@attested-intelligence/aga-mcp-server 2.0.1 → 2.2.0

package/dist/proxy/evaluator.js

@@ -0,0 +1,141 @@
+/**
+ * AGA Governance Proxy - Tool Policy Evaluator
+ * Ported from aga-mcp-gateway/src/governance/policy.ts with rate limiting.
+ *
+ * Patent: USPTO App. No. 19/433,835
+ * Copyright (c) 2026 Attested Intelligence Holdings LLC
+ * SPDX-License-Identifier: MIT
+ */
+const rateLimits = new Map();
+function checkRateLimit(toolName, maxPerMinute) {
+    const now = Date.now();
+    const cutoff = now - 60_000;
+    let window = rateLimits.get(toolName);
+    if (!window) {
+        window = { timestamps: [] };
+        rateLimits.set(toolName, window);
+    }
+    // Prune expired entries
+    window.timestamps = window.timestamps.filter(t => t > cutoff);
+    if (window.timestamps.length >= maxPerMinute)
+        return false;
+    window.timestamps.push(now);
+    return true;
+}
+export function resetRateLimits() {
+    rateLimits.clear();
+}
+// ── Path Utilities (from aga-mcp-gateway) ───────────────────
+export function cleanPath(p) {
+    p = p.replace(/\\/g, '/');
+    p = p.replace(/\/+/g, '/');
+    const segments = p.split('/');
+    const resolved = [];
+    const absolute = segments[0] === '';
+    for (const seg of segments) {
+        if (seg === '' || seg === '.')
+            continue;
+        if (seg === '..') {
+            if (resolved.length > 0 && resolved[resolved.length - 1] !== '..') {
+                resolved.pop();
+            }
+            else if (!absolute) {
+                resolved.push('..');
+            }
+        }
+        else {
+            resolved.push(seg);
+        }
+    }
+    let result = (absolute ? '/' : '') + resolved.join('/');
+    if (result === '')
+        result = '.';
+    return result;
+}
+export function matchesPrefix(prefix, candidate) {
+    const cleanPrefix = cleanPath(prefix);
+    const cleanCandidate = cleanPath(candidate);
+    if (cleanCandidate === cleanPrefix)
+        return true;
+    const prefixWithSlash = cleanPrefix.endsWith('/') ? cleanPrefix : cleanPrefix + '/';
+    return cleanCandidate.startsWith(prefixWithSlash);
+}
+function checkPathConstraints(constraint, args) {
+    if (!constraint.path_prefix)
+        return null;
+    const keys = constraint.path_keys?.length ? constraint.path_keys : ['path'];
+    if (!args)
+        return null;
+    for (const key of keys) {
+        const val = args[key];
+        if (typeof val === 'string') {
+            if (!matchesPrefix(constraint.path_prefix, val)) {
+                return `path "${val}" outside allowed prefix "${constraint.path_prefix}"`;
+            }
+        }
+    }
+    return null;
+}
+function checkDeniedPatterns(constraint, args) {
+    if (!constraint.denied_patterns?.length)
+        return null;
+    if (!args)
+        return null;
+    for (const [, val] of Object.entries(args)) {
+        if (typeof val !== 'string')
+            continue;
+        for (const pattern of constraint.denied_patterns) {
+            if (val.includes(pattern)) {
+                return `argument value matches denied pattern "${pattern}"`;
+            }
+        }
+    }
+    return null;
+}
+// ── Main Evaluator ──────────────────────────────────────────
+export function evaluate(policy, toolName, args) {
+    const base = { tool_name: toolName, policy_mode: policy.mode };
+    // Audit-only mode: always permit
+    if (policy.mode === 'audit_only') {
+        return { ...base, allowed: true, reason: 'audit_only: all calls permitted' };
+    }
+    if (policy.mode !== 'allowlist' && policy.mode !== 'denylist') {
+        return { ...base, allowed: false, reason: `unknown policy mode: ${policy.mode}` };
+    }
+    const constraint = policy.constraints[toolName];
+    if (policy.mode === 'allowlist') {
+        if (!constraint) {
+            return { ...base, allowed: false, reason: 'tool not in allowlist' };
+        }
+        if (!constraint.allowed) {
+            return { ...base, allowed: false, reason: 'tool explicitly disallowed' };
+        }
+        // Rate limit check
+        if (constraint.max_calls_per_minute) {
+            if (!checkRateLimit(toolName, constraint.max_calls_per_minute)) {
+                return { ...base, allowed: false, reason: `rate limit exceeded: ${constraint.max_calls_per_minute}/min` };
+            }
+        }
+        const pathResult = checkPathConstraints(constraint, args);
+        if (pathResult !== null) {
+            return { ...base, allowed: false, reason: pathResult };
+        }
+        const patternResult = checkDeniedPatterns(constraint, args);
+        if (patternResult !== null) {
+            return { ...base, allowed: false, reason: patternResult };
+        }
+        return { ...base, allowed: true, reason: 'tool permitted by allowlist' };
+    }
+    // Denylist mode
+    if (constraint && !constraint.allowed) {
+        return { ...base, allowed: false, reason: 'tool denied by denylist' };
+    }
+    // Rate limit check for denylist mode (tool not explicitly denied)
+    if (constraint?.max_calls_per_minute) {
+        if (!checkRateLimit(toolName, constraint.max_calls_per_minute)) {
+            return { ...base, allowed: false, reason: `rate limit exceeded: ${constraint.max_calls_per_minute}/min` };
+        }
+    }
+    return { ...base, allowed: true, reason: 'tool not denied' };
+}
+//# sourceMappingURL=evaluator.js.map

package/dist/proxy/evaluator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluator.js","sourceRoot":"","sources":["../../src/proxy/evaluator.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAUH,MAAM,UAAU,GAAG,IAAI,GAAG,EAAsB,CAAC;AAEjD,SAAS,cAAc,CAAC,QAAgB,EAAE,YAAoB;IAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC;IAE5B,IAAI,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;QAC5B,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC;IAED,wBAAwB;IACxB,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC;IAE9D,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,IAAI,YAAY;QAAE,OAAO,KAAK,CAAC;IAE3D,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,UAAU,CAAC,KAAK,EAAE,CAAC;AACrB,CAAC;AAED,+DAA+D;AAE/D,MAAM,UAAU,SAAS,CAAC,CAAS;IACjC,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAE3B,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;IAEpC,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,IAAI,GAAG,KAAK,EAAE,IAAI,GAAG,KAAK,GAAG;YAAE,SAAS;QACxC,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAClE,QAAQ,CAAC,GAAG,EAAE,CAAC;YACjB,CAAC;iBAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACrB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IAED,IAAI,MAAM,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxD,IAAI,MAAM,KAAK,EAAE;QAAE,MAAM,GAAG,GAAG,CAAC;IAChC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAAc,EAAE,SAAiB;IAC7D,MAAM,WAAW,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,cAAc,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;IAE5C,IAAI,cAAc,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IAChD,MAAM,eAAe,GAAG,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,GAAG,GAAG,CAAC;IACpF,OAAO,cAAc,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,oBAAoB,CAC3B,UAA0D,EAC1D,IAA8B;IAE9B,IAAI,CAAC,UAAU,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,IAAI,GAAG,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC5E,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QACtB,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC;gBAChD,OAAO,SAAS,GAAG,6BAA6B,UAAU,CAAC,WAAW,GAAG,CAAC;YAC5E,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,mBAAmB,CAC1B,UAA0C,EAC1C,IAA8B;IAE9B,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,MAAM;QAAE,OAAO,IAAI,CAAC;IACrD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,KAAK,MAAM,CAAC,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3C,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,SAAS;QACtC,KAAK,MAAM,OAAO,IAAI,UAAU,CAAC,eAAe,EAAE,CAAC;YACjD,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC1B,OAAO,0CAA0C,OAAO,GAAG,CAAC;YAC9D,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+DAA+D;AAE/D,MAAM,UAAU,QAAQ,CACtB,MAAkB,EAClB,QAAgB,EAChB,IAA8B;IAE9B,MAAM,IAAI,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IAE/D,iCAAiC;IACjC,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QACjC,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC;IAC/E,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC9D,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;IACpF,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IAEhD,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAChC,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;QACtE,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;YACxB,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;QAC3E,CAAC;QAED,mBAAmB;QACnB,IAAI,UAAU,CAAC,oBAAoB,EAAE,CAAC;YACpC,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,UAAU,CAAC,oBAAoB,CAAC,EAAE,CAAC;gBAC/D,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,UAAU,CAAC,oBAAoB,MAAM,EAAE,CAAC;YAC5G,CAAC;QACH,CAAC;QAED,MAAM,UAAU,GAAG,oBAAoB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QAC1D,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACxB,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QACzD,CAAC;QACD,MAAM,aAAa,GAAG,mBAAmB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QAC5D,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;YAC3B,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QAC5D,CAAC;QACD,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;IAC3E,CAAC;IAED,gBAAgB;IAChB,IAAI,UAAU,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QACtC,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;IACxE,CAAC;IAED,kEAAkE;IAClE,IAAI,UAAU,EAAE,oBAAoB,EAAE,CAAC;QACrC,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,UAAU,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAC/D,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,UAAU,CAAC,oBAAoB,MAAM,EAAE,CAAC;QAC5G,CAAC;IACH,CAAC;IAED,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;AAC/D,CAAC"}

package/dist/proxy/index.d.ts

@@ -0,0 +1,22 @@
+#!/usr/bin/env node
+/**
+ * AGA Governance Proxy - CLI Entry Point
+ *
+ * Usage:
+ *   aga-proxy start --upstream "node server.js"     # stdio upstream
+ *   aga-proxy start --upstream-url http://host:port  # HTTP upstream
+ *   aga-proxy start --profile standard               # policy profile
+ *   aga-proxy stop
+ *   aga-proxy status
+ *   aga-proxy export --output bundle.json
+ *   aga-proxy verify bundle.json
+ *
+ * Patent: USPTO App. No. 19/433,835
+ * Copyright (c) 2026 Attested Intelligence Holdings LLC
+ * SPDX-License-Identifier: MIT
+ */
+export { GovernanceProxy } from './server.js';
+export { evaluate, resetRateLimits } from './evaluator.js';
+export { PROFILES, PERMISSIVE, STANDARD, RESTRICTIVE } from './profiles.js';
+export type { ToolPolicy, ToolConstraint, ToolCallDecision, ProxyConfig } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/proxy/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/proxy/index.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;GAeG;AAsOH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5E,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC"}

package/dist/proxy/index.js

@@ -0,0 +1,230 @@
+#!/usr/bin/env node
+/**
+ * AGA Governance Proxy - CLI Entry Point
+ *
+ * Usage:
+ *   aga-proxy start --upstream "node server.js"     # stdio upstream
+ *   aga-proxy start --upstream-url http://host:port  # HTTP upstream
+ *   aga-proxy start --profile standard               # policy profile
+ *   aga-proxy stop
+ *   aga-proxy status
+ *   aga-proxy export --output bundle.json
+ *   aga-proxy verify bundle.json
+ *
+ * Patent: USPTO App. No. 19/433,835
+ * Copyright (c) 2026 Attested Intelligence Holdings LLC
+ * SPDX-License-Identifier: MIT
+ */
+import { Command } from 'commander';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import * as os from 'node:os';
+import { GovernanceProxy } from './server.js';
+import { PROFILES } from './profiles.js';
+const program = new Command();
+let proxy = null;
+function getDataDir() {
+    return path.join(os.homedir(), '.aga-proxy');
+}
+function getPidFile() {
+    return path.join(getDataDir(), 'proxy.pid');
+}
+program
+    .name('aga-proxy')
+    .description('AGA Governance Proxy - cryptographic runtime governance for MCP tool calls')
+    .version('0.1.0');
+// ── start ────────────────────────────────────────────────────
+program
+    .command('start')
+    .description('Start the governance proxy')
+    .option('-p, --port <port>', 'Proxy port', '18800')
+    .option('--upstream <command>', 'Downstream MCP server command (stdio)')
+    .option('--upstream-url <url>', 'Downstream MCP server URL (HTTP)')
+    .option('--profile <name>', 'Policy profile: permissive, standard, restrictive', 'permissive')
+    .option('--policy <path>', 'Custom policy JSON file')
+    .action(async (opts) => {
+    const port = parseInt(opts.port, 10);
+    let policy;
+    if (opts.policy) {
+        policy = JSON.parse(fs.readFileSync(opts.policy, 'utf-8'));
+    }
+    else {
+        policy = PROFILES[opts.profile] ?? PROFILES.permissive;
+    }
+    const upstream = opts.upstream ? parseUpstreamCommand(opts.upstream) : undefined;
+    proxy = new GovernanceProxy({
+        port,
+        policy,
+        upstream,
+        upstreamUrl: opts.upstreamUrl,
+    });
+    proxy.on('started', ({ port: p }) => {
+        console.log(`AGA Governance Proxy started on port ${p}`);
+        console.log(`Policy mode: ${policy.mode}`);
+        if (opts.upstream)
+            console.log(`Upstream (stdio): ${opts.upstream}`);
+        if (opts.upstreamUrl)
+            console.log(`Upstream (HTTP): ${opts.upstreamUrl}`);
+    });
+    proxy.on('error', (err) => {
+        console.error(`Proxy error: ${err.message}`);
+    });
+    // Ensure data dir exists
+    const dataDir = getDataDir();
+    if (!fs.existsSync(dataDir))
+        fs.mkdirSync(dataDir, { recursive: true });
+    await proxy.start();
+    // Write PID file
+    fs.writeFileSync(getPidFile(), String(process.pid));
+    // Graceful shutdown
+    const shutdown = async () => {
+        console.log('\nShutting down...');
+        if (proxy) {
+            await proxy.stop();
+            try {
+                fs.unlinkSync(getPidFile());
+            }
+            catch { /* ok */ }
+        }
+        process.exit(0);
+    };
+    process.on('SIGINT', shutdown);
+    process.on('SIGTERM', shutdown);
+});
+// ── run (foreground, alias for start) ────────────────────────
+program
+    .command('run')
+    .description('Run proxy in foreground (same as start, Ctrl+C to stop)')
+    .option('-p, --port <port>', 'Proxy port', '18800')
+    .option('--upstream <command>', 'Downstream MCP server command (stdio)')
+    .option('--upstream-url <url>', 'Downstream MCP server URL (HTTP)')
+    .option('--profile <name>', 'Policy profile', 'permissive')
+    .option('--policy <path>', 'Custom policy JSON file')
+    .action(async (opts) => {
+    // Delegate to start - identical behavior in Node.js
+    await program.commands.find(c => c.name() === 'start').parseAsync(['node', 'aga-proxy', 'start', ...process.argv.slice(3)]);
+});
+// ── stop ─────────────────────────────────────────────────────
+program
+    .command('stop')
+    .description('Stop the running proxy')
+    .action(async () => {
+    const pidFile = getPidFile();
+    if (!fs.existsSync(pidFile)) {
+        console.log('No running proxy found');
+        return;
+    }
+    const pid = parseInt(fs.readFileSync(pidFile, 'utf-8').trim(), 10);
+    try {
+        process.kill(pid, 'SIGTERM');
+        console.log(`Sent SIGTERM to proxy (PID ${pid})`);
+        fs.unlinkSync(pidFile);
+    }
+    catch {
+        console.log('Proxy process not found, cleaning up PID file');
+        fs.unlinkSync(pidFile);
+    }
+});
+// ── status ───────────────────────────────────────────────────
+program
+    .command('status')
+    .description('Show proxy status')
+    .action(async () => {
+    if (proxy) {
+        console.log(JSON.stringify(proxy.getStatus(), null, 2));
+    }
+    else {
+        const pidFile = getPidFile();
+        if (fs.existsSync(pidFile)) {
+            const pid = parseInt(fs.readFileSync(pidFile, 'utf-8').trim(), 10);
+            try {
+                process.kill(pid, 0); // Check if alive
+                console.log(JSON.stringify({ running: true, pid }, null, 2));
+            }
+            catch {
+                console.log(JSON.stringify({ running: false, stale_pid: pid }, null, 2));
+            }
+        }
+        else {
+            console.log(JSON.stringify({ running: false }, null, 2));
+        }
+    }
+});
+// ── export ───────────────────────────────────────────────────
+program
+    .command('export')
+    .description('Export evidence bundle')
+    .option('-o, --output <path>', 'Output file', 'evidence-bundle.json')
+    .action(async (opts) => {
+    if (!proxy) {
+        console.error('Proxy not running in this process. Start the proxy first.');
+        process.exit(1);
+    }
+    const bundle = await proxy.exportBundle();
+    fs.writeFileSync(opts.output, JSON.stringify(bundle, null, 2));
+    console.log(`Evidence bundle exported to ${opts.output}`);
+});
+// ── verify ───────────────────────────────────────────────────
+program
+    .command('verify <bundle>')
+    .description('Verify an evidence bundle (Ed25519-SHA256-JCS format)')
+    .action(async (bundlePath) => {
+    const { verifyGatewayBundle } = await import('./verify.js');
+    const bundleJson = fs.readFileSync(bundlePath, 'utf-8');
+    const result = await verifyGatewayBundle(bundleJson);
+    console.log(`Algorithm:        ${result.algorithm_valid ? 'PASS' : 'FAIL'}`);
+    console.log(`Signatures:       ${result.receipt_signatures_valid ? 'PASS' : 'FAIL'} (${result.receipts_checked} receipts)`);
+    console.log(`Chain integrity:  ${result.chain_integrity_valid ? 'PASS' : 'FAIL'}`);
+    console.log(`Merkle proofs:    ${result.merkle_proofs_valid ? 'PASS' : 'FAIL'}`);
+    console.log(`Consistency:      ${result.bundle_consistent ? 'PASS' : 'FAIL'}`);
+    console.log(`\nOVERALL: ${result.overall_valid ? 'VERIFIED' : 'FAILED'}`);
+    if (result.error)
+        console.log(`Error: ${result.error}`);
+    process.exit(result.overall_valid ? 0 : 1);
+});
+// ── policy ───────────────────────────────────────────────────
+const policyCmd = program.command('policy').description('Policy management');
+policyCmd
+    .command('show')
+    .description('Show current policy')
+    .action(() => {
+    if (!proxy) {
+        console.error('Proxy not running in this process.');
+        process.exit(1);
+    }
+    console.log(JSON.stringify(proxy.getStatus(), null, 2));
+});
+policyCmd
+    .command('switch <profile>')
+    .description('Switch policy profile')
+    .action(async (profile) => {
+    if (!proxy) {
+        console.error('Proxy not running in this process.');
+        process.exit(1);
+    }
+    const newPolicy = PROFILES[profile];
+    if (!newPolicy) {
+        console.error(`Unknown profile: ${profile}. Available: ${Object.keys(PROFILES).join(', ')}`);
+        process.exit(1);
+    }
+    await proxy.switchPolicy(newPolicy);
+    console.log(`Switched to ${profile} profile`);
+});
+// ── helpers ──────────────────────────────────────────────────
+function parseUpstreamCommand(cmd) {
+    const parts = cmd.split(/\s+/);
+    return { command: parts[0], args: parts.slice(1) };
+}
+// ── main ─────────────────────────────────────────────────────
+export { GovernanceProxy } from './server.js';
+export { evaluate, resetRateLimits } from './evaluator.js';
+export { PROFILES, PERMISSIVE, STANDARD, RESTRICTIVE } from './profiles.js';
+// Only parse CLI if run directly
+const isDirectRun = process.argv[1]?.includes('proxy') || process.argv[1]?.includes('aga-proxy');
+if (isDirectRun) {
+    program.parseAsync().catch((err) => {
+        console.error(err);
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=index.js.map

package/dist/proxy/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/proxy/index.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAGzC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAC9B,IAAI,KAAK,GAA2B,IAAI,CAAC;AAEzC,SAAS,UAAU;IACjB,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,YAAY,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,WAAW,CAAC,CAAC;AAC9C,CAAC;AAED,OAAO;KACJ,IAAI,CAAC,WAAW,CAAC;KACjB,WAAW,CAAC,4EAA4E,CAAC;KACzF,OAAO,CAAC,OAAO,CAAC,CAAC;AAEpB,gEAAgE;AAEhE,OAAO;KACJ,OAAO,CAAC,OAAO,CAAC;KAChB,WAAW,CAAC,4BAA4B,CAAC;KACzC,MAAM,CAAC,mBAAmB,EAAE,YAAY,EAAE,OAAO,CAAC;KAClD,MAAM,CAAC,sBAAsB,EAAE,uCAAuC,CAAC;KACvE,MAAM,CAAC,sBAAsB,EAAE,kCAAkC,CAAC;KAClE,MAAM,CAAC,kBAAkB,EAAE,mDAAmD,EAAE,YAAY,CAAC;KAC7F,MAAM,CAAC,iBAAiB,EAAE,yBAAyB,CAAC;KACpD,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACrB,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACrC,IAAI,MAAkB,CAAC;IAEvB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7D,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC;IACzD,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEjF,KAAK,GAAG,IAAI,eAAe,CAAC;QAC1B,IAAI;QACJ,MAAM;QACN,QAAQ;QACR,WAAW,EAAE,IAAI,CAAC,WAAW;KAC9B,CAAC,CAAC;IAEH,KAAK,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAoB,EAAE,EAAE;QACpD,OAAO,CAAC,GAAG,CAAC,wCAAwC,CAAC,EAAE,CAAC,CAAC;QACzD,OAAO,CAAC,GAAG,CAAC,gBAAgB,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3C,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QACrE,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE;QAC/B,OAAO,CAAC,KAAK,CAAC,gBAAgB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,yBAAyB;IACzB,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAExE,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;IAEpB,iBAAiB;IACjB,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAEpD,oBAAoB;IACpB,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE;QAC1B,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;QAClC,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;YACnB,IAAI,CAAC;gBAAC,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC;QACzD,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IAEF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC/B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC,CAAC,CAAC;AAEL,gEAAgE;AAEhE,OAAO;KACJ,OAAO,CAAC,KAAK,CAAC;KACd,WAAW,CAAC,yDAAyD,CAAC;KACtE,MAAM,CAAC,mBAAmB,EAAE,YAAY,EAAE,OAAO,CAAC;KAClD,MAAM,CAAC,sBAAsB,EAAE,uCAAuC,CAAC;KACvE,MAAM,CAAC,sBAAsB,EAAE,kCAAkC,CAAC;KAClE,MAAM,CAAC,kBAAkB,EAAE,gBAAgB,EAAE,YAAY,CAAC;KAC1D,MAAM,CAAC,iBAAiB,EAAE,yBAAyB,CAAC;KACpD,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACrB,oDAAoD;IACpD,MAAM,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,OAAO,CAAE,CAAC,UAAU,CAChE,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CACzD,CAAC;AACJ,CAAC,CAAC,CAAC;AAEL,gEAAgE;AAEhE,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,wBAAwB,CAAC;KACrC,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QACtC,OAAO;IACT,CAAC;IACD,MAAM,GAAG,GAAG,QAAQ,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IACnE,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,8BAA8B,GAAG,GAAG,CAAC,CAAC;QAClD,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;QAC7D,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,gEAAgE;AAEhE,OAAO;KACJ,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,mBAAmB,CAAC;KAChC,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1D,CAAC;SAAM,CAAC;QACN,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;QAC7B,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,QAAQ,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;YACnE,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,iBAAiB;gBACvC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC/D,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC3E,CAAC;QACH,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,gEAAgE;AAEhE,OAAO;KACJ,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,wBAAwB,CAAC;KACrC,MAAM,CAAC,qBAAqB,EAAE,aAAa,EAAE,sBAAsB,CAAC;KACpE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACrB,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC3E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,YAAY,EAAE,CAAC;IAC1C,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/D,OAAO,CAAC,GAAG,CAAC,+BAA+B,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;AAC5D,CAAC,CAAC,CAAC;AAEL,gEAAgE;AAEhE,OAAO;KACJ,OAAO,CAAC,iBAAiB,CAAC;KAC1B,WAAW,CAAC,uDAAuD,CAAC;KACpE,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE;IAC3B,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IAC5D,MAAM,UAAU,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,CAAC;IAErD,OAAO,CAAC,GAAG,CAAC,qBAAqB,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7E,OAAO,CAAC,GAAG,CAAC,qBAAqB,MAAM,CAAC,wBAAwB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,gBAAgB,YAAY,CAAC,CAAC;IAC5H,OAAO,CAAC,GAAG,CAAC,qBAAqB,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACnF,OAAO,CAAC,GAAG,CAAC,qBAAqB,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACjF,OAAO,CAAC,GAAG,CAAC,qBAAqB,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/E,OAAO,CAAC,GAAG,CAAC,cAAc,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC1E,IAAI,MAAM,CAAC,KAAK;QAAE,OAAO,CAAC,GAAG,CAAC,UAAU,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IAExD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7C,CAAC,CAAC,CAAC;AAEL,gEAAgE;AAEhE,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,mBAAmB,CAAC,CAAC;AAE7E,SAAS;KACN,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,qBAAqB,CAAC;KAClC,MAAM,CAAC,GAAG,EAAE;IACX,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACpD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAC1D,CAAC,CAAC,CAAC;AAEL,SAAS;KACN,OAAO,CAAC,kBAAkB,CAAC;KAC3B,WAAW,CAAC,uBAAuB,CAAC;KACpC,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IACxB,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACpD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,oBAAoB,OAAO,gBAAgB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC7F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,KAAK,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;IACpC,OAAO,CAAC,GAAG,CAAC,eAAe,OAAO,UAAU,CAAC,CAAC;AAChD,CAAC,CAAC,CAAC;AAEL,gEAAgE;AAEhE,SAAS,oBAAoB,CAAC,GAAW;IACvC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/B,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AACrD,CAAC;AAED,gEAAgE;AAEhE,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAG5E,iCAAiC;AACjC,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;AACjG,IAAI,WAAW,EAAE,CAAC;IAChB,OAAO,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACjC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/proxy/profiles.d.ts

@@ -0,0 +1,16 @@
+/**
+ * AGA Governance Proxy - Built-in Policy Profiles
+ *
+ * Patent: USPTO App. No. 19/433,835
+ * Copyright (c) 2026 Attested Intelligence Holdings LLC
+ * SPDX-License-Identifier: MIT
+ */
+import type { ToolPolicy } from './types.js';
+/** All tools permitted, no rate limits, logging only. */
+export declare const PERMISSIVE: ToolPolicy;
+/** All common tools allowed with rate limits. Dangerous patterns denied. */
+export declare const STANDARD: ToolPolicy;
+/** Explicit allowlist only. All unrecognized tools denied. Low rate limits. */
+export declare const RESTRICTIVE: ToolPolicy;
+export declare const PROFILES: Record<string, ToolPolicy>;
+//# sourceMappingURL=profiles.d.ts.map

package/dist/proxy/profiles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"profiles.d.ts","sourceRoot":"","sources":["../../src/proxy/profiles.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,yDAAyD;AACzD,eAAO,MAAM,UAAU,EAAE,UAGxB,CAAC;AAEF,4EAA4E;AAC5E,eAAO,MAAM,QAAQ,EAAE,UActB,CAAC;AAEF,+EAA+E;AAC/E,eAAO,MAAM,WAAW,EAAE,UAOzB,CAAC;AAEF,eAAO,MAAM,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAI/C,CAAC"}

package/dist/proxy/profiles.js

@@ -0,0 +1,43 @@
+/**
+ * AGA Governance Proxy - Built-in Policy Profiles
+ *
+ * Patent: USPTO App. No. 19/433,835
+ * Copyright (c) 2026 Attested Intelligence Holdings LLC
+ * SPDX-License-Identifier: MIT
+ */
+/** All tools permitted, no rate limits, logging only. */
+export const PERMISSIVE = {
+    mode: 'audit_only',
+    constraints: {},
+};
+/** All common tools allowed with rate limits. Dangerous patterns denied. */
+export const STANDARD = {
+    mode: 'allowlist',
+    constraints: {
+        filesystem_read: { name: 'filesystem_read', allowed: true, max_calls_per_minute: 30 },
+        filesystem_write: { name: 'filesystem_write', allowed: true, max_calls_per_minute: 30, denied_patterns: ['/etc/', '/sys/', '/proc/'] },
+        shell_execute: { name: 'shell_execute', allowed: true, max_calls_per_minute: 10, denied_patterns: ['rm -rf', 'mkfs', 'dd if=', ':(){:|:&};:'] },
+        web_search: { name: 'web_search', allowed: true, max_calls_per_minute: 20 },
+        web_fetch: { name: 'web_fetch', allowed: true, max_calls_per_minute: 20 },
+        send_message: { name: 'send_message', allowed: true, max_calls_per_minute: 5 },
+        calendar_create: { name: 'calendar_create', allowed: true, max_calls_per_minute: 5 },
+        memory_search: { name: 'memory_search', allowed: true, max_calls_per_minute: 30 },
+        memory_store: { name: 'memory_store', allowed: true, max_calls_per_minute: 10 },
+        code_execute: { name: 'code_execute', allowed: true, max_calls_per_minute: 10 },
+    },
+};
+/** Explicit allowlist only. All unrecognized tools denied. Low rate limits. */
+export const RESTRICTIVE = {
+    mode: 'allowlist',
+    constraints: {
+        filesystem_read: { name: 'filesystem_read', allowed: true, max_calls_per_minute: 10, path_prefix: '/home' },
+        web_search: { name: 'web_search', allowed: true, max_calls_per_minute: 5 },
+        memory_search: { name: 'memory_search', allowed: true, max_calls_per_minute: 10 },
+    },
+};
+export const PROFILES = {
+    permissive: PERMISSIVE,
+    standard: STANDARD,
+    restrictive: RESTRICTIVE,
+};
+//# sourceMappingURL=profiles.js.map

package/dist/proxy/profiles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profiles.js","sourceRoot":"","sources":["../../src/proxy/profiles.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,yDAAyD;AACzD,MAAM,CAAC,MAAM,UAAU,GAAe;IACpC,IAAI,EAAE,YAAY;IAClB,WAAW,EAAE,EAAE;CAChB,CAAC;AAEF,4EAA4E;AAC5E,MAAM,CAAC,MAAM,QAAQ,GAAe;IAClC,IAAI,EAAE,WAAW;IACjB,WAAW,EAAE;QACX,eAAe,EAAI,EAAE,IAAI,EAAE,iBAAiB,EAAI,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE;QACzF,gBAAgB,EAAG,EAAE,IAAI,EAAE,kBAAkB,EAAG,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE;QACxI,aAAa,EAAM,EAAE,IAAI,EAAE,eAAe,EAAM,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,CAAC,EAAE;QACvJ,UAAU,EAAS,EAAE,IAAI,EAAE,YAAY,EAAS,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE;QACzF,SAAS,EAAU,EAAE,IAAI,EAAE,WAAW,EAAU,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE;QACzF,YAAY,EAAO,EAAE,IAAI,EAAE,cAAc,EAAO,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,EAAE;QACxF,eAAe,EAAI,EAAE,IAAI,EAAE,iBAAiB,EAAI,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,EAAE;QACxF,aAAa,EAAM,EAAE,IAAI,EAAE,eAAe,EAAM,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE;QACzF,YAAY,EAAO,EAAE,IAAI,EAAE,cAAc,EAAO,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE;QACzF,YAAY,EAAO,EAAE,IAAI,EAAE,cAAc,EAAO,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE;KAC1F;CACF,CAAC;AAEF,+EAA+E;AAC/E,MAAM,CAAC,MAAM,WAAW,GAAe;IACrC,IAAI,EAAE,WAAW;IACjB,WAAW,EAAE;QACX,eAAe,EAAG,EAAE,IAAI,EAAE,iBAAiB,EAAG,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE;QAC7G,UAAU,EAAQ,EAAE,IAAI,EAAE,YAAY,EAAQ,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,EAAE;QACtF,aAAa,EAAK,EAAE,IAAI,EAAE,eAAe,EAAK,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE;KACxF;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,QAAQ,GAA+B;IAClD,UAAU,EAAE,UAAU;IACtB,QAAQ,EAAE,QAAQ;IAClB,WAAW,EAAE,WAAW;CACzB,CAAC"}

package/dist/proxy/server.d.ts

@@ -0,0 +1,106 @@
+/**
+ * AGA Governance Proxy Server
+ * TCP proxy that intercepts MCP JSON-RPC 2.0 tool calls,
+ * evaluates them against a sealed policy, and produces
+ * Ed25519-signed governance receipts.
+ *
+ * Receipt format: Ed25519-SHA256-JCS (canonical across TS gateway,
+ * Python SDK, Go CLI, and browser verifier).
+ *
+ * Architecture: Client → Proxy (:18800) → Downstream MCP Server
+ * The proxy holds ALL signing keys. The client holds NONE.
+ *
+ * Patent: USPTO App. No. 19/433,835
+ * Copyright (c) 2026 Attested Intelligence Holdings LLC
+ * SPDX-License-Identifier: MIT
+ */
+import { EventEmitter } from 'node:events';
+import { type StdioBridgeOptions } from './stdio-bridge.js';
+import type { ToolPolicy } from './types.js';
+export interface GovernanceReceipt {
+    receipt_id: string;
+    receipt_version: string;
+    algorithm: string;
+    timestamp: string;
+    request_id: string | number | null;
+    method: string;
+    tool_name: string;
+    decision: 'PERMITTED' | 'DENIED';
+    reason: string;
+    policy_reference: string;
+    arguments_hash: string;
+    previous_receipt_hash: string;
+    gateway_id: string;
+    signature: string;
+    public_key: string;
+}
+export interface EvidenceBundle {
+    schema_version: string;
+    bundle_id: string;
+    algorithm: string;
+    generated_at: string;
+    gateway_id: string;
+    public_key: string;
+    policy_reference: string;
+    receipts: GovernanceReceipt[];
+    merkle_root: string;
+    merkle_proofs: MerkleProof[];
+    offline_capable: boolean;
+}
+export interface MerkleProof {
+    leaf_hash: string;
+    leaf_index: number;
+    siblings: string[];
+    directions: ('left' | 'right')[];
+    merkle_root: string;
+}
+export interface ProxyServerOptions {
+    port?: number;
+    policy?: ToolPolicy;
+    upstream?: StdioBridgeOptions;
+    upstreamUrl?: string;
+    gatewayId?: string;
+}
+export declare class GovernanceProxy extends EventEmitter {
+    private server;
+    private bridge;
+    private signingKP;
+    private policy;
+    private port;
+    private started;
+    private upstreamOptions;
+    private upstreamUrl;
+    private gatewayId;
+    private receipts;
+    private lastReceiptHash;
+    private policyHash;
+    private stats;
+    constructor(options?: ProxyServerOptions);
+    start(): Promise<void>;
+    stop(): Promise<void>;
+    private handleConnection;
+    private handleMessage;
+    private interceptToolCall;
+    private generateReceipt;
+    private merkleNodeHash;
+    private computeMerkleRoot;
+    private computeMerkleProof;
+    private forwardHttp;
+    private respond;
+    switchPolicy(newPolicy: ToolPolicy): Promise<void>;
+    exportBundle(): EvidenceBundle;
+    getStatus(): {
+        public_key: string;
+        permitted: number;
+        denied: number;
+        total: number;
+        started_at: string;
+        running: boolean;
+        port: number;
+        policy_mode: "allowlist" | "denylist" | "audit_only";
+        receipt_count: number;
+    };
+    getPublicKey(): string;
+    getReceipts(): GovernanceReceipt[];
+}
+//# sourceMappingURL=server.d.ts.map

package/dist/proxy/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/proxy/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAO3C,OAAO,EAAe,KAAK,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAIzE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAK7C,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,WAAW,GAAG,QAAQ,CAAC;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,cAAc;IAC7B,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,WAAW,EAAE,CAAC;IAC7B,eAAe,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,UAAU,EAAE,CAAC,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC;IACjC,WAAW,EAAE,MAAM,CAAC;CACrB;AAID,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,qBAAa,eAAgB,SAAQ,YAAY;IAC/C,OAAO,CAAC,MAAM,CAA2B;IACzC,OAAO,CAAC,MAAM,CAA4B;IAG1C,OAAO,CAAC,SAAS,CAAU;IAG3B,OAAO,CAAC,MAAM,CAAa;IAC3B,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,eAAe,CAA4B;IACnD,OAAO,CAAC,WAAW,CAAgB;IACnC,OAAO,CAAC,SAAS,CAAS;IAG1B,OAAO,CAAC,QAAQ,CAA2B;IAC3C,OAAO,CAAC,eAAe,CAAc;IACrC,OAAO,CAAC,UAAU,CAAc;IAGhC,OAAO,CAAC,KAAK,CAAyD;gBAE1D,OAAO,GAAE,kBAAuB;IAYtC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IA4BtB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAqB3B,OAAO,CAAC,gBAAgB;YAoBV,aAAa;YAgDb,iBAAiB;IAiF/B,OAAO,CAAC,eAAe;IA6CvB,OAAO,CAAC,cAAc;IAStB,OAAO,CAAC,iBAAiB;IAkBzB,OAAO,CAAC,kBAAkB;YAuCZ,WAAW;IAoBzB,OAAO,CAAC,OAAO;IAQT,YAAY,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAOxD,YAAY,IAAI,cAAc;IAsB9B,SAAS;;;;;;;;;;;IAWT,YAAY,IAAI,MAAM;IACtB,WAAW,IAAI,iBAAiB,EAAE;CACnC"}