@attested-intelligence/aga-mcp-server 2.1.0 → 2.2.0

package/src/storage/memory.ts

@@ -0,0 +1,27 @@
+import type { AGAStorage } from './interface.js';
+import type { PolicyArtifact, ContinuityEvent, SignedReceipt, CheckpointReference } from '../core/types.js';
+
+export class MemoryStorage implements AGAStorage {
+  private artifacts = new Map<string, PolicyArtifact>();
+  private events: ContinuityEvent[] = [];
+  private receipts = new Map<string, SignedReceipt>();
+  private checkpoints: CheckpointReference[] = [];
+
+  async initialize() {}
+  async close() {}
+  async storeArtifact(a: PolicyArtifact) { this.artifacts.set(a.sealed_hash, a); }
+  async getArtifact(h: string) { return this.artifacts.get(h) ?? null; }
+  async getLatestArtifact() { const a = [...this.artifacts.values()]; return a.length ? a[a.length - 1] : null; }
+  async storeEvent(e: ContinuityEvent) { this.events.push(e); }
+  async getEvent(seq: number) { return this.events.find(e => e.sequence_number === seq) ?? null; }
+  async getEvents(s: number, e: number) { return this.events.filter(ev => ev.sequence_number >= s && ev.sequence_number <= e); }
+  async getLatestEvent() { return this.events.length ? this.events[this.events.length - 1] : null; }
+  async getAllEvents() { return [...this.events]; }
+  async storeReceipt(r: SignedReceipt) { this.receipts.set(r.receipt_id, r); }
+  async getReceipt(id: string) { return this.receipts.get(id) ?? null; }
+  async getReceiptsByArtifact(ref: string) { return [...this.receipts.values()].filter(r => r.artifact_reference === ref); }
+  async getAllReceipts() { return [...this.receipts.values()]; }
+  async storeCheckpoint(c: CheckpointReference) { this.checkpoints.push(c); }
+  async getLatestCheckpoint() { return this.checkpoints.length ? this.checkpoints[this.checkpoints.length - 1] : null; }
+  async getCheckpoints() { return [...this.checkpoints]; }
+}

package/src/storage/sqlite.ts

@@ -0,0 +1,45 @@
+import type { AGAStorage } from './interface.js';
+import type { PolicyArtifact, ContinuityEvent, SignedReceipt, CheckpointReference } from '../core/types.js';
+
+// Dynamic import - better-sqlite3 is optional (requires native build tools)
+let Database: any;
+try {
+  Database = (await import('better-sqlite3')).default;
+} catch {
+  // Will throw at construction time if better-sqlite3 is not available
+}
+
+export class SQLiteStorage implements AGAStorage {
+  private db: any;
+  constructor(path = 'aga.sqlite') {
+    if (!Database) throw new Error('better-sqlite3 is not installed. Install Visual Studio Build Tools and run: npm install better-sqlite3');
+    this.db = new Database(path);
+    this.db.pragma('journal_mode = WAL');
+  }
+  async initialize() {
+    this.db.exec(`
+      CREATE TABLE IF NOT EXISTS artifacts (sealed_hash TEXT PRIMARY KEY, data TEXT NOT NULL, created_at TEXT DEFAULT (datetime('now')));
+      CREATE TABLE IF NOT EXISTS chain_events (sequence_number INTEGER PRIMARY KEY, event_id TEXT UNIQUE, event_type TEXT, leaf_hash TEXT, data TEXT NOT NULL);
+      CREATE TABLE IF NOT EXISTS receipts (receipt_id TEXT PRIMARY KEY, artifact_reference TEXT, sequence_number INTEGER, data TEXT NOT NULL);
+      CREATE TABLE IF NOT EXISTS checkpoints (id INTEGER PRIMARY KEY AUTOINCREMENT, merkle_root TEXT, batch_start INTEGER, batch_end INTEGER, data TEXT NOT NULL);
+      CREATE INDEX IF NOT EXISTS idx_receipts_artifact ON receipts(artifact_reference);
+    `);
+  }
+  async close() { this.db.close(); }
+  private p<T>(row: any): T | null { return row ? JSON.parse(row.data) : null; }
+  async storeArtifact(a: PolicyArtifact) { this.db.prepare('INSERT OR REPLACE INTO artifacts (sealed_hash,data) VALUES (?,?)').run(a.sealed_hash, JSON.stringify(a)); }
+  async getArtifact(h: string) { return this.p<PolicyArtifact>(this.db.prepare('SELECT data FROM artifacts WHERE sealed_hash=?').get(h)); }
+  async getLatestArtifact() { return this.p<PolicyArtifact>(this.db.prepare('SELECT data FROM artifacts ORDER BY created_at DESC LIMIT 1').get()); }
+  async storeEvent(e: ContinuityEvent) { this.db.prepare('INSERT INTO chain_events (sequence_number,event_id,event_type,leaf_hash,data) VALUES (?,?,?,?,?)').run(e.sequence_number, e.event_id, e.event_type, e.leaf_hash, JSON.stringify(e)); }
+  async getEvent(seq: number) { return this.p<ContinuityEvent>(this.db.prepare('SELECT data FROM chain_events WHERE sequence_number=?').get(seq)); }
+  async getEvents(s: number, e: number) { return (this.db.prepare('SELECT data FROM chain_events WHERE sequence_number>=? AND sequence_number<=? ORDER BY sequence_number').all(s, e) as any[]).map((r: any) => JSON.parse(r.data)); }
+  async getLatestEvent() { return this.p<ContinuityEvent>(this.db.prepare('SELECT data FROM chain_events ORDER BY sequence_number DESC LIMIT 1').get()); }
+  async getAllEvents() { return (this.db.prepare('SELECT data FROM chain_events ORDER BY sequence_number').all() as any[]).map((r: any) => JSON.parse(r.data)); }
+  async storeReceipt(r: SignedReceipt) { this.db.prepare('INSERT INTO receipts (receipt_id,artifact_reference,sequence_number,data) VALUES (?,?,?,?)').run(r.receipt_id, r.artifact_reference, r.sequence_number, JSON.stringify(r)); }
+  async getReceipt(id: string) { return this.p<SignedReceipt>(this.db.prepare('SELECT data FROM receipts WHERE receipt_id=?').get(id)); }
+  async getReceiptsByArtifact(ref: string) { return (this.db.prepare('SELECT data FROM receipts WHERE artifact_reference=? ORDER BY sequence_number').all(ref) as any[]).map((r: any) => JSON.parse(r.data)); }
+  async getAllReceipts() { return (this.db.prepare('SELECT data FROM receipts ORDER BY sequence_number').all() as any[]).map((r: any) => JSON.parse(r.data)); }
+  async storeCheckpoint(c: CheckpointReference) { this.db.prepare('INSERT INTO checkpoints (merkle_root,batch_start,batch_end,data) VALUES (?,?,?,?)').run(c.merkle_root, c.batch_start_sequence, c.batch_end_sequence, JSON.stringify(c)); }
+  async getLatestCheckpoint() { return this.p<CheckpointReference>(this.db.prepare('SELECT data FROM checkpoints ORDER BY id DESC LIMIT 1').get()); }
+  async getCheckpoints() { return (this.db.prepare('SELECT data FROM checkpoints ORDER BY id').all() as any[]).map((r: any) => JSON.parse(r.data)); }
+}

package/src/tools/README.md

@@ -0,0 +1,13 @@
+# Tools Directory
+
+All MCP tool handlers are defined inline in `src/server.ts`.
+This keeps the server as a single-file reference implementation.
+
+For production use, refactor tools into individual files here:
+- attestation-tools.ts (attest_subject)
+- enforcement-tools.ts (measure_integrity, revoke_artifact)
+- chain-tools.ts (init_chain, verify_chain, get_chain_events)
+- checkpoint-tools.ts (create_checkpoint)
+- bundle-tools.ts (generate_evidence_bundle, verify_bundle_offline)
+- disclosure-tools.ts (request_claim, list_claims)
+- portal-tools.ts (get_server_info, get_portal_state, get_receipts)

package/src/utils/canonical.ts

@@ -0,0 +1,14 @@
+export function deepSortKeys(obj: unknown): unknown {
+  if (obj === null || obj === undefined || typeof obj !== 'object') return obj;
+  if (Array.isArray(obj)) return obj.map(deepSortKeys);
+  if (obj instanceof Uint8Array) return obj;
+  const sorted: Record<string, unknown> = {};
+  for (const key of Object.keys(obj as Record<string, unknown>).sort()) {
+    sorted[key] = deepSortKeys((obj as Record<string, unknown>)[key]);
+  }
+  return sorted;
+}
+
+export function canonicalize(obj: unknown): string {
+  return JSON.stringify(deepSortKeys(obj));
+}

package/src/utils/constants.ts

@@ -0,0 +1,3 @@
+export const SCHEMA_VERSION = '1.0.0';
+export const PROTOCOL_VERSION = '1.0.0';
+export const TAXONOMY_VERSION = '1.0.0';

package/src/utils/timestamp.ts

@@ -0,0 +1,12 @@
+export function utcNow(): string { return new Date().toISOString(); }
+
+export function isWithinPeriod(now: string, effective: string, expiration?: string | null): boolean {
+  const n = Date.parse(now);
+  if (n < Date.parse(effective)) return false;
+  if (expiration && n > Date.parse(expiration)) return false;
+  return true;
+}
+
+export function isExpired(issuedAt: string, ttlSeconds: number): boolean {
+  return Date.now() > Date.parse(issuedAt) + ttlSeconds * 1000;
+}

package/src/utils/uuid.ts

@@ -0,0 +1,2 @@
+import { v4 } from 'uuid';
+export function uuid(): string { return v4(); }

package/dist/context.d.ts

@@ -1,39 +0,0 @@
-import { Portal } from './core/portal.js';
-import { BehavioralMonitor as BehavioralMonitorImpl } from './core/behavioral.js';
-import type { AGAStorage } from './storage/interface.js';
-import type { KeyPair, QuarantineState, ContinuityEvent, VerificationTier, ClaimsTaxonomy, DelegationRecord, PolicyArtifact, DisclosurePolicy } from './types.js';
-import type { EventType } from './core/types.js';
-export interface ServerContext {
-    issuerKP: KeyPair;
-    portalKP: KeyPair;
-    chainKP: KeyPair;
-    portal: Portal;
-    storage: AGAStorage;
-    chainInitialized: boolean;
-    activeArtifact: PolicyArtifact | null;
-    quarantine: QuarantineState | null;
-    behavioralMonitor: BehavioralMonitorImpl;
-    measurementCount: number;
-    verificationTier: VerificationTier;
-    startTime: string;
-    claimsTaxonomy: ClaimsTaxonomy;
-    delegations: DelegationRecord[];
-    defaultEnforcement: import('./types.js').EnforcementParams;
-    defaultClaims: DisclosurePolicy;
-    claimValues: Record<string, unknown>;
-    appendToChain(type: EventType, payload: unknown): Promise<ContinuityEvent>;
-    json(x: unknown): {
-        content: Array<{
-            type: 'text';
-            text: string;
-        }>;
-    };
-    error(msg: string, extra?: Record<string, unknown>): {
-        content: Array<{
-            type: 'text';
-            text: string;
-        }>;
-    };
-}
-export declare function createContext(): Promise<ServerContext>;
-//# sourceMappingURL=context.d.ts.map

package/dist/context.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,iBAAiB,IAAI,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAGlF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,KAAK,EACV,OAAO,EAAE,eAAe,EAAE,eAAe,EACzC,gBAAgB,EAAE,cAAc,EAAE,gBAAgB,EAClD,cAAc,EAAE,gBAAgB,EACjC,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAGjD,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,UAAU,CAAC;IACpB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,cAAc,EAAE,cAAc,GAAG,IAAI,CAAC;IACtC,UAAU,EAAE,eAAe,GAAG,IAAI,CAAC;IACnC,iBAAiB,EAAE,qBAAqB,CAAC;IACzC,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,cAAc,CAAC;IAC/B,WAAW,EAAE,gBAAgB,EAAE,CAAC;IAChC,kBAAkB,EAAE,OAAO,YAAY,EAAE,iBAAiB,CAAC;IAC3D,aAAa,EAAE,gBAAgB,CAAC;IAChC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,aAAa,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAC3E,IAAI,CAAC,CAAC,EAAE,OAAO,GAAG;QAAE,OAAO,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC;IACrE,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;QAAE,OAAO,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC;CACzG;AAED,wBAAsB,aAAa,IAAI,OAAO,CAAC,aAAa,CAAC,CA8G5D"}

package/dist/context.js

@@ -1,113 +0,0 @@
-/**
- * ServerContext: replaces closure pattern in server.ts.
- * Central state container for the AGA MCP Server.
- */
-import { generateKeyPair } from './crypto/sign.js';
-import { sha256Str } from './crypto/hash.js';
-import { Portal } from './core/portal.js';
-import { BehavioralMonitor as BehavioralMonitorImpl } from './core/behavioral.js';
-import { MemoryStorage } from './storage/memory.js';
-import { createGenesisEvent, appendEvent } from './core/chain.js';
-export async function createContext() {
-    const storage = new MemoryStorage();
-    await storage.initialize();
-    const issuerKP = generateKeyPair();
-    const portalKP = generateKeyPair();
-    const chainKP = generateKeyPair();
-    const portal = new Portal();
-    const behavioralMonitor = new BehavioralMonitorImpl();
-    const defaultEnforcement = {
-        measurement_cadence_ms: 1000,
-        ttl_seconds: 3600,
-        enforcement_triggers: ['QUARANTINE', 'TERMINATE'],
-        re_attestation_required: true,
-        measurement_types: ['FILE_SYSTEM_STATE', 'CONFIG_MANIFEST'],
-    };
-    const defaultClaims = {
-        claims_taxonomy: [
-            // Identity claims
-            { claim_id: 'identity.name', sensitivity: 'S3_HIGH', substitutes: ['identity.pseudonym', 'identity.org'], inference_risks: [], permitted_modes: ['PROOF_ONLY'] },
-            { claim_id: 'identity.pseudonym', sensitivity: 'S2_MODERATE', substitutes: ['identity.org'], inference_risks: [], permitted_modes: ['PROOF_ONLY', 'REVEAL_MIN'] },
-            { claim_id: 'identity.org', sensitivity: 'S1_LOW', substitutes: [], inference_risks: [], permitted_modes: ['PROOF_ONLY', 'REVEAL_MIN', 'REVEAL_FULL'] },
-            { claim_id: 'identity.age', sensitivity: 'S3_HIGH', substitutes: ['identity.age_range', 'identity.is_adult'], inference_risks: [], permitted_modes: ['PROOF_ONLY'] },
-            { claim_id: 'identity.age_range', sensitivity: 'S2_MODERATE', substitutes: ['identity.is_adult'], inference_risks: [], permitted_modes: ['PROOF_ONLY', 'REVEAL_MIN', 'REVEAL_FULL'] },
-            { claim_id: 'identity.is_adult', sensitivity: 'S1_LOW', substitutes: [], inference_risks: [], permitted_modes: ['PROOF_ONLY', 'REVEAL_FULL'] },
-            // Vehicle claims (deployment-appropriate)
-            { claim_id: 'vehicle.exact_position', sensitivity: 'S4_CRITICAL', substitutes: ['vehicle.grid_square', 'vehicle.operational_area'], inference_risks: [], permitted_modes: ['PROOF_ONLY'] },
-            { claim_id: 'vehicle.grid_square', sensitivity: 'S2_MODERATE', substitutes: ['vehicle.operational_area'], inference_risks: [], permitted_modes: ['PROOF_ONLY', 'REVEAL_MIN'] },
-            { claim_id: 'vehicle.operational_area', sensitivity: 'S1_LOW', substitutes: [], inference_risks: [], permitted_modes: ['PROOF_ONLY', 'REVEAL_MIN', 'REVEAL_FULL'] },
-            // Plant/infrastructure claims
-            { claim_id: 'plant.reactor_id', sensitivity: 'S3_HIGH', substitutes: ['plant.facility_type'], inference_risks: [], permitted_modes: ['PROOF_ONLY'] },
-            { claim_id: 'plant.facility_type', sensitivity: 'S1_LOW', substitutes: [], inference_risks: [], permitted_modes: ['PROOF_ONLY', 'REVEAL_MIN', 'REVEAL_FULL'] },
-            // Agent/model claims
-            { claim_id: 'agent.model_weights_hash', sensitivity: 'S4_CRITICAL', substitutes: ['agent.model_family', 'agent.model_generation'], inference_risks: [], permitted_modes: ['PROOF_ONLY'] },
-            { claim_id: 'agent.model_family', sensitivity: 'S2_MODERATE', substitutes: ['agent.model_generation'], inference_risks: [], permitted_modes: ['PROOF_ONLY', 'REVEAL_MIN'] },
-            { claim_id: 'agent.model_generation', sensitivity: 'S1_LOW', substitutes: [], inference_risks: [], permitted_modes: ['PROOF_ONLY', 'REVEAL_MIN', 'REVEAL_FULL'] },
-        ],
-        substitution_rules: [],
-    };
-    const claimValues = {
-        'identity.name': 'Alice Johnson',
-        'identity.pseudonym': 'AJ-7742',
-        'identity.org': 'Attested Intelligence',
-        'identity.age': 32,
-        'identity.age_range': '25-34',
-        'identity.is_adult': true,
-        'vehicle.exact_position': '38.8977° N, 77.0365° W',
-        'vehicle.grid_square': 'FM18lv',
-        'vehicle.operational_area': 'National Capital Region',
-        'plant.reactor_id': 'NRC-R-1234',
-        'plant.facility_type': 'Nuclear Power Plant',
-        'agent.model_weights_hash': 'a4f8c2e1b3d7094f6e2a8b1c5d9f3e7a',
-        'agent.model_family': 'GPT-class LLM',
-        'agent.model_generation': 'Generation 4',
-    };
-    const claimsTaxonomy = {
-        claims: defaultClaims.claims_taxonomy,
-        version: '1.0.0',
-    };
-    const ctx = {
-        issuerKP,
-        portalKP,
-        chainKP,
-        portal,
-        storage,
-        chainInitialized: false,
-        activeArtifact: null,
-        quarantine: null,
-        behavioralMonitor,
-        measurementCount: 0,
-        verificationTier: 'BRONZE',
-        startTime: new Date().toISOString(),
-        claimsTaxonomy,
-        delegations: [],
-        defaultEnforcement,
-        defaultClaims,
-        claimValues,
-        async appendToChain(type, payload) {
-            if (!ctx.chainInitialized) {
-                const genesis = createGenesisEvent(ctx.chainKP, sha256Str('AGA Protocol Specification v2.0.0'));
-                await ctx.storage.storeEvent(genesis);
-                ctx.chainInitialized = true;
-                ctx.portal.sequenceCounter = 0;
-                ctx.portal.lastLeafHash = genesis.leaf_hash;
-            }
-            const prev = await ctx.storage.getLatestEvent();
-            if (!prev)
-                throw new Error('Chain initialization failed');
-            const event = appendEvent(type, payload, prev, ctx.chainKP);
-            await ctx.storage.storeEvent(event);
-            ctx.portal.sequenceCounter = event.sequence_number;
-            ctx.portal.lastLeafHash = event.leaf_hash;
-            return event;
-        },
-        json(x) {
-            return { content: [{ type: 'text', text: JSON.stringify(x, null, 2) }] };
-        },
-        error(msg, extra) {
-            return { content: [{ type: 'text', text: JSON.stringify({ success: false, error: msg, ...extra }, null, 2) }] };
-        },
-    };
-    return ctx;
-}
-//# sourceMappingURL=context.js.map

package/dist/context.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"context.js","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,eAAe,EAAW,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,iBAAiB,IAAI,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAClF,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAiClE,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,MAAM,OAAO,GAAG,IAAI,aAAa,EAAE,CAAC;IACpC,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;IAE3B,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;IAClC,MAAM,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;IAC5B,MAAM,iBAAiB,GAAG,IAAI,qBAAqB,EAAE,CAAC;IAEtD,MAAM,kBAAkB,GAA2C;QACjE,sBAAsB,EAAE,IAAI;QAC5B,WAAW,EAAE,IAAI;QACjB,oBAAoB,EAAE,CAAC,YAAY,EAAE,WAAW,CAAC;QACjD,uBAAuB,EAAE,IAAI;QAC7B,iBAAiB,EAAE,CAAC,mBAAmB,EAAE,iBAAiB,CAAC;KAC5D,CAAC;IAEF,MAAM,aAAa,GAAqB;QACtC,eAAe,EAAE;YACf,kBAAkB;YAClB,EAAE,QAAQ,EAAE,eAAe,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,oBAAoB,EAAE,cAAc,CAAC,EAAE,eAAe,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,YAAY,CAAC,EAAE;YAChK,EAAE,QAAQ,EAAE,oBAAoB,EAAE,WAAW,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC,cAAc,CAAC,EAAE,eAAe,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC,EAAE;YACjK,EAAE,QAAQ,EAAE,cAAc,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,aAAa,CAAC,EAAE;YACvJ,EAAE,QAAQ,EAAE,cAAc,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,oBAAoB,EAAE,mBAAmB,CAAC,EAAE,eAAe,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,YAAY,CAAC,EAAE;YACpK,EAAE,QAAQ,EAAE,oBAAoB,EAAE,WAAW,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC,mBAAmB,CAAC,EAAE,eAAe,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,aAAa,CAAC,EAAE;YACrL,EAAE,QAAQ,EAAE,mBAAmB,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,YAAY,EAAE,aAAa,CAAC,EAAE;YAC9I,0CAA0C;YAC1C,EAAE,QAAQ,EAAE,wBAAwB,EAAE,WAAW,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC,qBAAqB,EAAE,0BAA0B,CAAC,EAAE,eAAe,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,YAAY,CAAC,EAAE;YAC1L,EAAE,QAAQ,EAAE,qBAAqB,EAAE,WAAW,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC,0BAA0B,CAAC,EAAE,eAAe,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC,EAAE;YAC9K,EAAE,QAAQ,EAAE,0BAA0B,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,aAAa,CAAC,EAAE;YACnK,8BAA8B;YAC9B,EAAE,QAAQ,EAAE,kBAAkB,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,qBAAqB,CAAC,EAAE,eAAe,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,YAAY,CAAC,EAAE;YACpJ,EAAE,QAAQ,EAAE,qBAAqB,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,aAAa,CAAC,EAAE;YAC9J,qBAAqB;YACrB,EAAE,QAAQ,EAAE,0BAA0B,EAAE,WAAW,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC,oBAAoB,EAAE,wBAAwB,CAAC,EAAE,eAAe,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,YAAY,CAAC,EAAE;YACzL,EAAE,QAAQ,EAAE,oBAAoB,EAAE,WAAW,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC,wBAAwB,CAAC,EAAE,eAAe,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC,EAAE;YAC3K,EAAE,QAAQ,EAAE,wBAAwB,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,aAAa,CAAC,EAAE;SAClK;QACD,kBAAkB,EAAE,EAAE;KACvB,CAAC;IAEF,MAAM,WAAW,GAA4B;QAC3C,eAAe,EAAE,eAAe;QAChC,oBAAoB,EAAE,SAAS;QAC/B,cAAc,EAAE,uBAAuB;QACvC,cAAc,EAAE,EAAE;QAClB,oBAAoB,EAAE,OAAO;QAC7B,mBAAmB,EAAE,IAAI;QACzB,wBAAwB,EAAE,wBAAwB;QAClD,qBAAqB,EAAE,QAAQ;QAC/B,0BAA0B,EAAE,yBAAyB;QACrD,kBAAkB,EAAE,YAAY;QAChC,qBAAqB,EAAE,qBAAqB;QAC5C,0BAA0B,EAAE,kCAAkC;QAC9D,oBAAoB,EAAE,eAAe;QACrC,wBAAwB,EAAE,cAAc;KACzC,CAAC;IAEF,MAAM,cAAc,GAAmB;QACrC,MAAM,EAAE,aAAa,CAAC,eAAe;QACrC,OAAO,EAAE,OAAO;KACjB,CAAC;IAEF,MAAM,GAAG,GAAkB;QACzB,QAAQ;QACR,QAAQ;QACR,OAAO;QACP,MAAM;QACN,OAAO;QACP,gBAAgB,EAAE,KAAK;QACvB,cAAc,EAAE,IAAI;QACpB,UAAU,EAAE,IAAI;QAChB,iBAAiB;QACjB,gBAAgB,EAAE,CAAC;QACnB,gBAAgB,EAAE,QAAQ;QAC1B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,cAAc;QACd,WAAW,EAAE,EAAE;QACf,kBAAkB;QAClB,aAAa;QACb,WAAW;QAEX,KAAK,CAAC,aAAa,CAAC,IAAe,EAAE,OAAgB;YACnD,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;gBAC1B,MAAM,OAAO,GAAG,kBAAkB,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,mCAAmC,CAAC,CAAC,CAAC;gBAChG,MAAM,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;gBACtC,GAAG,CAAC,gBAAgB,GAAG,IAAI,CAAC;gBAC5B,GAAG,CAAC,MAAM,CAAC,eAAe,GAAG,CAAC,CAAC;gBAC/B,GAAG,CAAC,MAAM,CAAC,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC;YAC9C,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;YAChD,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;YAC1D,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YAC5D,MAAM,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YACpC,GAAG,CAAC,MAAM,CAAC,eAAe,GAAG,KAAK,CAAC,eAAe,CAAC;YACnD,GAAG,CAAC,MAAM,CAAC,YAAY,GAAG,KAAK,CAAC,SAAS,CAAC;YAC1C,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC,CAAU;YACb,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QACpF,CAAC;QAED,KAAK,CAAC,GAAW,EAAE,KAA+B;YAChD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC3H,CAAC;KACF,CAAC;IAEF,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/core/measurement.d.ts

@@ -1,16 +0,0 @@
-import type { SubjectIdentifier, SubjectMetadata, HashHex } from '../types.js';
-export interface MeasurementInput {
-    subjectBytes: Uint8Array;
-    metadata: SubjectMetadata;
-}
-export interface MeasurementOutput {
-    bytesHash: HashHex;
-    metadataHash: HashHex;
-}
-export declare function measureSubject(input: MeasurementInput): MeasurementOutput;
-export declare function compareState(current: MeasurementOutput, expected: SubjectIdentifier): {
-    match: boolean;
-    bytesMatch: boolean;
-    metadataMatch: boolean;
-};
-//# sourceMappingURL=measurement.d.ts.map

package/dist/core/measurement.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"measurement.d.ts","sourceRoot":"","sources":["../../src/core/measurement.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,iBAAiB,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAE/E,MAAM,WAAW,gBAAgB;IAC/B,YAAY,EAAE,UAAU,CAAC;IACzB,QAAQ,EAAE,eAAe,CAAC;CAC3B;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,EAAE,OAAO,CAAC;CACvB;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,gBAAgB,GAAG,iBAAiB,CAKzE;AAED,wBAAgB,YAAY,CAC1B,OAAO,EAAE,iBAAiB,EAC1B,QAAQ,EAAE,iBAAiB,GAC1B;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,UAAU,EAAE,OAAO,CAAC;IAAC,aAAa,EAAE,OAAO,CAAA;CAAE,CAIjE"}

package/dist/core/measurement.js

@@ -1,18 +0,0 @@
-/**
- * Subject measurement: hash, compare, detect drift.
- * Consolidates subject.ts + attestation.ts measurement logic.
- */
-import { sha256Bytes, sha256Str } from '../crypto/hash.js';
-import { canonicalize } from '../utils/canonical.js';
-export function measureSubject(input) {
-    return {
-        bytesHash: sha256Bytes(input.subjectBytes),
-        metadataHash: sha256Str(canonicalize(input.metadata)),
-    };
-}
-export function compareState(current, expected) {
-    const bytesMatch = current.bytesHash === expected.bytes_hash;
-    const metadataMatch = current.metadataHash === expected.metadata_hash;
-    return { match: bytesMatch && metadataMatch, bytesMatch, metadataMatch };
-}
-//# sourceMappingURL=measurement.js.map

package/dist/core/measurement.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"measurement.js","sourceRoot":"","sources":["../../src/core/measurement.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAarD,MAAM,UAAU,cAAc,CAAC,KAAuB;IACpD,OAAO;QACL,SAAS,EAAE,WAAW,CAAC,KAAK,CAAC,YAAY,CAAC;QAC1C,YAAY,EAAE,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;KACtD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,OAA0B,EAC1B,QAA2B;IAE3B,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,KAAK,QAAQ,CAAC,UAAU,CAAC;IAC7D,MAAM,aAAa,GAAG,OAAO,CAAC,YAAY,KAAK,QAAQ,CAAC,aAAa,CAAC;IACtE,OAAO,EAAE,KAAK,EAAE,UAAU,IAAI,aAAa,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC;AAC3E,CAAC"}

package/dist/crypto/canonicalize.d.ts

@@ -1,7 +0,0 @@
-/**
- * Deterministic JSON serialization (RFC 8785 aligned).
- * Moved from src/utils/canonical.ts for directive structure alignment.
- */
-export declare function deepSortKeys(obj: unknown): unknown;
-export declare function canonicalize(obj: unknown): string;
-//# sourceMappingURL=canonicalize.d.ts.map

package/dist/crypto/canonicalize.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"canonicalize.d.ts","sourceRoot":"","sources":["../../src/crypto/canonicalize.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CASlD;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAEjD"}

package/dist/crypto/canonicalize.js

@@ -1,21 +0,0 @@
-/**
- * Deterministic JSON serialization (RFC 8785 aligned).
- * Moved from src/utils/canonical.ts for directive structure alignment.
- */
-export function deepSortKeys(obj) {
-    if (obj === null || obj === undefined || typeof obj !== 'object')
-        return obj;
-    if (Array.isArray(obj))
-        return obj.map(deepSortKeys);
-    if (obj instanceof Uint8Array)
-        return obj;
-    const sorted = {};
-    for (const key of Object.keys(obj).sort()) {
-        sorted[key] = deepSortKeys(obj[key]);
-    }
-    return sorted;
-}
-export function canonicalize(obj) {
-    return JSON.stringify(deepSortKeys(obj));
-}
-//# sourceMappingURL=canonicalize.js.map

package/dist/crypto/canonicalize.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"canonicalize.js","sourceRoot":"","sources":["../../src/crypto/canonicalize.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,GAAY;IACvC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IAC7E,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACrD,IAAI,GAAG,YAAY,UAAU;QAAE,OAAO,GAAG,CAAC;IAC1C,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAA8B,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACrE,MAAM,CAAC,GAAG,CAAC,GAAG,YAAY,CAAE,GAA+B,CAAC,GAAG,CAAC,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAY;IACvC,OAAO,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;AAC3C,CAAC"}

package/dist/crypto/keys.d.ts

@@ -1,10 +0,0 @@
-import { pkToHex, hexToPk } from './sign.js';
-import type { KeyPair } from '../types.js';
-/** SHA-256 fingerprint of a public key (first 16 hex chars). */
-export declare function keyFingerprint(pk: Uint8Array): string;
-/** Check if a hex-encoded public key is valid (64 hex chars for Ed25519). */
-export declare function isKeyValid(hexKey: string): boolean;
-/** Rotate a keypair - returns new keypair. Old keypair should be revoked. */
-export declare function rotateKeyPair(): KeyPair;
-export { pkToHex, hexToPk };
-//# sourceMappingURL=keys.d.ts.map

package/dist/crypto/keys.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../src/crypto/keys.ts"],"names":[],"mappings":"AAIA,OAAO,EAAmB,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC9D,OAAO,KAAK,EAAE,OAAO,EAAW,MAAM,aAAa,CAAC;AAEpD,gEAAgE;AAChE,wBAAgB,cAAc,CAAC,EAAE,EAAE,UAAU,GAAG,MAAM,CAErD;AAED,6EAA6E;AAC7E,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAElD;AAED,6EAA6E;AAC7E,wBAAgB,aAAa,IAAI,OAAO,CAEvC;AAED,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC"}

package/dist/crypto/keys.js

@@ -1,19 +0,0 @@
-/**
- * Key utilities: fingerprints, hex encoding, validation.
- */
-import { sha256Str } from './hash.js';
-import { generateKeyPair, pkToHex, hexToPk } from './sign.js';
-/** SHA-256 fingerprint of a public key (first 16 hex chars). */
-export function keyFingerprint(pk) {
-    return sha256Str(pkToHex(pk)).slice(0, 16);
-}
-/** Check if a hex-encoded public key is valid (64 hex chars for Ed25519). */
-export function isKeyValid(hexKey) {
-    return /^[0-9a-f]{64}$/.test(hexKey);
-}
-/** Rotate a keypair - returns new keypair. Old keypair should be revoked. */
-export function rotateKeyPair() {
-    return generateKeyPair();
-}
-export { pkToHex, hexToPk };
-//# sourceMappingURL=keys.js.map

package/dist/crypto/keys.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../src/crypto/keys.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAG9D,gEAAgE;AAChE,MAAM,UAAU,cAAc,CAAC,EAAc;IAC3C,OAAO,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,UAAU,CAAC,MAAc;IACvC,OAAO,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACvC,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,aAAa;IAC3B,OAAO,eAAe,EAAE,CAAC;AAC3B,CAAC;AAED,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC"}

package/dist/prompts/drift-analysis.d.ts

@@ -1,13 +0,0 @@
-export declare const DRIFT_ANALYSIS_PROMPT: {
-    name: string;
-    description: string;
-    arguments: {
-        name: string;
-        description: string;
-        required: boolean;
-    }[];
-    template: (args: {
-        drift_type?: string;
-    }) => string;
-};
-//# sourceMappingURL=drift-analysis.d.ts.map

package/dist/prompts/drift-analysis.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"drift-analysis.d.ts","sourceRoot":"","sources":["../../src/prompts/drift-analysis.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,qBAAqB;;;;;;;;qBAMf;QAAE,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE;CAmCzC,CAAC"}

package/dist/prompts/drift-analysis.js

@@ -1,43 +0,0 @@
-export const DRIFT_ANALYSIS_PROMPT = {
-    name: 'drift-analysis',
-    description: 'Analyze drift events and recommend remediation',
-    arguments: [
-        { name: 'drift_type', description: 'Type of drift: binary, behavioral, or both', required: false },
-    ],
-    template: (args) => `# Drift Event Analysis
-
-Analyze drift events in the current AGA session for type: ${args.drift_type ?? 'both'}
-
-## Investigation Steps
-
-1. Call \`aga_get_chain\` to retrieve all chain events
-2. Filter for INTERACTION_RECEIPT events where drift_detected=true
-3. Filter for BEHAVIORAL_DRIFT events
-4. Call \`aga_measure_behavior\` for current behavioral state
-5. Call \`aga_get_portal_state\` for enforcement status
-
-## Analysis Framework
-
-For each drift event, determine:
-- **Root Cause:** Binary modification, prompt injection, configuration change, behavioral anomaly
-- **Severity:** Based on enforcement action taken (TERMINATE > QUARANTINE > ALERT_ONLY)
-- **Timeline:** When drift was first detected, how many measurements before detection
-- **Impact:** Which measurements were affected, what enforcement was applied
-
-## Remediation Recommendations
-
-Based on the drift analysis:
-- If binary drift → Recommend re-attestation with updated subject
-- If behavioral drift → Recommend baseline adjustment or investigation
-- If both → Recommend full security review and incident response
-
-## Output Format
-
-Produce a structured drift analysis report with:
-1. Drift event timeline
-2. Root cause assessment
-3. Severity classification
-4. Remediation steps
-5. Prevention recommendations`,
-};
-//# sourceMappingURL=drift-analysis.js.map

package/dist/prompts/drift-analysis.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"drift-analysis.js","sourceRoot":"","sources":["../../src/prompts/drift-analysis.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,IAAI,EAAE,gBAAgB;IACtB,WAAW,EAAE,gDAAgD;IAC7D,SAAS,EAAE;QACT,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,4CAA4C,EAAE,QAAQ,EAAE,KAAK,EAAE;KACnG;IACD,QAAQ,EAAE,CAAC,IAA6B,EAAE,EAAE,CAAC;;4DAEa,IAAI,CAAC,UAAU,IAAI,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8BAgCvD;CAC7B,CAAC"}

package/dist/prompts/governance-report.d.ts

@@ -1,7 +0,0 @@
-export declare const GOVERNANCE_REPORT_PROMPT: {
-    name: string;
-    description: string;
-    arguments: never[];
-    template: () => string;
-};
-//# sourceMappingURL=governance-report.d.ts.map

package/dist/prompts/governance-report.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"governance-report.d.ts","sourceRoot":"","sources":["../../src/prompts/governance-report.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,wBAAwB;;;;;CAwBpC,CAAC"}

package/dist/prompts/governance-report.js

@@ -1,26 +0,0 @@
-export const GOVERNANCE_REPORT_PROMPT = {
-    name: 'governance-report',
-    description: 'Generate a session governance summary report',
-    arguments: [],
-    template: () => `# Session Governance Summary Report
-
-Generate a comprehensive governance report for the current AGA session:
-
-1. Call \`aga_server_info\` for server identity and key information
-2. Call \`aga_get_portal_state\` for current enforcement status
-3. Call \`aga_get_chain\` with verify=true for chain integrity
-4. Call \`aga_measure_behavior\` for behavioral analysis
-5. Call \`aga_quarantine_status\` for quarantine state
-
-Then produce a report with:
-- **Session Identity:** Server keys, verification tier, uptime
-- **Governance State:** Portal state, artifact status, TTL remaining
-- **Chain Integrity:** Event count, verification status, any breaks
-- **Behavioral Analysis:** Violations detected, behavioral hash
-- **Quarantine Status:** Active/inactive, forensic captures
-- **Measurement Summary:** Total measurements, drift events
-- **Compliance Status:** NIST/NCCoE alignment assessment
-
-Format as a structured markdown report suitable for audit documentation.`,
-};
-//# sourceMappingURL=governance-report.js.map

package/dist/prompts/governance-report.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"governance-report.js","sourceRoot":"","sources":["../../src/prompts/governance-report.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,IAAI,EAAE,mBAAmB;IACzB,WAAW,EAAE,8CAA8C;IAC3D,SAAS,EAAE,EAAE;IACb,QAAQ,EAAE,GAAG,EAAE,CAAC;;;;;;;;;;;;;;;;;;;yEAmBuD;CACxE,CAAC"}

package/dist/prompts/nccoe-demo.d.ts

@@ -1,14 +0,0 @@
-export declare const NCCOE_DEMO_PROMPT: {
-    name: string;
-    description: string;
-    arguments: {
-        name: string;
-        description: string;
-        required: boolean;
-    }[];
-    template: (args: {
-        agent_code?: string;
-        include_behavioral?: string;
-    }) => string;
-};
-//# sourceMappingURL=nccoe-demo.d.ts.map

package/dist/prompts/nccoe-demo.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"nccoe-demo.d.ts","sourceRoot":"","sources":["../../src/prompts/nccoe-demo.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,iBAAiB;;;;;;;;qBAOX;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,kBAAkB,CAAC,EAAE,MAAM,CAAA;KAAE;CAsCtE,CAAC"}

package/dist/prompts/nccoe-demo.js

@@ -1,47 +0,0 @@
-export const NCCOE_DEMO_PROMPT = {
-    name: 'nccoe-demo',
-    description: 'NCCoE AI Agent Identity and Authorization - Full 4-phase demo with behavioral drift detection',
-    arguments: [
-        { name: 'agent_code', description: 'The agent source code to attest', required: false },
-        { name: 'include_behavioral', description: 'Include behavioral drift detection phase', required: false },
-    ],
-    template: (args) => `# NCCoE Lab Demo - AGA Protocol Full Lifecycle
-
-Execute the following phases using the AGA MCP Server tools:
-
-## Phase 1: Attestation and Identity Binding
-1. Call \`aga_init_chain\` to initialize the continuity chain
-2. Call \`aga_create_artifact\` with subject content: "${args.agent_code ?? 'def monitor(): return sensors.read_all()'}"
-   - Include metadata: filename="scada_agent.py", version="2.1.0", author="engineering"
-${args.include_behavioral === 'true' ? `   - Include behavioral_baseline: permitted_tools=["aga_measure_subject","aga_get_portal_state"], rate_limits={"aga_measure_subject":10}, forbidden_sequences=[["read_secret","send_email"]], window_ms=60000` : ''}
-3. Verify the portal state is ACTIVE_MONITORING
-
-## Phase 2: Authorized Operation
-4. Call \`aga_measure_subject\` with the SAME content - expect match=true
-5. Call \`aga_measure_subject\` again - expect match=true, receipt generated
-6. Verify both receipts show drift_detected=false
-
-## Phase 3: Simulated Prompt Injection
-7. Call \`aga_measure_subject\` with MODIFIED content: "def monitor(): return attacker.exfiltrate(sensors.read_all())"
-   - Expect match=false, drift_detected=true
-   - Expect enforcement_action=QUARANTINE
-8. Check portal state - should be PHANTOM_QUARANTINE
-9. Call \`aga_quarantine_status\` to see forensic capture state
-
-## Phase 3b: Mid-Session Revocation
-10. Call \`aga_revoke_artifact\` with the sealed hash and reason "Compromise detected"
-11. Verify portal state is TERMINATED
-
-${args.include_behavioral === 'true' ? `## Phase 3c: Behavioral Drift Detection
-12. Call \`aga_measure_behavior\` to check for tool pattern violations
-13. Review violations (unauthorized tools, rate limits, forbidden sequences)
-` : ''}
-
-## Phase 4: Offline Audit
-${args.include_behavioral === 'true' ? '14' : '12'}. Call \`aga_get_chain\` with verify=true to verify chain integrity
-${args.include_behavioral === 'true' ? '15' : '13'}. Call \`aga_export_bundle\` to generate evidence bundle (need checkpoint first)
-${args.include_behavioral === 'true' ? '16' : '14'}. Call \`aga_verify_bundle\` with the bundle and issuer public key
-
-All operations should produce signed receipts and chain events.`,
-};
-//# sourceMappingURL=nccoe-demo.js.map

package/dist/prompts/nccoe-demo.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"nccoe-demo.js","sourceRoot":"","sources":["../../src/prompts/nccoe-demo.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,IAAI,EAAE,YAAY;IAClB,WAAW,EAAE,+FAA+F;IAC5G,SAAS,EAAE;QACT,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,iCAAiC,EAAE,QAAQ,EAAE,KAAK,EAAE;QACvF,EAAE,IAAI,EAAE,oBAAoB,EAAE,WAAW,EAAE,0CAA0C,EAAE,QAAQ,EAAE,KAAK,EAAE;KACzG;IACD,QAAQ,EAAE,CAAC,IAA0D,EAAE,EAAE,CAAC;;;;;;yDAMnB,IAAI,CAAC,UAAU,IAAI,0CAA0C;;EAEpH,IAAI,CAAC,kBAAkB,KAAK,MAAM,CAAC,CAAC,CAAC,+MAA+M,CAAC,CAAC,CAAC,EAAE;;;;;;;;;;;;;;;;;;;EAmBzP,IAAI,CAAC,kBAAkB,KAAK,MAAM,CAAC,CAAC,CAAC;;;CAGtC,CAAC,CAAC,CAAC,EAAE;;;EAGJ,IAAI,CAAC,kBAAkB,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;EAChD,IAAI,CAAC,kBAAkB,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;EAChD,IAAI,CAAC,kBAAkB,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;;gEAEc;CAC/D,CAAC"}