@attested-intelligence/aga-mcp-server 0.1.1 → 2.0.1

package/dist/tools/trigger-measurement.js

@@ -0,0 +1,86 @@
+import { hashArtifact } from '../core/artifact.js';
+import { generateReceipt } from '../core/receipt.js';
+import { initQuarantine } from '../core/quarantine.js';
+export async function handleTriggerMeasurement(args, ctx) {
+    if (!ctx.portal.artifact)
+        return ctx.error('No artifact loaded.');
+    if (ctx.portal.state === 'TERMINATED' || ctx.portal.state === 'SAFE_STATE') {
+        return ctx.error(`Portal is ${ctx.portal.state}. Artifact revoked or expired.`);
+    }
+    let match;
+    let action = null;
+    let driftDesc = null;
+    let currentHash = 'UNAVAILABLE';
+    if (args.subject_bytes_hash) {
+        // Pre-computed hash mode
+        const bMatch = args.subject_bytes_hash === ctx.portal.artifact.subject_identifier.bytes_hash;
+        const mMatch = !args.subject_metadata_hash || args.subject_metadata_hash === ctx.portal.artifact.subject_identifier.metadata_hash;
+        match = bMatch && mMatch;
+        currentHash = args.subject_bytes_hash;
+        if (!match && ctx.portal.state === 'ACTIVE_MONITORING') {
+            ctx.portal.state = 'DRIFT_DETECTED';
+        }
+    }
+    else if (args.subject_content) {
+        const meta = args.subject_metadata ?? {};
+        const result = ctx.portal.measure(new TextEncoder().encode(args.subject_content), meta);
+        match = result.match;
+        currentHash = result.currentBytesHash || 'UNAVAILABLE';
+        if (!result.ttl_ok) {
+            driftDesc = 'TTL expired';
+            action = 'TERMINATE';
+            match = false;
+        }
+        else if (result.revoked) {
+            driftDesc = 'Artifact revoked';
+            action = 'TERMINATE';
+            match = false;
+        }
+    }
+    else {
+        return ctx.error('Provide either subject_content or subject_bytes_hash');
+    }
+    if (!match && !action) {
+        driftDesc = 'Subject modified - hash mismatch';
+        action = ctx.portal.artifact.enforcement_parameters.enforcement_triggers[0] ?? 'ALERT_ONLY';
+        if (ctx.portal.state === 'DRIFT_DETECTED') {
+            ctx.portal.enforce(action);
+        }
+        if (action === 'QUARANTINE')
+            ctx.quarantine = initQuarantine();
+    }
+    ctx.measurementCount++;
+    const artRef = hashArtifact(ctx.portal.artifact);
+    const mType = args.measurement_type ?? ctx.portal.artifact.enforcement_parameters.measurement_types[0] ?? 'FILE_SYSTEM_STATE';
+    const receipt = generateReceipt({
+        subjectId: ctx.portal.artifact.subject_identifier,
+        artifactRef: artRef,
+        currentHash,
+        sealedHash: ctx.portal.artifact.subject_identifier.bytes_hash,
+        driftDetected: !match,
+        driftDescription: driftDesc,
+        action,
+        measurementType: mType,
+        seq: ctx.portal.sequenceCounter + 1,
+        prevLeaf: ctx.portal.lastLeafHash,
+        portalKP: ctx.portalKP,
+    });
+    await ctx.storage.storeReceipt(receipt);
+    await ctx.appendToChain('INTERACTION_RECEIPT', {
+        receipt_id: receipt.receipt_id,
+        drift_detected: !match,
+        enforcement_action: action,
+        measurement_type: mType,
+    });
+    return ctx.json({
+        success: true,
+        match,
+        drift_detected: !match,
+        enforcement_action: action,
+        portal_state: ctx.portal.state,
+        receipt_id: receipt.receipt_id,
+        measurement_type: mType,
+        measurement_count: ctx.measurementCount,
+    });
+}
+//# sourceMappingURL=trigger-measurement.js.map

package/dist/tools/trigger-measurement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trigger-measurement.js","sourceRoot":"","sources":["../../src/tools/trigger-measurement.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAYvD,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,IAA4B,EAAE,GAAkB;IAC7F,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ;QAAE,OAAO,GAAG,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAClE,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,YAAY,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;QAC3E,OAAO,GAAG,CAAC,KAAK,CAAC,aAAa,GAAG,CAAC,MAAM,CAAC,KAAK,gCAAgC,CAAC,CAAC;IAClF,CAAC;IAED,IAAI,KAAc,CAAC;IACnB,IAAI,MAAM,GAA6B,IAAI,CAAC;IAC5C,IAAI,SAAS,GAAkB,IAAI,CAAC;IACpC,IAAI,WAAW,GAAG,aAAa,CAAC;IAEhC,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC5B,yBAAyB;QACzB,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,KAAK,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,UAAU,CAAC;QAC7F,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,qBAAqB,IAAI,IAAI,CAAC,qBAAqB,KAAK,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,aAAa,CAAC;QAClI,KAAK,GAAG,MAAM,IAAI,MAAM,CAAC;QACzB,WAAW,GAAG,IAAI,CAAC,kBAAkB,CAAC;QACtC,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,mBAAmB,EAAE,CAAC;YACtD,GAAG,CAAC,MAAc,CAAC,KAAK,GAAG,gBAAgB,CAAC;QAC/C,CAAC;IACH,CAAC;SAAM,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,IAAI,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,IAAI,CAAC,CAAC;QACxF,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QACrB,WAAW,GAAG,MAAM,CAAC,gBAAgB,IAAI,aAAa,CAAC;QACvD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YAAC,SAAS,GAAG,aAAa,CAAC;YAAC,MAAM,GAAG,WAAW,CAAC;YAAC,KAAK,GAAG,KAAK,CAAC;QAAC,CAAC;aAClF,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YAAC,SAAS,GAAG,kBAAkB,CAAC;YAAC,MAAM,GAAG,WAAW,CAAC;YAAC,KAAK,GAAG,KAAK,CAAC;QAAC,CAAC;IACnG,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,CAAC,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC3E,CAAC;IAED,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QACtB,SAAS,GAAG,kCAAkC,CAAC;QAC/C,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC;QAC5F,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,gBAAgB,EAAE,CAAC;YAC1C,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC7B,CAAC;QACD,IAAI,MAAM,KAAK,YAAY;YAAE,GAAG,CAAC,UAAU,GAAG,cAAc,EAAE,CAAC;IACjE,CAAC;IAED,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,IAAI,CAAC,gBAAgB,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,mBAAmB,CAAC;IAE9H,MAAM,OAAO,GAAG,eAAe,CAAC;QAC9B,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB;QACjD,WAAW,EAAE,MAAM;QACnB,WAAW;QACX,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,UAAU;QAC7D,aAAa,EAAE,CAAC,KAAK;QACrB,gBAAgB,EAAE,SAAS;QAC3B,MAAM;QACN,eAAe,EAAE,KAAK;QACtB,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,eAAe,GAAG,CAAC;QACnC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,YAAY;QACjC,QAAQ,EAAE,GAAG,CAAC,QAAQ;KACvB,CAAC,CAAC;IACH,MAAM,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,GAAG,CAAC,aAAa,CAAC,qBAAqB,EAAE;QAC7C,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,cAAc,EAAE,CAAC,KAAK;QACtB,kBAAkB,EAAE,MAAM;QAC1B,gBAAgB,EAAE,KAAK;KACxB,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC,IAAI,CAAC;QACd,OAAO,EAAE,IAAI;QACb,KAAK;QACL,cAAc,EAAE,CAAC,KAAK;QACtB,kBAAkB,EAAE,MAAM;QAC1B,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK;QAC9B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,gBAAgB,EAAE,KAAK;QACvB,iBAAiB,EAAE,GAAG,CAAC,gBAAgB;KACxC,CAAC,CAAC;AACL,CAAC"}

package/dist/tools/verify-artifact.d.ts

@@ -0,0 +1,13 @@
+import type { ServerContext } from '../context.js';
+import type { PolicyArtifact } from '../core/types.js';
+export interface VerifyArtifactArgs {
+    artifact: PolicyArtifact;
+    issuer_public_key: string;
+}
+export declare function handleVerifyArtifact(args: VerifyArtifactArgs, ctx: ServerContext): Promise<{
+    content: Array<{
+        type: "text";
+        text: string;
+    }>;
+}>;
+//# sourceMappingURL=verify-artifact.d.ts.map

package/dist/tools/verify-artifact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-artifact.d.ts","sourceRoot":"","sources":["../../src/tools/verify-artifact.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEvD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,cAAc,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,aAAa;;;;;GAGtF"}

package/dist/tools/verify-artifact.js

@@ -0,0 +1,6 @@
+import { verifyArtifactSignature } from '../core/artifact.js';
+export async function handleVerifyArtifact(args, ctx) {
+    const valid = verifyArtifactSignature(args.artifact, args.issuer_public_key);
+    return ctx.json({ success: true, signature_valid: valid });
+}
+//# sourceMappingURL=verify-artifact.js.map

package/dist/tools/verify-artifact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-artifact.js","sourceRoot":"","sources":["../../src/tools/verify-artifact.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAS9D,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAAwB,EAAE,GAAkB;IACrF,MAAM,KAAK,GAAG,uBAAuB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC7E,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC;AAC7D,CAAC"}

package/dist/tools/verify-bundle.d.ts

@@ -0,0 +1,13 @@
+import type { ServerContext } from '../context.js';
+import type { EvidenceBundle } from '../core/types.js';
+export interface VerifyBundleArgs {
+    bundle: EvidenceBundle;
+    pinned_public_key: string;
+}
+export declare function handleVerifyBundle(args: VerifyBundleArgs, ctx: ServerContext): Promise<{
+    content: Array<{
+        type: "text";
+        text: string;
+    }>;
+}>;
+//# sourceMappingURL=verify-bundle.d.ts.map

package/dist/tools/verify-bundle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-bundle.d.ts","sourceRoot":"","sources":["../../src/tools/verify-bundle.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEvD,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,cAAc,CAAC;IACvB,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,gBAAgB,EAAE,GAAG,EAAE,aAAa;;;;;GAGlF"}

package/dist/tools/verify-bundle.js

@@ -0,0 +1,6 @@
+import { verifyBundleOffline } from '../core/bundle.js';
+export async function handleVerifyBundle(args, ctx) {
+    const verification = verifyBundleOffline(args.bundle, args.pinned_public_key);
+    return ctx.json({ success: true, verification });
+}
+//# sourceMappingURL=verify-bundle.js.map

package/dist/tools/verify-bundle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-bundle.js","sourceRoot":"","sources":["../../src/tools/verify-bundle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AASxD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAsB,EAAE,GAAkB;IACjF,MAAM,YAAY,GAAG,mBAAmB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC9E,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;AACnD,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,261 @@
+/**
+ * AGA Protocol V2.0.0 - Unified Type Definitions
+ * NIST-2025-0035, NCCoE AI Agent Identity and Authorization
+ *
+ * All enums/interfaces aligned to directive specification.
+ */
+export type PublicKey = Uint8Array;
+export type SecretKey = Uint8Array;
+export interface KeyPair {
+    publicKey: PublicKey;
+    secretKey: SecretKey;
+}
+export type Signature = Uint8Array;
+export type HashHex = string;
+export type SignatureBase64 = string;
+export type SaltHex = string;
+export interface SaltedCommitment {
+    commitment: HashHex;
+    salt: SaltHex;
+}
+export interface MerkleInclusionProof {
+    leafHash: HashHex;
+    leafIndex: number;
+    siblings: Array<{
+        hash: HashHex;
+        position: 'left' | 'right';
+    }>;
+    root: HashHex;
+}
+export type EventType = 'GENESIS' | 'POLICY_ISSUANCE' | 'INTERACTION_RECEIPT' | 'REVOCATION' | 'ATTESTATION' | 'ANCHOR_BATCH' | 'DISCLOSURE' | 'SUBSTITUTION' | 'KEY_ROTATION' | 'BEHAVIORAL_DRIFT' | 'DELEGATION' | 'RE_ATTESTATION';
+export type EnforcementAction = 'TERMINATE' | 'QUARANTINE' | 'NETWORK_ISOLATE' | 'SAFE_STATE' | 'KEY_REVOKE' | 'TOKEN_INVALIDATE' | 'ACTUATOR_DISCONNECT' | 'ALERT_ONLY';
+export type MeasurementType = 'EXECUTABLE_IMAGE' | 'LOADED_MODULES' | 'CONTAINER_IMAGE' | 'CONFIG_MANIFEST' | 'SBOM' | 'TEE_QUOTE' | 'MEMORY_REGIONS' | 'CONTROL_FLOW' | 'FILE_SYSTEM_STATE' | 'NETWORK_CONFIG';
+export type PortalState = 'INITIALIZATION' | 'ARTIFACT_VERIFICATION' | 'ACTIVE_MONITORING' | 'DRIFT_DETECTED' | 'PHANTOM_QUARANTINE' | 'SAFE_STATE' | 'TERMINATED';
+export type VerificationTier = 'BRONZE' | 'SILVER' | 'GOLD';
+export type DisclosureMode = 'PROOF_ONLY' | 'REVEAL_MIN' | 'REVEAL_FULL';
+export type Sensitivity = 'S1_LOW' | 'S2_MODERATE' | 'S3_HIGH' | 'S4_CRITICAL';
+export interface SubjectIdentifier {
+    bytes_hash: HashHex;
+    metadata_hash: HashHex;
+}
+export interface SubjectMetadata {
+    filename?: string;
+    creation_timestamp?: string;
+    author?: string;
+    version?: string;
+    content_type?: string;
+    [key: string]: unknown;
+}
+export interface EnforcementParams {
+    measurement_cadence_ms: number;
+    ttl_seconds: number;
+    enforcement_triggers: EnforcementAction[];
+    re_attestation_required: boolean;
+    measurement_types: MeasurementType[];
+}
+export interface ClaimRecord {
+    claim_id: string;
+    sensitivity: Sensitivity;
+    substitutes: string[];
+    inference_risks: string[];
+    permitted_modes: DisclosureMode[];
+}
+export interface ClaimsTaxonomy {
+    claims: ClaimRecord[];
+    version: string;
+}
+export interface SubstitutionRule {
+    original_claim_id: string;
+    substitute_claim_id: string;
+    conditions: Record<string, unknown>;
+}
+export interface DisclosurePolicy {
+    claims_taxonomy: ClaimRecord[];
+    substitution_rules: SubstitutionRule[];
+}
+export interface DisclosureRequest {
+    requested_claim_id: string;
+    requester_id: string;
+    mode: DisclosureMode;
+    timestamp: string;
+}
+export interface SubstitutionReceipt {
+    receipt_id: string;
+    original_claim_id: string;
+    substitute_claim_id: string | null;
+    policy_version: number;
+    reason_code: string;
+    timestamp: string;
+    chain_sequence_ref: number;
+    signature: SignatureBase64;
+}
+export interface EvidenceCommitmentRecord {
+    commitment: HashHex;
+    salt: SaltHex;
+    label: string;
+}
+export interface EvidenceBundle {
+    artifact: PolicyArtifact;
+    receipts: SignedReceipt[];
+    merkle_proofs: MerkleInclusionProof[];
+    checkpoint_reference: CheckpointReference;
+    public_key: string;
+    bundle_signature: SignatureBase64;
+}
+export interface PolicyArtifact {
+    schema_version: string;
+    protocol_version: string;
+    subject_identifier: SubjectIdentifier;
+    policy_reference: HashHex;
+    policy_version: number;
+    sealed_hash: HashHex;
+    seal_salt: SaltHex;
+    issued_timestamp: string;
+    effective_timestamp: string;
+    expiration_timestamp: string | null;
+    issuer_identifier: string;
+    enforcement_parameters: EnforcementParams;
+    disclosure_policy: DisclosurePolicy;
+    evidence_commitments: EvidenceCommitmentRecord[];
+    signature: SignatureBase64;
+}
+export interface SignedReceipt {
+    receipt_id: string;
+    subject_identifier: SubjectIdentifier;
+    artifact_reference: HashHex;
+    current_hash: string;
+    sealed_hash: string;
+    drift_detected: boolean;
+    drift_description: string | null;
+    enforcement_action: EnforcementAction | null;
+    measurement_type: string;
+    timestamp: string;
+    sequence_number: number;
+    previous_leaf_hash: HashHex | null;
+    portal_signature: SignatureBase64;
+}
+export interface GenesisPayload {
+    protocol_version: string;
+    taxonomy_version: string;
+    root_fingerprint: string;
+    specification_hash: HashHex;
+    marker: 'GENESIS';
+}
+export interface StructuralMetadata {
+    schema_version: string;
+    protocol_version: string;
+    event_type: EventType;
+    event_id: string;
+    sequence_number: number;
+    timestamp: string;
+    previous_leaf_hash: HashHex | null;
+}
+export interface ContinuityEvent {
+    schema_version: string;
+    protocol_version: string;
+    event_type: EventType;
+    event_id: string;
+    sequence_number: number;
+    timestamp: string;
+    previous_leaf_hash: HashHex | null;
+    leaf_hash: HashHex;
+    payload: unknown;
+    payload_hash: HashHex;
+    event_signature: SignatureBase64;
+}
+export interface CheckpointReference {
+    merkle_root: HashHex;
+    batch_start_sequence: number;
+    batch_end_sequence: number;
+    anchor_network: string;
+    transaction_id: string;
+    timestamp: string;
+}
+export interface AnchorBatchPayload {
+    checkpoint_reference: CheckpointReference;
+    leaf_count: number;
+}
+export interface QuarantineState {
+    active: boolean;
+    started_at: string | null;
+    inputs_captured: number;
+    outputs_severed: boolean;
+    forensic_buffer: Array<{
+        timestamp: string;
+        type: string;
+        data: unknown;
+    }>;
+}
+export interface RevocationRecord {
+    artifact_sealed_hash: HashHex;
+    reason: string;
+    revoked_by: string;
+    timestamp: string;
+}
+export interface BehavioralBaseline {
+    permitted_tools: string[];
+    rate_limits: Record<string, number>;
+    forbidden_sequences: string[][];
+    window_ms: number;
+}
+export interface ToolInvocation {
+    tool_name: string;
+    timestamp: string;
+    args_hash: HashHex;
+}
+export type BehavioralViolation = {
+    type: 'UNAUTHORIZED_TOOL';
+    tool: string;
+} | {
+    type: 'RATE_EXCEEDED';
+    tool: string;
+    count: number;
+    limit: number;
+} | {
+    type: 'FORBIDDEN_SEQUENCE';
+    sequence: string[];
+};
+export interface BehavioralMeasurement {
+    window_start: string;
+    window_end: string;
+    invocations: ToolInvocation[];
+    violations: BehavioralViolation[];
+    behavioral_hash: HashHex;
+    drift_detected: boolean;
+}
+export interface BehavioralMonitor {
+    setBaseline(baseline: BehavioralBaseline): void;
+    recordInvocation(toolName: string, argsHash: HashHex): void;
+    measure(): BehavioralMeasurement;
+    reset(): void;
+}
+export interface DelegationRecord {
+    parent_artifact_hash: HashHex;
+    child_artifact_hash: HashHex;
+    effective_ttl_seconds: number;
+    scope_reduction: {
+        triggers_removed: string[];
+        measurement_types_removed: string[];
+    };
+    purpose: string;
+    timestamp: string;
+}
+export interface DelegationRequest {
+    enforcement_triggers: EnforcementAction[];
+    measurement_types: MeasurementType[];
+    requested_ttl_seconds: number;
+    delegation_purpose: string;
+}
+export interface DelegationResult {
+    success: boolean;
+    child_artifact?: PolicyArtifact;
+    child_artifact_hash?: string;
+    parent_artifact_hash: string;
+    effective_ttl_seconds?: number;
+    scope_reduction?: {
+        triggers_removed: string[];
+        measurement_types_removed: string[];
+    };
+    error?: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,MAAM,MAAM,SAAS,GAAG,UAAU,CAAC;AACnC,MAAM,MAAM,SAAS,GAAG,UAAU,CAAC;AACnC,MAAM,WAAW,OAAO;IAAG,SAAS,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,SAAS,CAAC;CAAE;AACxE,MAAM,MAAM,SAAS,GAAG,UAAU,CAAC;AACnC,MAAM,MAAM,OAAO,GAAG,MAAM,CAAC;AAC7B,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC;AACrC,MAAM,MAAM,OAAO,GAAG,MAAM,CAAC;AAE7B,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,OAAO,CAAC;IACpB,IAAI,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC,CAAC;IAC/D,IAAI,EAAE,OAAO,CAAC;CACf;AAID,MAAM,MAAM,SAAS,GACjB,SAAS,GACT,iBAAiB,GACjB,qBAAqB,GACrB,YAAY,GACZ,aAAa,GACb,cAAc,GACd,YAAY,GACZ,cAAc,GACd,cAAc,GACd,kBAAkB,GAClB,YAAY,GACZ,gBAAgB,CAAC;AAIrB,MAAM,MAAM,iBAAiB,GACzB,WAAW,GACX,YAAY,GACZ,iBAAiB,GACjB,YAAY,GACZ,YAAY,GACZ,kBAAkB,GAClB,qBAAqB,GACrB,YAAY,CAAC;AAIjB,MAAM,MAAM,eAAe,GACvB,kBAAkB,GAClB,gBAAgB,GAChB,iBAAiB,GACjB,iBAAiB,GACjB,MAAM,GACN,WAAW,GACX,gBAAgB,GAChB,cAAc,GACd,mBAAmB,GACnB,gBAAgB,CAAC;AAIrB,MAAM,MAAM,WAAW,GACnB,gBAAgB,GAChB,uBAAuB,GACvB,mBAAmB,GACnB,gBAAgB,GAChB,oBAAoB,GACpB,YAAY,GACZ,YAAY,CAAC;AAIjB,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;AAI5D,MAAM,MAAM,cAAc,GAAG,YAAY,GAAG,YAAY,GAAG,aAAa,CAAC;AAIzE,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,aAAa,GAAG,SAAS,GAAG,aAAa,CAAC;AAI/E,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,OAAO,CAAC;IACpB,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAID,MAAM,WAAW,iBAAiB;IAChC,sBAAsB,EAAE,MAAM,CAAC;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,oBAAoB,EAAE,iBAAiB,EAAE,CAAC;IAC1C,uBAAuB,EAAE,OAAO,CAAC;IACjC,iBAAiB,EAAE,eAAe,EAAE,CAAC;CACtC;AAID,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,WAAW,CAAC;IACzB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,eAAe,EAAE,cAAc,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAED,MAAM,WAAW,gBAAgB;IAC/B,eAAe,EAAE,WAAW,EAAE,CAAC;IAC/B,kBAAkB,EAAE,gBAAgB,EAAE,CAAC;CACxC;AAED,MAAM,WAAW,iBAAiB;IAChC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,cAAc,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,SAAS,EAAE,eAAe,CAAC;CAC5B;AAID,MAAM,WAAW,wBAAwB;IACvC,UAAU,EAAE,OAAO,CAAC;IACpB,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,cAAc,CAAC;IACzB,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,aAAa,EAAE,oBAAoB,EAAE,CAAC;IACtC,oBAAoB,EAAE,mBAAmB,CAAC;IAC1C,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,eAAe,CAAC;CACnC;AAID,MAAM,WAAW,cAAc;IAC7B,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,kBAAkB,EAAE,iBAAiB,CAAC;IACtC,gBAAgB,EAAE,OAAO,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,OAAO,CAAC;IACrB,SAAS,EAAE,OAAO,CAAC;IACnB,gBAAgB,EAAE,MAAM,CAAC;IACzB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,sBAAsB,EAAE,iBAAiB,CAAC;IAC1C,iBAAiB,EAAE,gBAAgB,CAAC;IACpC,oBAAoB,EAAE,wBAAwB,EAAE,CAAC;IACjD,SAAS,EAAE,eAAe,CAAC;CAC5B;AAID,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,kBAAkB,EAAE,iBAAiB,CAAC;IACtC,kBAAkB,EAAE,OAAO,CAAC;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,OAAO,CAAC;IACxB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,kBAAkB,EAAE,iBAAiB,GAAG,IAAI,CAAC;IAC7C,gBAAgB,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,kBAAkB,EAAE,OAAO,GAAG,IAAI,CAAC;IACnC,gBAAgB,EAAE,eAAe,CAAC;CACnC;AAID,MAAM,WAAW,cAAc;IAC7B,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,MAAM,EAAE,SAAS,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,SAAS,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB,EAAE,OAAO,GAAG,IAAI,CAAC;CACpC;AAED,MAAM,WAAW,eAAe;IAC9B,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,SAAS,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB,EAAE,OAAO,GAAG,IAAI,CAAC;IACnC,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,OAAO,CAAC;IACtB,eAAe,EAAE,eAAe,CAAC;CAClC;AAID,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,OAAO,CAAC;IACrB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,oBAAoB,EAAE,mBAAmB,CAAC;IAC1C,UAAU,EAAE,MAAM,CAAC;CACpB;AAID,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,OAAO,CAAC;IACzB,eAAe,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAC5E;AAID,MAAM,WAAW,gBAAgB;IAC/B,oBAAoB,EAAE,OAAO,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAID,MAAM,WAAW,kBAAkB;IACjC,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,mBAAmB,EAAE,MAAM,EAAE,EAAE,CAAC;IAChC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,MAAM,mBAAmB,GAC3B;IAAE,IAAI,EAAE,mBAAmB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACrE;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAEvD,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,cAAc,EAAE,CAAC;IAC9B,UAAU,EAAE,mBAAmB,EAAE,CAAC;IAClC,eAAe,EAAE,OAAO,CAAC;IACzB,cAAc,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,iBAAiB;IAChC,WAAW,CAAC,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAAC;IAChD,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG,IAAI,CAAC;IAC5D,OAAO,IAAI,qBAAqB,CAAC;IACjC,KAAK,IAAI,IAAI,CAAC;CACf;AAID,MAAM,WAAW,gBAAgB;IAC/B,oBAAoB,EAAE,OAAO,CAAC;IAC9B,mBAAmB,EAAE,OAAO,CAAC;IAC7B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,eAAe,EAAE;QACf,gBAAgB,EAAE,MAAM,EAAE,CAAC;QAC3B,yBAAyB,EAAE,MAAM,EAAE,CAAC;KACrC,CAAC;IACF,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,oBAAoB,EAAE,iBAAiB,EAAE,CAAC;IAC1C,iBAAiB,EAAE,eAAe,EAAE,CAAC;IACrC,qBAAqB,EAAE,MAAM,CAAC;IAC9B,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,eAAe,CAAC,EAAE;QAChB,gBAAgB,EAAE,MAAM,EAAE,CAAC;QAC3B,yBAAyB,EAAE,MAAM,EAAE,CAAC;KACrC,CAAC;IACF,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB"}

package/dist/types.js

@@ -0,0 +1,8 @@
+/**
+ * AGA Protocol V2.0.0 - Unified Type Definitions
+ * NIST-2025-0035, NCCoE AI Agent Identity and Authorization
+ *
+ * All enums/interfaces aligned to directive specification.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG"}

package/package.json

@@ -1,12 +1,17 @@
 {
   "name": "@attested-intelligence/aga-mcp-server",
-  "version": "0.1.1",
-  "description": "MCP server implementing the Attested Governance Artifact protocol — cryptographic compliance for autonomous systems",
+  "version": "2.0.1",
+  "description": "MCP server implementing the Attested Governance Artifact (AGA) protocol - cryptographic compliance enforcement for autonomous AI systems. 20 tools, 3 resources, 3 prompts.",
   "author": "Attested Intelligence Holdings LLC",
   "license": "MIT",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
+  "files": [
+    "dist/",
+    "README.md",
+    "LICENSE"
+  ],
   "bin": {
     "aga-mcp-server": "dist/index.js"
   },
@@ -18,6 +23,7 @@
     "test:watch": "vitest",
     "test:crypto": "vitest run tests/crypto/",
     "test:core": "vitest run tests/core/",
+    "test:tools": "vitest run tests/tools/",
     "test:integration": "vitest run tests/integration/",
     "demo": "tsx scripts/demo.ts",
     "benchmark": "tsx scripts/benchmark.ts",
@@ -47,10 +53,19 @@
   },
   "keywords": [
     "mcp",
+    "mcp-server",
     "attestation",
     "governance",
     "ai-governance",
+    "ai-safety",
     "runtime-integrity",
-    "continuity-chain"
+    "continuity-chain",
+    "zero-trust",
+    "nist",
+    "nccoe",
+    "spiffe",
+    "ed25519",
+    "evidence-bundle",
+    "policy-enforcement"
   ]
 }