@attested-intelligence/aga-mcp-server 2.0.1 → 2.1.0

package/dist/proxy/profiles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profiles.js","sourceRoot":"","sources":["../../src/proxy/profiles.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,yDAAyD;AACzD,MAAM,CAAC,MAAM,UAAU,GAAe;IACpC,IAAI,EAAE,YAAY;IAClB,WAAW,EAAE,EAAE;CAChB,CAAC;AAEF,4EAA4E;AAC5E,MAAM,CAAC,MAAM,QAAQ,GAAe;IAClC,IAAI,EAAE,WAAW;IACjB,WAAW,EAAE;QACX,eAAe,EAAI,EAAE,IAAI,EAAE,iBAAiB,EAAI,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE;QACzF,gBAAgB,EAAG,EAAE,IAAI,EAAE,kBAAkB,EAAG,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE;QACxI,aAAa,EAAM,EAAE,IAAI,EAAE,eAAe,EAAM,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,CAAC,EAAE;QACvJ,UAAU,EAAS,EAAE,IAAI,EAAE,YAAY,EAAS,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE;QACzF,SAAS,EAAU,EAAE,IAAI,EAAE,WAAW,EAAU,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE;QACzF,YAAY,EAAO,EAAE,IAAI,EAAE,cAAc,EAAO,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,EAAE;QACxF,eAAe,EAAI,EAAE,IAAI,EAAE,iBAAiB,EAAI,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,EAAE;QACxF,aAAa,EAAM,EAAE,IAAI,EAAE,eAAe,EAAM,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE;QACzF,YAAY,EAAO,EAAE,IAAI,EAAE,cAAc,EAAO,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE;QACzF,YAAY,EAAO,EAAE,IAAI,EAAE,cAAc,EAAO,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE;KAC1F;CACF,CAAC;AAEF,+EAA+E;AAC/E,MAAM,CAAC,MAAM,WAAW,GAAe;IACrC,IAAI,EAAE,WAAW;IACjB,WAAW,EAAE;QACX,eAAe,EAAG,EAAE,IAAI,EAAE,iBAAiB,EAAG,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE;QAC7G,UAAU,EAAQ,EAAE,IAAI,EAAE,YAAY,EAAQ,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,EAAE;QACtF,aAAa,EAAK,EAAE,IAAI,EAAE,eAAe,EAAK,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE;KACxF;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,QAAQ,GAA+B;IAClD,UAAU,EAAE,UAAU;IACtB,QAAQ,EAAE,QAAQ;IAClB,WAAW,EAAE,WAAW;CACzB,CAAC"}

package/dist/proxy/server.d.ts

@@ -0,0 +1,106 @@
+/**
+ * AGA Governance Proxy Server
+ * TCP proxy that intercepts MCP JSON-RPC 2.0 tool calls,
+ * evaluates them against a sealed policy, and produces
+ * Ed25519-signed governance receipts.
+ *
+ * Receipt format: Ed25519-SHA256-JCS (canonical across TS gateway,
+ * Python SDK, Go CLI, and browser verifier).
+ *
+ * Architecture: Client → Proxy (:18800) → Downstream MCP Server
+ * The proxy holds ALL signing keys. The client holds NONE.
+ *
+ * Patent: USPTO App. No. 19/433,835
+ * Copyright (c) 2026 Attested Intelligence Holdings LLC
+ * SPDX-License-Identifier: MIT
+ */
+import { EventEmitter } from 'node:events';
+import { type StdioBridgeOptions } from './stdio-bridge.js';
+import type { ToolPolicy } from './types.js';
+export interface GovernanceReceipt {
+    receipt_id: string;
+    receipt_version: string;
+    algorithm: string;
+    timestamp: string;
+    request_id: string | number | null;
+    method: string;
+    tool_name: string;
+    decision: 'PERMITTED' | 'DENIED';
+    reason: string;
+    policy_reference: string;
+    arguments_hash: string;
+    previous_receipt_hash: string;
+    gateway_id: string;
+    signature: string;
+    public_key: string;
+}
+export interface EvidenceBundle {
+    schema_version: string;
+    bundle_id: string;
+    algorithm: string;
+    generated_at: string;
+    gateway_id: string;
+    public_key: string;
+    policy_reference: string;
+    receipts: GovernanceReceipt[];
+    merkle_root: string;
+    merkle_proofs: MerkleProof[];
+    offline_capable: boolean;
+}
+export interface MerkleProof {
+    leaf_hash: string;
+    leaf_index: number;
+    siblings: string[];
+    directions: ('left' | 'right')[];
+    merkle_root: string;
+}
+export interface ProxyServerOptions {
+    port?: number;
+    policy?: ToolPolicy;
+    upstream?: StdioBridgeOptions;
+    upstreamUrl?: string;
+    gatewayId?: string;
+}
+export declare class GovernanceProxy extends EventEmitter {
+    private server;
+    private bridge;
+    private signingKP;
+    private policy;
+    private port;
+    private started;
+    private upstreamOptions;
+    private upstreamUrl;
+    private gatewayId;
+    private receipts;
+    private lastReceiptHash;
+    private policyHash;
+    private stats;
+    constructor(options?: ProxyServerOptions);
+    start(): Promise<void>;
+    stop(): Promise<void>;
+    private handleConnection;
+    private handleMessage;
+    private interceptToolCall;
+    private generateReceipt;
+    private merkleNodeHash;
+    private computeMerkleRoot;
+    private computeMerkleProof;
+    private forwardHttp;
+    private respond;
+    switchPolicy(newPolicy: ToolPolicy): Promise<void>;
+    exportBundle(): EvidenceBundle;
+    getStatus(): {
+        public_key: string;
+        permitted: number;
+        denied: number;
+        total: number;
+        started_at: string;
+        running: boolean;
+        port: number;
+        policy_mode: "allowlist" | "denylist" | "audit_only";
+        receipt_count: number;
+    };
+    getPublicKey(): string;
+    getReceipts(): GovernanceReceipt[];
+}
+//# sourceMappingURL=server.d.ts.map

package/dist/proxy/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/proxy/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAO3C,OAAO,EAAe,KAAK,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAIzE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAK7C,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,WAAW,GAAG,QAAQ,CAAC;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,cAAc;IAC7B,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,WAAW,EAAE,CAAC;IAC7B,eAAe,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,UAAU,EAAE,CAAC,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC;IACjC,WAAW,EAAE,MAAM,CAAC;CACrB;AAID,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,qBAAa,eAAgB,SAAQ,YAAY;IAC/C,OAAO,CAAC,MAAM,CAA2B;IACzC,OAAO,CAAC,MAAM,CAA4B;IAG1C,OAAO,CAAC,SAAS,CAAU;IAG3B,OAAO,CAAC,MAAM,CAAa;IAC3B,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,eAAe,CAA4B;IACnD,OAAO,CAAC,WAAW,CAAgB;IACnC,OAAO,CAAC,SAAS,CAAS;IAG1B,OAAO,CAAC,QAAQ,CAA2B;IAC3C,OAAO,CAAC,eAAe,CAAc;IACrC,OAAO,CAAC,UAAU,CAAc;IAGhC,OAAO,CAAC,KAAK,CAAyD;gBAE1D,OAAO,GAAE,kBAAuB;IAYtC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IA4BtB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAqB3B,OAAO,CAAC,gBAAgB;YAoBV,aAAa;YAgDb,iBAAiB;IAiF/B,OAAO,CAAC,eAAe;IA6CvB,OAAO,CAAC,cAAc;IAStB,OAAO,CAAC,iBAAiB;IAkBzB,OAAO,CAAC,kBAAkB;YAuCZ,WAAW;IAoBzB,OAAO,CAAC,OAAO;IAQT,YAAY,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAOxD,YAAY,IAAI,cAAc;IAsB9B,SAAS;;;;;;;;;;;IAWT,YAAY,IAAI,MAAM;IACtB,WAAW,IAAI,iBAAiB,EAAE;CACnC"}

package/dist/proxy/server.js

@@ -0,0 +1,389 @@
+/**
+ * AGA Governance Proxy Server
+ * TCP proxy that intercepts MCP JSON-RPC 2.0 tool calls,
+ * evaluates them against a sealed policy, and produces
+ * Ed25519-signed governance receipts.
+ *
+ * Receipt format: Ed25519-SHA256-JCS (canonical across TS gateway,
+ * Python SDK, Go CLI, and browser verifier).
+ *
+ * Architecture: Client → Proxy (:18800) → Downstream MCP Server
+ * The proxy holds ALL signing keys. The client holds NONE.
+ *
+ * Patent: USPTO App. No. 19/433,835
+ * Copyright (c) 2026 Attested Intelligence Holdings LLC
+ * SPDX-License-Identifier: MIT
+ */
+import * as net from 'node:net';
+import { EventEmitter } from 'node:events';
+import { generateKeyPair, pkToHex, signStr } from '../crypto/sign.js';
+import { bytesToHex, hexToBytes as utilHexToBytes } from '@noble/hashes/utils';
+import { sha256 } from '@noble/hashes/sha256';
+import { sha256Str } from '../crypto/hash.js';
+import { canonicalize } from '../utils/canonical.js';
+import { evaluate, resetRateLimits } from './evaluator.js';
+import { StdioBridge } from './stdio-bridge.js';
+import { PERMISSIVE } from './profiles.js';
+import { utcNow } from '../utils/timestamp.js';
+import { uuid } from '../utils/uuid.js';
+export class GovernanceProxy extends EventEmitter {
+    server = null;
+    bridge = null;
+    // Crypto key - never leaves this process
+    signingKP;
+    // State
+    policy;
+    port;
+    started = false;
+    upstreamOptions;
+    upstreamUrl;
+    gatewayId;
+    // Receipt chain
+    receipts = [];
+    lastReceiptHash = '';
+    policyHash = '';
+    // Stats
+    stats = { permitted: 0, denied: 0, total: 0, started_at: '' };
+    constructor(options = {}) {
+        super();
+        this.port = options.port ?? 18800;
+        this.policy = options.policy ?? PERMISSIVE;
+        this.upstreamOptions = options.upstream ?? null;
+        this.upstreamUrl = options.upstreamUrl ?? null;
+        this.gatewayId = options.gatewayId ?? 'aga-proxy';
+        this.signingKP = generateKeyPair();
+    }
+    // ── Start / Stop ───────────────────────────────────────────
+    async start() {
+        if (this.started)
+            throw new Error('Proxy already running');
+        this.policyHash = sha256Str(canonicalize(this.policy));
+        // Start downstream bridge if configured
+        if (this.upstreamOptions) {
+            this.bridge = new StdioBridge(this.upstreamOptions);
+            await this.bridge.start();
+            this.bridge.on('error', (err) => this.emit('error', err));
+            this.bridge.on('exit', (code) => {
+                process.stderr.write(`[aga-proxy] Downstream exited with code ${code}\n`);
+            });
+        }
+        // Start TCP server
+        this.server = net.createServer((socket) => this.handleConnection(socket));
+        await new Promise((resolve, reject) => {
+            this.server.listen(this.port, () => resolve());
+            this.server.on('error', reject);
+        });
+        this.started = true;
+        this.stats.started_at = new Date().toISOString();
+        resetRateLimits();
+        this.emit('started', { port: this.port });
+    }
+    async stop() {
+        if (!this.started)
+            return;
+        if (this.bridge) {
+            await this.bridge.stop();
+            this.bridge = null;
+        }
+        if (this.server) {
+            await new Promise((resolve) => {
+                this.server.close(() => resolve());
+            });
+            this.server = null;
+        }
+        this.started = false;
+        this.emit('stopped');
+    }
+    // ── Connection handler ─────────────────────────────────────
+    handleConnection(socket) {
+        let buffer = '';
+        socket.on('data', (chunk) => {
+            buffer += chunk.toString();
+            const lines = buffer.split('\n');
+            buffer = lines.pop() || '';
+            for (const line of lines) {
+                const trimmed = line.trim();
+                if (!trimmed)
+                    continue;
+                this.handleMessage(trimmed, socket).catch((err) => {
+                    process.stderr.write(`[aga-proxy] Error handling message: ${err}\n`);
+                });
+            }
+        });
+        socket.on('error', () => { });
+    }
+    async handleMessage(raw, socket) {
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch {
+            this.respond(socket, { jsonrpc: '2.0', error: { code: -32700, message: 'Parse error' }, id: null });
+            return;
+        }
+        if (parsed.jsonrpc !== '2.0') {
+            this.respond(socket, { jsonrpc: '2.0', error: { code: -32600, message: 'Invalid Request: missing jsonrpc 2.0' }, id: null });
+            return;
+        }
+        const requestId = parsed.id ?? null;
+        const method = parsed.method;
+        // Non-tools/call methods: forward transparently
+        if (method !== 'tools/call') {
+            if (this.bridge) {
+                try {
+                    const response = await this.bridge.send(parsed);
+                    this.respond(socket, response);
+                }
+                catch (err) {
+                    this.respond(socket, {
+                        jsonrpc: '2.0',
+                        error: { code: -32603, message: `Downstream error: ${err}` },
+                        id: requestId,
+                    });
+                }
+            }
+            else if (this.upstreamUrl) {
+                await this.forwardHttp(raw, socket, requestId);
+            }
+            else {
+                this.respond(socket, {
+                    jsonrpc: '2.0',
+                    error: { code: -32603, message: 'No upstream configured' },
+                    id: requestId,
+                });
+            }
+            return;
+        }
+        // tools/call - governance intercept
+        await this.interceptToolCall(parsed, socket, requestId);
+    }
+    // ── Tool call interception ─────────────────────────────────
+    async interceptToolCall(parsed, socket, requestId) {
+        const params = parsed.params;
+        const toolName = params?.name;
+        const toolArgs = params?.arguments;
+        this.stats.total++;
+        // Fail-closed: no tool name
+        if (!toolName) {
+            const receipt = this.generateReceipt('UNKNOWN', 'DENIED', 'tool name extraction failed, fail-closed', requestId, undefined);
+            this.stats.denied++;
+            this.respond(socket, {
+                jsonrpc: '2.0',
+                error: {
+                    code: -32600,
+                    message: 'Missing tool name',
+                    data: { receipt_id: receipt.receipt_id, decision: 'DENIED' },
+                },
+                id: requestId,
+            });
+            return;
+        }
+        // Evaluate against policy
+        const decision = evaluate(this.policy, toolName, toolArgs);
+        const receipt = this.generateReceipt(toolName, decision.allowed ? 'PERMITTED' : 'DENIED', decision.reason, requestId, toolArgs);
+        if (!decision.allowed) {
+            this.stats.denied++;
+            this.respond(socket, {
+                jsonrpc: '2.0',
+                error: {
+                    code: -32600,
+                    message: `Tool denied: ${decision.reason}`,
+                    data: { receipt_id: receipt.receipt_id, decision: 'DENIED', reason: decision.reason },
+                },
+                id: requestId,
+            });
+            return;
+        }
+        // Permitted - forward to downstream
+        this.stats.permitted++;
+        if (this.bridge) {
+            try {
+                const response = await this.bridge.send(parsed);
+                this.respond(socket, response);
+            }
+            catch (err) {
+                this.respond(socket, {
+                    jsonrpc: '2.0',
+                    error: { code: -32603, message: `Downstream error: ${err}` },
+                    id: requestId,
+                });
+            }
+        }
+        else if (this.upstreamUrl) {
+            await this.forwardHttp(JSON.stringify(parsed), socket, requestId);
+        }
+        else {
+            // No upstream - return success with receipt info
+            this.respond(socket, {
+                jsonrpc: '2.0',
+                result: {
+                    content: [{ type: 'text', text: JSON.stringify({ permitted: true, receipt_id: receipt.receipt_id, tool: toolName }) }],
+                },
+                id: requestId,
+            });
+        }
+    }
+    // ── Receipt generation (Ed25519-SHA256-JCS canonical format) ─
+    generateReceipt(toolName, decision, reason, requestId, toolArgs) {
+        const pubKeyHex = pkToHex(this.signingKP.publicKey);
+        // Arguments hash tri-state per spec Section 3.5
+        let argumentsHash;
+        if (toolArgs === undefined) {
+            argumentsHash = '';
+        }
+        else {
+            argumentsHash = sha256Str(canonicalize(toolArgs));
+        }
+        const unsigned = {
+            receipt_id: uuid(),
+            receipt_version: '1.0',
+            algorithm: 'Ed25519-SHA256-JCS',
+            timestamp: utcNow(),
+            request_id: requestId,
+            method: 'tools/call',
+            tool_name: toolName,
+            decision,
+            reason,
+            policy_reference: this.policyHash,
+            arguments_hash: argumentsHash,
+            previous_receipt_hash: this.lastReceiptHash,
+            gateway_id: this.gatewayId,
+            public_key: pubKeyHex,
+        };
+        const sig = signStr(canonicalize(unsigned), this.signingKP.secretKey);
+        const receipt = { ...unsigned, signature: bytesToHex(sig) };
+        this.receipts.push(receipt);
+        this.lastReceiptHash = sha256Str(canonicalize(receipt));
+        return receipt;
+    }
+    // ── Merkle tree (binary, odd-node promotion, binary concat) ─
+    merkleNodeHash(leftHex, rightHex) {
+        const left = utilHexToBytes(leftHex);
+        const right = utilHexToBytes(rightHex);
+        const combined = new Uint8Array(left.length + right.length);
+        combined.set(left, 0);
+        combined.set(right, left.length);
+        return bytesToHex(sha256(combined));
+    }
+    computeMerkleRoot(leaves) {
+        if (leaves.length === 0)
+            return '';
+        if (leaves.length === 1)
+            return leaves[0];
+        let level = [...leaves];
+        while (level.length > 1) {
+            const next = [];
+            for (let i = 0; i < level.length; i += 2) {
+                if (i + 1 < level.length) {
+                    next.push(this.merkleNodeHash(level[i], level[i + 1]));
+                }
+                else {
+                    next.push(level[i]);
+                }
+            }
+            level = next;
+        }
+        return level[0];
+    }
+    computeMerkleProof(leaves, leafIndex) {
+        const siblings = [];
+        const directions = [];
+        let level = [...leaves];
+        let idx = leafIndex;
+        while (level.length > 1) {
+            const next = [];
+            for (let i = 0; i < level.length; i += 2) {
+                if (i + 1 < level.length) {
+                    next.push(this.merkleNodeHash(level[i], level[i + 1]));
+                }
+                else {
+                    next.push(level[i]);
+                }
+            }
+            if (idx % 2 === 0) {
+                if (idx + 1 < level.length) {
+                    siblings.push(level[idx + 1]);
+                    directions.push('right');
+                }
+            }
+            else {
+                siblings.push(level[idx - 1]);
+                directions.push('left');
+            }
+            idx = Math.floor(idx / 2);
+            level = next;
+        }
+        return {
+            leaf_hash: leaves[leafIndex],
+            leaf_index: leafIndex,
+            siblings,
+            directions,
+            merkle_root: level[0],
+        };
+    }
+    // ── HTTP forwarding ────────────────────────────────────────
+    async forwardHttp(body, socket, requestId) {
+        try {
+            const resp = await fetch(this.upstreamUrl, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body,
+            });
+            const data = await resp.json();
+            this.respond(socket, data);
+        }
+        catch (err) {
+            this.respond(socket, {
+                jsonrpc: '2.0',
+                error: { code: -32603, message: `HTTP upstream error: ${err}` },
+                id: requestId,
+            });
+        }
+    }
+    // ── Response helper ────────────────────────────────────────
+    respond(socket, msg) {
+        if (!socket.destroyed) {
+            socket.write(JSON.stringify(msg) + '\n');
+        }
+    }
+    // ── Public API ─────────────────────────────────────────────
+    async switchPolicy(newPolicy) {
+        this.policy = newPolicy;
+        this.policyHash = sha256Str(canonicalize(newPolicy));
+        resetRateLimits();
+        this.emit('policy_switched');
+    }
+    exportBundle() {
+        if (this.receipts.length === 0)
+            throw new Error('No receipts');
+        const leafHashes = this.receipts.map(r => sha256Str(canonicalize(r)));
+        const root = this.computeMerkleRoot(leafHashes);
+        const proofs = leafHashes.map((_, i) => this.computeMerkleProof(leafHashes, i));
+        return {
+            schema_version: '1.0',
+            bundle_id: uuid(),
+            algorithm: 'Ed25519-SHA256-JCS',
+            generated_at: utcNow(),
+            gateway_id: this.gatewayId,
+            public_key: pkToHex(this.signingKP.publicKey),
+            policy_reference: this.policyHash,
+            receipts: this.receipts,
+            merkle_root: root,
+            merkle_proofs: proofs,
+            offline_capable: true,
+        };
+    }
+    getStatus() {
+        return {
+            running: this.started,
+            port: this.port,
+            policy_mode: this.policy.mode,
+            receipt_count: this.receipts.length,
+            ...this.stats,
+            public_key: pkToHex(this.signingKP.publicKey),
+        };
+    }
+    getPublicKey() { return pkToHex(this.signingKP.publicKey); }
+    getReceipts() { return this.receipts; }
+}
+//# sourceMappingURL=server.js.map

package/dist/proxy/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/proxy/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,UAAU,IAAI,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC/E,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EAAE,WAAW,EAA2B,MAAM,mBAAmB,CAAC;AACzE,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAwDxC,MAAM,OAAO,eAAgB,SAAQ,YAAY;IACvC,MAAM,GAAsB,IAAI,CAAC;IACjC,MAAM,GAAuB,IAAI,CAAC;IAE1C,yCAAyC;IACjC,SAAS,CAAU;IAE3B,QAAQ;IACA,MAAM,CAAa;IACnB,IAAI,CAAS;IACb,OAAO,GAAG,KAAK,CAAC;IAChB,eAAe,CAA4B;IAC3C,WAAW,CAAgB;IAC3B,SAAS,CAAS;IAE1B,gBAAgB;IACR,QAAQ,GAAwB,EAAE,CAAC;IACnC,eAAe,GAAW,EAAE,CAAC;IAC7B,UAAU,GAAW,EAAE,CAAC;IAEhC,QAAQ;IACA,KAAK,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IAEtE,YAAY,UAA8B,EAAE;QAC1C,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,KAAK,CAAC;QAClC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,UAAU,CAAC;QAC3C,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC;QAChD,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC;QAC/C,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,WAAW,CAAC;QAClD,IAAI,CAAC,SAAS,GAAG,eAAe,EAAE,CAAC;IACrC,CAAC;IAED,8DAA8D;IAE9D,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAE3D,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QAEvD,wCAAwC;QACxC,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzB,IAAI,CAAC,MAAM,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YACpD,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;YAC1D,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;gBACtC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,2CAA2C,IAAI,IAAI,CAAC,CAAC;YAC5E,CAAC,CAAC,CAAC;QACL,CAAC;QAED,mBAAmB;QACnB,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1E,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,IAAI,CAAC,MAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YAChD,IAAI,CAAC,MAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACjD,eAAe,EAAE,CAAC;QAClB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAE1B,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACzB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACrB,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;gBAClC,IAAI,CAAC,MAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YACtC,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACrB,CAAC;QAED,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACrB,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACvB,CAAC;IAED,8DAA8D;IAEtD,gBAAgB,CAAC,MAAkB;QACzC,IAAI,MAAM,GAAG,EAAE,CAAC;QAEhB,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;YAC1B,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;YAE3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC5B,IAAI,CAAC,OAAO;oBAAE,SAAS;gBACvB,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;oBAChD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uCAAuC,GAAG,IAAI,CAAC,CAAC;gBACvE,CAAC,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAA6B,CAAC,CAAC,CAAC;IAC1D,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,GAAW,EAAE,MAAkB;QACzD,IAAI,MAA+B,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YACpG,OAAO;QACT,CAAC;QAED,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;YAC7B,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,sCAAsC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7H,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAI,MAAM,CAAC,EAA6B,IAAI,IAAI,CAAC;QAChE,MAAM,MAAM,GAAG,MAAM,CAAC,MAA4B,CAAC;QAEnD,gDAAgD;QAChD,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;YAC5B,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChB,IAAI,CAAC;oBACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;oBAChD,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBACjC,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE;wBACnB,OAAO,EAAE,KAAK;wBACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,qBAAqB,GAAG,EAAE,EAAE;wBAC5D,EAAE,EAAE,SAAS;qBACd,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;iBAAM,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC5B,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;YACjD,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE;oBACnB,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,wBAAwB,EAAE;oBAC1D,EAAE,EAAE,SAAS;iBACd,CAAC,CAAC;YACL,CAAC;YACD,OAAO;QACT,CAAC;QAED,oCAAoC;QACpC,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IAC1D,CAAC;IAED,8DAA8D;IAEtD,KAAK,CAAC,iBAAiB,CAC7B,MAA+B,EAC/B,MAAkB,EAClB,SAAiC;QAEjC,MAAM,MAAM,GAAG,MAAM,CAAC,MAA6C,CAAC;QACpE,MAAM,QAAQ,GAAG,MAAM,EAAE,IAA0B,CAAC;QACpD,MAAM,QAAQ,GAAG,MAAM,EAAE,SAAgD,CAAC;QAE1E,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QAEnB,4BAA4B;QAC5B,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,SAAS,EAAE,QAAQ,EAAE,0CAA0C,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;YAC5H,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACpB,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE;gBACnB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,CAAC,KAAK;oBACZ,OAAO,EAAE,mBAAmB;oBAC5B,IAAI,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE;iBAC7D;gBACD,EAAE,EAAE,SAAS;aACd,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,0BAA0B;QAC1B,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAClC,QAAQ,EACR,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,EACzC,QAAQ,CAAC,MAAM,EACf,SAAS,EACT,QAAQ,CACT,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtB,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACpB,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE;gBACnB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,CAAC,KAAK;oBACZ,OAAO,EAAE,gBAAgB,QAAQ,CAAC,MAAM,EAAE;oBAC1C,IAAI,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE;iBACtF;gBACD,EAAE,EAAE,SAAS;aACd,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,oCAAoC;QACpC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QAEvB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAChD,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YACjC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE;oBACnB,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,qBAAqB,GAAG,EAAE,EAAE;oBAC5D,EAAE,EAAE,SAAS;iBACd,CAAC,CAAC;YACL,CAAC;QACH,CAAC;aAAM,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YAC5B,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QACpE,CAAC;aAAM,CAAC;YACN,iDAAiD;YACjD,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE;gBACnB,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE;oBACN,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;iBACvH;gBACD,EAAE,EAAE,SAAS;aACd,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,gEAAgE;IAExD,eAAe,CACrB,QAAgB,EAChB,QAAgC,EAChC,MAAc,EACd,SAAiC,EACjC,QAA6C;QAE7C,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAEpD,gDAAgD;QAChD,IAAI,aAAqB,CAAC;QAC1B,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,aAAa,GAAG,EAAE,CAAC;QACrB,CAAC;aAAM,CAAC;YACN,aAAa,GAAG,SAAS,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,QAAQ,GAAG;YACf,UAAU,EAAE,IAAI,EAAE;YAClB,eAAe,EAAE,KAAK;YACtB,SAAS,EAAE,oBAAoB;YAC/B,SAAS,EAAE,MAAM,EAAE;YACnB,UAAU,EAAE,SAAS;YACrB,MAAM,EAAE,YAAY;YACpB,SAAS,EAAE,QAAQ;YACnB,QAAQ;YACR,MAAM;YACN,gBAAgB,EAAE,IAAI,CAAC,UAAU;YACjC,cAAc,EAAE,aAAa;YAC7B,qBAAqB,EAAE,IAAI,CAAC,eAAe;YAC3C,UAAU,EAAE,IAAI,CAAC,SAAS;YAC1B,UAAU,EAAE,SAAS;SACtB,CAAC;QAEF,MAAM,GAAG,GAAG,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACtE,MAAM,OAAO,GAAsB,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAE/E,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5B,IAAI,CAAC,eAAe,GAAG,SAAS,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;QAExD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,+DAA+D;IAEvD,cAAc,CAAC,OAAe,EAAE,QAAgB;QACtD,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;QACvC,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;QAC5D,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACtB,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACjC,OAAO,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IACtC,CAAC;IAEO,iBAAiB,CAAC,MAAgB;QACxC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACnC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;QAC1C,IAAI,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;QACxB,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,GAAa,EAAE,CAAC;YAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzC,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;oBACzB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBACzD,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBACtB,CAAC;YACH,CAAC;YACD,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;QACD,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAEO,kBAAkB,CAAC,MAAgB,EAAE,SAAiB;QAC5D,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,MAAM,UAAU,GAAyB,EAAE,CAAC;QAC5C,IAAI,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;QACxB,IAAI,GAAG,GAAG,SAAS,CAAC;QAEpB,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,GAAa,EAAE,CAAC;YAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzC,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;oBACzB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBACzD,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBACtB,CAAC;YACH,CAAC;YACD,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBAClB,IAAI,GAAG,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;oBAC3B,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;oBAC9B,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC3B,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;gBAC9B,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC1B,CAAC;YACD,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;YAC1B,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;QAED,OAAO;YACL,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC;YAC5B,UAAU,EAAE,SAAS;YACrB,QAAQ;YACR,UAAU;YACV,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;SACtB,CAAC;IACJ,CAAC;IAED,8DAA8D;IAEtD,KAAK,CAAC,WAAW,CAAC,IAAY,EAAE,MAAkB,EAAE,SAAiC;QAC3F,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,WAAY,EAAE;gBAC1C,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI;aACL,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YAC/B,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAA+B,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE;gBACnB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,wBAAwB,GAAG,EAAE,EAAE;gBAC/D,EAAE,EAAE,SAAS;aACd,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,8DAA8D;IAEtD,OAAO,CAAC,MAAkB,EAAE,GAA4B;QAC9D,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACtB,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED,8DAA8D;IAE9D,KAAK,CAAC,YAAY,CAAC,SAAqB;QACtC,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;QACxB,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC;QACrD,eAAe,EAAE,CAAC;QAClB,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC/B,CAAC;IAED,YAAY;QACV,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;QAE/D,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtE,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC;QAEhF,OAAO;YACL,cAAc,EAAE,KAAK;YACrB,SAAS,EAAE,IAAI,EAAE;YACjB,SAAS,EAAE,oBAAoB;YAC/B,YAAY,EAAE,MAAM,EAAE;YACtB,UAAU,EAAE,IAAI,CAAC,SAAS;YAC1B,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;YAC7C,gBAAgB,EAAE,IAAI,CAAC,UAAU;YACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,WAAW,EAAE,IAAI;YACjB,aAAa,EAAE,MAAM;YACrB,eAAe,EAAE,IAAI;SACtB,CAAC;IACJ,CAAC;IAED,SAAS;QACP,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YAC7B,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM;YACnC,GAAG,IAAI,CAAC,KAAK;YACb,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;SAC9C,CAAC;IACJ,CAAC;IAED,YAAY,KAAa,OAAO,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACpE,WAAW,KAA0B,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;CAC7D"}

package/dist/proxy/stdio-bridge.d.ts

@@ -0,0 +1,42 @@
+/**
+ * AGA Governance Proxy - Stdio Bridge
+ * Spawns a downstream MCP server as a child process and manages
+ * JSON-RPC message framing over stdin/stdout.
+ *
+ * Patent: USPTO App. No. 19/433,835
+ * Copyright (c) 2026 Attested Intelligence Holdings LLC
+ * SPDX-License-Identifier: MIT
+ */
+import { EventEmitter } from 'node:events';
+export interface StdioBridgeOptions {
+    command: string;
+    args?: string[];
+    env?: Record<string, string>;
+    cwd?: string;
+}
+/**
+ * Bridges JSON-RPC messages to/from a child process via stdio.
+ * Handles newline-delimited JSON framing.
+ */
+export declare class StdioBridge extends EventEmitter {
+    private options;
+    private child;
+    private buffer;
+    private pendingRequests;
+    constructor(options: StdioBridgeOptions);
+    start(): Promise<void>;
+    private processBuffer;
+    private handleMessage;
+    /**
+     * Send a JSON-RPC request to the downstream server and wait for a response.
+     */
+    send(message: Record<string, unknown>, timeoutMs?: number): Promise<Record<string, unknown>>;
+    /**
+     * Send a raw message without waiting for a response.
+     */
+    sendRaw(message: Record<string, unknown>): void;
+    stop(): Promise<void>;
+    get running(): boolean;
+    private rejectAllPending;
+}
+//# sourceMappingURL=stdio-bridge.d.ts.map

package/dist/proxy/stdio-bridge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stdio-bridge.d.ts","sourceRoot":"","sources":["../../src/proxy/stdio-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;GAGG;AACH,qBAAa,WAAY,SAAQ,YAAY;IAS/B,OAAO,CAAC,OAAO;IAR3B,OAAO,CAAC,KAAK,CAA6B;IAC1C,OAAO,CAAC,MAAM,CAAM;IACpB,OAAO,CAAC,eAAe,CAIlB;gBAEe,OAAO,EAAE,kBAAkB;IAIzC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IA+B5B,OAAO,CAAC,aAAa;IAkBrB,OAAO,CAAC,aAAa;IAiBrB;;OAEG;IACG,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAwBlG;;OAEG;IACH,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IAOzC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAmB3B,IAAI,OAAO,IAAI,OAAO,CAErB;IAED,OAAO,CAAC,gBAAgB;CAOzB"}