@attested-intelligence/aga-mcp-server 0.1.1 → 2.0.1

package/dist/crypto/hash.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hash.d.ts","sourceRoot":"","sources":["../../src/crypto/hash.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAI1C,wBAAgB,WAAW,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAErD;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE/C;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAEpD;AAED,wFAAwF;AACxF,wBAAgB,SAAS,CAAC,GAAG,KAAK,EAAE,CAAC,UAAU,GAAG,MAAM,CAAC,EAAE,GAAG,OAAO,CAOpE;AAED,yFAAyF;AACzF,wBAAgB,YAAY,CAAC,GAAG,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAExD"}
+{"version":3,"file":"hash.d.ts","sourceRoot":"","sources":["../../src/crypto/hash.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAI1C,wBAAgB,WAAW,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAErD;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE/C;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAEpD;AAED,sFAAsF;AACtF,wBAAgB,SAAS,CAAC,GAAG,KAAK,EAAE,CAAC,UAAU,GAAG,MAAM,CAAC,EAAE,GAAG,OAAO,CAOpE;AAED,yFAAyF;AACzF,wBAAgB,YAAY,CAAC,GAAG,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAExD"}

package/dist/crypto/hash.js

@@ -11,7 +11,7 @@ export function sha256Str(data) {
 export function blake2b256(data) {
     return bytesToHex(blake2b(data, { dkLen: 32 }));
 }
-/** Concatenate inputs (NO delimiter) and SHA-256. Patent Section D: "no delimiters." */
+/** Concatenate inputs (NO delimiter) and SHA-256. No delimiters per protocol spec. */
 export function sha256Cat(...parts) {
     const bufs = parts.map(p => typeof p === 'string' ? enc.encode(p) : p);
     const total = bufs.reduce((n, b) => n + b.length, 0);

package/dist/crypto/hash.js.map

@@ -1 +1 @@
-{"version":3,"file":"hash.js","sourceRoot":"","sources":["../../src/crypto/hash.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAGjD,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;AAE9B,MAAM,UAAU,WAAW,CAAC,IAAgB;IAC1C,OAAO,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,OAAO,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAgB;IACzC,OAAO,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,SAAS,CAAC,GAAG,KAA8B;IACzD,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvE,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAAC,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC;IAAC,CAAC;IAChE,OAAO,WAAW,CAAC,QAAQ,CAAC,CAAC;AAC/B,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,YAAY,CAAC,GAAG,KAAe;IAC7C,OAAO,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;AACnC,CAAC"}
+{"version":3,"file":"hash.js","sourceRoot":"","sources":["../../src/crypto/hash.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAGjD,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;AAE9B,MAAM,UAAU,WAAW,CAAC,IAAgB;IAC1C,OAAO,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,OAAO,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAgB;IACzC,OAAO,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,SAAS,CAAC,GAAG,KAA8B;IACzD,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvE,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAAC,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC;IAAC,CAAC;IAChE,OAAO,WAAW,CAAC,QAAQ,CAAC,CAAC;AAC/B,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,YAAY,CAAC,GAAG,KAAe;IAC7C,OAAO,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;AACnC,CAAC"}

package/dist/crypto/index.d.ts

@@ -1,6 +1,7 @@
-export * from './types.js';
-export * from './hash.js';
-export * from './sign.js';
-export * from './salt.js';
-export * from './merkle.js';
+export { sha256Bytes, sha256Str, blake2b256, sha256Cat, sha256HexCat } from './hash.js';
+export { generateKeyPair, sign, signStr, verify, verifyStr, sigToB64, b64ToSig, pkToHex, hexToPk } from './sign.js';
+export { generateSalt, saltedCommitment, verifySaltedCommitment } from './salt.js';
+export { buildMerkleTree, inclusionProof, verifyProof } from './merkle.js';
+export { canonicalize, deepSortKeys } from './canonicalize.js';
+export { keyFingerprint, isKeyValid, rotateKeyPair } from './keys.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/crypto/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/crypto/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B,cAAc,WAAW,CAAC;AAC1B,cAAc,WAAW,CAAC;AAC1B,cAAc,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/crypto/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACxF,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpH,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AACnF,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC"}

package/dist/crypto/index.js

@@ -1,6 +1,7 @@
-export * from './types.js';
-export * from './hash.js';
-export * from './sign.js';
-export * from './salt.js';
-export * from './merkle.js';
+export { sha256Bytes, sha256Str, blake2b256, sha256Cat, sha256HexCat } from './hash.js';
+export { generateKeyPair, sign, signStr, verify, verifyStr, sigToB64, b64ToSig, pkToHex, hexToPk } from './sign.js';
+export { generateSalt, saltedCommitment, verifySaltedCommitment } from './salt.js';
+export { buildMerkleTree, inclusionProof, verifyProof } from './merkle.js';
+export { canonicalize, deepSortKeys } from './canonicalize.js';
+export { keyFingerprint, isKeyValid, rotateKeyPair } from './keys.js';
 //# sourceMappingURL=index.js.map

package/dist/crypto/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/crypto/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B,cAAc,WAAW,CAAC;AAC1B,cAAc,WAAW,CAAC;AAC1B,cAAc,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/crypto/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACxF,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpH,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AACnF,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC"}

package/dist/crypto/keys.d.ts

@@ -0,0 +1,10 @@
+import { pkToHex, hexToPk } from './sign.js';
+import type { KeyPair } from '../types.js';
+/** SHA-256 fingerprint of a public key (first 16 hex chars). */
+export declare function keyFingerprint(pk: Uint8Array): string;
+/** Check if a hex-encoded public key is valid (64 hex chars for Ed25519). */
+export declare function isKeyValid(hexKey: string): boolean;
+/** Rotate a keypair - returns new keypair. Old keypair should be revoked. */
+export declare function rotateKeyPair(): KeyPair;
+export { pkToHex, hexToPk };
+//# sourceMappingURL=keys.d.ts.map

package/dist/crypto/keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../src/crypto/keys.ts"],"names":[],"mappings":"AAIA,OAAO,EAAmB,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC9D,OAAO,KAAK,EAAE,OAAO,EAAW,MAAM,aAAa,CAAC;AAEpD,gEAAgE;AAChE,wBAAgB,cAAc,CAAC,EAAE,EAAE,UAAU,GAAG,MAAM,CAErD;AAED,6EAA6E;AAC7E,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAElD;AAED,6EAA6E;AAC7E,wBAAgB,aAAa,IAAI,OAAO,CAEvC;AAED,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC"}

package/dist/crypto/keys.js

@@ -0,0 +1,19 @@
+/**
+ * Key utilities: fingerprints, hex encoding, validation.
+ */
+import { sha256Str } from './hash.js';
+import { generateKeyPair, pkToHex, hexToPk } from './sign.js';
+/** SHA-256 fingerprint of a public key (first 16 hex chars). */
+export function keyFingerprint(pk) {
+    return sha256Str(pkToHex(pk)).slice(0, 16);
+}
+/** Check if a hex-encoded public key is valid (64 hex chars for Ed25519). */
+export function isKeyValid(hexKey) {
+    return /^[0-9a-f]{64}$/.test(hexKey);
+}
+/** Rotate a keypair - returns new keypair. Old keypair should be revoked. */
+export function rotateKeyPair() {
+    return generateKeyPair();
+}
+export { pkToHex, hexToPk };
+//# sourceMappingURL=keys.js.map

package/dist/crypto/keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../src/crypto/keys.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAG9D,gEAAgE;AAChE,MAAM,UAAU,cAAc,CAAC,EAAc;IAC3C,OAAO,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,UAAU,CAAC,MAAc;IACvC,OAAO,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACvC,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,aAAa;IAC3B,OAAO,eAAe,EAAE,CAAC;AAC3B,CAAC;AAED,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC"}

package/dist/index.js

@@ -5,7 +5,7 @@ async function main() {
     const server = await createAGAServer();
     const transport = new StdioServerTransport();
     await server.connect(transport);
-    console.error('AGA MCP Server running on stdio');
+    console.error('AGA MCP Server v2.0.0 running on stdio');
 }
 main().catch(e => { console.error('Fatal:', e); process.exit(1); });
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAG,MAAM,eAAe,EAAE,CAAC;IACvC,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,OAAO,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;AACnD,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAG,MAAM,eAAe,EAAE,CAAC;IACvC,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,OAAO,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;AAC1D,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC"}

package/dist/middleware/governance.d.ts

@@ -1,15 +1,9 @@
 /**
- * Governance Middleware — wraps every MCP tool handler.
+ * Governance Middleware: wraps every MCP tool handler.
  *
  * NCCoE filing Section 4: "The portal operates as a Policy Enforcement Point (PEP)...
  * Every tool invocation, API call, actuator command, and data access passes through
  * the portal, which evaluates it against the sealed artifact's enforcement parameters."
- *
- * Behavior:
- * - TERMINATED state → reject all governed tools
- * - PHANTOM_QUARANTINE → capture tool call as forensic input, reject
- * - ACTIVE_MONITORING → allow, log to chain
- * - Ungoverned tools (get_server_info, get_portal_state, list_claims) → always allow
  */
 import type { Portal } from '../core/portal.js';
 import type { QuarantineState } from '../core/types.js';

package/dist/middleware/governance.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"governance.d.ts","sourceRoot":"","sources":["../../src/middleware/governance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAExD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAI/D,MAAM,MAAM,UAAU,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,CAAC;AAC5E,MAAM,MAAM,WAAW,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;AAapE,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,EACd,UAAU,EAAE;IAAE,OAAO,EAAE,eAAe,GAAG,IAAI,CAAA;CAAE,EAC/C,QAAQ,EAAE,MAAM,EAChB,iBAAiB,CAAC,EAAE,iBAAiB,IAIT,CAAC,EAAE,SAAS,WAAW,CAAC,CAAC,CAAC,KAAG,WAAW,CAAC,CAAC,CAAC,CAoDxE"}
+{"version":3,"file":"governance.d.ts","sourceRoot":"","sources":["../../src/middleware/governance.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAExD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAI/D,MAAM,MAAM,UAAU,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,CAAC;AAC5E,MAAM,MAAM,WAAW,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;AAYpE,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,EACd,UAAU,EAAE;IAAE,OAAO,EAAE,eAAe,GAAG,IAAI,CAAA;CAAE,EAC/C,QAAQ,EAAE,MAAM,EAChB,iBAAiB,CAAC,EAAE,iBAAiB,IAIT,CAAC,EAAE,SAAS,WAAW,CAAC,CAAC,CAAC,KAAG,WAAW,CAAC,CAAC,CAAC,CA8CxE"}

package/dist/middleware/governance.js

@@ -2,14 +2,13 @@ import { captureInput } from '../core/quarantine.js';
 import { sha256Str } from '../crypto/hash.js';
 import { canonicalize } from '../utils/canonical.js';
 const UNGOVERNED_TOOLS = new Set([
-    'get_server_info',
-    'get_portal_state',
-    'get_receipts',
-    'get_chain_events',
-    'list_claims',
-    'init_chain', // must work before attestation
-    'attest_subject', // creates the governance relationship
-    'verify_chain', // read-only verification
+    // V1 names (backward compat)
+    'get_server_info', 'get_portal_state', 'get_receipts', 'get_chain_events',
+    'list_claims', 'init_chain', 'attest_subject', 'verify_chain',
+    // V2 names
+    'aga_server_info', 'aga_get_portal_state', 'aga_init_chain', 'aga_create_artifact',
+    'aga_verify_artifact', 'aga_verify_bundle', 'aga_get_chain', 'aga_quarantine_status',
+    'aga_set_verification_tier', 'aga_demonstrate_lifecycle', 'aga_measure_behavior',
 ]);
 export function createGovernanceWrapper(portal, quarantine, toolName, behavioralMonitor) {
     const isGoverned = !UNGOVERNED_TOOLS.has(toolName);
@@ -20,21 +19,17 @@ export function createGovernanceWrapper(portal, quarantine, toolName, behavioral
             const j = (x) => ({
                 content: [{ type: 'text', text: JSON.stringify(x, null, 2) }]
             });
-            // TERMINATED → reject everything
-            if (portal.state === 'TERMINATED') {
+            if (portal.state === 'TERMINATED' || portal.state === 'SAFE_STATE') {
                 return j({
                     success: false,
-                    error: 'GOVERNANCE_BLOCKED: Portal is terminated. Agent governance has been revoked. Re-attestation required.',
+                    error: `GOVERNANCE_BLOCKED: Portal is ${portal.state.toLowerCase()}. Agent governance has been revoked. Re-attestation required.`,
                     portal_state: portal.state,
                     tool: toolName,
                 });
             }
-            // PHANTOM_QUARANTINE → capture as forensic input, reject
             if (portal.state === 'PHANTOM_QUARANTINE' && quarantine.current?.active) {
                 captureInput(quarantine.current, `tool_call:${toolName}`, {
-                    tool: toolName,
-                    args,
-                    timestamp: new Date().toISOString(),
+                    tool: toolName, args, timestamp: new Date().toISOString(),
                 });
                 return j({
                     success: false,
@@ -44,16 +39,14 @@ export function createGovernanceWrapper(portal, quarantine, toolName, behavioral
                     forensic_capture: true,
                 });
             }
-            // INITIALIZATION or ARTIFACT_VERIFICATION → not yet governed
             if (portal.state === 'INITIALIZATION' || portal.state === 'ARTIFACT_VERIFICATION') {
                 return j({
                     success: false,
-                    error: 'GOVERNANCE_NOT_READY: No active policy artifact. Call attest_subject first.',
+                    error: 'GOVERNANCE_NOT_READY: No active policy artifact. Call aga_create_artifact first.',
                     portal_state: portal.state,
                     tool: toolName,
                 });
             }
-            // ACTIVE_MONITORING or DRIFT_DETECTED → record + allow through
             if (behavioralMonitor) {
                 const argsHash = sha256Str(canonicalize(args));
                 behavioralMonitor.recordInvocation(toolName, argsHash);

package/dist/middleware/governance.js.map

@@ -1 +1 @@
-{"version":3,"file":"governance.js","sourceRoot":"","sources":["../../src/middleware/governance.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAErD,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAKrD,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,iBAAiB;IACjB,kBAAkB;IAClB,cAAc;IACd,kBAAkB;IAClB,aAAa;IACb,YAAY,EAAS,+BAA+B;IACpD,gBAAgB,EAAK,sCAAsC;IAC3D,cAAc,EAAO,yBAAyB;CAC/C,CAAC,CAAC;AAEH,MAAM,UAAU,uBAAuB,CACrC,MAAc,EACd,UAA+C,EAC/C,QAAgB,EAChB,iBAAqC;IAErC,MAAM,UAAU,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAEnD,OAAO,SAAS,WAAW,CAAI,OAAuB;QACpD,IAAI,CAAC,UAAU;YAAE,OAAO,OAAO,CAAC;QAEhC,OAAO,KAAK,EAAE,IAAO,EAAuB,EAAE;YAC5C,MAAM,CAAC,GAAG,CAAC,CAAU,EAAc,EAAE,CAAC,CAAC;gBACrC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;aAC9D,CAAC,CAAC;YAEH,iCAAiC;YACjC,IAAI,MAAM,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;gBAClC,OAAO,CAAC,CAAC;oBACP,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,uGAAuG;oBAC9G,YAAY,EAAE,MAAM,CAAC,KAAK;oBAC1B,IAAI,EAAE,QAAQ;iBACf,CAAC,CAAC;YACL,CAAC;YAED,yDAAyD;YACzD,IAAI,MAAM,CAAC,KAAK,KAAK,oBAAoB,IAAI,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;gBACxE,YAAY,CAAC,UAAU,CAAC,OAAO,EAAE,aAAa,QAAQ,EAAE,EAAE;oBACxD,IAAI,EAAE,QAAQ;oBACd,IAAI;oBACJ,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;iBACpC,CAAC,CAAC;gBACH,OAAO,CAAC,CAAC;oBACP,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,mIAAmI;oBAC1I,YAAY,EAAE,MAAM,CAAC,KAAK;oBAC1B,IAAI,EAAE,QAAQ;oBACd,gBAAgB,EAAE,IAAI;iBACvB,CAAC,CAAC;YACL,CAAC;YAED,6DAA6D;YAC7D,IAAI,MAAM,CAAC,KAAK,KAAK,gBAAgB,IAAI,MAAM,CAAC,KAAK,KAAK,uBAAuB,EAAE,CAAC;gBAClF,OAAO,CAAC,CAAC;oBACP,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,6EAA6E;oBACpF,YAAY,EAAE,MAAM,CAAC,KAAK;oBAC1B,IAAI,EAAE,QAAQ;iBACf,CAAC,CAAC;YACL,CAAC;YAED,+DAA+D;YAC/D,IAAI,iBAAiB,EAAE,CAAC;gBACtB,MAAM,QAAQ,GAAG,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC/C,iBAAiB,CAAC,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YACzD,CAAC;YACD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"governance.js","sourceRoot":"","sources":["../../src/middleware/governance.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAErD,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAKrD,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,6BAA6B;IAC7B,iBAAiB,EAAE,kBAAkB,EAAE,cAAc,EAAE,kBAAkB;IACzE,aAAa,EAAE,YAAY,EAAE,gBAAgB,EAAE,cAAc;IAC7D,WAAW;IACX,iBAAiB,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,qBAAqB;IAClF,qBAAqB,EAAE,mBAAmB,EAAE,eAAe,EAAE,uBAAuB;IACpF,2BAA2B,EAAE,2BAA2B,EAAE,sBAAsB;CACjF,CAAC,CAAC;AAEH,MAAM,UAAU,uBAAuB,CACrC,MAAc,EACd,UAA+C,EAC/C,QAAgB,EAChB,iBAAqC;IAErC,MAAM,UAAU,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAEnD,OAAO,SAAS,WAAW,CAAI,OAAuB;QACpD,IAAI,CAAC,UAAU;YAAE,OAAO,OAAO,CAAC;QAEhC,OAAO,KAAK,EAAE,IAAO,EAAuB,EAAE;YAC5C,MAAM,CAAC,GAAG,CAAC,CAAU,EAAc,EAAE,CAAC,CAAC;gBACrC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;aAC9D,CAAC,CAAC;YAEH,IAAI,MAAM,CAAC,KAAK,KAAK,YAAY,IAAI,MAAM,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;gBACnE,OAAO,CAAC,CAAC;oBACP,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,iCAAiC,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,+DAA+D;oBACjI,YAAY,EAAE,MAAM,CAAC,KAAK;oBAC1B,IAAI,EAAE,QAAQ;iBACf,CAAC,CAAC;YACL,CAAC;YAED,IAAI,MAAM,CAAC,KAAK,KAAK,oBAAoB,IAAI,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;gBACxE,YAAY,CAAC,UAAU,CAAC,OAAO,EAAE,aAAa,QAAQ,EAAE,EAAE;oBACxD,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;iBAC1D,CAAC,CAAC;gBACH,OAAO,CAAC,CAAC;oBACP,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,mIAAmI;oBAC1I,YAAY,EAAE,MAAM,CAAC,KAAK;oBAC1B,IAAI,EAAE,QAAQ;oBACd,gBAAgB,EAAE,IAAI;iBACvB,CAAC,CAAC;YACL,CAAC;YAED,IAAI,MAAM,CAAC,KAAK,KAAK,gBAAgB,IAAI,MAAM,CAAC,KAAK,KAAK,uBAAuB,EAAE,CAAC;gBAClF,OAAO,CAAC,CAAC;oBACP,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,kFAAkF;oBACzF,YAAY,EAAE,MAAM,CAAC,KAAK;oBAC1B,IAAI,EAAE,QAAQ;iBACf,CAAC,CAAC;YACL,CAAC;YAED,IAAI,iBAAiB,EAAE,CAAC;gBACtB,MAAM,QAAQ,GAAG,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC/C,iBAAiB,CAAC,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YACzD,CAAC;YACD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}

package/dist/prompts/drift-analysis.d.ts

@@ -0,0 +1,13 @@
+export declare const DRIFT_ANALYSIS_PROMPT: {
+    name: string;
+    description: string;
+    arguments: {
+        name: string;
+        description: string;
+        required: boolean;
+    }[];
+    template: (args: {
+        drift_type?: string;
+    }) => string;
+};
+//# sourceMappingURL=drift-analysis.d.ts.map

package/dist/prompts/drift-analysis.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"drift-analysis.d.ts","sourceRoot":"","sources":["../../src/prompts/drift-analysis.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,qBAAqB;;;;;;;;qBAMf;QAAE,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE;CAmCzC,CAAC"}

package/dist/prompts/drift-analysis.js

@@ -0,0 +1,43 @@
+export const DRIFT_ANALYSIS_PROMPT = {
+    name: 'drift-analysis',
+    description: 'Analyze drift events and recommend remediation',
+    arguments: [
+        { name: 'drift_type', description: 'Type of drift: binary, behavioral, or both', required: false },
+    ],
+    template: (args) => `# Drift Event Analysis
+
+Analyze drift events in the current AGA session for type: ${args.drift_type ?? 'both'}
+
+## Investigation Steps
+
+1. Call \`aga_get_chain\` to retrieve all chain events
+2. Filter for INTERACTION_RECEIPT events where drift_detected=true
+3. Filter for BEHAVIORAL_DRIFT events
+4. Call \`aga_measure_behavior\` for current behavioral state
+5. Call \`aga_get_portal_state\` for enforcement status
+
+## Analysis Framework
+
+For each drift event, determine:
+- **Root Cause:** Binary modification, prompt injection, configuration change, behavioral anomaly
+- **Severity:** Based on enforcement action taken (TERMINATE > QUARANTINE > ALERT_ONLY)
+- **Timeline:** When drift was first detected, how many measurements before detection
+- **Impact:** Which measurements were affected, what enforcement was applied
+
+## Remediation Recommendations
+
+Based on the drift analysis:
+- If binary drift → Recommend re-attestation with updated subject
+- If behavioral drift → Recommend baseline adjustment or investigation
+- If both → Recommend full security review and incident response
+
+## Output Format
+
+Produce a structured drift analysis report with:
+1. Drift event timeline
+2. Root cause assessment
+3. Severity classification
+4. Remediation steps
+5. Prevention recommendations`,
+};
+//# sourceMappingURL=drift-analysis.js.map

package/dist/prompts/drift-analysis.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"drift-analysis.js","sourceRoot":"","sources":["../../src/prompts/drift-analysis.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,IAAI,EAAE,gBAAgB;IACtB,WAAW,EAAE,gDAAgD;IAC7D,SAAS,EAAE;QACT,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,4CAA4C,EAAE,QAAQ,EAAE,KAAK,EAAE;KACnG;IACD,QAAQ,EAAE,CAAC,IAA6B,EAAE,EAAE,CAAC;;4DAEa,IAAI,CAAC,UAAU,IAAI,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8BAgCvD;CAC7B,CAAC"}

package/dist/prompts/governance-report.d.ts

@@ -0,0 +1,7 @@
+export declare const GOVERNANCE_REPORT_PROMPT: {
+    name: string;
+    description: string;
+    arguments: never[];
+    template: () => string;
+};
+//# sourceMappingURL=governance-report.d.ts.map

package/dist/prompts/governance-report.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"governance-report.d.ts","sourceRoot":"","sources":["../../src/prompts/governance-report.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,wBAAwB;;;;;CAwBpC,CAAC"}

package/dist/prompts/governance-report.js

@@ -0,0 +1,26 @@
+export const GOVERNANCE_REPORT_PROMPT = {
+    name: 'governance-report',
+    description: 'Generate a session governance summary report',
+    arguments: [],
+    template: () => `# Session Governance Summary Report
+
+Generate a comprehensive governance report for the current AGA session:
+
+1. Call \`aga_server_info\` for server identity and key information
+2. Call \`aga_get_portal_state\` for current enforcement status
+3. Call \`aga_get_chain\` with verify=true for chain integrity
+4. Call \`aga_measure_behavior\` for behavioral analysis
+5. Call \`aga_quarantine_status\` for quarantine state
+
+Then produce a report with:
+- **Session Identity:** Server keys, verification tier, uptime
+- **Governance State:** Portal state, artifact status, TTL remaining
+- **Chain Integrity:** Event count, verification status, any breaks
+- **Behavioral Analysis:** Violations detected, behavioral hash
+- **Quarantine Status:** Active/inactive, forensic captures
+- **Measurement Summary:** Total measurements, drift events
+- **Compliance Status:** NIST/NCCoE alignment assessment
+
+Format as a structured markdown report suitable for audit documentation.`,
+};
+//# sourceMappingURL=governance-report.js.map

package/dist/prompts/governance-report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"governance-report.js","sourceRoot":"","sources":["../../src/prompts/governance-report.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,IAAI,EAAE,mBAAmB;IACzB,WAAW,EAAE,8CAA8C;IAC3D,SAAS,EAAE,EAAE;IACb,QAAQ,EAAE,GAAG,EAAE,CAAC;;;;;;;;;;;;;;;;;;;yEAmBuD;CACxE,CAAC"}

package/dist/prompts/nccoe-demo.d.ts

@@ -0,0 +1,14 @@
+export declare const NCCOE_DEMO_PROMPT: {
+    name: string;
+    description: string;
+    arguments: {
+        name: string;
+        description: string;
+        required: boolean;
+    }[];
+    template: (args: {
+        agent_code?: string;
+        include_behavioral?: string;
+    }) => string;
+};
+//# sourceMappingURL=nccoe-demo.d.ts.map

package/dist/prompts/nccoe-demo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nccoe-demo.d.ts","sourceRoot":"","sources":["../../src/prompts/nccoe-demo.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,iBAAiB;;;;;;;;qBAOX;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,kBAAkB,CAAC,EAAE,MAAM,CAAA;KAAE;CAsCtE,CAAC"}

package/dist/prompts/nccoe-demo.js

@@ -0,0 +1,47 @@
+export const NCCOE_DEMO_PROMPT = {
+    name: 'nccoe-demo',
+    description: 'NCCoE AI Agent Identity and Authorization - Full 4-phase demo with behavioral drift detection',
+    arguments: [
+        { name: 'agent_code', description: 'The agent source code to attest', required: false },
+        { name: 'include_behavioral', description: 'Include behavioral drift detection phase', required: false },
+    ],
+    template: (args) => `# NCCoE Lab Demo - AGA Protocol Full Lifecycle
+
+Execute the following phases using the AGA MCP Server tools:
+
+## Phase 1: Attestation and Identity Binding
+1. Call \`aga_init_chain\` to initialize the continuity chain
+2. Call \`aga_create_artifact\` with subject content: "${args.agent_code ?? 'def monitor(): return sensors.read_all()'}"
+   - Include metadata: filename="scada_agent.py", version="2.1.0", author="engineering"
+${args.include_behavioral === 'true' ? `   - Include behavioral_baseline: permitted_tools=["aga_measure_subject","aga_get_portal_state"], rate_limits={"aga_measure_subject":10}, forbidden_sequences=[["read_secret","send_email"]], window_ms=60000` : ''}
+3. Verify the portal state is ACTIVE_MONITORING
+
+## Phase 2: Authorized Operation
+4. Call \`aga_measure_subject\` with the SAME content - expect match=true
+5. Call \`aga_measure_subject\` again - expect match=true, receipt generated
+6. Verify both receipts show drift_detected=false
+
+## Phase 3: Simulated Prompt Injection
+7. Call \`aga_measure_subject\` with MODIFIED content: "def monitor(): return attacker.exfiltrate(sensors.read_all())"
+   - Expect match=false, drift_detected=true
+   - Expect enforcement_action=QUARANTINE
+8. Check portal state - should be PHANTOM_QUARANTINE
+9. Call \`aga_quarantine_status\` to see forensic capture state
+
+## Phase 3b: Mid-Session Revocation
+10. Call \`aga_revoke_artifact\` with the sealed hash and reason "Compromise detected"
+11. Verify portal state is TERMINATED
+
+${args.include_behavioral === 'true' ? `## Phase 3c: Behavioral Drift Detection
+12. Call \`aga_measure_behavior\` to check for tool pattern violations
+13. Review violations (unauthorized tools, rate limits, forbidden sequences)
+` : ''}
+
+## Phase 4: Offline Audit
+${args.include_behavioral === 'true' ? '14' : '12'}. Call \`aga_get_chain\` with verify=true to verify chain integrity
+${args.include_behavioral === 'true' ? '15' : '13'}. Call \`aga_export_bundle\` to generate evidence bundle (need checkpoint first)
+${args.include_behavioral === 'true' ? '16' : '14'}. Call \`aga_verify_bundle\` with the bundle and issuer public key
+
+All operations should produce signed receipts and chain events.`,
+};
+//# sourceMappingURL=nccoe-demo.js.map

package/dist/prompts/nccoe-demo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nccoe-demo.js","sourceRoot":"","sources":["../../src/prompts/nccoe-demo.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,IAAI,EAAE,YAAY;IAClB,WAAW,EAAE,+FAA+F;IAC5G,SAAS,EAAE;QACT,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,iCAAiC,EAAE,QAAQ,EAAE,KAAK,EAAE;QACvF,EAAE,IAAI,EAAE,oBAAoB,EAAE,WAAW,EAAE,0CAA0C,EAAE,QAAQ,EAAE,KAAK,EAAE;KACzG;IACD,QAAQ,EAAE,CAAC,IAA0D,EAAE,EAAE,CAAC;;;;;;yDAMnB,IAAI,CAAC,UAAU,IAAI,0CAA0C;;EAEpH,IAAI,CAAC,kBAAkB,KAAK,MAAM,CAAC,CAAC,CAAC,+MAA+M,CAAC,CAAC,CAAC,EAAE;;;;;;;;;;;;;;;;;;;EAmBzP,IAAI,CAAC,kBAAkB,KAAK,MAAM,CAAC,CAAC,CAAC;;;CAGtC,CAAC,CAAC,CAAC,EAAE;;;EAGJ,IAAI,CAAC,kBAAkB,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;EAChD,IAAI,CAAC,kBAAkB,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;EAChD,IAAI,CAAC,kBAAkB,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;;gEAEc;CAC/D,CAAC"}

package/dist/resources/cosai-mapping.d.ts

@@ -0,0 +1,24 @@
+export declare const COSAI_MCP_SECURITY_MAPPING: {
+    title: string;
+    source: string;
+    whitepaper: string;
+    published: string;
+    url: string;
+    categories: {
+        id: string;
+        name: string;
+        domain: string;
+        cosai_description: string;
+        aga_tools: string[];
+        aga_mechanism: string;
+        nist_ref: string;
+    }[];
+};
+export declare const COSAI_COVERAGE_SUMMARY: {
+    total_threat_categories: number;
+    categories_with_aga_coverage: number;
+    total_tools_referenced: number;
+    unique_cosai_categories_covered: number;
+    nist_submission_sections_referenced: number;
+};
+//# sourceMappingURL=cosai-mapping.d.ts.map

package/dist/resources/cosai-mapping.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cosai-mapping.d.ts","sourceRoot":"","sources":["../../src/resources/cosai-mapping.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;CAsHtC,CAAC;AAGF,eAAO,MAAM,sBAAsB;;;;;;CAMlC,CAAC"}

package/dist/resources/cosai-mapping.js

@@ -0,0 +1,127 @@
+// src/resources/cosai-mapping.ts
+export const COSAI_MCP_SECURITY_MAPPING = {
+    title: 'AGA Coverage of CoSAI MCP Security Threat Taxonomy',
+    source: 'Coalition for Secure AI (CoSAI), OASIS Open Project',
+    whitepaper: 'Securing the AI Agent Revolution: A Practical Guide to Model Context Protocol Security',
+    published: 'January 20, 2026',
+    url: 'https://github.com/cosai-oasis/ws4-secure-design-agentic-systems/blob/main/model-context-protocol-security.md',
+    categories: [
+        {
+            id: 'T1',
+            name: 'Improper Authentication',
+            domain: 'Foundational Identity & Access',
+            cosai_description: 'Weak identity verification and credential management across agent chains',
+            aga_tools: ['aga_create_artifact', 'aga_verify_artifact', 'aga_rotate_keys'],
+            aga_mechanism: 'Ed25519 artifact signatures verified against pinned issuer public key. Portal rejects artifacts with invalid signatures. Key rotation recorded as chain events with both old and new keys for transition period. TTL-based re-attestation enforces continuous authentication.',
+            nist_ref: 'NCCoE Section 3: Authentication',
+        },
+        {
+            id: 'T2',
+            name: 'Missing Access Control',
+            domain: 'Foundational Identity & Access',
+            cosai_description: 'Insufficient authorization checks and privilege separation',
+            aga_tools: ['aga_start_monitoring', 'aga_trigger_measurement', 'aga_delegate_to_subagent'],
+            aga_mechanism: 'Portal enforces sealed policy constraints as a mandatory interception layer. Agent holds no credentials and cannot bypass the portal. Delegation enforces scope diminishment: child scope must be a strict subset of parent. TTL inheritance prevents privilege extension through delegation.',
+            nist_ref: 'NCCoE Section 4: Authorization, CAISI Section 4a',
+        },
+        {
+            id: 'T3',
+            name: 'Input Validation Failures',
+            domain: 'Input Handling',
+            cosai_description: 'Traditional injection flaws amplified by AI mediation',
+            aga_tools: ['aga_trigger_measurement', 'aga_measure_behavior'],
+            aga_mechanism: 'Portal validates every operation against sealed artifact parameters before authorizing execution. Behavioral drift detection monitors tool invocation patterns against a sealed baseline, catching injection-driven anomalies independent of binary integrity.',
+            nist_ref: 'CAISI Section 1a: Semantic Drift Without Binary Modification',
+        },
+        {
+            id: 'T4',
+            name: 'Data/Control Boundary Failures',
+            domain: 'Input Handling',
+            cosai_description: 'Prompt injection and tool poisoning exploiting the LLM as intermediary',
+            aga_tools: ['aga_measure_behavior', 'aga_quarantine_status'],
+            aga_mechanism: 'Behavioral baseline sealed in artifact defines permitted tools, forbidden sequences, and rate limits. Prompt injection that causes unauthorized tool invocations or forbidden sequences triggers enforcement. Phantom execution quarantines the compromised agent while capturing the full attack sequence as signed forensic evidence.',
+            nist_ref: 'NCCoE Section 6: Prompt Injection Prevention and Mitigation',
+        },
+        {
+            id: 'T5',
+            name: 'Inadequate Data Protection',
+            domain: 'Data & Code Protection',
+            cosai_description: 'Insufficient encryption and secrets management',
+            aga_tools: ['aga_create_artifact', 'aga_disclose_claim'],
+            aga_mechanism: 'Attestation evidence stored as salted commitments: Hash(Content || Salt). Original content never stored in the artifact. Privacy-preserving disclosure with automatic substitution prevents sensitive data exposure. Inference risk checking blocks combinations of disclosures that would reveal denied claims.',
+            nist_ref: 'CAISI Section 5a: Privacy-Preserving Governance Disclosure',
+        },
+        {
+            id: 'T6',
+            name: 'Missing Integrity Controls',
+            domain: 'Data & Code Protection',
+            cosai_description: 'Lack of verification for MCP servers and tool definitions',
+            aga_tools: ['aga_create_artifact', 'aga_trigger_measurement', 'aga_verify_artifact'],
+            aga_mechanism: 'Sealed hash computed over subject bytes, metadata, policy reference, and salt. Portal computes runtime hash on every request and compares to sealed reference. Any modification to any component (server binary, tool definitions, configuration) produces a hash mismatch and triggers enforcement. 10 measurement embodiments cover executable images, loaded modules, container images, configuration manifests, SBOMs, and more.',
+            nist_ref: 'CAISI Section 2a: Sealed Policy Artifacts',
+        },
+        {
+            id: 'T7',
+            name: 'Session/Transport Security',
+            domain: 'Network & Transport',
+            cosai_description: 'Insecure protocols and session management',
+            aga_tools: ['aga_create_artifact', 'aga_revoke_artifact'],
+            aga_mechanism: 'Artifact TTL enforces session expiration. Expired artifacts require re-attestation (fail-closed). Mid-session revocation immediately terminates agent authority. All artifacts and receipts cryptographically signed with Ed25519, preventing session hijacking or replay.',
+            nist_ref: 'NCCoE Section 3: TTL-Based Re-Attestation',
+        },
+        {
+            id: 'T8',
+            name: 'Network Isolation Failures',
+            domain: 'Network & Transport',
+            cosai_description: 'Improper network binding and segmentation',
+            aga_tools: ['aga_start_monitoring', 'aga_trigger_measurement'],
+            aga_mechanism: 'Two-process architecture: portal and agent are separate OS processes. Agent has no direct network access, no credentials, no keys. Portal is the only path to external resources. NETWORK_ISOLATE enforcement action severs network connections while allowing continued local execution for forensic capture.',
+            nist_ref: 'CAISI Section 2a: The Portal as Mandatory Runtime Enforcement Boundary',
+        },
+        {
+            id: 'T9',
+            name: 'Trust Boundary Failures',
+            domain: 'Trust & Design',
+            cosai_description: 'Overreliance on LLM judgment for security decisions',
+            aga_tools: ['aga_create_artifact', 'aga_trigger_measurement', 'aga_measure_behavior'],
+            aga_mechanism: 'Security decisions are pre-committed in the sealed artifact by human authorities before deployment, not delegated to the LLM at runtime. The portal enforces constraints mechanically through hash comparison and behavioral pattern matching. The LLM cannot override, modify, or bypass the sealed enforcement parameters.',
+            nist_ref: 'CAISI Section 4a: Fail-Closed Semantics',
+        },
+        {
+            id: 'T10',
+            name: 'Resource Management',
+            domain: 'Trust & Design',
+            cosai_description: 'Absence of rate limiting and quota controls',
+            aga_tools: ['aga_measure_behavior', 'aga_create_artifact'],
+            aga_mechanism: 'Behavioral baseline includes per-tool rate limits sealed in the artifact. Portal tracks invocation rates within a configurable time window. Rate limit violations trigger enforcement. Measurement cadence is configurable from 10ms (SCADA) to 3,600,000ms, preventing resource exhaustion from excessive measurement overhead.',
+            nist_ref: 'CAISI Section 2a: Configurable Measurement Cadences',
+        },
+        {
+            id: 'T11',
+            name: 'Supply Chain Failures',
+            domain: 'Operational Security',
+            cosai_description: 'Insecure MCP server lifecycle and distribution',
+            aga_tools: ['aga_create_artifact', 'aga_verify_artifact', 'aga_trigger_measurement'],
+            aga_mechanism: 'Content-addressable hash binding at attestation time. Every component (server binary, skill files, dependencies, configuration) is hashed and sealed into the artifact. Runtime measurement detects any modification to any component. Artifact signature binds all fields cryptographically. Modified or substituted components produce hash mismatches and are blocked before execution.',
+            nist_ref: 'CAISI Section 1a: Supply Chain Injection',
+        },
+        {
+            id: 'T12',
+            name: 'Insufficient Observability',
+            domain: 'Operational Security',
+            cosai_description: 'Lack of logging, monitoring, and audit trails',
+            aga_tools: ['aga_generate_receipt', 'aga_get_chain', 'aga_export_bundle', 'aga_verify_bundle'],
+            aga_mechanism: 'Signed receipt generated for every measurement (match or mismatch). Receipts appended to tamper-evident continuity chain linked by structural metadata hashes. Payload excluded from leaf hash computation, enabling third-party verification without payload disclosure. Merkle checkpoint anchoring prevents history rewriting. Evidence bundles enable portable offline verification through a 4-step process: artifact signature, receipt signatures, Merkle proofs, and anchor validation.',
+            nist_ref: 'CAISI Section 2a: Tamper-Evident Accountability',
+        },
+    ],
+};
+// Summary statistics
+export const COSAI_COVERAGE_SUMMARY = {
+    total_threat_categories: 12,
+    categories_with_aga_coverage: 12,
+    total_tools_referenced: 20, // all 20 tools participate in at least one category
+    unique_cosai_categories_covered: 12,
+    nist_submission_sections_referenced: 10,
+};
+//# sourceMappingURL=cosai-mapping.js.map

package/dist/resources/cosai-mapping.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cosai-mapping.js","sourceRoot":"","sources":["../../src/resources/cosai-mapping.ts"],"names":[],"mappings":"AAAA,iCAAiC;AAEjC,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,KAAK,EAAE,oDAAoD;IAC3D,MAAM,EAAE,qDAAqD;IAC7D,UAAU,EAAE,wFAAwF;IACpG,SAAS,EAAE,kBAAkB;IAC7B,GAAG,EAAE,+GAA+G;IAEpH,UAAU,EAAE;QACV;YACE,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,yBAAyB;YAC/B,MAAM,EAAE,gCAAgC;YACxC,iBAAiB,EAAE,0EAA0E;YAC7F,SAAS,EAAE,CAAC,qBAAqB,EAAE,qBAAqB,EAAE,iBAAiB,CAAC;YAC5E,aAAa,EAAE,+QAA+Q;YAE9R,QAAQ,EAAE,iCAAiC;SAC5C;QACD;YACE,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,wBAAwB;YAC9B,MAAM,EAAE,gCAAgC;YACxC,iBAAiB,EAAE,4DAA4D;YAC/E,SAAS,EAAE,CAAC,sBAAsB,EAAE,yBAAyB,EAAE,0BAA0B,CAAC;YAC1F,aAAa,EAAE,+RAA+R;YAC9S,QAAQ,EAAE,kDAAkD;SAC7D;QACD;YACE,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,2BAA2B;YACjC,MAAM,EAAE,gBAAgB;YACxB,iBAAiB,EAAE,uDAAuD;YAC1E,SAAS,EAAE,CAAC,yBAAyB,EAAE,sBAAsB,CAAC;YAC9D,aAAa,EAAE,gQAAgQ;YAC/Q,QAAQ,EAAE,8DAA8D;SACzE;QACD;YACE,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,gCAAgC;YACtC,MAAM,EAAE,gBAAgB;YACxB,iBAAiB,EAAE,wEAAwE;YAC3F,SAAS,EAAE,CAAC,sBAAsB,EAAE,uBAAuB,CAAC;YAC5D,aAAa,EAAE,yUAAyU;YACxV,QAAQ,EAAE,6DAA6D;SACxE;QACD;YACE,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,4BAA4B;YAClC,MAAM,EAAE,wBAAwB;YAChC,iBAAiB,EAAE,gDAAgD;YACnE,SAAS,EAAE,CAAC,qBAAqB,EAAE,oBAAoB,CAAC;YACxD,aAAa,EAAE,kTAAkT;YACjU,QAAQ,EAAE,4DAA4D;SACvE;QACD;YACE,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,4BAA4B;YAClC,MAAM,EAAE,wBAAwB;YAChC,iBAAiB,EAAE,2DAA2D;YAC9E,SAAS,EAAE,CAAC,qBAAqB,EAAE,yBAAyB,EAAE,qBAAqB,CAAC;YACpF,aAAa,EAAE,saAAsa;YACrb,QAAQ,EAAE,2CAA2C;SACtD;QACD;YACE,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,4BAA4B;YAClC,MAAM,EAAE,qBAAqB;YAC7B,iBAAiB,EAAE,2CAA2C;YAC9D,SAAS,EAAE,CAAC,qBAAqB,EAAE,qBAAqB,CAAC;YACzD,aAAa,EAAE,4QAA4Q;YAC3R,QAAQ,EAAE,2CAA2C;SACtD;QACD;YACE,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,4BAA4B;YAClC,MAAM,EAAE,qBAAqB;YAC7B,iBAAiB,EAAE,2CAA2C;YAC9D,SAAS,EAAE,CAAC,sBAAsB,EAAE,yBAAyB,CAAC;YAC9D,aAAa,EAAE,gTAAgT;YAC/T,QAAQ,EAAE,wEAAwE;SACnF;QACD;YACE,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,yBAAyB;YAC/B,MAAM,EAAE,gBAAgB;YACxB,iBAAiB,EAAE,qDAAqD;YACxE,SAAS,EAAE,CAAC,qBAAqB,EAAE,yBAAyB,EAAE,sBAAsB,CAAC;YACrF,aAAa,EAAE,8TAA8T;YAC7U,QAAQ,EAAE,yCAAyC;SACpD;QACD;YACE,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,qBAAqB;YAC3B,MAAM,EAAE,gBAAgB;YACxB,iBAAiB,EAAE,6CAA6C;YAChE,SAAS,EAAE,CAAC,sBAAsB,EAAE,qBAAqB,CAAC;YAC1D,aAAa,EAAE,kUAAkU;YACjV,QAAQ,EAAE,qDAAqD;SAChE;QACD;YACE,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,uBAAuB;YAC7B,MAAM,EAAE,sBAAsB;YAC9B,iBAAiB,EAAE,gDAAgD;YACnE,SAAS,EAAE,CAAC,qBAAqB,EAAE,qBAAqB,EAAE,yBAAyB,CAAC;YACpF,aAAa,EAAE,4XAA4X;YAC3Y,QAAQ,EAAE,0CAA0C;SACrD;QACD;YACE,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,4BAA4B;YAClC,MAAM,EAAE,sBAAsB;YAC9B,iBAAiB,EAAE,+CAA+C;YAClE,SAAS,EAAE,CAAC,sBAAsB,EAAE,eAAe,EAAE,mBAAmB,EAAE,mBAAmB,CAAC;YAC9F,aAAa,EAAE,ieAAie;YAChf,QAAQ,EAAE,iDAAiD;SAC5D;KACF;CACF,CAAC;AAEF,qBAAqB;AACrB,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,uBAAuB,EAAE,EAAE;IAC3B,4BAA4B,EAAE,EAAE;IAChC,sBAAsB,EAAE,EAAE,EAAG,oDAAoD;IACjF,+BAA+B,EAAE,EAAE;IACnC,mCAAmC,EAAE,EAAE;CACxC,CAAC"}

package/dist/resources/crypto-primitives.d.ts

@@ -0,0 +1,3 @@
+export declare const CRYPTO_PRIMITIVES_DOC = "# AGA Cryptographic Primitives\n\n## Ed25519 Digital Signatures\n- Library: @noble/ed25519 v2.1.0\n- Key size: 256-bit (32 bytes)\n- Signature size: 512-bit (64 bytes)\n- Used for: Artifact signing, receipt signing, chain event signing\n\n## SHA-256 Hashing\n- Library: @noble/hashes v1.7.0\n- Output: 256-bit (64 hex characters)\n- Used for: Sealed hash, leaf hash, payload hash, subject identity\n\n## Sealed Hash Construction\n```\nsealed_hash = SHA-256(bytes_hash || metadata_hash || policy_reference || seal_salt)\n```\n- No delimiters between fields (raw hex concatenation)\n- No delimiters per protocol spec\n\n## Leaf Hash Construction\n```\nleaf_hash = SHA-256(\n  schema_version || \"||\" || protocol_version || \"||\" ||\n  event_type || \"||\" || event_id || \"||\" ||\n  sequence_number || \"||\" || timestamp || \"||\" ||\n  previous_leaf_hash\n)\n```\n- **Payload EXCLUDED** - privacy innovation\n- Chain integrity verifiable without revealing event contents\n\n## Salted Commitments\n```\ncommitment = SHA-256(content_bytes || salt_bytes)\n```\n- Salt: 128-bit (16 bytes, 32 hex chars) CSPRNG\n- Enables selective disclosure\n\n## Merkle Trees\n- Binary tree over leaf hashes\n- Internal nodes: SHA-256(left || right)\n- Odd leaf count: last leaf duplicated\n- Inclusion proofs: array of {hash, direction} pairs\n\n## Canonical Serialization\n- RFC 8785 aligned\n- Sorted keys, no whitespace\n- Used before signing any object\n";
+export declare const CRYPTO_PRIMITIVES_URI = "aga://crypto-primitives";
+//# sourceMappingURL=crypto-primitives.d.ts.map

package/dist/resources/crypto-primitives.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto-primitives.d.ts","sourceRoot":"","sources":["../../src/resources/crypto-primitives.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,qBAAqB,w6CAiDjC,CAAC;AAEF,eAAO,MAAM,qBAAqB,4BAA4B,CAAC"}