,MAAM,IAAI,UAAU,CAAC,SAAS,GAAG,cAAc,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;IACtG,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAqC,EAAE,CAAC;IACtD,IAAI,EAAE,GAAG,GAAG,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACxB,MAAM,OAAO,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QAC7B,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACpE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACzE,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAA2B;IACrD,IAAI,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC;IACvB,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC/B,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC;AAC1B,CAAC"}

package/dist/crypto/salt.d.ts

@@ -0,0 +1,5 @@
+import type { SaltHex, SaltedCommitment, HashHex } from './types.js';
+export declare function generateSalt(): SaltHex;
+export declare function saltedCommitment(content: Uint8Array | string, salt?: SaltHex): SaltedCommitment;
+export declare function verifySaltedCommitment(content: Uint8Array | string, salt: SaltHex, expected: HashHex): boolean;
+//# sourceMappingURL=salt.d.ts.map

package/dist/crypto/salt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"salt.d.ts","sourceRoot":"","sources":["../../src/crypto/salt.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAIrE,wBAAgB,YAAY,IAAI,OAAO,CAAwC;AAE/E,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,UAAU,GAAG,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,gBAAgB,CAI/F;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,UAAU,GAAG,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,GAAG,OAAO,CAE9G"}

package/dist/crypto/salt.js

@@ -0,0 +1,14 @@
+import { randomBytes } from 'node:crypto';
+import { bytesToHex } from '@noble/hashes/utils';
+import { sha256Cat } from './hash.js';
+const enc = new TextEncoder();
+export function generateSalt() { return bytesToHex(randomBytes(16)); }
+export function saltedCommitment(content, salt) {
+    const s = salt ?? generateSalt();
+    const c = typeof content === 'string' ? enc.encode(content) : content;
+    return { commitment: sha256Cat(c, s), salt: s };
+}
+export function verifySaltedCommitment(content, salt, expected) {
+    return saltedCommitment(content, salt).commitment === expected;
+}
+//# sourceMappingURL=salt.js.map

package/dist/crypto/salt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"salt.js","sourceRoot":"","sources":["../../src/crypto/salt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAGtC,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;AAE9B,MAAM,UAAU,YAAY,KAAc,OAAO,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAE/E,MAAM,UAAU,gBAAgB,CAAC,OAA4B,EAAE,IAAc;IAC3E,MAAM,CAAC,GAAG,IAAI,IAAI,YAAY,EAAE,CAAC;IACjC,MAAM,CAAC,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IACtE,OAAO,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAA4B,EAAE,IAAa,EAAE,QAAiB;IACnG,OAAO,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,UAAU,KAAK,QAAQ,CAAC;AACjE,CAAC"}

package/dist/crypto/sign.d.ts

@@ -0,0 +1,11 @@
+import type { KeyPair, Signature, SignatureBase64 } from './types.js';
+export declare function generateKeyPair(): KeyPair;
+export declare function sign(msg: Uint8Array, sk: Uint8Array): Signature;
+export declare function signStr(msg: string, sk: Uint8Array): Signature;
+export declare function verify(sig: Signature, msg: Uint8Array, pk: Uint8Array): boolean;
+export declare function verifyStr(sig: Signature, msg: string, pk: Uint8Array): boolean;
+export declare const sigToB64: (s: Signature) => SignatureBase64;
+export declare const b64ToSig: (b: SignatureBase64) => Signature;
+export declare const pkToHex: (pk: Uint8Array) => string;
+export declare const hexToPk: (h: string) => Uint8Array;
+//# sourceMappingURL=sign.d.ts.map

package/dist/crypto/sign.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign.d.ts","sourceRoot":"","sources":["../../src/crypto/sign.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAatE,wBAAgB,eAAe,IAAI,OAAO,CAGzC;AAED,wBAAgB,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE,UAAU,GAAG,SAAS,CAA6B;AAC7F,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,GAAG,SAAS,CAAsC;AAErG,wBAAgB,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE,UAAU,GAAG,OAAO,CAE/E;AACD,wBAAgB,SAAS,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,GAAG,OAAO,CAE9E;AAED,eAAO,MAAM,QAAQ,GAAI,GAAG,SAAS,KAAG,eAAoD,CAAC;AAC7F,eAAO,MAAM,QAAQ,GAAI,GAAG,eAAe,KAAG,SAAqD,CAAC;AACpG,eAAO,MAAM,OAAO,GAAI,IAAI,UAAU,KAAG,MAAwB,CAAC;AAClE,eAAO,MAAM,OAAO,GAAI,GAAG,MAAM,KAAG,UAA2B,CAAC"}

package/dist/crypto/sign.js

@@ -0,0 +1,37 @@
+import * as ed from '@noble/ed25519';
+import { sha512 } from '@noble/hashes/sha512';
+import { bytesToHex, hexToBytes } from '@noble/hashes/utils';
+// Set sha512 sync ONCE at module load
+ed.etc.sha512Sync = (...m) => {
+    const total = m.reduce((n, a) => n + a.length, 0);
+    const buf = new Uint8Array(total);
+    let off = 0;
+    for (const a of m) {
+        buf.set(a, off);
+        off += a.length;
+    }
+    return sha512(buf);
+};
+const enc = new TextEncoder();
+export function generateKeyPair() {
+    const secretKey = ed.utils.randomPrivateKey();
+    return { publicKey: ed.getPublicKey(secretKey), secretKey };
+}
+export function sign(msg, sk) { return ed.sign(msg, sk); }
+export function signStr(msg, sk) { return sign(enc.encode(msg), sk); }
+export function verify(sig, msg, pk) {
+    try {
+        return ed.verify(sig, msg, pk);
+    }
+    catch {
+        return false;
+    }
+}
+export function verifyStr(sig, msg, pk) {
+    return verify(sig, enc.encode(msg), pk);
+}
+export const sigToB64 = (s) => Buffer.from(s).toString('base64');
+export const b64ToSig = (b) => new Uint8Array(Buffer.from(b, 'base64'));
+export const pkToHex = (pk) => bytesToHex(pk);
+export const hexToPk = (h) => hexToBytes(h);
+//# sourceMappingURL=sign.js.map

package/dist/crypto/sign.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign.js","sourceRoot":"","sources":["../../src/crypto/sign.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,gBAAgB,CAAC;AACrC,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAG7D,sCAAsC;AACtC,EAAE,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC,GAAG,CAAe,EAAE,EAAE;IACzC,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAClD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAAC,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC;IAAC,CAAC;IACxD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;AACrB,CAAC,CAAC;AAEF,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;AAE9B,MAAM,UAAU,eAAe;IAC7B,MAAM,SAAS,GAAG,EAAE,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC;IAC9C,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,GAAe,EAAE,EAAc,IAAe,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;AAC7F,MAAM,UAAU,OAAO,CAAC,GAAW,EAAE,EAAc,IAAe,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;AAErG,MAAM,UAAU,MAAM,CAAC,GAAc,EAAE,GAAe,EAAE,EAAc;IACpE,IAAI,CAAC;QAAC,OAAO,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;AACjE,CAAC;AACD,MAAM,UAAU,SAAS,CAAC,GAAc,EAAE,GAAW,EAAE,EAAc;IACnE,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAY,EAAmB,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC7F,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAkB,EAAa,EAAE,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;AACpG,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,EAAc,EAAU,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;AAClE,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAS,EAAc,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC"}

package/dist/crypto/types.d.ts

@@ -0,0 +1,24 @@
+export type PublicKey = Uint8Array;
+export type SecretKey = Uint8Array;
+export interface KeyPair {
+    publicKey: PublicKey;
+    secretKey: SecretKey;
+}
+export type Signature = Uint8Array;
+export type HashHex = string;
+export type SignatureBase64 = string;
+export type SaltHex = string;
+export interface SaltedCommitment {
+    commitment: HashHex;
+    salt: SaltHex;
+}
+export interface MerkleInclusionProof {
+    leafHash: HashHex;
+    leafIndex: number;
+    siblings: Array<{
+        hash: HashHex;
+        position: 'left' | 'right';
+    }>;
+    root: HashHex;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/crypto/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/crypto/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,SAAS,GAAG,UAAU,CAAC;AACnC,MAAM,MAAM,SAAS,GAAG,UAAU,CAAC;AACnC,MAAM,WAAW,OAAO;IAAG,SAAS,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,SAAS,CAAC;CAAE;AACxE,MAAM,MAAM,SAAS,GAAG,UAAU,CAAC;AACnC,MAAM,MAAM,OAAO,GAAG,MAAM,CAAC;AAC7B,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC;AACrC,MAAM,MAAM,OAAO,GAAG,MAAM,CAAC;AAE7B,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,OAAO,CAAC;IACpB,IAAI,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC,CAAC;IAC/D,IAAI,EAAE,OAAO,CAAC;CACf"}

package/dist/crypto/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/crypto/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/crypto/types.ts"],"names":[],"mappings":""}

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":""}

package/dist/index.js

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { createAGAServer } from './server.js';
+async function main() {
+    const server = await createAGAServer();
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+    console.error('AGA MCP Server running on stdio');
+}
+main().catch(e => { console.error('Fatal:', e); process.exit(1); });
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAG,MAAM,eAAe,EAAE,CAAC;IACvC,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,OAAO,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;AACnD,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC"}

package/dist/middleware/governance.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Governance Middleware — wraps every MCP tool handler.
+ *
+ * NCCoE filing Section 4: "The portal operates as a Policy Enforcement Point (PEP)...
+ * Every tool invocation, API call, actuator command, and data access passes through
+ * the portal, which evaluates it against the sealed artifact's enforcement parameters."
+ *
+ * Behavior:
+ * - TERMINATED state → reject all governed tools
+ * - PHANTOM_QUARANTINE → capture tool call as forensic input, reject
+ * - ACTIVE_MONITORING → allow, log to chain
+ * - Ungoverned tools (get_server_info, get_portal_state, list_claims) → always allow
+ */
+import type { Portal } from '../core/portal.js';
+import type { QuarantineState } from '../core/types.js';
+import type { BehavioralMonitor } from '../core/behavioral.js';
+export type ToolResult = {
+    content: Array<{
+        type: 'text';
+        text: string;
+    }>;
+};
+export type ToolHandler<T = any> = (args: T) => Promise<ToolResult>;
+export declare function createGovernanceWrapper(portal: Portal, quarantine: {
+    current: QuarantineState | null;
+}, toolName: string, behavioralMonitor?: BehavioralMonitor): <T>(handler: ToolHandler<T>) => ToolHandler<T>;
+//# sourceMappingURL=governance.d.ts.map

package/dist/middleware/governance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"governance.d.ts","sourceRoot":"","sources":["../../src/middleware/governance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAExD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAI/D,MAAM,MAAM,UAAU,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,CAAC;AAC5E,MAAM,MAAM,WAAW,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;AAapE,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,EACd,UAAU,EAAE;IAAE,OAAO,EAAE,eAAe,GAAG,IAAI,CAAA;CAAE,EAC/C,QAAQ,EAAE,MAAM,EAChB,iBAAiB,CAAC,EAAE,iBAAiB,IAIT,CAAC,EAAE,SAAS,WAAW,CAAC,CAAC,CAAC,KAAG,WAAW,CAAC,CAAC,CAAC,CAoDxE"}

package/dist/middleware/governance.js

@@ -0,0 +1,65 @@
+import { captureInput } from '../core/quarantine.js';
+import { sha256Str } from '../crypto/hash.js';
+import { canonicalize } from '../utils/canonical.js';
+const UNGOVERNED_TOOLS = new Set([
+    'get_server_info',
+    'get_portal_state',
+    'get_receipts',
+    'get_chain_events',
+    'list_claims',
+    'init_chain', // must work before attestation
+    'attest_subject', // creates the governance relationship
+    'verify_chain', // read-only verification
+]);
+export function createGovernanceWrapper(portal, quarantine, toolName, behavioralMonitor) {
+    const isGoverned = !UNGOVERNED_TOOLS.has(toolName);
+    return function wrapHandler(handler) {
+        if (!isGoverned)
+            return handler;
+        return async (args) => {
+            const j = (x) => ({
+                content: [{ type: 'text', text: JSON.stringify(x, null, 2) }]
+            });
+            // TERMINATED → reject everything
+            if (portal.state === 'TERMINATED') {
+                return j({
+                    success: false,
+                    error: 'GOVERNANCE_BLOCKED: Portal is terminated. Agent governance has been revoked. Re-attestation required.',
+                    portal_state: portal.state,
+                    tool: toolName,
+                });
+            }
+            // PHANTOM_QUARANTINE → capture as forensic input, reject
+            if (portal.state === 'PHANTOM_QUARANTINE' && quarantine.current?.active) {
+                captureInput(quarantine.current, `tool_call:${toolName}`, {
+                    tool: toolName,
+                    args,
+                    timestamp: new Date().toISOString(),
+                });
+                return j({
+                    success: false,
+                    error: 'GOVERNANCE_QUARANTINED: Agent is in phantom quarantine. All outputs are severed. Inputs are being captured for forensic analysis.',
+                    portal_state: portal.state,
+                    tool: toolName,
+                    forensic_capture: true,
+                });
+            }
+            // INITIALIZATION or ARTIFACT_VERIFICATION → not yet governed
+            if (portal.state === 'INITIALIZATION' || portal.state === 'ARTIFACT_VERIFICATION') {
+                return j({
+                    success: false,
+                    error: 'GOVERNANCE_NOT_READY: No active policy artifact. Call attest_subject first.',
+                    portal_state: portal.state,
+                    tool: toolName,
+                });
+            }
+            // ACTIVE_MONITORING or DRIFT_DETECTED → record + allow through
+            if (behavioralMonitor) {
+                const argsHash = sha256Str(canonicalize(args));
+                behavioralMonitor.recordInvocation(toolName, argsHash);
+            }
+            return handler(args);
+        };
+    };
+}
+//# sourceMappingURL=governance.js.map

package/dist/middleware/governance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"governance.js","sourceRoot":"","sources":["../../src/middleware/governance.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAErD,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAKrD,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,iBAAiB;IACjB,kBAAkB;IAClB,cAAc;IACd,kBAAkB;IAClB,aAAa;IACb,YAAY,EAAS,+BAA+B;IACpD,gBAAgB,EAAK,sCAAsC;IAC3D,cAAc,EAAO,yBAAyB;CAC/C,CAAC,CAAC;AAEH,MAAM,UAAU,uBAAuB,CACrC,MAAc,EACd,UAA+C,EAC/C,QAAgB,EAChB,iBAAqC;IAErC,MAAM,UAAU,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAEnD,OAAO,SAAS,WAAW,CAAI,OAAuB;QACpD,IAAI,CAAC,UAAU;YAAE,OAAO,OAAO,CAAC;QAEhC,OAAO,KAAK,EAAE,IAAO,EAAuB,EAAE;YAC5C,MAAM,CAAC,GAAG,CAAC,CAAU,EAAc,EAAE,CAAC,CAAC;gBACrC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;aAC9D,CAAC,CAAC;YAEH,iCAAiC;YACjC,IAAI,MAAM,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;gBAClC,OAAO,CAAC,CAAC;oBACP,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,uGAAuG;oBAC9G,YAAY,EAAE,MAAM,CAAC,KAAK;oBAC1B,IAAI,EAAE,QAAQ;iBACf,CAAC,CAAC;YACL,CAAC;YAED,yDAAyD;YACzD,IAAI,MAAM,CAAC,KAAK,KAAK,oBAAoB,IAAI,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;gBACxE,YAAY,CAAC,UAAU,CAAC,OAAO,EAAE,aAAa,QAAQ,EAAE,EAAE;oBACxD,IAAI,EAAE,QAAQ;oBACd,IAAI;oBACJ,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;iBACpC,CAAC,CAAC;gBACH,OAAO,CAAC,CAAC;oBACP,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,mIAAmI;oBAC1I,YAAY,EAAE,MAAM,CAAC,KAAK;oBAC1B,IAAI,EAAE,QAAQ;oBACd,gBAAgB,EAAE,IAAI;iBACvB,CAAC,CAAC;YACL,CAAC;YAED,6DAA6D;YAC7D,IAAI,MAAM,CAAC,KAAK,KAAK,gBAAgB,IAAI,MAAM,CAAC,KAAK,KAAK,uBAAuB,EAAE,CAAC;gBAClF,OAAO,CAAC,CAAC;oBACP,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,6EAA6E;oBACpF,YAAY,EAAE,MAAM,CAAC,KAAK;oBAC1B,IAAI,EAAE,QAAQ;iBACf,CAAC,CAAC;YACL,CAAC;YAED,+DAA+D;YAC/D,IAAI,iBAAiB,EAAE,CAAC;gBACtB,MAAM,QAAQ,GAAG,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC/C,iBAAiB,CAAC,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YACzD,CAAC;YACD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/index.d.ts

@@ -0,0 +1,2 @@
+export * from './governance.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/middleware/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/middleware/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC"}

package/dist/middleware/index.js

@@ -0,0 +1,2 @@
+export * from './governance.js';
+//# sourceMappingURL=index.js.map

package/dist/middleware/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/middleware/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC"}

package/dist/server.d.ts

@@ -0,0 +1,13 @@
+/**
+ * AGA MCP Server. The Portal (ref 150) as an MCP service.
+ *
+ * V3 NIST-aligned behaviors:
+ * 1. Every measurement generates a receipt (match OR mismatch)
+ * 2. TTL checked on every measurement (fail-closed)
+ * 3. Mid-session revocation via revoke_artifact tool
+ * 4. Governance middleware: portal state checked before tool execution
+ * 5. Auto-chaining: every operation writes to continuity chain
+ */
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+export declare function createAGAServer(): Promise<McpServer>;
+//# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAiDpE,wBAAsB,eAAe,IAAI,OAAO,CAAC,SAAS,CAAC,CAwX1D"}