@attested-intelligence/aga-mcp-server 2.0.1 → 2.2.0

package/dist/proxy/server.js

@@ -0,0 +1,389 @@
+/**
+ * AGA Governance Proxy Server
+ * TCP proxy that intercepts MCP JSON-RPC 2.0 tool calls,
+ * evaluates them against a sealed policy, and produces
+ * Ed25519-signed governance receipts.
+ *
+ * Receipt format: Ed25519-SHA256-JCS (canonical across TS gateway,
+ * Python SDK, Go CLI, and browser verifier).
+ *
+ * Architecture: Client → Proxy (:18800) → Downstream MCP Server
+ * The proxy holds ALL signing keys. The client holds NONE.
+ *
+ * Patent: USPTO App. No. 19/433,835
+ * Copyright (c) 2026 Attested Intelligence Holdings LLC
+ * SPDX-License-Identifier: MIT
+ */
+import * as net from 'node:net';
+import { EventEmitter } from 'node:events';
+import { generateKeyPair, pkToHex, signStr } from '../crypto/sign.js';
+import { bytesToHex, hexToBytes as utilHexToBytes } from '@noble/hashes/utils';
+import { sha256 } from '@noble/hashes/sha256';
+import { sha256Str } from '../crypto/hash.js';
+import { canonicalize } from '../utils/canonical.js';
+import { evaluate, resetRateLimits } from './evaluator.js';
+import { StdioBridge } from './stdio-bridge.js';
+import { PERMISSIVE } from './profiles.js';
+import { utcNow } from '../utils/timestamp.js';
+import { uuid } from '../utils/uuid.js';
+export class GovernanceProxy extends EventEmitter {
+    server = null;
+    bridge = null;
+    // Crypto key - never leaves this process
+    signingKP;
+    // State
+    policy;
+    port;
+    started = false;
+    upstreamOptions;
+    upstreamUrl;
+    gatewayId;
+    // Receipt chain
+    receipts = [];
+    lastReceiptHash = '';
+    policyHash = '';
+    // Stats
+    stats = { permitted: 0, denied: 0, total: 0, started_at: '' };
+    constructor(options = {}) {
+        super();
+        this.port = options.port ?? 18800;
+        this.policy = options.policy ?? PERMISSIVE;
+        this.upstreamOptions = options.upstream ?? null;
+        this.upstreamUrl = options.upstreamUrl ?? null;
+        this.gatewayId = options.gatewayId ?? 'aga-proxy';
+        this.signingKP = generateKeyPair();
+    }
+    // ── Start / Stop ───────────────────────────────────────────
+    async start() {
+        if (this.started)
+            throw new Error('Proxy already running');
+        this.policyHash = sha256Str(canonicalize(this.policy));
+        // Start downstream bridge if configured
+        if (this.upstreamOptions) {
+            this.bridge = new StdioBridge(this.upstreamOptions);
+            await this.bridge.start();
+            this.bridge.on('error', (err) => this.emit('error', err));
+            this.bridge.on('exit', (code) => {
+                process.stderr.write(`[aga-proxy] Downstream exited with code ${code}\n`);
+            });
+        }
+        // Start TCP server
+        this.server = net.createServer((socket) => this.handleConnection(socket));
+        await new Promise((resolve, reject) => {
+            this.server.listen(this.port, () => resolve());
+            this.server.on('error', reject);
+        });
+        this.started = true;
+        this.stats.started_at = new Date().toISOString();
+        resetRateLimits();
+        this.emit('started', { port: this.port });
+    }
+    async stop() {
+        if (!this.started)
+            return;
+        if (this.bridge) {
+            await this.bridge.stop();
+            this.bridge = null;
+        }
+        if (this.server) {
+            await new Promise((resolve) => {
+                this.server.close(() => resolve());
+            });
+            this.server = null;
+        }
+        this.started = false;
+        this.emit('stopped');
+    }
+    // ── Connection handler ─────────────────────────────────────
+    handleConnection(socket) {
+        let buffer = '';
+        socket.on('data', (chunk) => {
+            buffer += chunk.toString();
+            const lines = buffer.split('\n');
+            buffer = lines.pop() || '';
+            for (const line of lines) {
+                const trimmed = line.trim();
+                if (!trimmed)
+                    continue;
+                this.handleMessage(trimmed, socket).catch((err) => {
+                    process.stderr.write(`[aga-proxy] Error handling message: ${err}\n`);
+                });
+            }
+        });
+        socket.on('error', () => { });
+    }
+    async handleMessage(raw, socket) {
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch {
+            this.respond(socket, { jsonrpc: '2.0', error: { code: -32700, message: 'Parse error' }, id: null });
+            return;
+        }
+        if (parsed.jsonrpc !== '2.0') {
+            this.respond(socket, { jsonrpc: '2.0', error: { code: -32600, message: 'Invalid Request: missing jsonrpc 2.0' }, id: null });
+            return;
+        }
+        const requestId = parsed.id ?? null;
+        const method = parsed.method;
+        // Non-tools/call methods: forward transparently
+        if (method !== 'tools/call') {
+            if (this.bridge) {
+                try {
+                    const response = await this.bridge.send(parsed);
+                    this.respond(socket, response);
+                }
+                catch (err) {
+                    this.respond(socket, {
+                        jsonrpc: '2.0',
+                        error: { code: -32603, message: `Downstream error: ${err}` },
+                        id: requestId,
+                    });
+                }
+            }
+            else if (this.upstreamUrl) {
+                await this.forwardHttp(raw, socket, requestId);
+            }
+            else {
+                this.respond(socket, {
+                    jsonrpc: '2.0',
+                    error: { code: -32603, message: 'No upstream configured' },
+                    id: requestId,
+                });
+            }
+            return;
+        }
+        // tools/call - governance intercept
+        await this.interceptToolCall(parsed, socket, requestId);
+    }
+    // ── Tool call interception ─────────────────────────────────
+    async interceptToolCall(parsed, socket, requestId) {
+        const params = parsed.params;
+        const toolName = params?.name;
+        const toolArgs = params?.arguments;
+        this.stats.total++;
+        // Fail-closed: no tool name
+        if (!toolName) {
+            const receipt = this.generateReceipt('UNKNOWN', 'DENIED', 'tool name extraction failed, fail-closed', requestId, undefined);
+            this.stats.denied++;
+            this.respond(socket, {
+                jsonrpc: '2.0',
+                error: {
+                    code: -32600,
+                    message: 'Missing tool name',
+                    data: { receipt_id: receipt.receipt_id, decision: 'DENIED' },
+                },
+                id: requestId,
+            });
+            return;
+        }
+        // Evaluate against policy
+        const decision = evaluate(this.policy, toolName, toolArgs);
+        const receipt = this.generateReceipt(toolName, decision.allowed ? 'PERMITTED' : 'DENIED', decision.reason, requestId, toolArgs);
+        if (!decision.allowed) {
+            this.stats.denied++;
+            this.respond(socket, {
+                jsonrpc: '2.0',
+                error: {
+                    code: -32600,
+                    message: `Tool denied: ${decision.reason}`,
+                    data: { receipt_id: receipt.receipt_id, decision: 'DENIED', reason: decision.reason },
+                },
+                id: requestId,
+            });
+            return;
+        }
+        // Permitted - forward to downstream
+        this.stats.permitted++;
+        if (this.bridge) {
+            try {
+                const response = await this.bridge.send(parsed);
+                this.respond(socket, response);
+            }
+            catch (err) {
+                this.respond(socket, {
+                    jsonrpc: '2.0',
+                    error: { code: -32603, message: `Downstream error: ${err}` },
+                    id: requestId,
+                });
+            }
+        }
+        else if (this.upstreamUrl) {
+            await this.forwardHttp(JSON.stringify(parsed), socket, requestId);
+        }
+        else {
+            // No upstream - return success with receipt info
+            this.respond(socket, {
+                jsonrpc: '2.0',
+                result: {
+                    content: [{ type: 'text', text: JSON.stringify({ permitted: true, receipt_id: receipt.receipt_id, tool: toolName }) }],
+                },
+                id: requestId,
+            });
+        }
+    }
+    // ── Receipt generation (Ed25519-SHA256-JCS canonical format) ─
+    generateReceipt(toolName, decision, reason, requestId, toolArgs) {
+        const pubKeyHex = pkToHex(this.signingKP.publicKey);
+        // Arguments hash tri-state per spec Section 3.5
+        let argumentsHash;
+        if (toolArgs === undefined) {
+            argumentsHash = '';
+        }
+        else {
+            argumentsHash = sha256Str(canonicalize(toolArgs));
+        }
+        const unsigned = {
+            receipt_id: uuid(),
+            receipt_version: '1.0',
+            algorithm: 'Ed25519-SHA256-JCS',
+            timestamp: utcNow(),
+            request_id: requestId,
+            method: 'tools/call',
+            tool_name: toolName,
+            decision,
+            reason,
+            policy_reference: this.policyHash,
+            arguments_hash: argumentsHash,
+            previous_receipt_hash: this.lastReceiptHash,
+            gateway_id: this.gatewayId,
+            public_key: pubKeyHex,
+        };
+        const sig = signStr(canonicalize(unsigned), this.signingKP.secretKey);
+        const receipt = { ...unsigned, signature: bytesToHex(sig) };
+        this.receipts.push(receipt);
+        this.lastReceiptHash = sha256Str(canonicalize(receipt));
+        return receipt;
+    }
+    // ── Merkle tree (binary, odd-node promotion, binary concat) ─
+    merkleNodeHash(leftHex, rightHex) {
+        const left = utilHexToBytes(leftHex);
+        const right = utilHexToBytes(rightHex);
+        const combined = new Uint8Array(left.length + right.length);
+        combined.set(left, 0);
+        combined.set(right, left.length);
+        return bytesToHex(sha256(combined));
+    }
+    computeMerkleRoot(leaves) {
+        if (leaves.length === 0)
+            return '';
+        if (leaves.length === 1)
+            return leaves[0];
+        let level = [...leaves];
+        while (level.length > 1) {
+            const next = [];
+            for (let i = 0; i < level.length; i += 2) {
+                if (i + 1 < level.length) {
+                    next.push(this.merkleNodeHash(level[i], level[i + 1]));
+                }
+                else {
+                    next.push(level[i]);
+                }
+            }
+            level = next;
+        }
+        return level[0];
+    }
+    computeMerkleProof(leaves, leafIndex) {
+        const siblings = [];
+        const directions = [];
+        let level = [...leaves];
+        let idx = leafIndex;
+        while (level.length > 1) {
+            const next = [];
+            for (let i = 0; i < level.length; i += 2) {
+                if (i + 1 < level.length) {
+                    next.push(this.merkleNodeHash(level[i], level[i + 1]));
+                }
+                else {
+                    next.push(level[i]);
+                }
+            }
+            if (idx % 2 === 0) {
+                if (idx + 1 < level.length) {
+                    siblings.push(level[idx + 1]);
+                    directions.push('right');
+                }
+            }
+            else {
+                siblings.push(level[idx - 1]);
+                directions.push('left');
+            }
+            idx = Math.floor(idx / 2);
+            level = next;
+        }
+        return {
+            leaf_hash: leaves[leafIndex],
+            leaf_index: leafIndex,
+            siblings,
+            directions,
+            merkle_root: level[0],
+        };
+    }
+    // ── HTTP forwarding ────────────────────────────────────────
+    async forwardHttp(body, socket, requestId) {
+        try {
+            const resp = await fetch(this.upstreamUrl, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body,
+            });
+            const data = await resp.json();
+            this.respond(socket, data);
+        }
+        catch (err) {
+            this.respond(socket, {
+                jsonrpc: '2.0',
+                error: { code: -32603, message: `HTTP upstream error: ${err}` },
+                id: requestId,
+            });
+        }
+    }
+    // ── Response helper ────────────────────────────────────────
+    respond(socket, msg) {
+        if (!socket.destroyed) {
+            socket.write(JSON.stringify(msg) + '\n');
+        }
+    }
+    // ── Public API ─────────────────────────────────────────────
+    async switchPolicy(newPolicy) {
+        this.policy = newPolicy;
+        this.policyHash = sha256Str(canonicalize(newPolicy));
+        resetRateLimits();
+        this.emit('policy_switched');
+    }
+    exportBundle() {
+        if (this.receipts.length === 0)
+            throw new Error('No receipts');
+        const leafHashes = this.receipts.map(r => sha256Str(canonicalize(r)));
+        const root = this.computeMerkleRoot(leafHashes);
+        const proofs = leafHashes.map((_, i) => this.computeMerkleProof(leafHashes, i));
+        return {
+            schema_version: '1.0',
+            bundle_id: uuid(),
+            algorithm: 'Ed25519-SHA256-JCS',
+            generated_at: utcNow(),
+            gateway_id: this.gatewayId,
+            public_key: pkToHex(this.signingKP.publicKey),
+            policy_reference: this.policyHash,
+            receipts: this.receipts,
+            merkle_root: root,
+            merkle_proofs: proofs,
+            offline_capable: true,
+        };
+    }
+    getStatus() {
+        return {
+            running: this.started,
+            port: this.port,
+            policy_mode: this.policy.mode,
+            receipt_count: this.receipts.length,
+            ...this.stats,
+            public_key: pkToHex(this.signingKP.publicKey),
+        };
+    }
+    getPublicKey() { return pkToHex(this.signingKP.publicKey); }
+    getReceipts() { return this.receipts; }
+}
+//# sourceMappingURL=server.js.map

package/dist/proxy/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/proxy/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,UAAU,IAAI,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC/E,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EAAE,WAAW,EAA2B,MAAM,mBAAmB,CAAC;AACzE,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAwDxC,MAAM,OAAO,eAAgB,SAAQ,YAAY;IACvC,MAAM,GAAsB,IAAI,CAAC;IACjC,MAAM,GAAuB,IAAI,CAAC;IAE1C,yCAAyC;IACjC,SAAS,CAAU;IAE3B,QAAQ;IACA,MAAM,CAAa;IACnB,IAAI,CAAS;IACb,OAAO,GAAG,KAAK,CAAC;IAChB,eAAe,CAA4B;IAC3C,WAAW,CAAgB;IAC3B,SAAS,CAAS;IAE1B,gBAAgB;IACR,QAAQ,GAAwB,EAAE,CAAC;IACnC,eAAe,GAAW,EAAE,CAAC;IAC7B,UAAU,GAAW,EAAE,CAAC;IAEhC,QAAQ;IACA,KAAK,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IAEtE,YAAY,UAA8B,EAAE;QAC1C,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,KAAK,CAAC;QAClC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,UAAU,CAAC;QAC3C,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC;QAChD,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC;QAC/C,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,WAAW,CAAC;QAClD,IAAI,CAAC,SAAS,GAAG,eAAe,EAAE,CAAC;IACrC,CAAC;IAED,8DAA8D;IAE9D,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAE3D,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QAEvD,wCAAwC;QACxC,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzB,IAAI,CAAC,MAAM,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YACpD,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;YAC1D,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;gBACtC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,2CAA2C,IAAI,IAAI,CAAC,CAAC;YAC5E,CAAC,CAAC,CAAC;QACL,CAAC;QAED,mBAAmB;QACnB,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1E,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,IAAI,CAAC,MAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YAChD,IAAI,CAAC,MAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACjD,eAAe,EAAE,CAAC;QAClB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAE1B,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACzB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACrB,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;gBAClC,IAAI,CAAC,MAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YACtC,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACrB,CAAC;QAED,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACrB,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACvB,CAAC;IAED,8DAA8D;IAEtD,gBAAgB,CAAC,MAAkB;QACzC,IAAI,MAAM,GAAG,EAAE,CAAC;QAEhB,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;YAC1B,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;YAE3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC5B,IAAI,CAAC,OAAO;oBAAE,SAAS;gBACvB,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;oBAChD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uCAAuC,GAAG,IAAI,CAAC,CAAC;gBACvE,CAAC,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAA6B,CAAC,CAAC,CAAC;IAC1D,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,GAAW,EAAE,MAAkB;QACzD,IAAI,MAA+B,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YACpG,OAAO;QACT,CAAC;QAED,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;YAC7B,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,sCAAsC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7H,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAI,MAAM,CAAC,EAA6B,IAAI,IAAI,CAAC;QAChE,MAAM,MAAM,GAAG,MAAM,CAAC,MAA4B,CAAC;QAEnD,gDAAgD;QAChD,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;YAC5B,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChB,IAAI,CAAC;oBACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;oBAChD,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBACjC,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE;wBACnB,OAAO,EAAE,KAAK;wBACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,qBAAqB,GAAG,EAAE,EAAE;wBAC5D,EAAE,EAAE,SAAS;qBACd,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;iBAAM,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC5B,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;YACjD,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE;oBACnB,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,wBAAwB,EAAE;oBAC1D,EAAE,EAAE,SAAS;iBACd,CAAC,CAAC;YACL,CAAC;YACD,OAAO;QACT,CAAC;QAED,oCAAoC;QACpC,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IAC1D,CAAC;IAED,8DAA8D;IAEtD,KAAK,CAAC,iBAAiB,CAC7B,MAA+B,EAC/B,MAAkB,EAClB,SAAiC;QAEjC,MAAM,MAAM,GAAG,MAAM,CAAC,MAA6C,CAAC;QACpE,MAAM,QAAQ,GAAG,MAAM,EAAE,IAA0B,CAAC;QACpD,MAAM,QAAQ,GAAG,MAAM,EAAE,SAAgD,CAAC;QAE1E,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QAEnB,4BAA4B;QAC5B,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,SAAS,EAAE,QAAQ,EAAE,0CAA0C,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;YAC5H,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACpB,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE;gBACnB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,CAAC,KAAK;oBACZ,OAAO,EAAE,mBAAmB;oBAC5B,IAAI,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE;iBAC7D;gBACD,EAAE,EAAE,SAAS;aACd,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,0BAA0B;QAC1B,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAClC,QAAQ,EACR,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,EACzC,QAAQ,CAAC,MAAM,EACf,SAAS,EACT,QAAQ,CACT,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtB,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACpB,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE;gBACnB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,CAAC,KAAK;oBACZ,OAAO,EAAE,gBAAgB,QAAQ,CAAC,MAAM,EAAE;oBAC1C,IAAI,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE;iBACtF;gBACD,EAAE,EAAE,SAAS;aACd,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,oCAAoC;QACpC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QAEvB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAChD,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YACjC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE;oBACnB,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,qBAAqB,GAAG,EAAE,EAAE;oBAC5D,EAAE,EAAE,SAAS;iBACd,CAAC,CAAC;YACL,CAAC;QACH,CAAC;aAAM,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YAC5B,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QACpE,CAAC;aAAM,CAAC;YACN,iDAAiD;YACjD,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE;gBACnB,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE;oBACN,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;iBACvH;gBACD,EAAE,EAAE,SAAS;aACd,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,gEAAgE;IAExD,eAAe,CACrB,QAAgB,EAChB,QAAgC,EAChC,MAAc,EACd,SAAiC,EACjC,QAA6C;QAE7C,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAEpD,gDAAgD;QAChD,IAAI,aAAqB,CAAC;QAC1B,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,aAAa,GAAG,EAAE,CAAC;QACrB,CAAC;aAAM,CAAC;YACN,aAAa,GAAG,SAAS,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,QAAQ,GAAG;YACf,UAAU,EAAE,IAAI,EAAE;YAClB,eAAe,EAAE,KAAK;YACtB,SAAS,EAAE,oBAAoB;YAC/B,SAAS,EAAE,MAAM,EAAE;YACnB,UAAU,EAAE,SAAS;YACrB,MAAM,EAAE,YAAY;YACpB,SAAS,EAAE,QAAQ;YACnB,QAAQ;YACR,MAAM;YACN,gBAAgB,EAAE,IAAI,CAAC,UAAU;YACjC,cAAc,EAAE,aAAa;YAC7B,qBAAqB,EAAE,IAAI,CAAC,eAAe;YAC3C,UAAU,EAAE,IAAI,CAAC,SAAS;YAC1B,UAAU,EAAE,SAAS;SACtB,CAAC;QAEF,MAAM,GAAG,GAAG,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACtE,MAAM,OAAO,GAAsB,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAE/E,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5B,IAAI,CAAC,eAAe,GAAG,SAAS,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;QAExD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,+DAA+D;IAEvD,cAAc,CAAC,OAAe,EAAE,QAAgB;QACtD,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;QACvC,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;QAC5D,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACtB,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACjC,OAAO,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IACtC,CAAC;IAEO,iBAAiB,CAAC,MAAgB;QACxC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACnC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;QAC1C,IAAI,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;QACxB,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,GAAa,EAAE,CAAC;YAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzC,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;oBACzB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBACzD,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBACtB,CAAC;YACH,CAAC;YACD,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;QACD,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAEO,kBAAkB,CAAC,MAAgB,EAAE,SAAiB;QAC5D,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,MAAM,UAAU,GAAyB,EAAE,CAAC;QAC5C,IAAI,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;QACxB,IAAI,GAAG,GAAG,SAAS,CAAC;QAEpB,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,GAAa,EAAE,CAAC;YAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzC,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;oBACzB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBACzD,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBACtB,CAAC;YACH,CAAC;YACD,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBAClB,IAAI,GAAG,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;oBAC3B,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;oBAC9B,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC3B,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;gBAC9B,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC1B,CAAC;YACD,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;YAC1B,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;QAED,OAAO;YACL,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC;YAC5B,UAAU,EAAE,SAAS;YACrB,QAAQ;YACR,UAAU;YACV,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;SACtB,CAAC;IACJ,CAAC;IAED,8DAA8D;IAEtD,KAAK,CAAC,WAAW,CAAC,IAAY,EAAE,MAAkB,EAAE,SAAiC;QAC3F,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,WAAY,EAAE;gBAC1C,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI;aACL,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YAC/B,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAA+B,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE;gBACnB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,wBAAwB,GAAG,EAAE,EAAE;gBAC/D,EAAE,EAAE,SAAS;aACd,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,8DAA8D;IAEtD,OAAO,CAAC,MAAkB,EAAE,GAA4B;QAC9D,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACtB,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED,8DAA8D;IAE9D,KAAK,CAAC,YAAY,CAAC,SAAqB;QACtC,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;QACxB,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC;QACrD,eAAe,EAAE,CAAC;QAClB,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC/B,CAAC;IAED,YAAY;QACV,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;QAE/D,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtE,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC;QAEhF,OAAO;YACL,cAAc,EAAE,KAAK;YACrB,SAAS,EAAE,IAAI,EAAE;YACjB,SAAS,EAAE,oBAAoB;YAC/B,YAAY,EAAE,MAAM,EAAE;YACtB,UAAU,EAAE,IAAI,CAAC,SAAS;YAC1B,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;YAC7C,gBAAgB,EAAE,IAAI,CAAC,UAAU;YACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,WAAW,EAAE,IAAI;YACjB,aAAa,EAAE,MAAM;YACrB,eAAe,EAAE,IAAI;SACtB,CAAC;IACJ,CAAC;IAED,SAAS;QACP,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YAC7B,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM;YACnC,GAAG,IAAI,CAAC,KAAK;YACb,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;SAC9C,CAAC;IACJ,CAAC;IAED,YAAY,KAAa,OAAO,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACpE,WAAW,KAA0B,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;CAC7D"}

package/dist/proxy/stdio-bridge.d.ts

@@ -0,0 +1,42 @@
+/**
+ * AGA Governance Proxy - Stdio Bridge
+ * Spawns a downstream MCP server as a child process and manages
+ * JSON-RPC message framing over stdin/stdout.
+ *
+ * Patent: USPTO App. No. 19/433,835
+ * Copyright (c) 2026 Attested Intelligence Holdings LLC
+ * SPDX-License-Identifier: MIT
+ */
+import { EventEmitter } from 'node:events';
+export interface StdioBridgeOptions {
+    command: string;
+    args?: string[];
+    env?: Record<string, string>;
+    cwd?: string;
+}
+/**
+ * Bridges JSON-RPC messages to/from a child process via stdio.
+ * Handles newline-delimited JSON framing.
+ */
+export declare class StdioBridge extends EventEmitter {
+    private options;
+    private child;
+    private buffer;
+    private pendingRequests;
+    constructor(options: StdioBridgeOptions);
+    start(): Promise<void>;
+    private processBuffer;
+    private handleMessage;
+    /**
+     * Send a JSON-RPC request to the downstream server and wait for a response.
+     */
+    send(message: Record<string, unknown>, timeoutMs?: number): Promise<Record<string, unknown>>;
+    /**
+     * Send a raw message without waiting for a response.
+     */
+    sendRaw(message: Record<string, unknown>): void;
+    stop(): Promise<void>;
+    get running(): boolean;
+    private rejectAllPending;
+}
+//# sourceMappingURL=stdio-bridge.d.ts.map

package/dist/proxy/stdio-bridge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stdio-bridge.d.ts","sourceRoot":"","sources":["../../src/proxy/stdio-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;GAGG;AACH,qBAAa,WAAY,SAAQ,YAAY;IAS/B,OAAO,CAAC,OAAO;IAR3B,OAAO,CAAC,KAAK,CAA6B;IAC1C,OAAO,CAAC,MAAM,CAAM;IACpB,OAAO,CAAC,eAAe,CAIlB;gBAEe,OAAO,EAAE,kBAAkB;IAIzC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IA+B5B,OAAO,CAAC,aAAa;IAkBrB,OAAO,CAAC,aAAa;IAiBrB;;OAEG;IACG,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAwBlG;;OAEG;IACH,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IAOzC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAmB3B,IAAI,OAAO,IAAI,OAAO,CAErB;IAED,OAAO,CAAC,gBAAgB;CAOzB"}

package/dist/proxy/stdio-bridge.js

@@ -0,0 +1,142 @@
+/**
+ * AGA Governance Proxy - Stdio Bridge
+ * Spawns a downstream MCP server as a child process and manages
+ * JSON-RPC message framing over stdin/stdout.
+ *
+ * Patent: USPTO App. No. 19/433,835
+ * Copyright (c) 2026 Attested Intelligence Holdings LLC
+ * SPDX-License-Identifier: MIT
+ */
+import { spawn } from 'node:child_process';
+import { EventEmitter } from 'node:events';
+/**
+ * Bridges JSON-RPC messages to/from a child process via stdio.
+ * Handles newline-delimited JSON framing.
+ */
+export class StdioBridge extends EventEmitter {
+    options;
+    child = null;
+    buffer = '';
+    pendingRequests = new Map();
+    constructor(options) {
+        super();
+        this.options = options;
+    }
+    async start() {
+        const { command, args = [], env, cwd } = this.options;
+        this.child = spawn(command, args, {
+            stdio: ['pipe', 'pipe', 'pipe'],
+            env: { ...process.env, ...env },
+            cwd,
+            shell: process.platform === 'win32',
+        });
+        this.child.stdout.on('data', (chunk) => {
+            this.buffer += chunk.toString();
+            this.processBuffer();
+        });
+        this.child.stderr.on('data', (chunk) => {
+            // Log downstream stderr but don't treat as JSON-RPC
+            process.stderr.write(`[downstream] ${chunk.toString()}`);
+        });
+        this.child.on('exit', (code, signal) => {
+            this.emit('exit', code, signal);
+            this.rejectAllPending(new Error(`Downstream process exited: code=${code} signal=${signal}`));
+        });
+        this.child.on('error', (err) => {
+            this.emit('error', err);
+            this.rejectAllPending(err);
+        });
+    }
+    processBuffer() {
+        const lines = this.buffer.split('\n');
+        // Keep the last (possibly incomplete) line in the buffer
+        this.buffer = lines.pop() || '';
+        for (const line of lines) {
+            const trimmed = line.trim();
+            if (!trimmed)
+                continue;
+            try {
+                const msg = JSON.parse(trimmed);
+                this.handleMessage(msg);
+            }
+            catch {
+                // Not valid JSON - skip
+            }
+        }
+    }
+    handleMessage(msg) {
+        // If it has an id and either result or error, it's a response
+        if ('id' in msg && ('result' in msg || 'error' in msg)) {
+            const id = msg.id;
+            const pending = this.pendingRequests.get(id);
+            if (pending) {
+                clearTimeout(pending.timer);
+                this.pendingRequests.delete(id);
+                pending.resolve(msg);
+            }
+            return;
+        }
+        // Notifications from downstream (no id, or has method) - emit for proxy to handle
+        this.emit('notification', msg);
+    }
+    /**
+     * Send a JSON-RPC request to the downstream server and wait for a response.
+     */
+    async send(message, timeoutMs = 30_000) {
+        if (!this.child?.stdin?.writable) {
+            throw new Error('Downstream process not running');
+        }
+        const id = message.id;
+        // Notifications (no id) - fire and forget
+        if (id === undefined || id === null) {
+            this.child.stdin.write(JSON.stringify(message) + '\n');
+            return { jsonrpc: '2.0', result: null, id: null };
+        }
+        return new Promise((resolve, reject) => {
+            const timer = setTimeout(() => {
+                this.pendingRequests.delete(id);
+                reject(new Error(`Timeout waiting for response to request ${id}`));
+            }, timeoutMs);
+            this.pendingRequests.set(id, { resolve, reject, timer });
+            this.child.stdin.write(JSON.stringify(message) + '\n');
+        });
+    }
+    /**
+     * Send a raw message without waiting for a response.
+     */
+    sendRaw(message) {
+        if (!this.child?.stdin?.writable) {
+            throw new Error('Downstream process not running');
+        }
+        this.child.stdin.write(JSON.stringify(message) + '\n');
+    }
+    async stop() {
+        this.rejectAllPending(new Error('Bridge stopped'));
+        if (this.child) {
+            this.child.kill('SIGTERM');
+            // Give it a moment, then force kill
+            await new Promise(resolve => {
+                const timer = setTimeout(() => {
+                    this.child?.kill('SIGKILL');
+                    resolve();
+                }, 3000);
+                this.child.on('exit', () => {
+                    clearTimeout(timer);
+                    resolve();
+                });
+            });
+            this.child = null;
+        }
+    }
+    get running() {
+        return this.child !== null && this.child.exitCode === null;
+    }
+    rejectAllPending(err) {
+        for (const [id, pending] of this.pendingRequests) {
+            clearTimeout(pending.timer);
+            pending.reject(err);
+        }
+        this.pendingRequests.clear();
+    }
+}
+//# sourceMappingURL=stdio-bridge.js.map

package/dist/proxy/stdio-bridge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stdio-bridge.js","sourceRoot":"","sources":["../../src/proxy/stdio-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAS3C;;;GAGG;AACH,MAAM,OAAO,WAAY,SAAQ,YAAY;IASvB;IARZ,KAAK,GAAwB,IAAI,CAAC;IAClC,MAAM,GAAG,EAAE,CAAC;IACZ,eAAe,GAAG,IAAI,GAAG,EAI7B,CAAC;IAEL,YAAoB,OAA2B;QAC7C,KAAK,EAAE,CAAC;QADU,YAAO,GAAP,OAAO,CAAoB;IAE/C,CAAC;IAED,KAAK,CAAC,KAAK;QACT,MAAM,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QAEtD,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE;YAChC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;YAC/B,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE;YAC/B,GAAG;YACH,KAAK,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO;SACpC,CAAC,CAAC;QAEH,IAAI,CAAC,KAAK,CAAC,MAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAC9C,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YAChC,IAAI,CAAC,aAAa,EAAE,CAAC;QACvB,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,KAAK,CAAC,MAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAC9C,oDAAoD;YACpD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC3D,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YACrC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;YAChC,IAAI,CAAC,gBAAgB,CAAC,IAAI,KAAK,CAAC,mCAAmC,IAAI,WAAW,MAAM,EAAE,CAAC,CAAC,CAAC;QAC/F,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YAC7B,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACxB,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,aAAa;QACnB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACtC,yDAAyD;QACzD,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;QAEhC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,IAAI,CAAC,OAAO;gBAAE,SAAS;YAEvB,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAA4B,CAAC;gBAC3D,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;YAC1B,CAAC;YAAC,MAAM,CAAC;gBACP,wBAAwB;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;IAEO,aAAa,CAAC,GAA4B;QAChD,8DAA8D;QAC9D,IAAI,IAAI,IAAI,GAAG,IAAI,CAAC,QAAQ,IAAI,GAAG,IAAI,OAAO,IAAI,GAAG,CAAC,EAAE,CAAC;YACvD,MAAM,EAAE,GAAG,GAAG,CAAC,EAAqB,CAAC;YACrC,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC7C,IAAI,OAAO,EAAE,CAAC;gBACZ,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBAC5B,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAChC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACvB,CAAC;YACD,OAAO;QACT,CAAC;QAED,kFAAkF;QAClF,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI,CAAC,OAAgC,EAAE,SAAS,GAAG,MAAM;QAC7D,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,EAAE,GAAG,OAAO,CAAC,EAAiC,CAAC;QAErD,0CAA0C;QAC1C,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YACpC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;YACvD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACpD,CAAC;QAED,OAAO,IAAI,OAAO,CAA0B,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC9D,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAChC,MAAM,CAAC,IAAI,KAAK,CAAC,2CAA2C,EAAE,EAAE,CAAC,CAAC,CAAC;YACrE,CAAC,EAAE,SAAS,CAAC,CAAC;YAEd,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YACzD,IAAI,CAAC,KAAM,CAAC,KAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;QAC3D,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,OAAgC;QACtC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,CAAC,gBAAgB,CAAC,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC;QACnD,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC3B,oCAAoC;YACpC,MAAM,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE;gBAChC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;oBAC5B,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;oBAC5B,OAAO,EAAE,CAAC;gBACZ,CAAC,EAAE,IAAI,CAAC,CAAC;gBACT,IAAI,CAAC,KAAM,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;oBAC1B,YAAY,CAAC,KAAK,CAAC,CAAC;oBACpB,OAAO,EAAE,CAAC;gBACZ,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QACpB,CAAC;IACH,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,KAAK,KAAK,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC;IAC7D,CAAC;IAEO,gBAAgB,CAAC,GAAU;QACjC,KAAK,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACjD,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC5B,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACtB,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;IAC/B,CAAC;CACF"}

package/dist/proxy/types.d.ts

@@ -0,0 +1,36 @@
+/**
+ * AGA Governance Proxy - Types
+ * Adapted from aga-mcp-gateway/src/governance/types.ts
+ *
+ * Patent: USPTO App. No. 19/433,835
+ * Copyright (c) 2026 Attested Intelligence Holdings LLC
+ * SPDX-License-Identifier: MIT
+ */
+export interface ToolConstraint {
+    name: string;
+    allowed: boolean;
+    max_calls_per_minute?: number;
+    path_prefix?: string;
+    path_keys?: string[];
+    denied_patterns?: string[];
+}
+export interface ToolPolicy {
+    mode: 'allowlist' | 'denylist' | 'audit_only';
+    constraints: Record<string, ToolConstraint>;
+}
+export interface ToolCallDecision {
+    allowed: boolean;
+    reason: string;
+    tool_name: string;
+    policy_mode: string;
+}
+export interface ProxyConfig {
+    port: number;
+    upstream: string;
+    upstreamType: 'stdio' | 'http';
+    policy: ToolPolicy;
+    dataDir: string;
+}
+export declare const DEFAULT_PROXY_PORT = 18800;
+export declare const DEFAULT_DATA_DIR = ".aga-proxy";
+//# sourceMappingURL=types.d.ts.map

package/dist/proxy/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/proxy/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,WAAW,GAAG,UAAU,GAAG,YAAY,CAAC;IAC9C,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,OAAO,GAAG,MAAM,CAAC;IAC/B,MAAM,EAAE,UAAU,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,eAAO,MAAM,kBAAkB,QAAQ,CAAC;AACxC,eAAO,MAAM,gBAAgB,eAAe,CAAC"}

package/dist/proxy/types.js

@@ -0,0 +1,11 @@
+/**
+ * AGA Governance Proxy - Types
+ * Adapted from aga-mcp-gateway/src/governance/types.ts
+ *
+ * Patent: USPTO App. No. 19/433,835
+ * Copyright (c) 2026 Attested Intelligence Holdings LLC
+ * SPDX-License-Identifier: MIT
+ */
+export const DEFAULT_PROXY_PORT = 18800;
+export const DEFAULT_DATA_DIR = '.aga-proxy';
+//# sourceMappingURL=types.js.map

package/dist/proxy/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/proxy/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AA+BH,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,CAAC;AACxC,MAAM,CAAC,MAAM,gBAAgB,GAAG,YAAY,CAAC"}