@attested-intelligence/aga-mcp-server 0.1.1 → 2.0.1

package/dist/tools/get-chain.js

@@ -0,0 +1,45 @@
+import { verifyChainIntegrity } from '../core/chain.js';
+const FILTER_MAP = {
+    behavioral: ['BEHAVIORAL_DRIFT'],
+    delegations: ['DELEGATION'],
+    receipts: ['INTERACTION_RECEIPT'],
+    revocations: ['REVOCATION'],
+    attestations: ['POLICY_ISSUANCE', 'RE_ATTESTATION', 'ATTESTATION'],
+    disclosure: ['DISCLOSURE', 'SUBSTITUTION'],
+    keys: ['KEY_ROTATION'],
+};
+export async function handleGetChain(args, ctx) {
+    let events = (args.start_seq !== undefined && args.end_seq !== undefined)
+        ? await ctx.storage.getEvents(args.start_seq, args.end_seq)
+        : await ctx.storage.getAllEvents();
+    // Apply filter_type
+    if (args.filter_type && args.filter_type !== 'all') {
+        const allowedTypes = FILTER_MAP[args.filter_type];
+        if (allowedTypes) {
+            events = events.filter(e => allowedTypes.includes(e.event_type));
+        }
+    }
+    const result = {
+        count: events.length,
+        events: events.map(e => ({
+            sequence_number: e.sequence_number,
+            event_type: e.event_type,
+            event_id: e.event_id,
+            timestamp: e.timestamp,
+            leaf_hash: e.leaf_hash.slice(0, 16) + '...',
+            previous_leaf_hash: e.previous_leaf_hash ? e.previous_leaf_hash.slice(0, 16) + '...' : null,
+            payload_hash: e.payload_hash.slice(0, 16) + '...',
+        })),
+    };
+    if (args.verify) {
+        const allEvents = await ctx.storage.getAllEvents();
+        const integrity = verifyChainIntegrity(allEvents);
+        result.chain_valid = integrity.valid;
+        result.broken_at = integrity.brokenAt;
+        result.verification_error = integrity.error;
+        result.leaf_hash_formula = 'SHA-256(schema_version || protocol_version || event_type || event_id || sequence_number || timestamp || previous_leaf_hash) - PAYLOAD EXCLUDED';
+        result.event_signature_covers = 'COMPLETE event including payload';
+    }
+    return ctx.json(result);
+}
+//# sourceMappingURL=get-chain.js.map

package/dist/tools/get-chain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-chain.js","sourceRoot":"","sources":["../../src/tools/get-chain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAUxD,MAAM,UAAU,GAA6B;IAC3C,UAAU,EAAE,CAAC,kBAAkB,CAAC;IAChC,WAAW,EAAE,CAAC,YAAY,CAAC;IAC3B,QAAQ,EAAE,CAAC,qBAAqB,CAAC;IACjC,WAAW,EAAE,CAAC,YAAY,CAAC;IAC3B,YAAY,EAAE,CAAC,iBAAiB,EAAE,gBAAgB,EAAE,aAAa,CAAC;IAClE,UAAU,EAAE,CAAC,YAAY,EAAE,cAAc,CAAC;IAC1C,IAAI,EAAE,CAAC,cAAc,CAAC;CACvB,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAkB,EAAE,GAAkB;IACzE,IAAI,MAAM,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC;QACvE,CAAC,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC;QAC3D,CAAC,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;IAErC,oBAAoB;IACpB,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,KAAK,KAAK,EAAE,CAAC;QACnD,MAAM,YAAY,GAAG,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAClD,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAA4B;QACtC,KAAK,EAAE,MAAM,CAAC,MAAM;QACpB,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACvB,eAAe,EAAE,CAAC,CAAC,eAAe;YAClC,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;YAC3C,kBAAkB,EAAE,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI;YAC3F,YAAY,EAAE,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;SAClD,CAAC,CAAC;KACJ,CAAC;IAEF,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;QACnD,MAAM,SAAS,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;QAClD,MAAM,CAAC,WAAW,GAAG,SAAS,CAAC,KAAK,CAAC;QACrC,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC,QAAQ,CAAC;QACtC,MAAM,CAAC,kBAAkB,GAAG,SAAS,CAAC,KAAK,CAAC;QAC5C,MAAM,CAAC,iBAAiB,GAAG,gJAAgJ,CAAC;QAC5K,MAAM,CAAC,sBAAsB,GAAG,kCAAkC,CAAC;IACrE,CAAC;IAED,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC1B,CAAC"}

package/dist/tools/get-portal-state.d.ts

@@ -0,0 +1,8 @@
+import type { ServerContext } from '../context.js';
+export declare function handleGetPortalState(_args: Record<string, never>, ctx: ServerContext): Promise<{
+    content: Array<{
+        type: "text";
+        text: string;
+    }>;
+}>;
+//# sourceMappingURL=get-portal-state.d.ts.map

package/dist/tools/get-portal-state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-portal-state.d.ts","sourceRoot":"","sources":["../../src/tools/get-portal-state.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAEnD,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,GAAG,EAAE,aAAa;;;;;GAa1F"}

package/dist/tools/get-portal-state.js

@@ -0,0 +1,15 @@
+export async function handleGetPortalState(_args, ctx) {
+    return ctx.json({
+        state: ctx.portal.state,
+        artifact_loaded: !!ctx.portal.artifact,
+        sealed_hash: ctx.portal.artifact?.sealed_hash ?? null,
+        ttl_seconds: ctx.portal.artifact?.enforcement_parameters.ttl_seconds ?? null,
+        issued_at: ctx.portal.artifact?.issued_timestamp ?? null,
+        enforcement_triggers: ctx.portal.artifact?.enforcement_parameters.enforcement_triggers ?? [],
+        sequence_counter: ctx.portal.sequenceCounter,
+        quarantine_active: ctx.quarantine?.active ?? false,
+        verification_tier: ctx.verificationTier,
+        measurement_count: ctx.measurementCount,
+    });
+}
+//# sourceMappingURL=get-portal-state.js.map

package/dist/tools/get-portal-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-portal-state.js","sourceRoot":"","sources":["../../src/tools/get-portal-state.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAA4B,EAAE,GAAkB;IACzF,OAAO,GAAG,CAAC,IAAI,CAAC;QACd,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK;QACvB,eAAe,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ;QACtC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,IAAI,IAAI;QACrD,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,sBAAsB,CAAC,WAAW,IAAI,IAAI;QAC5E,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,gBAAgB,IAAI,IAAI;QACxD,oBAAoB,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,sBAAsB,CAAC,oBAAoB,IAAI,EAAE;QAC5F,gBAAgB,EAAE,GAAG,CAAC,MAAM,CAAC,eAAe;QAC5C,iBAAiB,EAAE,GAAG,CAAC,UAAU,EAAE,MAAM,IAAI,KAAK;QAClD,iBAAiB,EAAE,GAAG,CAAC,gBAAgB;QACvC,iBAAiB,EAAE,GAAG,CAAC,gBAAgB;KACxC,CAAC,CAAC;AACL,CAAC"}

package/dist/tools/init-chain.d.ts

@@ -0,0 +1,10 @@
+import type { ServerContext } from '../context.js';
+export declare function handleInitChain(args: {
+    specification_hash?: string;
+}, ctx: ServerContext): Promise<{
+    content: Array<{
+        type: "text";
+        text: string;
+    }>;
+}>;
+//# sourceMappingURL=init-chain.d.ts.map

package/dist/tools/init-chain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"init-chain.d.ts","sourceRoot":"","sources":["../../src/tools/init-chain.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAEnD,wBAAsB,eAAe,CAAC,IAAI,EAAE;IAAE,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAAE,EAAE,GAAG,EAAE,aAAa;;;;;GAQ9F"}

package/dist/tools/init-chain.js

@@ -0,0 +1,13 @@
+import { sha256Str } from '../crypto/hash.js';
+import { createGenesisEvent } from '../core/chain.js';
+export async function handleInitChain(args, ctx) {
+    if (ctx.chainInitialized)
+        return ctx.error('Chain already initialized');
+    const genesis = createGenesisEvent(ctx.chainKP, args.specification_hash ?? sha256Str('AGA Protocol Specification v2.0.0'));
+    await ctx.storage.storeEvent(genesis);
+    ctx.chainInitialized = true;
+    ctx.portal.sequenceCounter = 0;
+    ctx.portal.lastLeafHash = genesis.leaf_hash;
+    return ctx.json({ success: true, genesis_event_id: genesis.event_id, genesis_leaf_hash: genesis.leaf_hash });
+}
+//# sourceMappingURL=init-chain.js.map

package/dist/tools/init-chain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"init-chain.js","sourceRoot":"","sources":["../../src/tools/init-chain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAGtD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAqC,EAAE,GAAkB;IAC7F,IAAI,GAAG,CAAC,gBAAgB;QAAE,OAAO,GAAG,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;IACxE,MAAM,OAAO,GAAG,kBAAkB,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,kBAAkB,IAAI,SAAS,CAAC,mCAAmC,CAAC,CAAC,CAAC;IAC3H,MAAM,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IACtC,GAAG,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAC5B,GAAG,CAAC,MAAM,CAAC,eAAe,GAAG,CAAC,CAAC;IAC/B,GAAG,CAAC,MAAM,CAAC,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC;IAC5C,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,CAAC,QAAQ,EAAE,iBAAiB,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;AAC/G,CAAC"}

package/dist/tools/measure-behavior.d.ts

@@ -0,0 +1,12 @@
+import type { ServerContext } from '../context.js';
+export interface MeasureBehaviorArgs {
+    tool_name?: string;
+    record_only?: boolean;
+}
+export declare function handleMeasureBehavior(args: MeasureBehaviorArgs, ctx: ServerContext): Promise<{
+    content: Array<{
+        type: "text";
+        text: string;
+    }>;
+}>;
+//# sourceMappingURL=measure-behavior.d.ts.map

package/dist/tools/measure-behavior.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"measure-behavior.d.ts","sourceRoot":"","sources":["../../src/tools/measure-behavior.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAEnD,MAAM,WAAW,mBAAmB;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,aAAa;;;;;GA4BxF"}

package/dist/tools/measure-behavior.js

@@ -0,0 +1,29 @@
+import { sha256Str } from '../crypto/hash.js';
+export async function handleMeasureBehavior(args, ctx) {
+    // If a tool_name is provided, record the invocation first
+    if (args.tool_name) {
+        ctx.behavioralMonitor.recordInvocation(args.tool_name, sha256Str(args.tool_name));
+    }
+    // If record_only, just acknowledge the recording
+    if (args.record_only) {
+        return ctx.json({
+            success: true,
+            recorded: args.tool_name,
+            record_only: true,
+        });
+    }
+    // Measure behavioral patterns
+    const measurement = ctx.behavioralMonitor.measure();
+    if (measurement.drift_detected) {
+        await ctx.appendToChain('BEHAVIORAL_DRIFT', {
+            violations: measurement.violations,
+            behavioral_hash: measurement.behavioral_hash,
+        });
+    }
+    return ctx.json({
+        success: true,
+        ...measurement,
+        violation_count: measurement.violations.length,
+    });
+}
+//# sourceMappingURL=measure-behavior.js.map

package/dist/tools/measure-behavior.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"measure-behavior.js","sourceRoot":"","sources":["../../src/tools/measure-behavior.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAQ9C,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAAyB,EAAE,GAAkB;IACvF,0DAA0D;IAC1D,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,GAAG,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IACpF,CAAC;IAED,iDAAiD;IACjD,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,OAAO,GAAG,CAAC,IAAI,CAAC;YACd,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,IAAI,CAAC,SAAS;YACxB,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;IACL,CAAC;IAED,8BAA8B;IAC9B,MAAM,WAAW,GAAG,GAAG,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;IACpD,IAAI,WAAW,CAAC,cAAc,EAAE,CAAC;QAC/B,MAAM,GAAG,CAAC,aAAa,CAAC,kBAAkB,EAAE;YAC1C,UAAU,EAAE,WAAW,CAAC,UAAU;YAClC,eAAe,EAAE,WAAW,CAAC,eAAe;SAC7C,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC;QACd,OAAO,EAAE,IAAI;QACb,GAAG,WAAW;QACd,eAAe,EAAE,WAAW,CAAC,UAAU,CAAC,MAAM;KAC/C,CAAC,CAAC;AACL,CAAC"}

package/dist/tools/measure-subject.d.ts

@@ -0,0 +1,15 @@
+import type { ServerContext } from '../context.js';
+import type { SubjectMetadata } from '../core/types.js';
+export interface MeasureSubjectArgs {
+    subject_content?: string;
+    subject_bytes_hash?: string;
+    subject_metadata_hash?: string;
+    subject_metadata?: SubjectMetadata;
+}
+export declare function handleMeasureSubject(args: MeasureSubjectArgs, ctx: ServerContext): Promise<{
+    content: Array<{
+        type: "text";
+        text: string;
+    }>;
+}>;
+//# sourceMappingURL=measure-subject.d.ts.map

package/dist/tools/measure-subject.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"measure-subject.d.ts","sourceRoot":"","sources":["../../src/tools/measure-subject.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAqB,MAAM,kBAAkB,CAAC;AAE3E,MAAM,WAAW,kBAAkB;IACjC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,gBAAgB,CAAC,EAAE,eAAe,CAAC;CACpC;AAED,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,aAAa;;;;;GA0GtF"}

package/dist/tools/measure-subject.js

@@ -0,0 +1,106 @@
+import { hashArtifact } from '../core/artifact.js';
+import { generateReceipt } from '../core/receipt.js';
+import { initQuarantine } from '../core/quarantine.js';
+export async function handleMeasureSubject(args, ctx) {
+    if (!ctx.portal.artifact)
+        return ctx.error('No artifact loaded. Call aga_create_artifact first.');
+    if (ctx.portal.state === 'TERMINATED')
+        return ctx.error('Portal is terminated. Re-attest required.');
+    if (ctx.portal.state === 'SAFE_STATE')
+        return ctx.error('Portal is in safe state. Re-attest required.');
+    let currentBytesHash;
+    let currentMetaHash;
+    let match;
+    if (args.subject_bytes_hash) {
+        // Pre-computed hash mode
+        currentBytesHash = args.subject_bytes_hash;
+        currentMetaHash = args.subject_metadata_hash ?? ctx.portal.artifact.subject_identifier.metadata_hash;
+        match = currentBytesHash === ctx.portal.artifact.subject_identifier.bytes_hash &&
+            currentMetaHash === ctx.portal.artifact.subject_identifier.metadata_hash;
+        if (!match && ctx.portal.state === 'ACTIVE_MONITORING') {
+            ctx.portal.state = 'DRIFT_DETECTED';
+        }
+    }
+    else if (args.subject_content) {
+        // Content mode - use portal.measure()
+        const result = ctx.portal.measure(new TextEncoder().encode(args.subject_content), args.subject_metadata ?? {});
+        currentBytesHash = result.currentBytesHash;
+        currentMetaHash = result.currentMetaHash;
+        match = result.match;
+        if (!result.ttl_ok) {
+            ctx.measurementCount++;
+            const receipt = generateReceipt({
+                subjectId: ctx.portal.artifact.subject_identifier, artifactRef: hashArtifact(ctx.portal.artifact),
+                currentHash: 'UNAVAILABLE', sealedHash: `${result.expectedBytesHash}||${result.expectedMetaHash}`,
+                driftDetected: true, driftDescription: 'TTL expired - fail-closed termination', action: 'TERMINATE',
+                measurementType: ctx.portal.artifact.enforcement_parameters.measurement_types.join(','),
+                seq: ctx.portal.sequenceCounter + 1, prevLeaf: ctx.portal.lastLeafHash, portalKP: ctx.portalKP,
+            });
+            await ctx.storage.storeReceipt(receipt);
+            await ctx.appendToChain('INTERACTION_RECEIPT', { receipt_id: receipt.receipt_id, drift_detected: true, enforcement_action: 'TERMINATE' });
+            return ctx.json({ success: true, match: false, drift_detected: true, ttl_ok: false, revoked: false, enforcement_action: 'TERMINATE', portal_state: ctx.portal.state, receipt_id: receipt.receipt_id, measurement_count: ctx.measurementCount });
+        }
+        if (result.revoked) {
+            ctx.measurementCount++;
+            const receipt = generateReceipt({
+                subjectId: ctx.portal.artifact.subject_identifier, artifactRef: hashArtifact(ctx.portal.artifact),
+                currentHash: 'UNAVAILABLE', sealedHash: `${result.expectedBytesHash}||${result.expectedMetaHash}`,
+                driftDetected: true, driftDescription: 'Artifact revoked - fail-closed termination', action: 'TERMINATE',
+                measurementType: ctx.portal.artifact.enforcement_parameters.measurement_types.join(','),
+                seq: ctx.portal.sequenceCounter + 1, prevLeaf: ctx.portal.lastLeafHash, portalKP: ctx.portalKP,
+            });
+            await ctx.storage.storeReceipt(receipt);
+            await ctx.appendToChain('INTERACTION_RECEIPT', { receipt_id: receipt.receipt_id, drift_detected: true, enforcement_action: 'TERMINATE' });
+            return ctx.json({ success: true, match: false, drift_detected: true, ttl_ok: true, revoked: true, enforcement_action: 'TERMINATE', portal_state: ctx.portal.state, receipt_id: receipt.receipt_id, measurement_count: ctx.measurementCount });
+        }
+    }
+    else {
+        return ctx.error('Provide either subject_content or subject_bytes_hash');
+    }
+    const artRef = hashArtifact(ctx.portal.artifact);
+    const currentStr = `${currentBytesHash}||${currentMetaHash}`;
+    const sealedStr = `${ctx.portal.artifact.subject_identifier.bytes_hash}||${ctx.portal.artifact.subject_identifier.metadata_hash}`;
+    let action = null;
+    let driftDesc = null;
+    if (!match) {
+        driftDesc = 'Subject modified - hash mismatch';
+        action = ctx.portal.artifact.enforcement_parameters.enforcement_triggers[0] ?? 'ALERT_ONLY';
+        if (ctx.portal.state === 'DRIFT_DETECTED') {
+            ctx.portal.enforce(action);
+        }
+        if (action === 'QUARANTINE')
+            ctx.quarantine = initQuarantine();
+    }
+    ctx.measurementCount++;
+    const receipt = generateReceipt({
+        subjectId: ctx.portal.artifact.subject_identifier,
+        artifactRef: artRef,
+        currentHash: currentStr,
+        sealedHash: sealedStr,
+        driftDetected: !match,
+        driftDescription: driftDesc,
+        action,
+        measurementType: ctx.portal.artifact.enforcement_parameters.measurement_types.join(','),
+        seq: ctx.portal.sequenceCounter + 1,
+        prevLeaf: ctx.portal.lastLeafHash,
+        portalKP: ctx.portalKP,
+    });
+    await ctx.storage.storeReceipt(receipt);
+    await ctx.appendToChain('INTERACTION_RECEIPT', {
+        receipt_id: receipt.receipt_id,
+        drift_detected: !match,
+        enforcement_action: action,
+    });
+    return ctx.json({
+        success: true,
+        match,
+        drift_detected: !match,
+        ttl_ok: true,
+        revoked: false,
+        enforcement_action: action,
+        portal_state: ctx.portal.state,
+        receipt_id: receipt.receipt_id,
+        measurement_count: ctx.measurementCount,
+    });
+}
+//# sourceMappingURL=measure-subject.js.map

package/dist/tools/measure-subject.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"measure-subject.js","sourceRoot":"","sources":["../../src/tools/measure-subject.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAYvD,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAAwB,EAAE,GAAkB;IACrF,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ;QAAE,OAAO,GAAG,CAAC,KAAK,CAAC,qDAAqD,CAAC,CAAC;IAClG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,YAAY;QAAE,OAAO,GAAG,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;IACrG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,YAAY;QAAE,OAAO,GAAG,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAExG,IAAI,gBAAwB,CAAC;IAC7B,IAAI,eAAuB,CAAC;IAC5B,IAAI,KAAc,CAAC;IAEnB,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC5B,yBAAyB;QACzB,gBAAgB,GAAG,IAAI,CAAC,kBAAkB,CAAC;QAC3C,eAAe,GAAG,IAAI,CAAC,qBAAqB,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,aAAa,CAAC;QACrG,KAAK,GAAG,gBAAgB,KAAK,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,UAAU;YACtE,eAAe,KAAK,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,aAAa,CAAC;QACjF,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,mBAAmB,EAAE,CAAC;YACtD,GAAG,CAAC,MAAc,CAAC,KAAK,GAAG,gBAAgB,CAAC;QAC/C,CAAC;IACH,CAAC;SAAM,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;QAChC,sCAAsC;QACtC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,CAC/B,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,EAC9C,IAAI,CAAC,gBAAgB,IAAI,EAAE,CAC5B,CAAC;QACF,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,CAAC;QAC3C,eAAe,GAAG,MAAM,CAAC,eAAe,CAAC;QACzC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QACrB,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,GAAG,CAAC,gBAAgB,EAAE,CAAC;YACvB,MAAM,OAAO,GAAG,eAAe,CAAC;gBAC9B,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,EAAE,WAAW,EAAE,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC;gBACjG,WAAW,EAAE,aAAa,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,iBAAiB,KAAK,MAAM,CAAC,gBAAgB,EAAE;gBACjG,aAAa,EAAE,IAAI,EAAE,gBAAgB,EAAE,uCAAuC,EAAE,MAAM,EAAE,WAAW;gBACnG,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC;gBACvF,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,eAAe,GAAG,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ;aAC/F,CAAC,CAAC;YACH,MAAM,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;YACxC,MAAM,GAAG,CAAC,aAAa,CAAC,qBAAqB,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,cAAc,EAAE,IAAI,EAAE,kBAAkB,EAAE,WAAW,EAAE,CAAC,CAAC;YAC1I,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,iBAAiB,EAAE,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAClP,CAAC;QACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,GAAG,CAAC,gBAAgB,EAAE,CAAC;YACvB,MAAM,OAAO,GAAG,eAAe,CAAC;gBAC9B,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,EAAE,WAAW,EAAE,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC;gBACjG,WAAW,EAAE,aAAa,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,iBAAiB,KAAK,MAAM,CAAC,gBAAgB,EAAE;gBACjG,aAAa,EAAE,IAAI,EAAE,gBAAgB,EAAE,4CAA4C,EAAE,MAAM,EAAE,WAAW;gBACxG,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC;gBACvF,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,eAAe,GAAG,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ;aAC/F,CAAC,CAAC;YACH,MAAM,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;YACxC,MAAM,GAAG,CAAC,aAAa,CAAC,qBAAqB,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,cAAc,EAAE,IAAI,EAAE,kBAAkB,EAAE,WAAW,EAAE,CAAC,CAAC;YAC1I,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,iBAAiB,EAAE,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAChP,CAAC;IACH,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,CAAC,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACjD,MAAM,UAAU,GAAG,GAAG,gBAAgB,KAAK,eAAe,EAAE,CAAC;IAC7D,MAAM,SAAS,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,UAAU,KAAK,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,aAAa,EAAE,CAAC;IAElI,IAAI,MAAM,GAA6B,IAAI,CAAC;IAC5C,IAAI,SAAS,GAAkB,IAAI,CAAC;IAEpC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,SAAS,GAAG,kCAAkC,CAAC;QAC/C,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC;QAC5F,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,gBAAgB,EAAE,CAAC;YAC1C,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC7B,CAAC;QACD,IAAI,MAAM,KAAK,YAAY;YAAE,GAAG,CAAC,UAAU,GAAG,cAAc,EAAE,CAAC;IACjE,CAAC;IAED,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAEvB,MAAM,OAAO,GAAG,eAAe,CAAC;QAC9B,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB;QACjD,WAAW,EAAE,MAAM;QACnB,WAAW,EAAE,UAAU;QACvB,UAAU,EAAE,SAAS;QACrB,aAAa,EAAE,CAAC,KAAK;QACrB,gBAAgB,EAAE,SAAS;QAC3B,MAAM;QACN,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC;QACvF,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,eAAe,GAAG,CAAC;QACnC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,YAAY;QACjC,QAAQ,EAAE,GAAG,CAAC,QAAQ;KACvB,CAAC,CAAC;IACH,MAAM,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,GAAG,CAAC,aAAa,CAAC,qBAAqB,EAAE;QAC7C,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,cAAc,EAAE,CAAC,KAAK;QACtB,kBAAkB,EAAE,MAAM;KAC3B,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC,IAAI,CAAC;QACd,OAAO,EAAE,IAAI;QACb,KAAK;QACL,cAAc,EAAE,CAAC,KAAK;QACtB,MAAM,EAAE,IAAI;QACZ,OAAO,EAAE,KAAK;QACd,kBAAkB,EAAE,MAAM;QAC1B,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK;QAC9B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,iBAAiB,EAAE,GAAG,CAAC,gBAAgB;KACxC,CAAC,CAAC;AACL,CAAC"}

package/dist/tools/quarantine-status.d.ts

@@ -0,0 +1,8 @@
+import type { ServerContext } from '../context.js';
+export declare function handleQuarantineStatus(_args: Record<string, never>, ctx: ServerContext): Promise<{
+    content: Array<{
+        type: "text";
+        text: string;
+    }>;
+}>;
+//# sourceMappingURL=quarantine-status.d.ts.map

package/dist/tools/quarantine-status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"quarantine-status.d.ts","sourceRoot":"","sources":["../../src/tools/quarantine-status.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAEnD,wBAAsB,sBAAsB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,GAAG,EAAE,aAAa;;;;;GAe5F"}

package/dist/tools/quarantine-status.js

@@ -0,0 +1,16 @@
+export async function handleQuarantineStatus(_args, ctx) {
+    if (ctx.portal.state !== 'PHANTOM_QUARANTINE' && !ctx.quarantine?.active) {
+        return ctx.error('Quarantine status unavailable - portal is not in quarantine state', {
+            portal_state: ctx.portal.state,
+        });
+    }
+    return ctx.json({
+        quarantine_active: ctx.quarantine?.active ?? false,
+        started_at: ctx.quarantine?.started_at ?? null,
+        inputs_captured: ctx.quarantine?.inputs_captured ?? 0,
+        outputs_severed: ctx.quarantine?.outputs_severed ?? false,
+        forensic_buffer_size: ctx.quarantine?.forensic_buffer.length ?? 0,
+        portal_state: ctx.portal.state,
+    });
+}
+//# sourceMappingURL=quarantine-status.js.map

package/dist/tools/quarantine-status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"quarantine-status.js","sourceRoot":"","sources":["../../src/tools/quarantine-status.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAA4B,EAAE,GAAkB;IAC3F,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,oBAAoB,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QACzE,OAAO,GAAG,CAAC,KAAK,CAAC,mEAAmE,EAAE;YACpF,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK;SAC/B,CAAC,CAAC;IACL,CAAC;IAED,OAAO,GAAG,CAAC,IAAI,CAAC;QACd,iBAAiB,EAAE,GAAG,CAAC,UAAU,EAAE,MAAM,IAAI,KAAK;QAClD,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,UAAU,IAAI,IAAI;QAC9C,eAAe,EAAE,GAAG,CAAC,UAAU,EAAE,eAAe,IAAI,CAAC;QACrD,eAAe,EAAE,GAAG,CAAC,UAAU,EAAE,eAAe,IAAI,KAAK;QACzD,oBAAoB,EAAE,GAAG,CAAC,UAAU,EAAE,eAAe,CAAC,MAAM,IAAI,CAAC;QACjE,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK;KAC/B,CAAC,CAAC;AACL,CAAC"}

package/dist/tools/revoke-artifact.d.ts

@@ -0,0 +1,13 @@
+import type { ServerContext } from '../context.js';
+export interface RevokeArtifactArgs {
+    sealed_hash?: string;
+    reason: string;
+    transition_to?: 'TERMINATED' | 'SAFE_STATE';
+}
+export declare function handleRevokeArtifact(args: RevokeArtifactArgs, ctx: ServerContext): Promise<{
+    content: Array<{
+        type: "text";
+        text: string;
+    }>;
+}>;
+//# sourceMappingURL=revoke-artifact.d.ts.map

package/dist/tools/revoke-artifact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"revoke-artifact.d.ts","sourceRoot":"","sources":["../../src/tools/revoke-artifact.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAGnD,MAAM,WAAW,kBAAkB;IACjC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,YAAY,GAAG,YAAY,CAAC;CAC7C;AAED,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,aAAa;;;;;GAsBtF"}

package/dist/tools/revoke-artifact.js

@@ -0,0 +1,24 @@
+import { pkToHex } from '../crypto/sign.js';
+import { utcNow } from '../utils/timestamp.js';
+export async function handleRevokeArtifact(args, ctx) {
+    const sealedHash = args.sealed_hash ?? ctx.activeArtifact?.sealed_hash;
+    if (!sealedHash)
+        return ctx.error('No sealed_hash provided and no active artifact.');
+    const transition = args.transition_to ?? 'TERMINATED';
+    ctx.portal.revoke(sealedHash, transition);
+    const record = {
+        artifact_sealed_hash: sealedHash,
+        reason: args.reason,
+        revoked_by: pkToHex(ctx.issuerKP.publicKey),
+        timestamp: utcNow(),
+    };
+    await ctx.appendToChain('REVOCATION', { ...record, transition_to: transition });
+    return ctx.json({
+        success: true,
+        revoked: sealedHash,
+        portal_state: ctx.portal.state,
+        reason: args.reason,
+        transition_to: transition,
+    });
+}
+//# sourceMappingURL=revoke-artifact.js.map

package/dist/tools/revoke-artifact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"revoke-artifact.js","sourceRoot":"","sources":["../../src/tools/revoke-artifact.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAU/C,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAAwB,EAAE,GAAkB;IACrF,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,IAAI,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC;IACvE,IAAI,CAAC,UAAU;QAAE,OAAO,GAAG,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;IAErF,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,IAAI,YAAY,CAAC;IACtD,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IAE1C,MAAM,MAAM,GAAqB;QAC/B,oBAAoB,EAAE,UAAU;QAChC,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC3C,SAAS,EAAE,MAAM,EAAE;KACpB,CAAC;IACF,MAAM,GAAG,CAAC,aAAa,CAAC,YAAY,EAAE,EAAE,GAAG,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC,CAAC;IAEhF,OAAO,GAAG,CAAC,IAAI,CAAC;QACd,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,UAAU;QACnB,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK;QAC9B,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,aAAa,EAAE,UAAU;KAC1B,CAAC,CAAC;AACL,CAAC"}

package/dist/tools/rotate-keys.d.ts

@@ -0,0 +1,13 @@
+import type { ServerContext } from '../context.js';
+export interface RotateKeysArgs {
+    key_type?: 'issuer' | 'portal' | 'chain';
+    keypair?: 'issuer' | 'portal' | 'chain';
+    reason?: string;
+}
+export declare function handleRotateKeys(args: RotateKeysArgs, ctx: ServerContext): Promise<{
+    content: Array<{
+        type: "text";
+        text: string;
+    }>;
+}>;
+//# sourceMappingURL=rotate-keys.d.ts.map

package/dist/tools/rotate-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rotate-keys.d.ts","sourceRoot":"","sources":["../../src/tools/rotate-keys.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAEnD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC;IACzC,OAAO,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,aAAa;;;;;GAsC9E"}

package/dist/tools/rotate-keys.js

@@ -0,0 +1,39 @@
+import { rotateKeys } from '../core/identity.js';
+export async function handleRotateKeys(args, ctx) {
+    const keyType = args.key_type ?? args.keypair;
+    if (!keyType)
+        return ctx.error('Provide key_type or keypair parameter.');
+    let result;
+    switch (keyType) {
+        case 'issuer':
+            result = rotateKeys(ctx.issuerKP);
+            ctx.issuerKP = result.newKeyPair;
+            break;
+        case 'portal':
+            result = rotateKeys(ctx.portalKP);
+            ctx.portalKP = result.newKeyPair;
+            break;
+        case 'chain':
+            result = rotateKeys(ctx.chainKP);
+            ctx.chainKP = result.newKeyPair;
+            break;
+        default:
+            return ctx.error(`Invalid key_type: ${keyType}. Must be issuer, portal, or chain.`);
+    }
+    await ctx.appendToChain('KEY_ROTATION', {
+        key_type: keyType,
+        old_public_key: result.oldPublicKeyHex,
+        new_public_key: result.newPublicKeyHex,
+        rotated_at: result.rotatedAt,
+        reason: args.reason ?? 'Key rotation',
+    });
+    return ctx.json({
+        success: true,
+        key_type: keyType,
+        old_public_key: result.oldPublicKeyHex,
+        new_public_key: result.newPublicKeyHex,
+        rotated_at: result.rotatedAt,
+        reason: args.reason,
+    });
+}
+//# sourceMappingURL=rotate-keys.js.map

package/dist/tools/rotate-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rotate-keys.js","sourceRoot":"","sources":["../../src/tools/rotate-keys.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AASjD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAoB,EAAE,GAAkB;IAC7E,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC;IAC9C,IAAI,CAAC,OAAO;QAAE,OAAO,GAAG,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAEzE,IAAI,MAAM,CAAC;IACX,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,QAAQ;YACX,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACjC,GAAW,CAAC,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC;YAC1C,MAAM;QACR,KAAK,QAAQ;YACX,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACjC,GAAW,CAAC,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC;YAC1C,MAAM;QACR,KAAK,OAAO;YACV,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAChC,GAAW,CAAC,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC;YACzC,MAAM;QACR;YACE,OAAO,GAAG,CAAC,KAAK,CAAC,qBAAqB,OAAO,qCAAqC,CAAC,CAAC;IACxF,CAAC;IAED,MAAM,GAAG,CAAC,aAAa,CAAC,cAAc,EAAE;QACtC,QAAQ,EAAE,OAAO;QACjB,cAAc,EAAE,MAAM,CAAC,eAAe;QACtC,cAAc,EAAE,MAAM,CAAC,eAAe;QACtC,UAAU,EAAE,MAAM,CAAC,SAAS;QAC5B,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,cAAc;KACtC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC,IAAI,CAAC;QACd,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,OAAO;QACjB,cAAc,EAAE,MAAM,CAAC,eAAe;QACtC,cAAc,EAAE,MAAM,CAAC,eAAe;QACtC,UAAU,EAAE,MAAM,CAAC,SAAS;QAC5B,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,CAAC,CAAC;AACL,CAAC"}

package/dist/tools/server-info.d.ts

@@ -0,0 +1,8 @@
+import type { ServerContext } from '../context.js';
+export declare function handleServerInfo(_args: Record<string, never>, ctx: ServerContext): Promise<{
+    content: Array<{
+        type: "text";
+        text: string;
+    }>;
+}>;
+//# sourceMappingURL=server-info.d.ts.map

package/dist/tools/server-info.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-info.d.ts","sourceRoot":"","sources":["../../src/tools/server-info.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAEnD,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,GAAG,EAAE,aAAa;;;;;GAoBtF"}

package/dist/tools/server-info.js

@@ -0,0 +1,23 @@
+import { pkToHex } from '../crypto/sign.js';
+export async function handleServerInfo(_args, ctx) {
+    return ctx.json({
+        server: 'AGA MCP Server',
+        version: '2.0.0',
+        protocol: 'Attested Governance Artifacts v2.0.0',
+        nist_references: ['NIST-2025-0035', 'NCCoE AI Agent Identity'],
+        framework_alignment: {
+            spiffe: 'SPIFFE provides workload identity (SVID); AGA binds governance to workload intent',
+            nist_sp_800_57: 'Key management aligned with SP 800-57 recommendations',
+            nist_ai_rmf: 'AI Risk Management Framework: Govern, Map, Measure, Manage',
+        },
+        issuer_public_key: pkToHex(ctx.issuerKP.publicKey),
+        portal_public_key: pkToHex(ctx.portalKP.publicKey),
+        chain_public_key: pkToHex(ctx.chainKP.publicKey),
+        chain_initialized: ctx.chainInitialized,
+        portal_state: ctx.portal.state,
+        verification_tier: ctx.verificationTier,
+        measurement_count: ctx.measurementCount,
+        uptime_ms: Date.now() - Date.parse(ctx.startTime),
+    });
+}
+//# sourceMappingURL=server-info.js.map

package/dist/tools/server-info.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-info.js","sourceRoot":"","sources":["../../src/tools/server-info.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAG5C,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAA4B,EAAE,GAAkB;IACrF,OAAO,GAAG,CAAC,IAAI,CAAC;QACd,MAAM,EAAE,gBAAgB;QACxB,OAAO,EAAE,OAAO;QAChB,QAAQ,EAAE,sCAAsC;QAChD,eAAe,EAAE,CAAC,gBAAgB,EAAE,yBAAyB,CAAC;QAC9D,mBAAmB,EAAE;YACnB,MAAM,EAAE,mFAAmF;YAC3F,cAAc,EAAE,uDAAuD;YACvE,WAAW,EAAE,4DAA4D;SAC1E;QACD,iBAAiB,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;QAClD,iBAAiB,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;QAClD,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC;QAChD,iBAAiB,EAAE,GAAG,CAAC,gBAAgB;QACvC,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK;QAC9B,iBAAiB,EAAE,GAAG,CAAC,gBAAgB;QACvC,iBAAiB,EAAE,GAAG,CAAC,gBAAgB;QACvC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC;KAClD,CAAC,CAAC;AACL,CAAC"}

package/dist/tools/set-verification-tier.d.ts

@@ -0,0 +1,11 @@
+import type { ServerContext } from '../context.js';
+export interface SetVerificationTierArgs {
+    tier: 'BRONZE' | 'SILVER' | 'GOLD';
+}
+export declare function handleSetVerificationTier(args: SetVerificationTierArgs, ctx: ServerContext): Promise<{
+    content: Array<{
+        type: "text";
+        text: string;
+    }>;
+}>;
+//# sourceMappingURL=set-verification-tier.d.ts.map

package/dist/tools/set-verification-tier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"set-verification-tier.d.ts","sourceRoot":"","sources":["../../src/tools/set-verification-tier.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAEnD,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;CACpC;AAiBD,wBAAsB,yBAAyB,CAAC,IAAI,EAAE,uBAAuB,EAAE,GAAG,EAAE,aAAa;;;;;GAehG"}

package/dist/tools/set-verification-tier.js

@@ -0,0 +1,31 @@
+const TIER_DESCRIPTIONS = {
+    BRONZE: {
+        description: 'Cryptographic signatures only - artifact and receipt verification via Ed25519',
+        trust_assumption: 'Trust that signing keys are not compromised',
+    },
+    SILVER: {
+        description: 'Signatures plus continuity chain verification - tamper-evident event linkage',
+        trust_assumption: 'Trust the chain operator plus key integrity',
+    },
+    GOLD: {
+        description: 'Full verification with blockchain-anchored Merkle proofs - offline-verifiable evidence bundles',
+        trust_assumption: 'Minimal trust - cryptographic proof anchored to immutable external ledger',
+    },
+};
+export async function handleSetVerificationTier(args, ctx) {
+    const validTiers = ['BRONZE', 'SILVER', 'GOLD'];
+    if (!validTiers.includes(args.tier)) {
+        return ctx.error(`Invalid tier: ${args.tier}. Must be BRONZE, SILVER, or GOLD.`);
+    }
+    const previousTier = ctx.verificationTier;
+    ctx.verificationTier = args.tier;
+    const info = TIER_DESCRIPTIONS[args.tier];
+    return ctx.json({
+        success: true,
+        previous_tier: previousTier,
+        current_tier: ctx.verificationTier,
+        description: info.description,
+        trust_assumption: info.trust_assumption,
+    });
+}
+//# sourceMappingURL=set-verification-tier.js.map

package/dist/tools/set-verification-tier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"set-verification-tier.js","sourceRoot":"","sources":["../../src/tools/set-verification-tier.ts"],"names":[],"mappings":"AAMA,MAAM,iBAAiB,GAAsE;IAC3F,MAAM,EAAE;QACN,WAAW,EAAE,+EAA+E;QAC5F,gBAAgB,EAAE,6CAA6C;KAChE;IACD,MAAM,EAAE;QACN,WAAW,EAAE,8EAA8E;QAC3F,gBAAgB,EAAE,6CAA6C;KAChE;IACD,IAAI,EAAE;QACJ,WAAW,EAAE,gGAAgG;QAC7G,gBAAgB,EAAE,2EAA2E;KAC9F;CACF,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,IAA6B,EAAE,GAAkB;IAC/F,MAAM,UAAU,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAU,CAAC;IACzD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAW,CAAC,EAAE,CAAC;QAC3C,OAAO,GAAG,CAAC,KAAK,CAAC,iBAAiB,IAAI,CAAC,IAAI,oCAAoC,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,YAAY,GAAG,GAAG,CAAC,gBAAgB,CAAC;IAC1C,GAAG,CAAC,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC;IACjC,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,OAAO,GAAG,CAAC,IAAI,CAAC;QACd,OAAO,EAAE,IAAI;QACb,aAAa,EAAE,YAAY;QAC3B,YAAY,EAAE,GAAG,CAAC,gBAAgB;QAClC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;KACxC,CAAC,CAAC;AACL,CAAC"}

package/dist/tools/start-monitoring.d.ts

@@ -0,0 +1,12 @@
+import type { ServerContext } from '../context.js';
+import type { BehavioralBaseline } from '../core/behavioral.js';
+export interface StartMonitoringArgs {
+    behavioral_baseline?: BehavioralBaseline;
+}
+export declare function handleStartMonitoring(args: StartMonitoringArgs, ctx: ServerContext): Promise<{
+    content: Array<{
+        type: "text";
+        text: string;
+    }>;
+}>;
+//# sourceMappingURL=start-monitoring.d.ts.map

package/dist/tools/start-monitoring.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"start-monitoring.d.ts","sourceRoot":"","sources":["../../src/tools/start-monitoring.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAEhE,MAAM,WAAW,mBAAmB;IAClC,mBAAmB,CAAC,EAAE,kBAAkB,CAAC;CAC1C;AAED,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,aAAa;;;;;GAexF"}

package/dist/tools/start-monitoring.js

@@ -0,0 +1,17 @@
+export async function handleStartMonitoring(args, ctx) {
+    if (!ctx.portal.artifact)
+        return ctx.error('No artifact loaded. Call aga_create_artifact first.');
+    if (ctx.portal.state !== 'ACTIVE_MONITORING')
+        return ctx.error(`Cannot start monitoring in state ${ctx.portal.state}`);
+    ctx.behavioralMonitor.reset();
+    if (args.behavioral_baseline) {
+        ctx.behavioralMonitor.setBaseline(args.behavioral_baseline);
+    }
+    return ctx.json({
+        success: true,
+        portal_state: ctx.portal.state,
+        monitoring_active: true,
+        baseline_set: !!args.behavioral_baseline,
+    });
+}
+//# sourceMappingURL=start-monitoring.js.map

package/dist/tools/start-monitoring.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"start-monitoring.js","sourceRoot":"","sources":["../../src/tools/start-monitoring.ts"],"names":[],"mappings":"AAOA,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAAyB,EAAE,GAAkB;IACvF,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ;QAAE,OAAO,GAAG,CAAC,KAAK,CAAC,qDAAqD,CAAC,CAAC;IAClG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,mBAAmB;QAAE,OAAO,GAAG,CAAC,KAAK,CAAC,oCAAoC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IAEvH,GAAG,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC;IAC9B,IAAI,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC7B,GAAG,CAAC,iBAAiB,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAC9D,CAAC;IAED,OAAO,GAAG,CAAC,IAAI,CAAC;QACd,OAAO,EAAE,IAAI;QACb,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK;QAC9B,iBAAiB,EAAE,IAAI;QACvB,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB;KACzC,CAAC,CAAC;AACL,CAAC"}

package/dist/tools/trigger-measurement.d.ts

@@ -0,0 +1,15 @@
+import type { ServerContext } from '../context.js';
+export interface TriggerMeasurementArgs {
+    subject_content?: string;
+    subject_bytes_hash?: string;
+    subject_metadata_hash?: string;
+    measurement_type?: string;
+    subject_metadata?: Record<string, string>;
+}
+export declare function handleTriggerMeasurement(args: TriggerMeasurementArgs, ctx: ServerContext): Promise<{
+    content: Array<{
+        type: "text";
+        text: string;
+    }>;
+}>;
+//# sourceMappingURL=trigger-measurement.d.ts.map

package/dist/tools/trigger-measurement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trigger-measurement.d.ts","sourceRoot":"","sources":["../../src/tools/trigger-measurement.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAGnD,MAAM,WAAW,sBAAsB;IACrC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC3C;AAED,wBAAsB,wBAAwB,CAAC,IAAI,EAAE,sBAAsB,EAAE,GAAG,EAAE,aAAa;;;;;GA2E9F"}