@agent-custody/receipts 0.1.0

package/dist/policy.js

@@ -0,0 +1,28 @@
+// Cedar policy evaluation. Fails closed: any evaluation error is a deny.
+import * as cedar from "@cedar-policy/cedar-wasm/nodejs";
+import { sha256Hex } from "./crypto.js";
+export function policyDigest(policyText) {
+    return sha256Hex(policyText);
+}
+export function evaluate(policyText, req) {
+    const digest = policyDigest(policyText);
+    const answer = cedar.isAuthorized({
+        principal: { type: "Agent", id: req.agentId },
+        action: { type: "Action", id: req.tool },
+        resource: { type: "Tool", id: req.tool },
+        context: req.context,
+        policies: { staticPolicies: policyText },
+        entities: [],
+    });
+    if (answer.type === "failure") {
+        return { decision: "deny", reasons: [], errors: answer.errors.map((e) => e.message), policyDigest: digest };
+    }
+    const { decision, diagnostics } = answer.response;
+    const errors = diagnostics.errors.map((e) => `${e.policyId}: ${e.error.message}`);
+    return {
+        decision: errors.length > 0 ? "deny" : decision,
+        reasons: diagnostics.reason,
+        errors,
+        policyDigest: digest,
+    };
+}

package/dist/receipt.d.ts

@@ -0,0 +1,114 @@
+import type { Envelope } from "./crypto.ts";
+import type { InclusionProof } from "./log.ts";
+import type { PolicyDecision } from "./policy.ts";
+export declare const RECEIPT_TYPE = "application/vnd.in-toto+json";
+export declare const RECEIPT_PREDICATE_TYPE = "https://agent-custody.dev/receipt/v0.2";
+export declare const TREEHEAD_TYPE = "application/vnd.agent-custody.treehead+json";
+/**
+ * Provenance of a receipt field. This is the honest part of the design.
+ *  - attested: signed by a key other than the issuer's (today: the principal's delegation key)
+ *  - observed: the issuer obtained this deterministically, outside the agent's control (gateway only)
+ *  - claimed:  originates from the agent, the model, or the agent's own process, with no independent check
+ */
+export type Provenance = "attested" | "observed" | "claimed";
+/**
+ * Who produced the receipt. This is the first thing a verifier should read.
+ *  - gateway: an out-of-process enforcement point; the agent could neither skip nor forge it
+ *  - sdk:     an interceptor inside the agent's own process; self-reported, tamper-evident after issue but not before
+ */
+export type IssuerKind = "gateway" | "sdk";
+export interface FactRecord {
+    tool: string;
+    args: Record<string, unknown>;
+    value: unknown;
+    resultDigest: string;
+    provenance: "observed";
+}
+export interface ReceiptPredicate {
+    receiptId: string;
+    timestamp: string;
+    issuer: {
+        kind: IssuerKind;
+        keyid: string;
+        version: string;
+        framework?: string;
+    };
+    principal: {
+        id: string;
+        keyid: string;
+        provenance: "attested";
+    } | {
+        id: string | null;
+        provenance: "claimed";
+    };
+    agent: {
+        id: string;
+        provenance: Provenance;
+    };
+    /** Present on gateway receipts. Absent when the issuer had no signed grant to check against. */
+    delegation?: {
+        envelope: Envelope;
+        provenance: "attested";
+    };
+    /** Correlation ids from the host, when it supplied any. Never checked, always claimed. */
+    session: {
+        id: string | null;
+        toolUseId: string | null;
+        provenance: "claimed";
+    };
+    model: {
+        id: string | null;
+        provenance: "claimed";
+    };
+    tool: {
+        name: string;
+        provenance: Provenance;
+    };
+    request: {
+        args: Record<string, unknown>;
+        argsDigest: string;
+        provenance: "claimed";
+    };
+    facts: Record<string, FactRecord>;
+    /** null when the issuer evaluated no policy. */
+    policy: (PolicyDecision & {
+        provenance: Provenance;
+    }) | null;
+    execution: {
+        status: "executed" | "failed";
+        result: unknown;
+        resultDigest: string;
+        provenance: Provenance;
+    } | {
+        status: "denied";
+        reason: string;
+        provenance: Provenance;
+    } | {
+        status: "error";
+        error: string;
+        provenance: Provenance;
+    };
+}
+export interface ReceiptStatement {
+    _type: "https://in-toto.io/Statement/v1";
+    subject: {
+        name: string;
+        digest: {
+            sha256: string;
+        };
+    }[];
+    predicateType: typeof RECEIPT_PREDICATE_TYPE;
+    predicate: ReceiptPredicate;
+}
+export interface TreeHead {
+    treeSize: number;
+    rootHash: string;
+    timestamp: string;
+}
+/** What gets written to disk and handed to a verifier. Self-contained apart from public keys. */
+export interface ReceiptBundle {
+    envelope: Envelope;
+    treeHead: Envelope;
+    inclusion: InclusionProof;
+}
+export declare function buildStatement(p: ReceiptPredicate): ReceiptStatement;

package/dist/receipt.js

@@ -0,0 +1,11 @@
+export const RECEIPT_TYPE = "application/vnd.in-toto+json";
+export const RECEIPT_PREDICATE_TYPE = "https://agent-custody.dev/receipt/v0.2";
+export const TREEHEAD_TYPE = "application/vnd.agent-custody.treehead+json";
+export function buildStatement(p) {
+    return {
+        _type: "https://in-toto.io/Statement/v1",
+        subject: [{ name: `tool-call:${p.tool.name}:${p.receiptId}`, digest: { sha256: p.request.argsDigest } }],
+        predicateType: RECEIPT_PREDICATE_TYPE,
+        predicate: p,
+    };
+}

package/dist/sdk/claude.d.ts

@@ -0,0 +1,53 @@
+import { createSdkIssuer, type SdkIssuer } from "./index.ts";
+export interface HookInput {
+    hook_event_name: string;
+    session_id?: string;
+    tool_name: string;
+    tool_input?: unknown;
+    tool_response?: unknown;
+    tool_use_id?: string;
+    error?: unknown;
+    [k: string]: unknown;
+}
+export interface HookOutput {
+    continue?: boolean;
+    hookSpecificOutput?: {
+        hookEventName: string;
+        permissionDecision?: "allow" | "deny" | "ask";
+        permissionDecisionReason?: string;
+    };
+}
+/**
+ * PreToolUse: evaluate policy; on deny, issue a denial receipt and block. On allow or no policy, return no decision,
+ * so the host's normal permission flow still applies. This adapter never auto-approves.
+ * PostToolUse / PostToolUseFailure: issue the receipt for the completed call.
+ */
+export declare function handleHookEvent(issuer: SdkIssuer, input: HookInput): HookOutput;
+/**
+ * Hooks for the Claude Agent SDK's query({ hooks }) option. Register all three events.
+ * Typed loosely on purpose so this file does not depend on the SDK package.
+ */
+export declare function claudeAgentHooks(issuer: SdkIssuer, matcher?: string): {
+    PreToolUse: ({
+        hooks: ((input: unknown) => Promise<HookOutput>)[];
+        matcher?: undefined;
+    } | {
+        matcher: string;
+        hooks: ((input: unknown) => Promise<HookOutput>)[];
+    })[];
+    PostToolUse: ({
+        hooks: ((input: unknown) => Promise<HookOutput>)[];
+        matcher?: undefined;
+    } | {
+        matcher: string;
+        hooks: ((input: unknown) => Promise<HookOutput>)[];
+    })[];
+    PostToolUseFailure: ({
+        hooks: ((input: unknown) => Promise<HookOutput>)[];
+        matcher?: undefined;
+    } | {
+        matcher: string;
+        hooks: ((input: unknown) => Promise<HookOutput>)[];
+    })[];
+};
+export { createSdkIssuer };

package/dist/sdk/claude.js

@@ -0,0 +1,52 @@
+// Adapter for Claude Code hooks (command hooks over stdin/stdout) and the Claude Agent SDK (in-process hooks).
+// Both use the same input and output JSON, so one handler serves both.
+import { createSdkIssuer, receiptIdOf } from "./index.js";
+function toEvent(input) {
+    const raw = input.tool_input;
+    const args = raw && typeof raw === "object" && !Array.isArray(raw) ? raw : { input: raw ?? null };
+    return { tool: input.tool_name, args, session: { id: input.session_id ?? null, toolUseId: input.tool_use_id ?? null } };
+}
+/**
+ * PreToolUse: evaluate policy; on deny, issue a denial receipt and block. On allow or no policy, return no decision,
+ * so the host's normal permission flow still applies. This adapter never auto-approves.
+ * PostToolUse / PostToolUseFailure: issue the receipt for the completed call.
+ */
+export function handleHookEvent(issuer, input) {
+    const ev = toEvent(input);
+    switch (input.hook_event_name) {
+        case "PreToolUse": {
+            const policy = issuer.decide(ev);
+            if (policy && policy.decision === "deny") {
+                const reason = [...policy.reasons, ...policy.errors].join("; ") || "no permit policy matched";
+                const bundle = issuer.record(ev, { status: "denied", reason }, policy);
+                return {
+                    continue: true,
+                    hookSpecificOutput: {
+                        hookEventName: "PreToolUse",
+                        permissionDecision: "deny",
+                        permissionDecisionReason: `agent-custody: ${reason} (receipt ${receiptIdOf(bundle)})`,
+                    },
+                };
+            }
+            return {};
+        }
+        case "PostToolUse":
+            issuer.record(ev, { status: "executed", result: input.tool_response ?? null }, issuer.decide(ev));
+            return {};
+        case "PostToolUseFailure":
+            issuer.record(ev, { status: "failed", result: input.error ?? input.tool_response ?? null }, issuer.decide(ev));
+            return {};
+        default:
+            return {};
+    }
+}
+/**
+ * Hooks for the Claude Agent SDK's query({ hooks }) option. Register all three events.
+ * Typed loosely on purpose so this file does not depend on the SDK package.
+ */
+export function claudeAgentHooks(issuer, matcher) {
+    const cb = async (input) => handleHookEvent(issuer, input);
+    const entry = matcher === undefined ? { hooks: [cb] } : { matcher, hooks: [cb] };
+    return { PreToolUse: [entry], PostToolUse: [entry], PostToolUseFailure: [entry] };
+}
+export { createSdkIssuer };

package/dist/sdk/index.d.ts

@@ -0,0 +1,41 @@
+import type { SdkConfig } from "../config.ts";
+import { type PolicyDecision } from "../policy.ts";
+import type { ReceiptBundle } from "../receipt.ts";
+export declare const SDK_VERSION = "0.1.0";
+export interface ToolEvent {
+    tool: string;
+    args: Record<string, unknown>;
+    model?: string | null;
+    session?: {
+        id?: string | null;
+        toolUseId?: string | null;
+    };
+}
+export type Outcome = {
+    status: "executed" | "failed";
+    result: unknown;
+} | {
+    status: "denied";
+    reason: string;
+} | {
+    status: "error";
+    error: string;
+};
+export interface SdkIssuer {
+    agentId: string;
+    keyid: string;
+    /** Evaluates the configured policy for a call. Returns null when no policy is configured. */
+    decide(ev: ToolEvent): PolicyDecision | null;
+    /** Issues one receipt for a completed, failed, denied, or errored call. */
+    record(ev: ToolEvent, outcome: Outcome, policy?: PolicyDecision | null): ReceiptBundle;
+    /** Wraps a tool function: decide, run, record. Throws PolicyDeniedError on deny, after issuing the denial receipt. */
+    wrap<A extends Record<string, unknown>, R>(tool: string, fn: (args: A) => R | Promise<R>, meta?: Omit<ToolEvent, "tool" | "args">): (args: A) => Promise<R>;
+}
+export declare class PolicyDeniedError extends Error {
+    readonly tool: string;
+    readonly reason: string;
+    readonly receiptId: string;
+    constructor(tool: string, reason: string, receiptId: string);
+}
+export declare function createSdkIssuer(cfg: SdkConfig): SdkIssuer;
+export declare function receiptIdOf(bundle: ReceiptBundle): string;

package/dist/sdk/index.js

@@ -0,0 +1,77 @@
+// The interceptor SDK: issues receipts from inside the agent's own process.
+// Everything it records is "claimed", because the issuer shares a process with the agent. The receipt says so.
+import { randomUUID } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { digestOf, loadPrivateKey } from "../crypto.js";
+import { createIssuer } from "../issue.js";
+import { evaluate } from "../policy.js";
+export const SDK_VERSION = "0.1.0";
+export class PolicyDeniedError extends Error {
+    tool;
+    reason;
+    receiptId;
+    constructor(tool, reason, receiptId) {
+        super(`Denied by policy: ${reason} (receipt ${receiptId})`);
+        this.name = "PolicyDeniedError";
+        this.tool = tool;
+        this.reason = reason;
+        this.receiptId = receiptId;
+    }
+}
+export function createSdkIssuer(cfg) {
+    const key = loadPrivateKey(cfg.identity.keyFile);
+    const issuer = createIssuer(key, cfg.receiptsDir, cfg.logFile);
+    const policyText = cfg.policyFile ? readFileSync(cfg.policyFile, "utf8") : null;
+    const decide = (ev) => policyText === null ? null : evaluate(policyText, { agentId: cfg.agentId, tool: ev.tool, context: { args: ev.args, facts: {} } });
+    function record(ev, outcome, policy = null) {
+        const execution = outcome.status === "denied"
+            ? { status: "denied", reason: outcome.reason, provenance: "claimed" }
+            : outcome.status === "error"
+                ? { status: "error", error: outcome.error, provenance: "claimed" }
+                : { status: outcome.status, result: outcome.result, resultDigest: digestOf(outcome.result), provenance: "claimed" };
+        return issuer.issue({
+            receiptId: randomUUID(),
+            timestamp: new Date().toISOString(),
+            issuer: { kind: "sdk", keyid: issuer.keyid, version: SDK_VERSION, ...(cfg.framework ? { framework: cfg.framework } : {}) },
+            principal: { id: cfg.principalId ?? null, provenance: "claimed" },
+            agent: { id: cfg.agentId, provenance: "claimed" },
+            session: { id: ev.session?.id ?? null, toolUseId: ev.session?.toolUseId ?? null, provenance: "claimed" },
+            model: { id: ev.model ?? null, provenance: "claimed" },
+            tool: { name: ev.tool, provenance: "claimed" },
+            request: { args: ev.args, argsDigest: digestOf(ev.args), provenance: "claimed" },
+            facts: {},
+            policy: policy ? { ...policy, provenance: "claimed" } : null,
+            execution,
+        });
+    }
+    return {
+        agentId: cfg.agentId,
+        keyid: issuer.keyid,
+        decide,
+        record,
+        wrap(tool, fn, meta = {}) {
+            return async (args) => {
+                const ev = { tool, args, ...meta };
+                const policy = decide(ev);
+                if (policy && policy.decision === "deny") {
+                    const reason = [...policy.reasons, ...policy.errors].join("; ") || "no permit policy matched";
+                    const bundle = record(ev, { status: "denied", reason }, policy);
+                    throw new PolicyDeniedError(tool, reason, receiptIdOf(bundle));
+                }
+                try {
+                    const result = await fn(args);
+                    record(ev, { status: "executed", result }, policy);
+                    return result;
+                }
+                catch (e) {
+                    record(ev, { status: "error", error: e instanceof Error ? e.message : String(e) }, policy);
+                    throw e;
+                }
+            };
+        },
+    };
+}
+export function receiptIdOf(bundle) {
+    const st = JSON.parse(Buffer.from(bundle.envelope.payload, "base64").toString());
+    return st.predicate.receiptId;
+}

package/dist/sdk/langchain.d.ts

@@ -0,0 +1,17 @@
+import { BaseCallbackHandler } from "@langchain/core/callbacks/base";
+import type { SdkIssuer } from "./index.ts";
+export declare class ReceiptCallbackHandler extends BaseCallbackHandler {
+    name: string;
+    private readonly issuer;
+    private readonly pending;
+    constructor(issuer: SdkIssuer);
+    handleToolStart(tool: {
+        name?: string;
+    }, input: string, runId: string, _parentRunId?: string, _tags?: string[], _metadata?: Record<string, unknown>, runName?: string, toolCallId?: string): void;
+    handleToolEnd(output: unknown, runId: string): void;
+    handleToolError(err: Error, runId: string): void;
+}
+/** Convenience: `tool.invoke(args, receiptCallbacks(issuer))`, or spread into any RunnableConfig. */
+export declare function receiptCallbacks(issuer: SdkIssuer): {
+    callbacks: ReceiptCallbackHandler[];
+};

package/dist/sdk/langchain.js

@@ -0,0 +1,61 @@
+// LangChain / LangGraph (JS) adapter: a callback handler that issues a receipt for every tool run it observes.
+// Observe-only. LangChain callbacks cannot block a tool, so this handler evaluates no policy. For enforcement,
+// construct the tool with issuer.wrap(): tool(issuer.wrap("name", fn), { name, schema }). Do not combine both on
+// one tool, or it will be recorded twice.
+import { BaseCallbackHandler } from "@langchain/core/callbacks/base";
+function parseArgs(input) {
+    try {
+        const v = JSON.parse(input);
+        return v && typeof v === "object" && !Array.isArray(v) ? v : { input: v };
+    }
+    catch {
+        return { input };
+    }
+}
+/** LangChain hands the handler either the raw return value or a ToolMessage. Record the content either way. */
+function unwrapOutput(output) {
+    if (output && typeof output === "object" && "content" in output && "tool_call_id" in output) {
+        const content = output.content;
+        if (typeof content === "string") {
+            try {
+                return JSON.parse(content);
+            }
+            catch {
+                return content;
+            }
+        }
+        return content;
+    }
+    return output;
+}
+export class ReceiptCallbackHandler extends BaseCallbackHandler {
+    name = "agent-custody";
+    issuer;
+    pending = new Map();
+    constructor(issuer) {
+        super();
+        this.issuer = issuer;
+    }
+    handleToolStart(tool, input, runId, _parentRunId, _tags, _metadata, runName, toolCallId) {
+        const name = runName ?? tool.name ?? "unknown";
+        this.pending.set(runId, { tool: name, args: parseArgs(input), session: { id: null, toolUseId: toolCallId ?? null } });
+    }
+    handleToolEnd(output, runId) {
+        const ev = this.pending.get(runId);
+        if (!ev)
+            return;
+        this.pending.delete(runId);
+        this.issuer.record(ev, { status: "executed", result: unwrapOutput(output) }, null);
+    }
+    handleToolError(err, runId) {
+        const ev = this.pending.get(runId);
+        if (!ev)
+            return;
+        this.pending.delete(runId);
+        this.issuer.record(ev, { status: "error", error: err.message }, null);
+    }
+}
+/** Convenience: `tool.invoke(args, receiptCallbacks(issuer))`, or spread into any RunnableConfig. */
+export function receiptCallbacks(issuer) {
+    return { callbacks: [new ReceiptCallbackHandler(issuer)] };
+}

package/dist/sdk/openai-agents.d.ts

@@ -0,0 +1,11 @@
+import { type SdkIssuer } from "./index.ts";
+type InvokeFn = (runContext: any, input: string, details?: any) => Promise<unknown>;
+export declare function wrapTools<T extends {
+    name: string;
+    invoke: InvokeFn;
+}>(issuer: SdkIssuer, tools: readonly T[]): T[];
+interface Listenable {
+    on(event: any, listener: (...args: any[]) => void): unknown;
+}
+export declare function observeRunner(issuer: SdkIssuer, runner: Listenable): void;
+export {};

package/dist/sdk/openai-agents.js

@@ -0,0 +1,66 @@
+// OpenAI Agents SDK (JS) adapter.
+//   wrapTools:     enforcement + receipts, by wrapping each FunctionTool's invoke(). A denied call never runs; the
+//                  model receives the denial text as the tool result and the run continues.
+//   observeRunner: receipts only, from the runner's agent_tool_start / agent_tool_end events. Cannot block, so it
+//                  evaluates no policy. Use one or the other per tool, not both.
+// Typed structurally so this file does not import the package.
+import { receiptIdOf } from "./index.js";
+function parseArgs(input) {
+    if (!input)
+        return {};
+    try {
+        const v = JSON.parse(input);
+        return v && typeof v === "object" && !Array.isArray(v) ? v : { input: v };
+    }
+    catch {
+        return { input };
+    }
+}
+function parseResult(result) {
+    if (typeof result !== "string")
+        return result;
+    try {
+        return JSON.parse(result);
+    }
+    catch {
+        return result;
+    }
+}
+export function wrapTools(issuer, tools) {
+    return tools.map((t) => {
+        const invoke = async (ctx, input, details) => {
+            const ev = { tool: t.name, args: parseArgs(input), session: { id: null, toolUseId: details?.toolCall?.callId ?? null } };
+            const policy = issuer.decide(ev);
+            if (policy && policy.decision === "deny") {
+                const reason = [...policy.reasons, ...policy.errors].join("; ") || "no permit policy matched";
+                const bundle = issuer.record(ev, { status: "denied", reason }, policy);
+                return `Denied by policy: ${reason} (receipt ${receiptIdOf(bundle)})`;
+            }
+            try {
+                const result = await t.invoke(ctx, input, details);
+                issuer.record(ev, { status: "executed", result: parseResult(result) }, policy);
+                return result;
+            }
+            catch (e) {
+                issuer.record(ev, { status: "error", error: e instanceof Error ? e.message : String(e) }, policy);
+                throw e;
+            }
+        };
+        return { ...t, invoke };
+    });
+}
+export function observeRunner(issuer, runner) {
+    const pending = new Map();
+    runner.on("agent_tool_start", (_ctx, _agent, tool, details) => {
+        const callId = details?.toolCall?.callId;
+        if (!callId)
+            return;
+        pending.set(callId, { tool: tool.name, args: parseArgs(details?.toolCall?.arguments), session: { id: null, toolUseId: callId } });
+    });
+    runner.on("agent_tool_end", (_ctx, _agent, tool, result, details) => {
+        const callId = details?.toolCall?.callId ?? "";
+        const ev = pending.get(callId) ?? { tool: tool.name, args: {}, session: { id: null, toolUseId: callId || null } };
+        pending.delete(callId);
+        issuer.record(ev, { status: "executed", result: parseResult(result) }, null);
+    });
+}

package/dist/sdk/vercel-ai.d.ts

@@ -0,0 +1,7 @@
+import { type SdkIssuer } from "./index.ts";
+type ExecuteFn = (input: any, options: any) => unknown;
+/** Returns a new ToolSet. Tools without execute (client-side or provider-executed) pass through unchanged. */
+export declare function wrapTools<T extends Record<string, {
+    execute?: ExecuteFn;
+}>>(issuer: SdkIssuer, tools: T): T;
+export {};

package/dist/sdk/vercel-ai.js

@@ -0,0 +1,35 @@
+// Vercel AI SDK adapter: wraps every tool's execute() in a ToolSet. Decides, runs, records.
+// Typed structurally so this file does not import the `ai` package.
+import { PolicyDeniedError, receiptIdOf } from "./index.js";
+/** Returns a new ToolSet. Tools without execute (client-side or provider-executed) pass through unchanged. */
+export function wrapTools(issuer, tools) {
+    const out = {};
+    for (const [name, t] of Object.entries(tools)) {
+        const original = t.execute;
+        if (!original) {
+            out[name] = t;
+            continue;
+        }
+        const execute = async (input, options) => {
+            const args = input && typeof input === "object" && !Array.isArray(input) ? input : { input };
+            const ev = { tool: name, args, session: { id: null, toolUseId: options?.toolCallId ?? null } };
+            const policy = issuer.decide(ev);
+            if (policy && policy.decision === "deny") {
+                const reason = [...policy.reasons, ...policy.errors].join("; ") || "no permit policy matched";
+                const bundle = issuer.record(ev, { status: "denied", reason }, policy);
+                throw new PolicyDeniedError(name, reason, receiptIdOf(bundle));
+            }
+            try {
+                const result = await original(input, options);
+                issuer.record(ev, { status: "executed", result }, policy);
+                return result;
+            }
+            catch (e) {
+                issuer.record(ev, { status: "error", error: e instanceof Error ? e.message : String(e) }, policy);
+                throw e;
+            }
+        };
+        out[name] = { ...t, execute };
+    }
+    return out;
+}

package/dist/verify.d.ts

@@ -0,0 +1,22 @@
+import { type PublicKeyRef } from "./crypto.ts";
+import { type ReceiptBundle, type ReceiptStatement } from "./receipt.ts";
+export interface Check {
+    name: string;
+    ok: boolean;
+    detail?: string;
+}
+export interface VerifyOptions {
+    /** keys trusted to have issued receipts: gateway keys, SDK application keys */
+    issuerKeys: PublicKeyRef[];
+    principalKeys: PublicKeyRef[];
+    /** If given, the root is recomputed from this log file at the receipt's tree size and compared. */
+    logFile?: string;
+}
+export interface VerifyResult {
+    ok: boolean;
+    checks: Check[];
+    statement: ReceiptStatement | null;
+}
+export declare function verifyBundle(bundle: ReceiptBundle, opts: VerifyOptions): VerifyResult;
+/** Human-readable report: checks, then every field with its provenance so the reader knows what was proven vs. claimed. */
+export declare function formatReport(r: VerifyResult): string;