@permission-protocol/mcp-guard 0.1.0 → 0.2.0

package/dist/src/approval-ui.js

@@ -1,6 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getApprovalHTML = getApprovalHTML;
+/**
+ * The built-in approval page. It is static and holds no secret: the access token
+ * arrives in the URL fragment (`#t=…`, never sent to any server), is kept in
+ * sessionStorage for this tab, and is sent as `Authorization: Bearer` on every call.
+ */
 function getApprovalHTML() {
     return `<!DOCTYPE html>
 <html lang="en">
@@ -21,12 +26,9 @@ function getApprovalHTML() {
     display: inline-block; padding: 2px 8px; border-radius: 12px;
     font-size: 12px; font-weight: 600; text-transform: uppercase;
   }
-  .badge-pending { background: #d29922; color: #0d1117; }
-  .badge-approved { background: #238636; color: #fff; }
-  .badge-denied { background: #da3633; color: #fff; }
+  .badge-pending, .badge-held_for_approval { background: #d29922; color: #0d1117; }
   .badge-allowed { background: #238636; color: #fff; }
   .badge-blocked { background: #da3633; color: #fff; }
-  .badge-held_for_approval { background: #d29922; color: #0d1117; }
   .card {
     border: 1px solid #30363d; border-radius: 8px; padding: 16px;
     margin-bottom: 12px; background: #161b22;
@@ -35,19 +37,13 @@ function getApprovalHTML() {
   .tool-name { font-size: 18px; font-weight: 700; color: #f0f6fc; }
   .meta { font-size: 13px; color: #8b949e; margin-bottom: 8px; }
   .meta span { margin-right: 16px; }
-  .args-toggle {
-    background: none; border: 1px solid #30363d; color: #58a6ff;
-    padding: 4px 10px; border-radius: 4px; cursor: pointer; font-size: 12px;
-    margin-bottom: 8px;
-  }
-  .args-toggle:hover { border-color: #58a6ff; }
+  .summary { margin-bottom: 8px; }
   .args-content {
-    display: none; background: #0d1117; border: 1px solid #30363d;
+    background: #0d1117; border: 1px solid #30363d;
     border-radius: 4px; padding: 12px; margin-bottom: 12px;
     font-family: 'SF Mono', Consolas, monospace; font-size: 13px;
     overflow-x: auto; white-space: pre-wrap; word-break: break-all;
   }
-  .args-content.open { display: block; }
   .actions { display: flex; gap: 8px; }
   .btn {
     padding: 6px 16px; border-radius: 6px; border: none;
@@ -57,100 +53,143 @@ function getApprovalHTML() {
   .btn:disabled { opacity: 0.4; cursor: not-allowed; }
   .btn-approve { background: #238636; color: #fff; }
   .btn-deny { background: #da3633; color: #fff; }
-  .empty {
+  .empty, .notice {
     text-align: center; padding: 40px; color: #8b949e;
     border: 1px dashed #30363d; border-radius: 8px; margin-bottom: 24px;
   }
+  .notice { color: #d29922; border-color: #d29922; }
   h2 { color: #c9d1d9; font-size: 18px; margin: 24px 0 12px; }
   table { width: 100%; border-collapse: collapse; font-size: 13px; }
   th { text-align: left; padding: 8px; border-bottom: 2px solid #30363d; color: #8b949e; font-weight: 600; }
   td { padding: 8px; border-bottom: 1px solid #21262d; }
-  .pulse { display: inline-block; width: 8px; height: 8px; border-radius: 50%; background: #3fb950; margin-right: 8px; animation: pulse 2s infinite; }
-  @keyframes pulse { 0%,100% { opacity: 1; } 50% { opacity: 0.3; } }
   .status-bar { display: flex; align-items: center; font-size: 12px; color: #8b949e; margin-bottom: 16px; }
 </style>
 </head>
 <body>
 <h1>MCP Guard — Approval Queue</h1>
 <p class="subtitle">Human-in-the-loop approval for AI tool calls</p>
-<div class="status-bar"><span class="pulse"></span> Polling every 3s</div>
+<div class="status-bar" id="status">Connecting…</div>
 
 <div id="pending"></div>
 <h2>Recent Decisions</h2>
 <div id="receipts"></div>
 
 <script>
-function esc(s) { const d = document.createElement('div'); d.textContent = s; return d.innerHTML; }
+(function () {
+  var token = null;
+  var m = location.hash.match(/(?:^#|&)t=([^&]+)/);
+  if (m) {
+    token = decodeURIComponent(m[1]);
+    try { sessionStorage.setItem('mcp-guard-token', token); } catch (e) {}
+    history.replaceState(null, '', location.pathname + location.search);
+  } else {
+    try { token = sessionStorage.getItem('mcp-guard-token'); } catch (e) {}
+  }
 
-function toggleArgs(btn) {
-  const c = btn.nextElementSibling;
-  c.classList.toggle('open');
-  btn.textContent = c.classList.contains('open') ? '▾ Hide arguments' : '▸ Show arguments';
-}
+  var statusEl = document.getElementById('status');
+  var pEl = document.getElementById('pending');
+  var rEl = document.getElementById('receipts');
 
-async function act(id, action) {
-  const btns = document.querySelectorAll('[data-id="'+id+'"]');
-  btns.forEach(b => b.disabled = true);
-  try {
-    const r = await fetch('/api/' + action + '/' + id, { method: 'POST' });
-    if (!r.ok) { const e = await r.text(); alert('Error: ' + e); }
-  } catch(e) { alert('Network error'); }
-  refresh();
-}
+  function el(tag, cls, text) {
+    var n = document.createElement(tag);
+    if (cls) n.className = cls;
+    if (text != null) n.textContent = text;
+    return n;
+  }
 
-async function refresh() {
-  try {
-    const [pRes, rRes] = await Promise.all([
-      fetch('/api/pending'), fetch('/api/receipts')
-    ]);
-    const pending = await pRes.json();
-    const receipts = await rRes.json();
+  function api(path, method) {
+    return fetch(path, { method: method || 'GET', headers: { Authorization: 'Bearer ' + token }, cache: 'no-store' });
+  }
 
-    const pEl = document.getElementById('pending');
-    if (pending.length === 0) {
-      pEl.innerHTML = '<div class="empty">No pending approvals</div>';
-    } else {
-      pEl.innerHTML = pending.map(p => \`
-        <div class="card">
-          <div class="card-header">
-            <span class="tool-name">\${esc(p.tool_name)}</span>
-            <span class="badge badge-pending">pending</span>
-          </div>
-          <div class="meta">
-            <span>Agent: <strong>\${esc(p.agent_id)}</strong></span>
-            <span>Rule: <strong>\${esc(p.rule_id)}</strong></span>
-            <span>\${esc(new Date(p.timestamp).toLocaleTimeString())}</span>
-          </div>
-          <button class="args-toggle" onclick="toggleArgs(this)">▸ Show arguments</button>
-          <div class="args-content">\${esc(JSON.stringify(p.tool_args, null, 2))}</div>
-          <div class="actions">
-            <button class="btn btn-approve" data-id="\${p.id}" onclick="act('\${p.id}','approve')">✅ Approve</button>
-            <button class="btn btn-deny" data-id="\${p.id}" onclick="act('\${p.id}','deny')">❌ Deny</button>
-          </div>
-        </div>
-      \`).join('');
-    }
+  function noToken(msg) {
+    pEl.textContent = '';
+    pEl.appendChild(el('div', 'notice', msg));
+    statusEl.textContent = 'Not connected';
+  }
 
-    const rEl = document.getElementById('receipts');
-    if (receipts.length === 0) {
-      rEl.innerHTML = '<div class="empty">No recent decisions</div>';
-    } else {
-      rEl.innerHTML = \`<table>
-        <thead><tr><th>Time</th><th>Tool</th><th>Decision</th><th>Agent</th><th>Rule</th></tr></thead>
-        <tbody>\${receipts.map(r => \`<tr>
-          <td>\${esc(new Date(r.timestamp).toLocaleTimeString())}</td>
-          <td><strong>\${esc(r.tool_name)}</strong></td>
-          <td><span class="badge badge-\${r.decision}">\${esc(r.decision)}</span></td>
-          <td>\${esc(r.agent_id)}</td>
-          <td>\${esc(r.rule_id || '—')}</td>
-        </tr>\`).join('')}</tbody>
-      </table>\`;
-    }
-  } catch(e) { /* retry next cycle */ }
-}
+  async function act(id, verb, btns) {
+    btns.forEach(function (b) { b.disabled = true; });
+    try {
+      var r = await api('/api/' + verb + '/' + id, 'POST');
+      if (!r.ok) statusEl.textContent = 'Could not ' + verb + ' (HTTP ' + r.status + ')';
+    } catch (e) { statusEl.textContent = 'Network error'; }
+    refresh();
+  }
+
+  function renderPending(pending) {
+    pEl.textContent = '';
+    if (pending.length === 0) { pEl.appendChild(el('div', 'empty', 'No pending approvals')); return; }
+    pending.forEach(function (p) {
+      var card = el('div', 'card');
+      var head = el('div', 'card-header');
+      head.appendChild(el('span', 'tool-name', p.tool_name));
+      head.appendChild(el('span', 'badge badge-pending', p.acted ? 'ran · confirm' : 'pending'));
+      card.appendChild(head);
+      var meta = el('div', 'meta');
+      meta.appendChild(el('span', null, 'Agent: ' + p.agent_id));
+      meta.appendChild(el('span', null, 'Rule: ' + (p.rule_id || 'default action')));
+      meta.appendChild(el('span', null, new Date(p.created_at).toLocaleTimeString()));
+      if (p.countdown_remaining != null) meta.appendChild(el('span', null, 'Auto-releases in ' + p.countdown_remaining + 's'));
+      card.appendChild(meta);
+      card.appendChild(el('div', 'summary', p.summary));
+      if (p.scope) {
+        card.appendChild(el('div', 'meta', 'Approving signs for: ' + p.scope.scope
+          + (p.scope.ref ? ' · ' + p.scope.ref : '') + (p.scope.sha ? ' @ ' + p.scope.sha : '')));
+      }
+      card.appendChild(el('div', 'args-content', p.args_full || p.args_preview));
+      var actions = el('div', 'actions');
+      var approve = el('button', 'btn btn-approve', p.acted ? 'Acknowledge' : 'Approve');
+      var btns = [approve];
+      approve.addEventListener('click', function () { act(p.id, 'approve', btns); });
+      actions.appendChild(approve);
+      if (!p.acted) {
+        var deny = el('button', 'btn btn-deny', 'Deny');
+        btns.push(deny);
+        deny.addEventListener('click', function () { act(p.id, 'deny', btns); });
+        actions.appendChild(deny);
+      }
+      card.appendChild(actions);
+      pEl.appendChild(card);
+    });
+  }
+
+  function renderReceipts(receipts) {
+    rEl.textContent = '';
+    if (receipts.length === 0) { rEl.appendChild(el('div', 'empty', 'No recent decisions')); return; }
+    var table = el('table');
+    var thead = el('thead'); var hr = el('tr');
+    ['Time', 'Action', 'Decision', 'Approved by', 'Rule', 'Receipt'].forEach(function (h) { hr.appendChild(el('th', null, h)); });
+    thead.appendChild(hr); table.appendChild(thead);
+    var tbody = el('tbody');
+    receipts.forEach(function (r) {
+      var e = r.envelope || {};
+      var tr = el('tr');
+      tr.appendChild(el('td', null, new Date(e.issued_at).toLocaleTimeString()));
+      tr.appendChild(el('td', null, e.tool || e.method));
+      var td = el('td'); td.appendChild(el('span', 'badge badge-' + e.decision, e.decision)); tr.appendChild(td);
+      tr.appendChild(el('td', null, e.approval ? e.approval.kind + ': ' + e.approval.id : '—'));
+      tr.appendChild(el('td', null, e.rule_id || '—'));
+      tr.appendChild(el('td', null, e.receipt_id));
+      tbody.appendChild(tr);
+    });
+    table.appendChild(tbody);
+    rEl.appendChild(table);
+  }
+
+  async function refresh() {
+    if (!token) { noToken('Open the approval URL printed in the terminal. It ends with #t=… and carries the access token.'); return; }
+    try {
+      var res = await Promise.all([api('/api/pending'), api('/api/receipts')]);
+      if (res[0].status === 401) { noToken('The access token is missing or wrong. Open the URL printed in the terminal again.'); return; }
+      renderPending(await res[0].json());
+      renderReceipts(await res[1].json());
+      statusEl.textContent = 'Live · refreshes every 3s';
+    } catch (e) { statusEl.textContent = 'Disconnected · retrying'; }
+  }
 
-refresh();
-setInterval(refresh, 3000);
+  refresh();
+  setInterval(refresh, 3000);
+})();
 </script>
 </body>
 </html>`;

package/dist/src/approval-ui.js.map

@@ -1 +1 @@
-{"version":3,"file":"approval-ui.js","sourceRoot":"","sources":["../../src/approval-ui.ts"],"names":[],"mappings":";;AAAA,0CAyJC;AAzJD,SAAgB,eAAe;IAC7B,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAuJD,CAAC;AACT,CAAC"}
+{"version":3,"file":"approval-ui.js","sourceRoot":"","sources":["../../src/approval-ui.ts"],"names":[],"mappings":";;AAKA,0CA2LC;AAhMD;;;;GAIG;AACH,SAAgB,eAAe;IAC7B,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAyLD,CAAC;AACT,CAAC"}

package/dist/src/classify.d.ts

@@ -0,0 +1,29 @@
+import type { Rule } from './config.js';
+import type { Decision } from './engine.js';
+/**
+ * Permission Deck Slice 1 — the reversibility/confidence classifier.
+ *
+ * The base engine produces allow | block | held_for_approval from a rule match. This
+ * layer enriches an attention-requiring decision with:
+ *   - which human lane it belongs in (decide | unblock | verify)
+ *   - reversibility (the primary risk axis)
+ *   - a countdown for reversible holds
+ *
+ * It can also DOWNGRADE a protected spend under its cap into an "act now, surface in
+ * Verify" decision. The amount is read only from the argument the rule names
+ * (`amount_arg`) — the argument the tool actually acts on — never from agent metadata.
+ *
+ * Agent metadata under `_pp` (confidence, requires_input) can only ADD human attention:
+ * it routes lanes but never turns a held or blocked call into an allowed one.
+ *
+ * Pure function. No I/O. Fully unit-testable.
+ */
+export interface ActionMeta {
+    confidence?: number;
+    requires_input?: boolean;
+}
+/** Pull Permission Deck lane hints out of the tool-call args (under `_pp`). */
+export declare function extractMeta(toolArgs: Record<string, unknown> | undefined): ActionMeta;
+/** The capped amount, or undefined when it is missing or not a finite non-negative number. */
+export declare function readAmount(rule: Rule, toolArgs: Record<string, unknown> | undefined): number | undefined;
+export declare function classify(base: Decision, rule: Rule | null, meta: ActionMeta, toolArgs?: Record<string, unknown>): Decision;

package/dist/src/classify.js

@@ -0,0 +1,107 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.extractMeta = extractMeta;
+exports.readAmount = readAmount;
+exports.classify = classify;
+/** Pull Permission Deck lane hints out of the tool-call args (under `_pp`). */
+function extractMeta(toolArgs) {
+    const pp = toolArgs?._pp;
+    const meta = {};
+    if (!pp || typeof pp !== 'object' || Array.isArray(pp))
+        return meta;
+    const p = pp;
+    if (typeof p.confidence === 'number' && Number.isFinite(p.confidence))
+        meta.confidence = clamp(p.confidence, 0, 100);
+    if (typeof p.requires_input === 'boolean')
+        meta.requires_input = p.requires_input;
+    return meta;
+}
+/** The capped amount, or undefined when it is missing or not a finite non-negative number. */
+function readAmount(rule, toolArgs) {
+    if (!rule.amount_arg)
+        return undefined;
+    const v = toolArgs?.[rule.amount_arg];
+    return typeof v === 'number' && Number.isFinite(v) && v >= 0 ? v : undefined;
+}
+function classify(base, rule, meta, toolArgs) {
+    // Explicit hard block or plain allow with no protected rule: pass through untouched.
+    if (base.decision === 'blocked')
+        return base;
+    if (base.decision === 'allowed') {
+        // Allowed actions can still be surfaced for Verify when confidence is low.
+        return maybeVerify(base, rule, meta);
+    }
+    // From here: the action is held_for_approval. Resolve the lane.
+    const reversibility = rule?.reversibility ?? 'irreversible'; // fail safe: unknown = irreversible
+    const confidence = meta.confidence !== undefined ? { confidence: meta.confidence } : {};
+    // 1) Needs an input only the human has -> Unblock. No countdown. An irreversible hold
+    //    stays a Decide hard stop whatever the agent claims.
+    if (meta.requires_input && reversibility === 'reversible') {
+        return {
+            ...base,
+            lane: 'unblock',
+            reversibility,
+            ...confidence,
+            reason: `${base.reason}; needs human-only input`,
+        };
+    }
+    // 2) Spend with a cap -> act+verify under cap, hard-stop at/over cap or when unreadable.
+    if (rule?.cap_usd !== undefined) {
+        const amount = readAmount(rule, toolArgs);
+        if (amount === undefined) {
+            return {
+                ...base,
+                lane: 'decide',
+                reversibility: 'irreversible',
+                ...confidence,
+                reason: `${base.reason}; "${rule.amount_arg}" missing or not a non-negative number — hard stop`,
+            };
+        }
+        if (amount < rule.cap_usd) {
+            return {
+                ...base,
+                decision: 'allowed', // under cap: act now under the standing rule...
+                lane: 'verify', // ...but surface for post-hoc confirmation
+                reversibility,
+                ...confidence,
+                reason: `${base.reason}; under the $${rule.cap_usd} cap — acted, routed to Verify`,
+            };
+        }
+        return {
+            ...base,
+            lane: 'decide',
+            reversibility: 'irreversible', // over-cap spend is treated as a hard stop
+            ...confidence,
+            reason: `${base.reason}; at or over the $${rule.cap_usd} cap — hard stop`,
+        };
+    }
+    // 3) General held action -> Decide. Reversible gets a countdown; irreversible is a hard stop.
+    const decideCard = { ...base, lane: 'decide', reversibility, ...confidence };
+    if (reversibility === 'reversible' && rule?.countdown_seconds) {
+        decideCard.countdown_seconds = rule.countdown_seconds;
+        decideCard.reason = `${base.reason}; reversible — auto-releases in ${rule.countdown_seconds}s unless held`;
+    }
+    else {
+        decideCard.reason = `${base.reason}; ${reversibility} — hard stop until approved`;
+    }
+    return decideCard;
+}
+/** An allowed action routes to Verify when its self-reported confidence is below threshold. */
+function maybeVerify(base, rule, meta) {
+    if (rule?.verify_threshold === undefined || meta.confidence === undefined)
+        return base;
+    const threshold = rule.verify_threshold;
+    if (meta.confidence < threshold) {
+        return {
+            ...base,
+            lane: 'verify',
+            confidence: meta.confidence,
+            reason: `${base.reason}; confidence ${meta.confidence} < ${threshold} — routed to Verify`,
+        };
+    }
+    return base;
+}
+function clamp(n, lo, hi) {
+    return Math.max(lo, Math.min(hi, n));
+}
+//# sourceMappingURL=classify.js.map

package/dist/src/classify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"classify.js","sourceRoot":"","sources":["../../src/classify.ts"],"names":[],"mappings":";;AA4BA,kCAQC;AAGD,gCAIC;AAED,4BAqEC;AAvFD,+EAA+E;AAC/E,SAAgB,WAAW,CAAC,QAA6C;IACvE,MAAM,EAAE,GAAG,QAAQ,EAAE,GAAG,CAAC;IACzB,MAAM,IAAI,GAAe,EAAE,CAAC;IAC5B,IAAI,CAAC,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACpE,MAAM,CAAC,GAAG,EAA6B,CAAC;IACxC,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC;QAAE,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;IACrH,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,SAAS;QAAE,IAAI,CAAC,cAAc,GAAG,CAAC,CAAC,cAAc,CAAC;IAClF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8FAA8F;AAC9F,SAAgB,UAAU,CAAC,IAAU,EAAE,QAA6C;IAClF,IAAI,CAAC,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IACvC,MAAM,CAAC,GAAG,QAAQ,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACtC,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/E,CAAC;AAED,SAAgB,QAAQ,CACtB,IAAc,EACd,IAAiB,EACjB,IAAgB,EAChB,QAAkC;IAElC,qFAAqF;IACrF,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC7C,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAChC,2EAA2E;QAC3E,OAAO,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACvC,CAAC;IAED,gEAAgE;IAChE,MAAM,aAAa,GAAkB,IAAI,EAAE,aAAa,IAAI,cAAc,CAAC,CAAC,oCAAoC;IAChH,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAExF,sFAAsF;IACtF,yDAAyD;IACzD,IAAI,IAAI,CAAC,cAAc,IAAI,aAAa,KAAK,YAAY,EAAE,CAAC;QAC1D,OAAO;YACL,GAAG,IAAI;YACP,IAAI,EAAE,SAAS;YACf,aAAa;YACb,GAAG,UAAU;YACb,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,0BAA0B;SACjD,CAAC;IACJ,CAAC;IAED,yFAAyF;IACzF,IAAI,IAAI,EAAE,OAAO,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC1C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO;gBACL,GAAG,IAAI;gBACP,IAAI,EAAE,QAAQ;gBACd,aAAa,EAAE,cAAc;gBAC7B,GAAG,UAAU;gBACb,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,MAAM,IAAI,CAAC,UAAU,oDAAoD;aAChG,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAC1B,OAAO;gBACL,GAAG,IAAI;gBACP,QAAQ,EAAE,SAAS,EAAE,gDAAgD;gBACrE,IAAI,EAAE,QAAQ,EAAO,2CAA2C;gBAChE,aAAa;gBACb,GAAG,UAAU;gBACb,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,gBAAgB,IAAI,CAAC,OAAO,gCAAgC;aACnF,CAAC;QACJ,CAAC;QACD,OAAO;YACL,GAAG,IAAI;YACP,IAAI,EAAE,QAAQ;YACd,aAAa,EAAE,cAAc,EAAE,2CAA2C;YAC1E,GAAG,UAAU;YACb,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,qBAAqB,IAAI,CAAC,OAAO,kBAAkB;SAC1E,CAAC;IACJ,CAAC;IAED,8FAA8F;IAC9F,MAAM,UAAU,GAAa,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,UAAU,EAAE,CAAC;IACvF,IAAI,aAAa,KAAK,YAAY,IAAI,IAAI,EAAE,iBAAiB,EAAE,CAAC;QAC9D,UAAU,CAAC,iBAAiB,GAAG,IAAI,CAAC,iBAAiB,CAAC;QACtD,UAAU,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,mCAAmC,IAAI,CAAC,iBAAiB,eAAe,CAAC;IAC7G,CAAC;SAAM,CAAC;QACN,UAAU,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,KAAK,aAAa,6BAA6B,CAAC;IACpF,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,+FAA+F;AAC/F,SAAS,WAAW,CAAC,IAAc,EAAE,IAAiB,EAAE,IAAgB;IACtE,IAAI,IAAI,EAAE,gBAAgB,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACvF,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC;IACxC,IAAI,IAAI,CAAC,UAAU,GAAG,SAAS,EAAE,CAAC;QAChC,OAAO;YACL,GAAG,IAAI;YACP,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,gBAAgB,IAAI,CAAC,UAAU,MAAM,SAAS,qBAAqB;SAC1F,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,KAAK,CAAC,CAAS,EAAE,EAAU,EAAE,EAAU;IAC9C,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;AACvC,CAAC"}

package/dist/src/cli.js

@@ -3,6 +3,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.main = main;
 const config_js_1 = require("./config.js");
 const proxy_js_1 = require("./proxy.js");
+const verify_cli_js_1 = require("./verify-cli.js");
+const signer_js_1 = require("./signer.js");
 const node_path_1 = require("node:path");
 const node_child_process_1 = require("node:child_process");
 function main() {
@@ -13,14 +15,24 @@ function main() {
         const result = (0, node_child_process_1.spawnSync)('bash', [scriptPath], { stdio: 'inherit' });
         process.exit(result.status ?? 0);
     }
+    if (args[0] === 'verify') {
+        process.exit((0, verify_cli_js_1.runVerify)(args.slice(1)));
+    }
+    if (args[0] === 'export-key') {
+        // Write the signing public key (the trust anchor verifiers pin). Never the private key.
+        const out = args[1] || 'mcp-guard.pub.pem';
+        (0, signer_js_1.exportPublicKey)(out);
+        console.log(`Wrote public key ${(0, signer_js_1.currentKeyId)()} to ${out} (private key stays in ${(0, signer_js_1.keysDir)()})`);
+        process.exit(0);
+    }
     let configPath = './pp.config.yaml';
     let agentId = 'unknown';
     let modeOverride;
     let approvalPort;
-    let serverCommand = [];
+    let operator;
     const dashDashIndex = args.indexOf('--');
     const cliArgs = dashDashIndex >= 0 ? args.slice(0, dashDashIndex) : args;
-    serverCommand = dashDashIndex >= 0 ? args.slice(dashDashIndex + 1) : [];
+    const serverCommand = dashDashIndex >= 0 ? args.slice(dashDashIndex + 1) : [];
     for (let i = 0; i < cliArgs.length; i++) {
         if (cliArgs[i] === '--config' && cliArgs[i + 1]) {
             configPath = cliArgs[++i];
@@ -28,10 +40,16 @@ function main() {
         else if (cliArgs[i] === '--agent-id' && cliArgs[i + 1]) {
             agentId = cliArgs[++i];
         }
+        else if (cliArgs[i] === '--operator' && cliArgs[i + 1]) {
+            operator = cliArgs[++i];
+        }
         else if (cliArgs[i] === '--mode' && cliArgs[i + 1]) {
             const m = cliArgs[++i];
-            if (m === 'enforce' || m === 'observe')
-                modeOverride = m;
+            if (m !== 'enforce' && m !== 'observe') {
+                process.stderr.write('[mcp-guard] Error: --mode must be enforce or observe\n');
+                process.exit(1);
+            }
+            modeOverride = m;
         }
         else if (cliArgs[i] === '--approval-port' && cliArgs[i + 1]) {
             approvalPort = parseInt(cliArgs[++i], 10);
@@ -49,31 +67,50 @@ function main() {
         process.stderr.write('[mcp-guard] Error: No server command. Use: mcp-guard [options] -- <server command>\n');
         process.exit(1);
     }
-    const config = (0, config_js_1.loadConfig)(configPath);
+    let config;
+    try {
+        config = (0, config_js_1.loadConfig)(configPath);
+    }
+    catch (err) {
+        process.stderr.write(`[mcp-guard] Error: ${err.message}\n`);
+        process.exit(1);
+    }
     if (modeOverride)
         config.mode = modeOverride;
     process.stderr.write(`[mcp-guard] Loaded ${config.rules.length} rules (default: ${config.default_action}, mode: ${config.mode})\n`);
-    process.stderr.write(`[mcp-guard] Starting server: ${serverCommand.join(' ')}\n`);
-    (0, proxy_js_1.startProxy)(config, agentId, serverCommand, approvalPort);
+    if (config.default_action === 'allow') {
+        process.stderr.write('[mcp-guard] WARNING: default_action is "allow" — any tool or method without a rule runs unchecked. Use "block" or "require_approval" to fail closed.\n');
+    }
+    process.stderr.write(`[mcp-guard] Starting server: ${serverCommand[0]}\n`);
+    try {
+        (0, proxy_js_1.startProxy)(config, agentId, serverCommand, { approvalPort, operator });
+    }
+    catch (err) {
+        process.stderr.write(`[mcp-guard] Error: ${err.message}\n`);
+        process.exit(1);
+    }
 }
 function printHelp() {
     const help = `
-mcp-guard — MCP tool-call policy proxy
+mcp-guard — MCP policy proxy
 
 Usage:
   mcp-guard [options] -- <server command>
+  mcp-guard verify --receipt-file <path> --pubkey <pem> [--scope s] [--scope-ref r] [--scope-sha h]
+  mcp-guard export-key [out.pem]
 
 Options:
   --config <path>         Path to config file (default: ./pp.config.yaml)
   --agent-id <id>         Agent identifier for receipts (default: "unknown")
+  --operator <name>       Approver name recorded on receipts (default: OS username)
   --mode <mode>           enforce or observe (overrides config; default: enforce)
-  --approval-port <port>  Enable approval UI on this port (e.g. 3100)
+  --approval-port <port>  Enable the approval UI on 127.0.0.1:<port>
   -h, --help              Show this help
 
-Example:
-  mcp-guard --config pp.config.yaml -- node my-mcp-server.js
+The approval UI URL printed at startup carries its access token after "#t=".
+Open that exact URL; requests without the token are refused.
 
-  # With approval UI:
+Example:
   mcp-guard --config pp.config.yaml --approval-port 3100 -- node my-mcp-server.js
 `.trim();
     console.log(help);

package/dist/src/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../src/cli.ts"],"names":[],"mappings":";;AAOA,oBAmDC;AA1DD,2CAAyC;AACzC,yCAAwC;AACxC,yCAAiC;AACjC,2DAA+C;AAI/C,SAAgB,IAAI;IAClB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAEnC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QACvB,2DAA2D;QAC3D,MAAM,UAAU,GAAG,IAAA,gBAAI,EAAC,SAAS,EAAE,uBAAuB,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,IAAA,8BAAS,EAAC,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QACrE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,UAAU,GAAG,kBAAkB,CAAC;IACpC,IAAI,OAAO,GAAG,SAAS,CAAC;IACxB,IAAI,YAA+C,CAAC;IACpD,IAAI,YAAgC,CAAC;IACrC,IAAI,aAAa,GAAa,EAAE,CAAC;IAEjC,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,aAAa,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzE,aAAa,GAAG,aAAa,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAExE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,UAAU,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAChD,UAAU,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5B,CAAC;aAAM,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,YAAY,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACzD,OAAO,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QACzB,CAAC;aAAM,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACrD,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;YACvB,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,SAAS;gBAAE,YAAY,GAAG,CAAC,CAAC;QAC3D,CAAC;aAAM,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,iBAAiB,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC9D,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC1C,IAAI,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;gBACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;gBAC9E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;aAAM,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC1D,SAAS,EAAE,CAAC;YACZ,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sFAAsF,CAAC,CAAC;QAC7G,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,IAAA,sBAAU,EAAC,UAAU,CAAC,CAAC;IACtC,IAAI,YAAY;QAAE,MAAM,CAAC,IAAI,GAAG,YAAY,CAAC;IAC7C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,MAAM,CAAC,KAAK,CAAC,MAAM,oBAAoB,MAAM,CAAC,cAAc,WAAW,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC;IACpI,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAElF,IAAA,qBAAU,EAAC,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,SAAS;IAChB,MAAM,IAAI,GAAG;;;;;;;;;;;;;;;;;;CAkBd,CAAC,IAAI,EAAE,CAAC;IACP,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACpB,CAAC;AAED,IAAI,EAAE,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../src/cli.ts"],"names":[],"mappings":";;AAOA,oBAmFC;AA1FD,2CAAyC;AACzC,yCAAwC;AACxC,mDAA4C;AAC5C,2CAAqE;AACrE,yCAAiC;AACjC,2DAA+C;AAE/C,SAAgB,IAAI;IAClB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAEnC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QACvB,2DAA2D;QAC3D,MAAM,UAAU,GAAG,IAAA,gBAAI,EAAC,SAAS,EAAE,uBAAuB,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,IAAA,8BAAS,EAAC,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QACrE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QACzB,OAAO,CAAC,IAAI,CAAC,IAAA,yBAAS,EAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzC,CAAC;IAED,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,YAAY,EAAE,CAAC;QAC7B,wFAAwF;QACxF,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,mBAAmB,CAAC;QAC3C,IAAA,2BAAe,EAAC,GAAG,CAAC,CAAC;QACrB,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAA,wBAAY,GAAE,OAAO,GAAG,0BAA0B,IAAA,mBAAO,GAAE,GAAG,CAAC,CAAC;QAChG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,UAAU,GAAG,kBAAkB,CAAC;IACpC,IAAI,OAAO,GAAG,SAAS,CAAC;IACxB,IAAI,YAA+C,CAAC;IACpD,IAAI,YAAgC,CAAC;IACrC,IAAI,QAA4B,CAAC;IAEjC,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,aAAa,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzE,MAAM,aAAa,GAAG,aAAa,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAE9E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,UAAU,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAChD,UAAU,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5B,CAAC;aAAM,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,YAAY,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACzD,OAAO,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QACzB,CAAC;aAAM,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,YAAY,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACzD,QAAQ,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1B,CAAC;aAAM,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACrD,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;YACvB,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;gBACvC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAC;gBAC/E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,YAAY,GAAG,CAAC,CAAC;QACnB,CAAC;aAAM,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,iBAAiB,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC9D,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC1C,IAAI,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;gBACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;gBAC9E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;aAAM,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC1D,SAAS,EAAE,CAAC;YACZ,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sFAAsF,CAAC,CAAC;QAC7G,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,IAAA,sBAAU,EAAC,UAAU,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC;QAC5D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,YAAY;QAAE,MAAM,CAAC,IAAI,GAAG,YAAY,CAAC;IAC7C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,MAAM,CAAC,KAAK,CAAC,MAAM,oBAAoB,MAAM,CAAC,cAAc,WAAW,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC;IACpI,IAAI,MAAM,CAAC,cAAc,KAAK,OAAO,EAAE,CAAC;QACtC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wJAAwJ,CAAC,CAAC;IACjL,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAE3E,IAAI,CAAC;QACH,IAAA,qBAAU,EAAC,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC,CAAC;IACzE,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC;QAC5D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,SAAS,SAAS;IAChB,MAAM,IAAI,GAAG;;;;;;;;;;;;;;;;;;;;;CAqBd,CAAC,IAAI,EAAE,CAAC;IACP,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACpB,CAAC;AAED,IAAI,EAAE,CAAC"}

package/dist/src/config.d.ts

@@ -1,13 +1,33 @@
 export type Action = 'allow' | 'block' | 'require_approval';
+export type Reversibility = 'reversible' | 'irreversible';
 export interface Rule {
     id: string;
-    tool: string;
+    /** JSON-RPC method this rule governs. Defaults to `tools/call`. */
+    method?: string;
+    /** Tool name; required for `tools/call` rules, forbidden for other methods. */
+    tool?: string;
     action: Action;
+    reversibility?: Reversibility;
+    countdown_seconds?: number;
+    cap_usd?: number;
+    amount_arg?: string;
+    verify_threshold?: number;
 }
 export type Mode = 'enforce' | 'observe';
 export interface Config {
     default_action: Action;
     mode: Mode;
     rules: Rule[];
+    /** Held requests expire after this many seconds. */
+    approval_ttl_seconds: number;
+    /** Signed receipts expire this many seconds after issue. */
+    receipt_ttl_seconds: number;
+    /** sha256 of the policy source, bound into every receipt. */
+    policy_sha256: string;
 }
+export declare const DEFAULT_APPROVAL_TTL_SECONDS = 900;
+export declare const DEFAULT_RECEIPT_TTL_SECONDS = 900;
+export declare const TOOLS_CALL = "tools/call";
 export declare function loadConfig(configPath: string): Config;
+/** Parse and strictly validate a policy. Anything unrecognized is an error, never ignored. */
+export declare function parseConfig(raw: string): Config;