protect-mcp 0.5.4 → 0.6.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +142 -7
- package/dist/{ed25519-V7HDL2WC.mjs → chunk-LYKNULYU.mjs} +166 -10
- package/dist/{chunk-FAELTNS7.mjs → chunk-SPHLVRJ2.mjs} +27 -22
- package/dist/cli.js +34 -23
- package/dist/cli.mjs +10 -4
- package/dist/ed25519-DZMMNNVE.mjs +38 -0
- package/dist/hook-server.js +27 -22
- package/dist/hook-server.mjs +1 -1
- package/dist/index.d.mts +149 -1
- package/dist/index.d.ts +149 -1
- package/dist/index.js +2776 -412
- package/dist/index.mjs +241 -8
- package/package.json +3 -3
package/dist/hook-server.js
CHANGED
|
@@ -1097,48 +1097,53 @@ async function startHookServer(options = {}) {
|
|
|
1097
1097
|
}));
|
|
1098
1098
|
});
|
|
1099
1099
|
server.listen(port, "127.0.0.1", () => {
|
|
1100
|
-
process.stderr.write(
|
|
1100
|
+
const w = (s) => process.stderr.write(s);
|
|
1101
|
+
const pad = (s, n = 46) => s.padEnd(n);
|
|
1102
|
+
w(`
|
|
1101
1103
|
`);
|
|
1102
|
-
|
|
1104
|
+
w(` protect-mcp v0.5.4
|
|
1103
1105
|
`);
|
|
1104
|
-
|
|
1106
|
+
w(` ScopeBlind \u2014 https://scopeblind.com
|
|
1105
1107
|
`);
|
|
1106
|
-
|
|
1108
|
+
w(`
|
|
1107
1109
|
`);
|
|
1108
|
-
|
|
1110
|
+
w(` Listening http://127.0.0.1:${port}
|
|
1109
1111
|
`);
|
|
1110
|
-
|
|
1112
|
+
w(` Mode ${enforce ? "enforce" : "shadow"}
|
|
1111
1113
|
`);
|
|
1112
|
-
|
|
1114
|
+
w(` Policy ${cedarPolicies ? `Cedar (${cedarPolicies.fileCount} files)` : jsonPolicy ? "JSON" : "none"}
|
|
1113
1115
|
`);
|
|
1114
|
-
|
|
1116
|
+
w(` Signing ${isSigningEnabled() ? "Ed25519" : "disabled"}
|
|
1115
1117
|
`);
|
|
1116
|
-
|
|
1118
|
+
if (state.swarmContext.team_name) {
|
|
1119
|
+
w(` Swarm ${state.swarmContext.team_name} (${state.swarmContext.agent_type})
|
|
1117
1120
|
`);
|
|
1118
|
-
|
|
1121
|
+
}
|
|
1122
|
+
w(`
|
|
1119
1123
|
`);
|
|
1120
|
-
|
|
1124
|
+
w(` POST /hook Hook receiver
|
|
1121
1125
|
`);
|
|
1122
|
-
|
|
1126
|
+
w(` GET /health Health + signer info
|
|
1123
1127
|
`);
|
|
1124
|
-
|
|
1128
|
+
w(` GET /receipts Signed receipts
|
|
1125
1129
|
`);
|
|
1126
|
-
|
|
1130
|
+
w(` GET /suggestions Cedar policy suggestions
|
|
1127
1131
|
`);
|
|
1128
|
-
|
|
1132
|
+
w(`
|
|
1129
1133
|
`);
|
|
1130
|
-
|
|
1134
|
+
w(` deny is authoritative \u2014 cannot be overridden.
|
|
1131
1135
|
`);
|
|
1132
|
-
|
|
1136
|
+
w(`
|
|
1133
1137
|
`);
|
|
1134
|
-
process.
|
|
1138
|
+
const hasSlug = process.env.SCOPEBLIND_SLUG || (0, import_node_fs5.existsSync)((0, import_node_path3.join)(process.cwd(), ".scopeblind"));
|
|
1139
|
+
if (!hasSlug) {
|
|
1140
|
+
w(` Dashboard npx protect-mcp connect
|
|
1135
1141
|
`);
|
|
1136
|
-
|
|
1142
|
+
w(` Free up to 20,000 receipts/month
|
|
1137
1143
|
`);
|
|
1138
|
-
|
|
1139
|
-
`);
|
|
1140
|
-
process.stderr.write(`
|
|
1144
|
+
w(`
|
|
1141
1145
|
`);
|
|
1146
|
+
}
|
|
1142
1147
|
});
|
|
1143
1148
|
const shutdown = () => {
|
|
1144
1149
|
process.stderr.write("\n[PROTECT_MCP] Shutting down hook server...\n");
|
package/dist/hook-server.mjs
CHANGED
package/dist/index.d.mts
CHANGED
|
@@ -95,6 +95,29 @@ interface SigningConfig {
|
|
|
95
95
|
issuer?: string;
|
|
96
96
|
/** Whether signing is enabled (default: true when key_path is set) */
|
|
97
97
|
enabled?: boolean;
|
|
98
|
+
/**
|
|
99
|
+
* Commitment-mode signing.
|
|
100
|
+
*
|
|
101
|
+
* When enabled, listed fields are committed via SHA-256(salt || JCS({name, salt, value}))
|
|
102
|
+
* and the receipt payload carries a single committed_fields_root (Merkle root) instead
|
|
103
|
+
* of the cleartext field values. Per draft-farley-acta-signed-receipts-01 §commitment-mode.
|
|
104
|
+
*
|
|
105
|
+
* The receipt issuer keeps the openings (value + salt per field) for later selective
|
|
106
|
+
* disclosure. A receipt holder can prove a field's value to an auditor without
|
|
107
|
+
* revealing other committed fields.
|
|
108
|
+
*
|
|
109
|
+
* @since 0.6.0
|
|
110
|
+
*/
|
|
111
|
+
commitment_mode?: {
|
|
112
|
+
/** Whether commitment-mode signing is active. Default: false. */
|
|
113
|
+
enabled?: boolean;
|
|
114
|
+
/**
|
|
115
|
+
* Names of payload fields to commit.
|
|
116
|
+
* Recommended defaults: tool, scope, payload_digest, swarm.
|
|
117
|
+
* Other fields remain cleartext.
|
|
118
|
+
*/
|
|
119
|
+
committed_field_names?: string[];
|
|
120
|
+
};
|
|
98
121
|
}
|
|
99
122
|
interface RateLimit {
|
|
100
123
|
count: number;
|
|
@@ -825,6 +848,131 @@ declare function getSignerInfo(): {
|
|
|
825
848
|
*/
|
|
826
849
|
declare function isSigningEnabled(): boolean;
|
|
827
850
|
|
|
851
|
+
/**
|
|
852
|
+
* A Merkle inclusion proof for a single leaf.
|
|
853
|
+
*
|
|
854
|
+
* The siblings array lists the sibling hashes encountered while walking
|
|
855
|
+
* from the leaf up to the root. Each sibling is hex-encoded SHA-256.
|
|
856
|
+
* The (index, treeSize) pair determines whether the current node is
|
|
857
|
+
* left or right at each level during verification.
|
|
858
|
+
*/
|
|
859
|
+
interface MerkleProof {
|
|
860
|
+
/** Zero-based index of the leaf in the canonically-sorted leaf list. */
|
|
861
|
+
index: number;
|
|
862
|
+
/** Total number of leaves in the tree. */
|
|
863
|
+
treeSize: number;
|
|
864
|
+
/** Sibling hashes from leaf upward, hex-encoded SHA-256 (lowercase). */
|
|
865
|
+
siblings: string[];
|
|
866
|
+
}
|
|
867
|
+
|
|
868
|
+
/**
|
|
869
|
+
* @scopeblind/protect-mcp: Commitment-Mode Signing
|
|
870
|
+
*
|
|
871
|
+
* Produces commitment-mode signed receipts per draft-farley-acta-signed-receipts-01
|
|
872
|
+
* §commitment-mode. Each listed field is independently committed via
|
|
873
|
+
* SHA-256(0x00 || JCS({name, salt, value})), arranged into an RFC 6962-style
|
|
874
|
+
* Merkle tree with explicit one-byte domain separation, and the receipt payload
|
|
875
|
+
* carries a single committed_fields_root field instead of the cleartext values.
|
|
876
|
+
*
|
|
877
|
+
* The receipt holder retains openings (value + salt per field) and can selectively
|
|
878
|
+
* disclose any subset to auditors via Merkle inclusion proofs verifiable by
|
|
879
|
+
* @veritasacta/verify@>=0.6.0.
|
|
880
|
+
*
|
|
881
|
+
* This module sits alongside signing.ts (the legacy @veritasacta/artifacts-based
|
|
882
|
+
* cleartext path) and is invoked when SigningConfig.commitment_mode.enabled is
|
|
883
|
+
* true. The two paths are mutually exclusive on a per-receipt basis.
|
|
884
|
+
*
|
|
885
|
+
* @since 0.6.0
|
|
886
|
+
* @standard draft-farley-acta-signed-receipts-01 §commitment-mode
|
|
887
|
+
* @standard RFC 6962 (Certificate Transparency Merkle tree construction)
|
|
888
|
+
* @standard RFC 8032 (Ed25519)
|
|
889
|
+
* @standard RFC 8785 (JCS)
|
|
890
|
+
*/
|
|
891
|
+
|
|
892
|
+
/**
|
|
893
|
+
* The opening information for a single committed field. Held by the
|
|
894
|
+
* receipt issuer; never embedded in the published receipt. Required to
|
|
895
|
+
* later produce a selective-disclosure proof.
|
|
896
|
+
*/
|
|
897
|
+
interface CommittedFieldOpening {
|
|
898
|
+
/** Field name (matches one of committed_field_names). */
|
|
899
|
+
name: string;
|
|
900
|
+
/** Cleartext value of the field. */
|
|
901
|
+
value: unknown;
|
|
902
|
+
/** Salt bytes (32 random bytes per field per receipt). */
|
|
903
|
+
salt: Uint8Array;
|
|
904
|
+
/** Zero-based index of the field in the canonically-sorted leaf list. */
|
|
905
|
+
index: number;
|
|
906
|
+
}
|
|
907
|
+
/**
|
|
908
|
+
* The result of signing a decision in commitment mode.
|
|
909
|
+
*/
|
|
910
|
+
interface CommittedSignResult {
|
|
911
|
+
/** The signed receipt as a JSON string (canonical wire form). */
|
|
912
|
+
signed: string;
|
|
913
|
+
/** Receipt artifact type, e.g. "decision_receipt_committed_v1". */
|
|
914
|
+
artifact_type: string;
|
|
915
|
+
/**
|
|
916
|
+
* Per-field openings, indexed by field name. The issuer MUST persist
|
|
917
|
+
* these securely if it intends to support selective disclosure later.
|
|
918
|
+
* Storing them is the issuer's responsibility; this library does not
|
|
919
|
+
* write them to disk.
|
|
920
|
+
*/
|
|
921
|
+
openings: Record<string, CommittedFieldOpening>;
|
|
922
|
+
/** Lowercase hex SHA-256 of the canonical signed receipt. */
|
|
923
|
+
receipt_hash: string;
|
|
924
|
+
}
|
|
925
|
+
/**
|
|
926
|
+
* A minimal selective-disclosure envelope. Reveal a single committed field
|
|
927
|
+
* to an auditor by supplying its (name, value, salt, proof). The auditor
|
|
928
|
+
* recomputes the leaf hash and walks the proof to confirm it reconstructs
|
|
929
|
+
* the receipt's committed_fields_root.
|
|
930
|
+
*
|
|
931
|
+
* Compatible with @veritasacta/verify@>=0.6.0.
|
|
932
|
+
*/
|
|
933
|
+
interface MinimalDisclosure {
|
|
934
|
+
/** The receipt this disclosure targets, by canonical hash. */
|
|
935
|
+
parent_receipt_hash: string;
|
|
936
|
+
/** Disclosed field name. */
|
|
937
|
+
name: string;
|
|
938
|
+
/** Cleartext value of the disclosed field. */
|
|
939
|
+
value: unknown;
|
|
940
|
+
/** Salt as base64url (no padding). */
|
|
941
|
+
salt: string;
|
|
942
|
+
/** Merkle inclusion proof. */
|
|
943
|
+
proof: MerkleProof;
|
|
944
|
+
}
|
|
945
|
+
/**
|
|
946
|
+
* Sign a DecisionLog in commitment mode.
|
|
947
|
+
*
|
|
948
|
+
* @param entry - The decision log entry to sign.
|
|
949
|
+
* @param committedFieldNames - Names of fields to commit. Recommended:
|
|
950
|
+
* ["tool", "scope", "payload_digest", "swarm"]. Fields not listed
|
|
951
|
+
* remain cleartext in the signed payload.
|
|
952
|
+
* @param signingKey - Ed25519 private key (32 bytes hex or raw).
|
|
953
|
+
* @param publicKey - Ed25519 public key (32 bytes hex).
|
|
954
|
+
* @param kid - Key identifier (RFC 7638 JWK thumbprint or operator-chosen).
|
|
955
|
+
* @param issuer - Issuer identifier (e.g. "my-gateway.example.com").
|
|
956
|
+
*
|
|
957
|
+
* @returns Signed receipt JSON, openings (per field), and receipt hash.
|
|
958
|
+
*
|
|
959
|
+
* @standard draft-farley-acta-signed-receipts-01 §signature-scope
|
|
960
|
+
* The signature covers SHA-256(JCS(payload_minus_signature)).
|
|
961
|
+
*/
|
|
962
|
+
declare function signCommittedDecision(entry: DecisionLog, committedFieldNames: string[], signingKey: string, publicKey: string, kid: string, issuer: string): CommittedSignResult;
|
|
963
|
+
/**
|
|
964
|
+
* Build a minimal selective-disclosure envelope for a single committed
|
|
965
|
+
* field. The envelope can be verified offline by anyone who has the
|
|
966
|
+
* receipt's committed_fields_root (which the receipt itself carries).
|
|
967
|
+
*
|
|
968
|
+
* @param receiptHash - Canonical hash of the receipt the disclosure targets.
|
|
969
|
+
* @param fieldName - Which field to disclose.
|
|
970
|
+
* @param openings - The full openings map produced by signCommittedDecision.
|
|
971
|
+
*
|
|
972
|
+
* @standard draft-farley-acta-signed-receipts-01 §commitment-disclosure
|
|
973
|
+
*/
|
|
974
|
+
declare function discloseField(receiptHash: string, fieldName: string, openings: Record<string, CommittedFieldOpening>): MinimalDisclosure;
|
|
975
|
+
|
|
828
976
|
/**
|
|
829
977
|
* @scopeblind/protect-mcp — External PDP Adapter
|
|
830
978
|
*
|
|
@@ -2763,4 +2911,4 @@ declare function confidentialInference(_prompt: string, _config: ConfidentialInf
|
|
|
2763
2911
|
receipt: Record<string, unknown>;
|
|
2764
2912
|
}>;
|
|
2765
2913
|
|
|
2766
|
-
export { type ActionReceipt, type AdmissionResult, type AgentId, type AgentManifest, type ApprovalAssertion, type ApprovalChallenge, type ApprovalNotification, type ApprovalResult, type ArenaPayload, type ArenaReceipt, type AttestationDocument, type AttestationPayload, type AttestationProvider, type AttestationReceipt, type AttestationResult, type AuditBundle, type AuditBundleOptions, type BenchmarkPayload, type BenchmarkReceipt, type BuilderId, type C2PAAssertion, type C2PAIngredient, type C2PAManifest, type C2PAOptions, type CCRConnectorConfig, type CCRSessionContext, type CalibrationScore, type CedarEvalRequest, type CedarPolicySet, type CedarSchema, type CedarSchemaResult, type ComplianceReport, ConfidentialGate, type ConfidentialGateConfig, type ConfidentialInferenceConfig, type CredentialConfig, type DecisionContext, type DecisionLog, type DelegationReceipt, type DisclosureMode, type Ed25519PublicKey, type EvidenceAttestation, type EvidenceAttestationInput, type EvidenceIssuer, type EvidenceReceipt, type EvidenceReceiptBase, type EvidenceSummary, type EvidenceSummaryEntry, type EvidenceType, type ExternalDecision, type ExternalPDPConfig, type HFDatasetMetadata, type HFReceiptRow, type HookEventName, type HookInput, type HookResponse, type IssuerType, type JsonRpcRequest, type JsonRpcResponse, type LeaseCompatibility, type ManifestBuilder, type ManifestCapabilities, type ManifestConfig, type ManifestIdentity, type ManifestPresentation, type ManifestSignature, type ManifestStatus, type McpToolDescription, type NotificationConfig, type PassportTokenClaims, type PayloadDigest, type PlanReceipt, type PolicyEngineMode, type PredictionReceipt, type PredictionResolution, type PropagatorConfig, type ProtectConfig, ProtectGateway, type ProtectPolicy, type RateLimit, ReceiptPropagator, type RedactedResult, type RedactionSalt, type RekorAnchor, type RekorVerification, type RestraintPayload, type RestraintReceipt, type SHA256Hash, type SafetyTranscript, type Sandbox, type SandboxConfig, type SandboxReceipt, type SandboxResult, type SandboxToolCall, type SchemaGeneratorConfig, type SigningConfig, type SimulationResult, type SimulationSummary, type SwarmContext, type TierOverrides, type TimingMetrics, type ToolPolicy, type TrustTier, type WorkPayload, type WorkReceipt, anchorToRekor, buildDecisionContext, checkRateLimit, collectSignedReceipts, computeCalibration, confidentialInference, createApprovalChallenge, createApprovalReceiptPayload, createAttestationField, createAuditBundle, createC2PAManifest, createDisclosurePackage, createEvidenceAttestation, createLogAnchorField, createReceiptChannel, createSandbox, destroySandbox, ed25519ToDIDKey, evaluateCedar, evaluateTier, exportC2PAManifestJSON, exportJSONL, formatReportMarkdown, formatSimulation, generateC2PACommand, generateCedarSchema, generateDatasetCard, generateHFMetadata, generateReport, generateSafetyTranscript, generateSchemaStub, getSignerInfo, getToolPolicy, hashReceipt, hashResponseBody, initSigning, isAgentId, isCedarAvailable, isDisclosureMode, isEvidenceType, isManifestStatus, isSigningEnabled, listCredentialLabels, loadCedarPolicies, loadPolicy, manifestToVC, meetsMinTier, parseLogFile, parseNotificationConfigFromEnv, parseRateLimit, queryExternalPDP, receiptToVP, receiptsToHFRows, redactFields, resolveCredential, revealField, runInSandbox, sendApprovalNotification, signDecision, simulate, toCredentialRequestOptions, toManifoldFormat, toMetaculusFormat, validateCredentials, validateEvidenceReceipt, validateManifest, verifyActaC2PAAssertions, verifyAllCommitments, verifyApprovalAssertion, verifyCommitment, verifyEvidenceAttestation, verifyRekorAnchor };
|
|
2914
|
+
export { type ActionReceipt, type AdmissionResult, type AgentId, type AgentManifest, type ApprovalAssertion, type ApprovalChallenge, type ApprovalNotification, type ApprovalResult, type ArenaPayload, type ArenaReceipt, type AttestationDocument, type AttestationPayload, type AttestationProvider, type AttestationReceipt, type AttestationResult, type AuditBundle, type AuditBundleOptions, type BenchmarkPayload, type BenchmarkReceipt, type BuilderId, type C2PAAssertion, type C2PAIngredient, type C2PAManifest, type C2PAOptions, type CCRConnectorConfig, type CCRSessionContext, type CalibrationScore, type CedarEvalRequest, type CedarPolicySet, type CedarSchema, type CedarSchemaResult, type CommittedFieldOpening, type CommittedSignResult, type ComplianceReport, ConfidentialGate, type ConfidentialGateConfig, type ConfidentialInferenceConfig, type CredentialConfig, type DecisionContext, type DecisionLog, type DelegationReceipt, type DisclosureMode, type Ed25519PublicKey, type EvidenceAttestation, type EvidenceAttestationInput, type EvidenceIssuer, type EvidenceReceipt, type EvidenceReceiptBase, type EvidenceSummary, type EvidenceSummaryEntry, type EvidenceType, type ExternalDecision, type ExternalPDPConfig, type HFDatasetMetadata, type HFReceiptRow, type HookEventName, type HookInput, type HookResponse, type IssuerType, type JsonRpcRequest, type JsonRpcResponse, type LeaseCompatibility, type ManifestBuilder, type ManifestCapabilities, type ManifestConfig, type ManifestIdentity, type ManifestPresentation, type ManifestSignature, type ManifestStatus, type McpToolDescription, type MinimalDisclosure, type NotificationConfig, type PassportTokenClaims, type PayloadDigest, type PlanReceipt, type PolicyEngineMode, type PredictionReceipt, type PredictionResolution, type PropagatorConfig, type ProtectConfig, ProtectGateway, type ProtectPolicy, type RateLimit, ReceiptPropagator, type RedactedResult, type RedactionSalt, type RekorAnchor, type RekorVerification, type RestraintPayload, type RestraintReceipt, type SHA256Hash, type SafetyTranscript, type Sandbox, type SandboxConfig, type SandboxReceipt, type SandboxResult, type SandboxToolCall, type SchemaGeneratorConfig, type SigningConfig, type SimulationResult, type SimulationSummary, type SwarmContext, type TierOverrides, type TimingMetrics, type ToolPolicy, type TrustTier, type WorkPayload, type WorkReceipt, anchorToRekor, buildDecisionContext, checkRateLimit, collectSignedReceipts, computeCalibration, confidentialInference, createApprovalChallenge, createApprovalReceiptPayload, createAttestationField, createAuditBundle, createC2PAManifest, createDisclosurePackage, createEvidenceAttestation, createLogAnchorField, createReceiptChannel, createSandbox, destroySandbox, discloseField, ed25519ToDIDKey, evaluateCedar, evaluateTier, exportC2PAManifestJSON, exportJSONL, formatReportMarkdown, formatSimulation, generateC2PACommand, generateCedarSchema, generateDatasetCard, generateHFMetadata, generateReport, generateSafetyTranscript, generateSchemaStub, getSignerInfo, getToolPolicy, hashReceipt, hashResponseBody, initSigning, isAgentId, isCedarAvailable, isDisclosureMode, isEvidenceType, isManifestStatus, isSigningEnabled, listCredentialLabels, loadCedarPolicies, loadPolicy, manifestToVC, meetsMinTier, parseLogFile, parseNotificationConfigFromEnv, parseRateLimit, queryExternalPDP, receiptToVP, receiptsToHFRows, redactFields, resolveCredential, revealField, runInSandbox, sendApprovalNotification, signCommittedDecision, signDecision, simulate, toCredentialRequestOptions, toManifoldFormat, toMetaculusFormat, validateCredentials, validateEvidenceReceipt, validateManifest, verifyActaC2PAAssertions, verifyAllCommitments, verifyApprovalAssertion, verifyCommitment, verifyEvidenceAttestation, verifyRekorAnchor };
|
package/dist/index.d.ts
CHANGED
|
@@ -95,6 +95,29 @@ interface SigningConfig {
|
|
|
95
95
|
issuer?: string;
|
|
96
96
|
/** Whether signing is enabled (default: true when key_path is set) */
|
|
97
97
|
enabled?: boolean;
|
|
98
|
+
/**
|
|
99
|
+
* Commitment-mode signing.
|
|
100
|
+
*
|
|
101
|
+
* When enabled, listed fields are committed via SHA-256(salt || JCS({name, salt, value}))
|
|
102
|
+
* and the receipt payload carries a single committed_fields_root (Merkle root) instead
|
|
103
|
+
* of the cleartext field values. Per draft-farley-acta-signed-receipts-01 §commitment-mode.
|
|
104
|
+
*
|
|
105
|
+
* The receipt issuer keeps the openings (value + salt per field) for later selective
|
|
106
|
+
* disclosure. A receipt holder can prove a field's value to an auditor without
|
|
107
|
+
* revealing other committed fields.
|
|
108
|
+
*
|
|
109
|
+
* @since 0.6.0
|
|
110
|
+
*/
|
|
111
|
+
commitment_mode?: {
|
|
112
|
+
/** Whether commitment-mode signing is active. Default: false. */
|
|
113
|
+
enabled?: boolean;
|
|
114
|
+
/**
|
|
115
|
+
* Names of payload fields to commit.
|
|
116
|
+
* Recommended defaults: tool, scope, payload_digest, swarm.
|
|
117
|
+
* Other fields remain cleartext.
|
|
118
|
+
*/
|
|
119
|
+
committed_field_names?: string[];
|
|
120
|
+
};
|
|
98
121
|
}
|
|
99
122
|
interface RateLimit {
|
|
100
123
|
count: number;
|
|
@@ -825,6 +848,131 @@ declare function getSignerInfo(): {
|
|
|
825
848
|
*/
|
|
826
849
|
declare function isSigningEnabled(): boolean;
|
|
827
850
|
|
|
851
|
+
/**
|
|
852
|
+
* A Merkle inclusion proof for a single leaf.
|
|
853
|
+
*
|
|
854
|
+
* The siblings array lists the sibling hashes encountered while walking
|
|
855
|
+
* from the leaf up to the root. Each sibling is hex-encoded SHA-256.
|
|
856
|
+
* The (index, treeSize) pair determines whether the current node is
|
|
857
|
+
* left or right at each level during verification.
|
|
858
|
+
*/
|
|
859
|
+
interface MerkleProof {
|
|
860
|
+
/** Zero-based index of the leaf in the canonically-sorted leaf list. */
|
|
861
|
+
index: number;
|
|
862
|
+
/** Total number of leaves in the tree. */
|
|
863
|
+
treeSize: number;
|
|
864
|
+
/** Sibling hashes from leaf upward, hex-encoded SHA-256 (lowercase). */
|
|
865
|
+
siblings: string[];
|
|
866
|
+
}
|
|
867
|
+
|
|
868
|
+
/**
|
|
869
|
+
* @scopeblind/protect-mcp: Commitment-Mode Signing
|
|
870
|
+
*
|
|
871
|
+
* Produces commitment-mode signed receipts per draft-farley-acta-signed-receipts-01
|
|
872
|
+
* §commitment-mode. Each listed field is independently committed via
|
|
873
|
+
* SHA-256(0x00 || JCS({name, salt, value})), arranged into an RFC 6962-style
|
|
874
|
+
* Merkle tree with explicit one-byte domain separation, and the receipt payload
|
|
875
|
+
* carries a single committed_fields_root field instead of the cleartext values.
|
|
876
|
+
*
|
|
877
|
+
* The receipt holder retains openings (value + salt per field) and can selectively
|
|
878
|
+
* disclose any subset to auditors via Merkle inclusion proofs verifiable by
|
|
879
|
+
* @veritasacta/verify@>=0.6.0.
|
|
880
|
+
*
|
|
881
|
+
* This module sits alongside signing.ts (the legacy @veritasacta/artifacts-based
|
|
882
|
+
* cleartext path) and is invoked when SigningConfig.commitment_mode.enabled is
|
|
883
|
+
* true. The two paths are mutually exclusive on a per-receipt basis.
|
|
884
|
+
*
|
|
885
|
+
* @since 0.6.0
|
|
886
|
+
* @standard draft-farley-acta-signed-receipts-01 §commitment-mode
|
|
887
|
+
* @standard RFC 6962 (Certificate Transparency Merkle tree construction)
|
|
888
|
+
* @standard RFC 8032 (Ed25519)
|
|
889
|
+
* @standard RFC 8785 (JCS)
|
|
890
|
+
*/
|
|
891
|
+
|
|
892
|
+
/**
|
|
893
|
+
* The opening information for a single committed field. Held by the
|
|
894
|
+
* receipt issuer; never embedded in the published receipt. Required to
|
|
895
|
+
* later produce a selective-disclosure proof.
|
|
896
|
+
*/
|
|
897
|
+
interface CommittedFieldOpening {
|
|
898
|
+
/** Field name (matches one of committed_field_names). */
|
|
899
|
+
name: string;
|
|
900
|
+
/** Cleartext value of the field. */
|
|
901
|
+
value: unknown;
|
|
902
|
+
/** Salt bytes (32 random bytes per field per receipt). */
|
|
903
|
+
salt: Uint8Array;
|
|
904
|
+
/** Zero-based index of the field in the canonically-sorted leaf list. */
|
|
905
|
+
index: number;
|
|
906
|
+
}
|
|
907
|
+
/**
|
|
908
|
+
* The result of signing a decision in commitment mode.
|
|
909
|
+
*/
|
|
910
|
+
interface CommittedSignResult {
|
|
911
|
+
/** The signed receipt as a JSON string (canonical wire form). */
|
|
912
|
+
signed: string;
|
|
913
|
+
/** Receipt artifact type, e.g. "decision_receipt_committed_v1". */
|
|
914
|
+
artifact_type: string;
|
|
915
|
+
/**
|
|
916
|
+
* Per-field openings, indexed by field name. The issuer MUST persist
|
|
917
|
+
* these securely if it intends to support selective disclosure later.
|
|
918
|
+
* Storing them is the issuer's responsibility; this library does not
|
|
919
|
+
* write them to disk.
|
|
920
|
+
*/
|
|
921
|
+
openings: Record<string, CommittedFieldOpening>;
|
|
922
|
+
/** Lowercase hex SHA-256 of the canonical signed receipt. */
|
|
923
|
+
receipt_hash: string;
|
|
924
|
+
}
|
|
925
|
+
/**
|
|
926
|
+
* A minimal selective-disclosure envelope. Reveal a single committed field
|
|
927
|
+
* to an auditor by supplying its (name, value, salt, proof). The auditor
|
|
928
|
+
* recomputes the leaf hash and walks the proof to confirm it reconstructs
|
|
929
|
+
* the receipt's committed_fields_root.
|
|
930
|
+
*
|
|
931
|
+
* Compatible with @veritasacta/verify@>=0.6.0.
|
|
932
|
+
*/
|
|
933
|
+
interface MinimalDisclosure {
|
|
934
|
+
/** The receipt this disclosure targets, by canonical hash. */
|
|
935
|
+
parent_receipt_hash: string;
|
|
936
|
+
/** Disclosed field name. */
|
|
937
|
+
name: string;
|
|
938
|
+
/** Cleartext value of the disclosed field. */
|
|
939
|
+
value: unknown;
|
|
940
|
+
/** Salt as base64url (no padding). */
|
|
941
|
+
salt: string;
|
|
942
|
+
/** Merkle inclusion proof. */
|
|
943
|
+
proof: MerkleProof;
|
|
944
|
+
}
|
|
945
|
+
/**
|
|
946
|
+
* Sign a DecisionLog in commitment mode.
|
|
947
|
+
*
|
|
948
|
+
* @param entry - The decision log entry to sign.
|
|
949
|
+
* @param committedFieldNames - Names of fields to commit. Recommended:
|
|
950
|
+
* ["tool", "scope", "payload_digest", "swarm"]. Fields not listed
|
|
951
|
+
* remain cleartext in the signed payload.
|
|
952
|
+
* @param signingKey - Ed25519 private key (32 bytes hex or raw).
|
|
953
|
+
* @param publicKey - Ed25519 public key (32 bytes hex).
|
|
954
|
+
* @param kid - Key identifier (RFC 7638 JWK thumbprint or operator-chosen).
|
|
955
|
+
* @param issuer - Issuer identifier (e.g. "my-gateway.example.com").
|
|
956
|
+
*
|
|
957
|
+
* @returns Signed receipt JSON, openings (per field), and receipt hash.
|
|
958
|
+
*
|
|
959
|
+
* @standard draft-farley-acta-signed-receipts-01 §signature-scope
|
|
960
|
+
* The signature covers SHA-256(JCS(payload_minus_signature)).
|
|
961
|
+
*/
|
|
962
|
+
declare function signCommittedDecision(entry: DecisionLog, committedFieldNames: string[], signingKey: string, publicKey: string, kid: string, issuer: string): CommittedSignResult;
|
|
963
|
+
/**
|
|
964
|
+
* Build a minimal selective-disclosure envelope for a single committed
|
|
965
|
+
* field. The envelope can be verified offline by anyone who has the
|
|
966
|
+
* receipt's committed_fields_root (which the receipt itself carries).
|
|
967
|
+
*
|
|
968
|
+
* @param receiptHash - Canonical hash of the receipt the disclosure targets.
|
|
969
|
+
* @param fieldName - Which field to disclose.
|
|
970
|
+
* @param openings - The full openings map produced by signCommittedDecision.
|
|
971
|
+
*
|
|
972
|
+
* @standard draft-farley-acta-signed-receipts-01 §commitment-disclosure
|
|
973
|
+
*/
|
|
974
|
+
declare function discloseField(receiptHash: string, fieldName: string, openings: Record<string, CommittedFieldOpening>): MinimalDisclosure;
|
|
975
|
+
|
|
828
976
|
/**
|
|
829
977
|
* @scopeblind/protect-mcp — External PDP Adapter
|
|
830
978
|
*
|
|
@@ -2763,4 +2911,4 @@ declare function confidentialInference(_prompt: string, _config: ConfidentialInf
|
|
|
2763
2911
|
receipt: Record<string, unknown>;
|
|
2764
2912
|
}>;
|
|
2765
2913
|
|
|
2766
|
-
export { type ActionReceipt, type AdmissionResult, type AgentId, type AgentManifest, type ApprovalAssertion, type ApprovalChallenge, type ApprovalNotification, type ApprovalResult, type ArenaPayload, type ArenaReceipt, type AttestationDocument, type AttestationPayload, type AttestationProvider, type AttestationReceipt, type AttestationResult, type AuditBundle, type AuditBundleOptions, type BenchmarkPayload, type BenchmarkReceipt, type BuilderId, type C2PAAssertion, type C2PAIngredient, type C2PAManifest, type C2PAOptions, type CCRConnectorConfig, type CCRSessionContext, type CalibrationScore, type CedarEvalRequest, type CedarPolicySet, type CedarSchema, type CedarSchemaResult, type ComplianceReport, ConfidentialGate, type ConfidentialGateConfig, type ConfidentialInferenceConfig, type CredentialConfig, type DecisionContext, type DecisionLog, type DelegationReceipt, type DisclosureMode, type Ed25519PublicKey, type EvidenceAttestation, type EvidenceAttestationInput, type EvidenceIssuer, type EvidenceReceipt, type EvidenceReceiptBase, type EvidenceSummary, type EvidenceSummaryEntry, type EvidenceType, type ExternalDecision, type ExternalPDPConfig, type HFDatasetMetadata, type HFReceiptRow, type HookEventName, type HookInput, type HookResponse, type IssuerType, type JsonRpcRequest, type JsonRpcResponse, type LeaseCompatibility, type ManifestBuilder, type ManifestCapabilities, type ManifestConfig, type ManifestIdentity, type ManifestPresentation, type ManifestSignature, type ManifestStatus, type McpToolDescription, type NotificationConfig, type PassportTokenClaims, type PayloadDigest, type PlanReceipt, type PolicyEngineMode, type PredictionReceipt, type PredictionResolution, type PropagatorConfig, type ProtectConfig, ProtectGateway, type ProtectPolicy, type RateLimit, ReceiptPropagator, type RedactedResult, type RedactionSalt, type RekorAnchor, type RekorVerification, type RestraintPayload, type RestraintReceipt, type SHA256Hash, type SafetyTranscript, type Sandbox, type SandboxConfig, type SandboxReceipt, type SandboxResult, type SandboxToolCall, type SchemaGeneratorConfig, type SigningConfig, type SimulationResult, type SimulationSummary, type SwarmContext, type TierOverrides, type TimingMetrics, type ToolPolicy, type TrustTier, type WorkPayload, type WorkReceipt, anchorToRekor, buildDecisionContext, checkRateLimit, collectSignedReceipts, computeCalibration, confidentialInference, createApprovalChallenge, createApprovalReceiptPayload, createAttestationField, createAuditBundle, createC2PAManifest, createDisclosurePackage, createEvidenceAttestation, createLogAnchorField, createReceiptChannel, createSandbox, destroySandbox, ed25519ToDIDKey, evaluateCedar, evaluateTier, exportC2PAManifestJSON, exportJSONL, formatReportMarkdown, formatSimulation, generateC2PACommand, generateCedarSchema, generateDatasetCard, generateHFMetadata, generateReport, generateSafetyTranscript, generateSchemaStub, getSignerInfo, getToolPolicy, hashReceipt, hashResponseBody, initSigning, isAgentId, isCedarAvailable, isDisclosureMode, isEvidenceType, isManifestStatus, isSigningEnabled, listCredentialLabels, loadCedarPolicies, loadPolicy, manifestToVC, meetsMinTier, parseLogFile, parseNotificationConfigFromEnv, parseRateLimit, queryExternalPDP, receiptToVP, receiptsToHFRows, redactFields, resolveCredential, revealField, runInSandbox, sendApprovalNotification, signDecision, simulate, toCredentialRequestOptions, toManifoldFormat, toMetaculusFormat, validateCredentials, validateEvidenceReceipt, validateManifest, verifyActaC2PAAssertions, verifyAllCommitments, verifyApprovalAssertion, verifyCommitment, verifyEvidenceAttestation, verifyRekorAnchor };
|
|
2914
|
+
export { type ActionReceipt, type AdmissionResult, type AgentId, type AgentManifest, type ApprovalAssertion, type ApprovalChallenge, type ApprovalNotification, type ApprovalResult, type ArenaPayload, type ArenaReceipt, type AttestationDocument, type AttestationPayload, type AttestationProvider, type AttestationReceipt, type AttestationResult, type AuditBundle, type AuditBundleOptions, type BenchmarkPayload, type BenchmarkReceipt, type BuilderId, type C2PAAssertion, type C2PAIngredient, type C2PAManifest, type C2PAOptions, type CCRConnectorConfig, type CCRSessionContext, type CalibrationScore, type CedarEvalRequest, type CedarPolicySet, type CedarSchema, type CedarSchemaResult, type CommittedFieldOpening, type CommittedSignResult, type ComplianceReport, ConfidentialGate, type ConfidentialGateConfig, type ConfidentialInferenceConfig, type CredentialConfig, type DecisionContext, type DecisionLog, type DelegationReceipt, type DisclosureMode, type Ed25519PublicKey, type EvidenceAttestation, type EvidenceAttestationInput, type EvidenceIssuer, type EvidenceReceipt, type EvidenceReceiptBase, type EvidenceSummary, type EvidenceSummaryEntry, type EvidenceType, type ExternalDecision, type ExternalPDPConfig, type HFDatasetMetadata, type HFReceiptRow, type HookEventName, type HookInput, type HookResponse, type IssuerType, type JsonRpcRequest, type JsonRpcResponse, type LeaseCompatibility, type ManifestBuilder, type ManifestCapabilities, type ManifestConfig, type ManifestIdentity, type ManifestPresentation, type ManifestSignature, type ManifestStatus, type McpToolDescription, type MinimalDisclosure, type NotificationConfig, type PassportTokenClaims, type PayloadDigest, type PlanReceipt, type PolicyEngineMode, type PredictionReceipt, type PredictionResolution, type PropagatorConfig, type ProtectConfig, ProtectGateway, type ProtectPolicy, type RateLimit, ReceiptPropagator, type RedactedResult, type RedactionSalt, type RekorAnchor, type RekorVerification, type RestraintPayload, type RestraintReceipt, type SHA256Hash, type SafetyTranscript, type Sandbox, type SandboxConfig, type SandboxReceipt, type SandboxResult, type SandboxToolCall, type SchemaGeneratorConfig, type SigningConfig, type SimulationResult, type SimulationSummary, type SwarmContext, type TierOverrides, type TimingMetrics, type ToolPolicy, type TrustTier, type WorkPayload, type WorkReceipt, anchorToRekor, buildDecisionContext, checkRateLimit, collectSignedReceipts, computeCalibration, confidentialInference, createApprovalChallenge, createApprovalReceiptPayload, createAttestationField, createAuditBundle, createC2PAManifest, createDisclosurePackage, createEvidenceAttestation, createLogAnchorField, createReceiptChannel, createSandbox, destroySandbox, discloseField, ed25519ToDIDKey, evaluateCedar, evaluateTier, exportC2PAManifestJSON, exportJSONL, formatReportMarkdown, formatSimulation, generateC2PACommand, generateCedarSchema, generateDatasetCard, generateHFMetadata, generateReport, generateSafetyTranscript, generateSchemaStub, getSignerInfo, getToolPolicy, hashReceipt, hashResponseBody, initSigning, isAgentId, isCedarAvailable, isDisclosureMode, isEvidenceType, isManifestStatus, isSigningEnabled, listCredentialLabels, loadCedarPolicies, loadPolicy, manifestToVC, meetsMinTier, parseLogFile, parseNotificationConfigFromEnv, parseRateLimit, queryExternalPDP, receiptToVP, receiptsToHFRows, redactFields, resolveCredential, revealField, runInSandbox, sendApprovalNotification, signCommittedDecision, signDecision, simulate, toCredentialRequestOptions, toManifoldFormat, toMetaculusFormat, validateCredentials, validateEvidenceReceipt, validateManifest, verifyActaC2PAAssertions, verifyAllCommitments, verifyApprovalAssertion, verifyCommitment, verifyEvidenceAttestation, verifyRekorAnchor };
|