protect-mcp 0.5.4 → 0.6.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -1097,48 +1097,53 @@ async function startHookServer(options = {}) {
1097
1097
  }));
1098
1098
  });
1099
1099
  server.listen(port, "127.0.0.1", () => {
1100
- process.stderr.write(`
1100
+ const w = (s) => process.stderr.write(s);
1101
+ const pad = (s, n = 46) => s.padEnd(n);
1102
+ w(`
1101
1103
  `);
1102
- process.stderr.write(`[PROTECT_MCP] \u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510
1104
+ w(` protect-mcp v0.5.4
1103
1105
  `);
1104
- process.stderr.write(`[PROTECT_MCP] \u2502 protect-mcp Hook Server v0.5.3 \u2502
1106
+ w(` ScopeBlind \u2014 https://scopeblind.com
1105
1107
  `);
1106
- process.stderr.write(`[PROTECT_MCP] \u251C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524
1108
+ w(`
1107
1109
  `);
1108
- process.stderr.write(`[PROTECT_MCP] \u2502 Listening: http://127.0.0.1:${String(port).padEnd(5)} \u2502
1110
+ w(` Listening http://127.0.0.1:${port}
1109
1111
  `);
1110
- process.stderr.write(`[PROTECT_MCP] \u2502 Mode: ${(enforce ? "enforce" : "shadow").padEnd(36)}\u2502
1112
+ w(` Mode ${enforce ? "enforce" : "shadow"}
1111
1113
  `);
1112
- process.stderr.write(`[PROTECT_MCP] \u2502 Policy: ${(cedarPolicies ? `Cedar (${cedarPolicies.fileCount} files)` : jsonPolicy ? "JSON" : "none").padEnd(36)}\u2502
1114
+ w(` Policy ${cedarPolicies ? `Cedar (${cedarPolicies.fileCount} files)` : jsonPolicy ? "JSON" : "none"}
1113
1115
  `);
1114
- process.stderr.write(`[PROTECT_MCP] \u2502 Signing: ${(isSigningEnabled() ? "Ed25519 \u2713" : "disabled").padEnd(36)}\u2502
1116
+ w(` Signing ${isSigningEnabled() ? "Ed25519" : "disabled"}
1115
1117
  `);
1116
- process.stderr.write(`[PROTECT_MCP] \u2502 Swarm: ${(state.swarmContext.team_name ? `${state.swarmContext.team_name} (${state.swarmContext.agent_type})` : "standalone").padEnd(36)}\u2502
1118
+ if (state.swarmContext.team_name) {
1119
+ w(` Swarm ${state.swarmContext.team_name} (${state.swarmContext.agent_type})
1117
1120
  `);
1118
- process.stderr.write(`[PROTECT_MCP] \u2502 Sandbox: ${detectSandboxState().padEnd(36)}\u2502
1121
+ }
1122
+ w(`
1119
1123
  `);
1120
- process.stderr.write(`[PROTECT_MCP] \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518
1124
+ w(` POST /hook Hook receiver
1121
1125
  `);
1122
- process.stderr.write(`
1126
+ w(` GET /health Health + signer info
1123
1127
  `);
1124
- process.stderr.write(`[PROTECT_MCP] Endpoints:
1128
+ w(` GET /receipts Signed receipts
1125
1129
  `);
1126
- process.stderr.write(` POST /hook \u2014 Claude Code hook receiver
1130
+ w(` GET /suggestions Cedar policy suggestions
1127
1131
  `);
1128
- process.stderr.write(` GET /health \u2014 Health check + signer info
1132
+ w(`
1129
1133
  `);
1130
- process.stderr.write(` GET /receipts \u2014 Recent signed receipts
1134
+ w(` deny is authoritative \u2014 cannot be overridden.
1131
1135
  `);
1132
- process.stderr.write(` GET /suggestions \u2014 Auto-generated Cedar policy suggestions
1136
+ w(`
1133
1137
  `);
1134
- process.stderr.write(` GET /alerts \u2014 Config tamper alerts
1138
+ const hasSlug = process.env.SCOPEBLIND_SLUG || (0, import_node_fs5.existsSync)((0, import_node_path3.join)(process.cwd(), ".scopeblind"));
1139
+ if (!hasSlug) {
1140
+ w(` Dashboard npx protect-mcp connect
1135
1141
  `);
1136
- process.stderr.write(`
1142
+ w(` Free up to 20,000 receipts/month
1137
1143
  `);
1138
- process.stderr.write(`[PROTECT_MCP] deny decisions are AUTHORITATIVE \u2014 they cannot be overridden.
1139
- `);
1140
- process.stderr.write(`
1144
+ w(`
1141
1145
  `);
1146
+ }
1142
1147
  });
1143
1148
  const shutdown = () => {
1144
1149
  process.stderr.write("\n[PROTECT_MCP] Shutting down hook server...\n");
@@ -1,6 +1,6 @@
1
1
  import {
2
2
  startHookServer
3
- } from "./chunk-FAELTNS7.mjs";
3
+ } from "./chunk-SPHLVRJ2.mjs";
4
4
  import "./chunk-YTBC72JJ.mjs";
5
5
  import "./chunk-PQJP2ZCI.mjs";
6
6
  export {
package/dist/index.d.mts CHANGED
@@ -95,6 +95,29 @@ interface SigningConfig {
95
95
  issuer?: string;
96
96
  /** Whether signing is enabled (default: true when key_path is set) */
97
97
  enabled?: boolean;
98
+ /**
99
+ * Commitment-mode signing.
100
+ *
101
+ * When enabled, listed fields are committed via SHA-256(salt || JCS({name, salt, value}))
102
+ * and the receipt payload carries a single committed_fields_root (Merkle root) instead
103
+ * of the cleartext field values. Per draft-farley-acta-signed-receipts-01 §commitment-mode.
104
+ *
105
+ * The receipt issuer keeps the openings (value + salt per field) for later selective
106
+ * disclosure. A receipt holder can prove a field's value to an auditor without
107
+ * revealing other committed fields.
108
+ *
109
+ * @since 0.6.0
110
+ */
111
+ commitment_mode?: {
112
+ /** Whether commitment-mode signing is active. Default: false. */
113
+ enabled?: boolean;
114
+ /**
115
+ * Names of payload fields to commit.
116
+ * Recommended defaults: tool, scope, payload_digest, swarm.
117
+ * Other fields remain cleartext.
118
+ */
119
+ committed_field_names?: string[];
120
+ };
98
121
  }
99
122
  interface RateLimit {
100
123
  count: number;
@@ -825,6 +848,131 @@ declare function getSignerInfo(): {
825
848
  */
826
849
  declare function isSigningEnabled(): boolean;
827
850
 
851
+ /**
852
+ * A Merkle inclusion proof for a single leaf.
853
+ *
854
+ * The siblings array lists the sibling hashes encountered while walking
855
+ * from the leaf up to the root. Each sibling is hex-encoded SHA-256.
856
+ * The (index, treeSize) pair determines whether the current node is
857
+ * left or right at each level during verification.
858
+ */
859
+ interface MerkleProof {
860
+ /** Zero-based index of the leaf in the canonically-sorted leaf list. */
861
+ index: number;
862
+ /** Total number of leaves in the tree. */
863
+ treeSize: number;
864
+ /** Sibling hashes from leaf upward, hex-encoded SHA-256 (lowercase). */
865
+ siblings: string[];
866
+ }
867
+
868
+ /**
869
+ * @scopeblind/protect-mcp: Commitment-Mode Signing
870
+ *
871
+ * Produces commitment-mode signed receipts per draft-farley-acta-signed-receipts-01
872
+ * §commitment-mode. Each listed field is independently committed via
873
+ * SHA-256(0x00 || JCS({name, salt, value})), arranged into an RFC 6962-style
874
+ * Merkle tree with explicit one-byte domain separation, and the receipt payload
875
+ * carries a single committed_fields_root field instead of the cleartext values.
876
+ *
877
+ * The receipt holder retains openings (value + salt per field) and can selectively
878
+ * disclose any subset to auditors via Merkle inclusion proofs verifiable by
879
+ * @veritasacta/verify@>=0.6.0.
880
+ *
881
+ * This module sits alongside signing.ts (the legacy @veritasacta/artifacts-based
882
+ * cleartext path) and is invoked when SigningConfig.commitment_mode.enabled is
883
+ * true. The two paths are mutually exclusive on a per-receipt basis.
884
+ *
885
+ * @since 0.6.0
886
+ * @standard draft-farley-acta-signed-receipts-01 §commitment-mode
887
+ * @standard RFC 6962 (Certificate Transparency Merkle tree construction)
888
+ * @standard RFC 8032 (Ed25519)
889
+ * @standard RFC 8785 (JCS)
890
+ */
891
+
892
+ /**
893
+ * The opening information for a single committed field. Held by the
894
+ * receipt issuer; never embedded in the published receipt. Required to
895
+ * later produce a selective-disclosure proof.
896
+ */
897
+ interface CommittedFieldOpening {
898
+ /** Field name (matches one of committed_field_names). */
899
+ name: string;
900
+ /** Cleartext value of the field. */
901
+ value: unknown;
902
+ /** Salt bytes (32 random bytes per field per receipt). */
903
+ salt: Uint8Array;
904
+ /** Zero-based index of the field in the canonically-sorted leaf list. */
905
+ index: number;
906
+ }
907
+ /**
908
+ * The result of signing a decision in commitment mode.
909
+ */
910
+ interface CommittedSignResult {
911
+ /** The signed receipt as a JSON string (canonical wire form). */
912
+ signed: string;
913
+ /** Receipt artifact type, e.g. "decision_receipt_committed_v1". */
914
+ artifact_type: string;
915
+ /**
916
+ * Per-field openings, indexed by field name. The issuer MUST persist
917
+ * these securely if it intends to support selective disclosure later.
918
+ * Storing them is the issuer's responsibility; this library does not
919
+ * write them to disk.
920
+ */
921
+ openings: Record<string, CommittedFieldOpening>;
922
+ /** Lowercase hex SHA-256 of the canonical signed receipt. */
923
+ receipt_hash: string;
924
+ }
925
+ /**
926
+ * A minimal selective-disclosure envelope. Reveal a single committed field
927
+ * to an auditor by supplying its (name, value, salt, proof). The auditor
928
+ * recomputes the leaf hash and walks the proof to confirm it reconstructs
929
+ * the receipt's committed_fields_root.
930
+ *
931
+ * Compatible with @veritasacta/verify@>=0.6.0.
932
+ */
933
+ interface MinimalDisclosure {
934
+ /** The receipt this disclosure targets, by canonical hash. */
935
+ parent_receipt_hash: string;
936
+ /** Disclosed field name. */
937
+ name: string;
938
+ /** Cleartext value of the disclosed field. */
939
+ value: unknown;
940
+ /** Salt as base64url (no padding). */
941
+ salt: string;
942
+ /** Merkle inclusion proof. */
943
+ proof: MerkleProof;
944
+ }
945
+ /**
946
+ * Sign a DecisionLog in commitment mode.
947
+ *
948
+ * @param entry - The decision log entry to sign.
949
+ * @param committedFieldNames - Names of fields to commit. Recommended:
950
+ * ["tool", "scope", "payload_digest", "swarm"]. Fields not listed
951
+ * remain cleartext in the signed payload.
952
+ * @param signingKey - Ed25519 private key (32 bytes hex or raw).
953
+ * @param publicKey - Ed25519 public key (32 bytes hex).
954
+ * @param kid - Key identifier (RFC 7638 JWK thumbprint or operator-chosen).
955
+ * @param issuer - Issuer identifier (e.g. "my-gateway.example.com").
956
+ *
957
+ * @returns Signed receipt JSON, openings (per field), and receipt hash.
958
+ *
959
+ * @standard draft-farley-acta-signed-receipts-01 §signature-scope
960
+ * The signature covers SHA-256(JCS(payload_minus_signature)).
961
+ */
962
+ declare function signCommittedDecision(entry: DecisionLog, committedFieldNames: string[], signingKey: string, publicKey: string, kid: string, issuer: string): CommittedSignResult;
963
+ /**
964
+ * Build a minimal selective-disclosure envelope for a single committed
965
+ * field. The envelope can be verified offline by anyone who has the
966
+ * receipt's committed_fields_root (which the receipt itself carries).
967
+ *
968
+ * @param receiptHash - Canonical hash of the receipt the disclosure targets.
969
+ * @param fieldName - Which field to disclose.
970
+ * @param openings - The full openings map produced by signCommittedDecision.
971
+ *
972
+ * @standard draft-farley-acta-signed-receipts-01 §commitment-disclosure
973
+ */
974
+ declare function discloseField(receiptHash: string, fieldName: string, openings: Record<string, CommittedFieldOpening>): MinimalDisclosure;
975
+
828
976
  /**
829
977
  * @scopeblind/protect-mcp — External PDP Adapter
830
978
  *
@@ -2763,4 +2911,4 @@ declare function confidentialInference(_prompt: string, _config: ConfidentialInf
2763
2911
  receipt: Record<string, unknown>;
2764
2912
  }>;
2765
2913
 
2766
- export { type ActionReceipt, type AdmissionResult, type AgentId, type AgentManifest, type ApprovalAssertion, type ApprovalChallenge, type ApprovalNotification, type ApprovalResult, type ArenaPayload, type ArenaReceipt, type AttestationDocument, type AttestationPayload, type AttestationProvider, type AttestationReceipt, type AttestationResult, type AuditBundle, type AuditBundleOptions, type BenchmarkPayload, type BenchmarkReceipt, type BuilderId, type C2PAAssertion, type C2PAIngredient, type C2PAManifest, type C2PAOptions, type CCRConnectorConfig, type CCRSessionContext, type CalibrationScore, type CedarEvalRequest, type CedarPolicySet, type CedarSchema, type CedarSchemaResult, type ComplianceReport, ConfidentialGate, type ConfidentialGateConfig, type ConfidentialInferenceConfig, type CredentialConfig, type DecisionContext, type DecisionLog, type DelegationReceipt, type DisclosureMode, type Ed25519PublicKey, type EvidenceAttestation, type EvidenceAttestationInput, type EvidenceIssuer, type EvidenceReceipt, type EvidenceReceiptBase, type EvidenceSummary, type EvidenceSummaryEntry, type EvidenceType, type ExternalDecision, type ExternalPDPConfig, type HFDatasetMetadata, type HFReceiptRow, type HookEventName, type HookInput, type HookResponse, type IssuerType, type JsonRpcRequest, type JsonRpcResponse, type LeaseCompatibility, type ManifestBuilder, type ManifestCapabilities, type ManifestConfig, type ManifestIdentity, type ManifestPresentation, type ManifestSignature, type ManifestStatus, type McpToolDescription, type NotificationConfig, type PassportTokenClaims, type PayloadDigest, type PlanReceipt, type PolicyEngineMode, type PredictionReceipt, type PredictionResolution, type PropagatorConfig, type ProtectConfig, ProtectGateway, type ProtectPolicy, type RateLimit, ReceiptPropagator, type RedactedResult, type RedactionSalt, type RekorAnchor, type RekorVerification, type RestraintPayload, type RestraintReceipt, type SHA256Hash, type SafetyTranscript, type Sandbox, type SandboxConfig, type SandboxReceipt, type SandboxResult, type SandboxToolCall, type SchemaGeneratorConfig, type SigningConfig, type SimulationResult, type SimulationSummary, type SwarmContext, type TierOverrides, type TimingMetrics, type ToolPolicy, type TrustTier, type WorkPayload, type WorkReceipt, anchorToRekor, buildDecisionContext, checkRateLimit, collectSignedReceipts, computeCalibration, confidentialInference, createApprovalChallenge, createApprovalReceiptPayload, createAttestationField, createAuditBundle, createC2PAManifest, createDisclosurePackage, createEvidenceAttestation, createLogAnchorField, createReceiptChannel, createSandbox, destroySandbox, ed25519ToDIDKey, evaluateCedar, evaluateTier, exportC2PAManifestJSON, exportJSONL, formatReportMarkdown, formatSimulation, generateC2PACommand, generateCedarSchema, generateDatasetCard, generateHFMetadata, generateReport, generateSafetyTranscript, generateSchemaStub, getSignerInfo, getToolPolicy, hashReceipt, hashResponseBody, initSigning, isAgentId, isCedarAvailable, isDisclosureMode, isEvidenceType, isManifestStatus, isSigningEnabled, listCredentialLabels, loadCedarPolicies, loadPolicy, manifestToVC, meetsMinTier, parseLogFile, parseNotificationConfigFromEnv, parseRateLimit, queryExternalPDP, receiptToVP, receiptsToHFRows, redactFields, resolveCredential, revealField, runInSandbox, sendApprovalNotification, signDecision, simulate, toCredentialRequestOptions, toManifoldFormat, toMetaculusFormat, validateCredentials, validateEvidenceReceipt, validateManifest, verifyActaC2PAAssertions, verifyAllCommitments, verifyApprovalAssertion, verifyCommitment, verifyEvidenceAttestation, verifyRekorAnchor };
2914
+ export { type ActionReceipt, type AdmissionResult, type AgentId, type AgentManifest, type ApprovalAssertion, type ApprovalChallenge, type ApprovalNotification, type ApprovalResult, type ArenaPayload, type ArenaReceipt, type AttestationDocument, type AttestationPayload, type AttestationProvider, type AttestationReceipt, type AttestationResult, type AuditBundle, type AuditBundleOptions, type BenchmarkPayload, type BenchmarkReceipt, type BuilderId, type C2PAAssertion, type C2PAIngredient, type C2PAManifest, type C2PAOptions, type CCRConnectorConfig, type CCRSessionContext, type CalibrationScore, type CedarEvalRequest, type CedarPolicySet, type CedarSchema, type CedarSchemaResult, type CommittedFieldOpening, type CommittedSignResult, type ComplianceReport, ConfidentialGate, type ConfidentialGateConfig, type ConfidentialInferenceConfig, type CredentialConfig, type DecisionContext, type DecisionLog, type DelegationReceipt, type DisclosureMode, type Ed25519PublicKey, type EvidenceAttestation, type EvidenceAttestationInput, type EvidenceIssuer, type EvidenceReceipt, type EvidenceReceiptBase, type EvidenceSummary, type EvidenceSummaryEntry, type EvidenceType, type ExternalDecision, type ExternalPDPConfig, type HFDatasetMetadata, type HFReceiptRow, type HookEventName, type HookInput, type HookResponse, type IssuerType, type JsonRpcRequest, type JsonRpcResponse, type LeaseCompatibility, type ManifestBuilder, type ManifestCapabilities, type ManifestConfig, type ManifestIdentity, type ManifestPresentation, type ManifestSignature, type ManifestStatus, type McpToolDescription, type MinimalDisclosure, type NotificationConfig, type PassportTokenClaims, type PayloadDigest, type PlanReceipt, type PolicyEngineMode, type PredictionReceipt, type PredictionResolution, type PropagatorConfig, type ProtectConfig, ProtectGateway, type ProtectPolicy, type RateLimit, ReceiptPropagator, type RedactedResult, type RedactionSalt, type RekorAnchor, type RekorVerification, type RestraintPayload, type RestraintReceipt, type SHA256Hash, type SafetyTranscript, type Sandbox, type SandboxConfig, type SandboxReceipt, type SandboxResult, type SandboxToolCall, type SchemaGeneratorConfig, type SigningConfig, type SimulationResult, type SimulationSummary, type SwarmContext, type TierOverrides, type TimingMetrics, type ToolPolicy, type TrustTier, type WorkPayload, type WorkReceipt, anchorToRekor, buildDecisionContext, checkRateLimit, collectSignedReceipts, computeCalibration, confidentialInference, createApprovalChallenge, createApprovalReceiptPayload, createAttestationField, createAuditBundle, createC2PAManifest, createDisclosurePackage, createEvidenceAttestation, createLogAnchorField, createReceiptChannel, createSandbox, destroySandbox, discloseField, ed25519ToDIDKey, evaluateCedar, evaluateTier, exportC2PAManifestJSON, exportJSONL, formatReportMarkdown, formatSimulation, generateC2PACommand, generateCedarSchema, generateDatasetCard, generateHFMetadata, generateReport, generateSafetyTranscript, generateSchemaStub, getSignerInfo, getToolPolicy, hashReceipt, hashResponseBody, initSigning, isAgentId, isCedarAvailable, isDisclosureMode, isEvidenceType, isManifestStatus, isSigningEnabled, listCredentialLabels, loadCedarPolicies, loadPolicy, manifestToVC, meetsMinTier, parseLogFile, parseNotificationConfigFromEnv, parseRateLimit, queryExternalPDP, receiptToVP, receiptsToHFRows, redactFields, resolveCredential, revealField, runInSandbox, sendApprovalNotification, signCommittedDecision, signDecision, simulate, toCredentialRequestOptions, toManifoldFormat, toMetaculusFormat, validateCredentials, validateEvidenceReceipt, validateManifest, verifyActaC2PAAssertions, verifyAllCommitments, verifyApprovalAssertion, verifyCommitment, verifyEvidenceAttestation, verifyRekorAnchor };
package/dist/index.d.ts CHANGED
@@ -95,6 +95,29 @@ interface SigningConfig {
95
95
  issuer?: string;
96
96
  /** Whether signing is enabled (default: true when key_path is set) */
97
97
  enabled?: boolean;
98
+ /**
99
+ * Commitment-mode signing.
100
+ *
101
+ * When enabled, listed fields are committed via SHA-256(salt || JCS({name, salt, value}))
102
+ * and the receipt payload carries a single committed_fields_root (Merkle root) instead
103
+ * of the cleartext field values. Per draft-farley-acta-signed-receipts-01 §commitment-mode.
104
+ *
105
+ * The receipt issuer keeps the openings (value + salt per field) for later selective
106
+ * disclosure. A receipt holder can prove a field's value to an auditor without
107
+ * revealing other committed fields.
108
+ *
109
+ * @since 0.6.0
110
+ */
111
+ commitment_mode?: {
112
+ /** Whether commitment-mode signing is active. Default: false. */
113
+ enabled?: boolean;
114
+ /**
115
+ * Names of payload fields to commit.
116
+ * Recommended defaults: tool, scope, payload_digest, swarm.
117
+ * Other fields remain cleartext.
118
+ */
119
+ committed_field_names?: string[];
120
+ };
98
121
  }
99
122
  interface RateLimit {
100
123
  count: number;
@@ -825,6 +848,131 @@ declare function getSignerInfo(): {
825
848
  */
826
849
  declare function isSigningEnabled(): boolean;
827
850
 
851
+ /**
852
+ * A Merkle inclusion proof for a single leaf.
853
+ *
854
+ * The siblings array lists the sibling hashes encountered while walking
855
+ * from the leaf up to the root. Each sibling is hex-encoded SHA-256.
856
+ * The (index, treeSize) pair determines whether the current node is
857
+ * left or right at each level during verification.
858
+ */
859
+ interface MerkleProof {
860
+ /** Zero-based index of the leaf in the canonically-sorted leaf list. */
861
+ index: number;
862
+ /** Total number of leaves in the tree. */
863
+ treeSize: number;
864
+ /** Sibling hashes from leaf upward, hex-encoded SHA-256 (lowercase). */
865
+ siblings: string[];
866
+ }
867
+
868
+ /**
869
+ * @scopeblind/protect-mcp: Commitment-Mode Signing
870
+ *
871
+ * Produces commitment-mode signed receipts per draft-farley-acta-signed-receipts-01
872
+ * §commitment-mode. Each listed field is independently committed via
873
+ * SHA-256(0x00 || JCS({name, salt, value})), arranged into an RFC 6962-style
874
+ * Merkle tree with explicit one-byte domain separation, and the receipt payload
875
+ * carries a single committed_fields_root field instead of the cleartext values.
876
+ *
877
+ * The receipt holder retains openings (value + salt per field) and can selectively
878
+ * disclose any subset to auditors via Merkle inclusion proofs verifiable by
879
+ * @veritasacta/verify@>=0.6.0.
880
+ *
881
+ * This module sits alongside signing.ts (the legacy @veritasacta/artifacts-based
882
+ * cleartext path) and is invoked when SigningConfig.commitment_mode.enabled is
883
+ * true. The two paths are mutually exclusive on a per-receipt basis.
884
+ *
885
+ * @since 0.6.0
886
+ * @standard draft-farley-acta-signed-receipts-01 §commitment-mode
887
+ * @standard RFC 6962 (Certificate Transparency Merkle tree construction)
888
+ * @standard RFC 8032 (Ed25519)
889
+ * @standard RFC 8785 (JCS)
890
+ */
891
+
892
+ /**
893
+ * The opening information for a single committed field. Held by the
894
+ * receipt issuer; never embedded in the published receipt. Required to
895
+ * later produce a selective-disclosure proof.
896
+ */
897
+ interface CommittedFieldOpening {
898
+ /** Field name (matches one of committed_field_names). */
899
+ name: string;
900
+ /** Cleartext value of the field. */
901
+ value: unknown;
902
+ /** Salt bytes (32 random bytes per field per receipt). */
903
+ salt: Uint8Array;
904
+ /** Zero-based index of the field in the canonically-sorted leaf list. */
905
+ index: number;
906
+ }
907
+ /**
908
+ * The result of signing a decision in commitment mode.
909
+ */
910
+ interface CommittedSignResult {
911
+ /** The signed receipt as a JSON string (canonical wire form). */
912
+ signed: string;
913
+ /** Receipt artifact type, e.g. "decision_receipt_committed_v1". */
914
+ artifact_type: string;
915
+ /**
916
+ * Per-field openings, indexed by field name. The issuer MUST persist
917
+ * these securely if it intends to support selective disclosure later.
918
+ * Storing them is the issuer's responsibility; this library does not
919
+ * write them to disk.
920
+ */
921
+ openings: Record<string, CommittedFieldOpening>;
922
+ /** Lowercase hex SHA-256 of the canonical signed receipt. */
923
+ receipt_hash: string;
924
+ }
925
+ /**
926
+ * A minimal selective-disclosure envelope. Reveal a single committed field
927
+ * to an auditor by supplying its (name, value, salt, proof). The auditor
928
+ * recomputes the leaf hash and walks the proof to confirm it reconstructs
929
+ * the receipt's committed_fields_root.
930
+ *
931
+ * Compatible with @veritasacta/verify@>=0.6.0.
932
+ */
933
+ interface MinimalDisclosure {
934
+ /** The receipt this disclosure targets, by canonical hash. */
935
+ parent_receipt_hash: string;
936
+ /** Disclosed field name. */
937
+ name: string;
938
+ /** Cleartext value of the disclosed field. */
939
+ value: unknown;
940
+ /** Salt as base64url (no padding). */
941
+ salt: string;
942
+ /** Merkle inclusion proof. */
943
+ proof: MerkleProof;
944
+ }
945
+ /**
946
+ * Sign a DecisionLog in commitment mode.
947
+ *
948
+ * @param entry - The decision log entry to sign.
949
+ * @param committedFieldNames - Names of fields to commit. Recommended:
950
+ * ["tool", "scope", "payload_digest", "swarm"]. Fields not listed
951
+ * remain cleartext in the signed payload.
952
+ * @param signingKey - Ed25519 private key (32 bytes hex or raw).
953
+ * @param publicKey - Ed25519 public key (32 bytes hex).
954
+ * @param kid - Key identifier (RFC 7638 JWK thumbprint or operator-chosen).
955
+ * @param issuer - Issuer identifier (e.g. "my-gateway.example.com").
956
+ *
957
+ * @returns Signed receipt JSON, openings (per field), and receipt hash.
958
+ *
959
+ * @standard draft-farley-acta-signed-receipts-01 §signature-scope
960
+ * The signature covers SHA-256(JCS(payload_minus_signature)).
961
+ */
962
+ declare function signCommittedDecision(entry: DecisionLog, committedFieldNames: string[], signingKey: string, publicKey: string, kid: string, issuer: string): CommittedSignResult;
963
+ /**
964
+ * Build a minimal selective-disclosure envelope for a single committed
965
+ * field. The envelope can be verified offline by anyone who has the
966
+ * receipt's committed_fields_root (which the receipt itself carries).
967
+ *
968
+ * @param receiptHash - Canonical hash of the receipt the disclosure targets.
969
+ * @param fieldName - Which field to disclose.
970
+ * @param openings - The full openings map produced by signCommittedDecision.
971
+ *
972
+ * @standard draft-farley-acta-signed-receipts-01 §commitment-disclosure
973
+ */
974
+ declare function discloseField(receiptHash: string, fieldName: string, openings: Record<string, CommittedFieldOpening>): MinimalDisclosure;
975
+
828
976
  /**
829
977
  * @scopeblind/protect-mcp — External PDP Adapter
830
978
  *
@@ -2763,4 +2911,4 @@ declare function confidentialInference(_prompt: string, _config: ConfidentialInf
2763
2911
  receipt: Record<string, unknown>;
2764
2912
  }>;
2765
2913
 
2766
- export { type ActionReceipt, type AdmissionResult, type AgentId, type AgentManifest, type ApprovalAssertion, type ApprovalChallenge, type ApprovalNotification, type ApprovalResult, type ArenaPayload, type ArenaReceipt, type AttestationDocument, type AttestationPayload, type AttestationProvider, type AttestationReceipt, type AttestationResult, type AuditBundle, type AuditBundleOptions, type BenchmarkPayload, type BenchmarkReceipt, type BuilderId, type C2PAAssertion, type C2PAIngredient, type C2PAManifest, type C2PAOptions, type CCRConnectorConfig, type CCRSessionContext, type CalibrationScore, type CedarEvalRequest, type CedarPolicySet, type CedarSchema, type CedarSchemaResult, type ComplianceReport, ConfidentialGate, type ConfidentialGateConfig, type ConfidentialInferenceConfig, type CredentialConfig, type DecisionContext, type DecisionLog, type DelegationReceipt, type DisclosureMode, type Ed25519PublicKey, type EvidenceAttestation, type EvidenceAttestationInput, type EvidenceIssuer, type EvidenceReceipt, type EvidenceReceiptBase, type EvidenceSummary, type EvidenceSummaryEntry, type EvidenceType, type ExternalDecision, type ExternalPDPConfig, type HFDatasetMetadata, type HFReceiptRow, type HookEventName, type HookInput, type HookResponse, type IssuerType, type JsonRpcRequest, type JsonRpcResponse, type LeaseCompatibility, type ManifestBuilder, type ManifestCapabilities, type ManifestConfig, type ManifestIdentity, type ManifestPresentation, type ManifestSignature, type ManifestStatus, type McpToolDescription, type NotificationConfig, type PassportTokenClaims, type PayloadDigest, type PlanReceipt, type PolicyEngineMode, type PredictionReceipt, type PredictionResolution, type PropagatorConfig, type ProtectConfig, ProtectGateway, type ProtectPolicy, type RateLimit, ReceiptPropagator, type RedactedResult, type RedactionSalt, type RekorAnchor, type RekorVerification, type RestraintPayload, type RestraintReceipt, type SHA256Hash, type SafetyTranscript, type Sandbox, type SandboxConfig, type SandboxReceipt, type SandboxResult, type SandboxToolCall, type SchemaGeneratorConfig, type SigningConfig, type SimulationResult, type SimulationSummary, type SwarmContext, type TierOverrides, type TimingMetrics, type ToolPolicy, type TrustTier, type WorkPayload, type WorkReceipt, anchorToRekor, buildDecisionContext, checkRateLimit, collectSignedReceipts, computeCalibration, confidentialInference, createApprovalChallenge, createApprovalReceiptPayload, createAttestationField, createAuditBundle, createC2PAManifest, createDisclosurePackage, createEvidenceAttestation, createLogAnchorField, createReceiptChannel, createSandbox, destroySandbox, ed25519ToDIDKey, evaluateCedar, evaluateTier, exportC2PAManifestJSON, exportJSONL, formatReportMarkdown, formatSimulation, generateC2PACommand, generateCedarSchema, generateDatasetCard, generateHFMetadata, generateReport, generateSafetyTranscript, generateSchemaStub, getSignerInfo, getToolPolicy, hashReceipt, hashResponseBody, initSigning, isAgentId, isCedarAvailable, isDisclosureMode, isEvidenceType, isManifestStatus, isSigningEnabled, listCredentialLabels, loadCedarPolicies, loadPolicy, manifestToVC, meetsMinTier, parseLogFile, parseNotificationConfigFromEnv, parseRateLimit, queryExternalPDP, receiptToVP, receiptsToHFRows, redactFields, resolveCredential, revealField, runInSandbox, sendApprovalNotification, signDecision, simulate, toCredentialRequestOptions, toManifoldFormat, toMetaculusFormat, validateCredentials, validateEvidenceReceipt, validateManifest, verifyActaC2PAAssertions, verifyAllCommitments, verifyApprovalAssertion, verifyCommitment, verifyEvidenceAttestation, verifyRekorAnchor };
2914
+ export { type ActionReceipt, type AdmissionResult, type AgentId, type AgentManifest, type ApprovalAssertion, type ApprovalChallenge, type ApprovalNotification, type ApprovalResult, type ArenaPayload, type ArenaReceipt, type AttestationDocument, type AttestationPayload, type AttestationProvider, type AttestationReceipt, type AttestationResult, type AuditBundle, type AuditBundleOptions, type BenchmarkPayload, type BenchmarkReceipt, type BuilderId, type C2PAAssertion, type C2PAIngredient, type C2PAManifest, type C2PAOptions, type CCRConnectorConfig, type CCRSessionContext, type CalibrationScore, type CedarEvalRequest, type CedarPolicySet, type CedarSchema, type CedarSchemaResult, type CommittedFieldOpening, type CommittedSignResult, type ComplianceReport, ConfidentialGate, type ConfidentialGateConfig, type ConfidentialInferenceConfig, type CredentialConfig, type DecisionContext, type DecisionLog, type DelegationReceipt, type DisclosureMode, type Ed25519PublicKey, type EvidenceAttestation, type EvidenceAttestationInput, type EvidenceIssuer, type EvidenceReceipt, type EvidenceReceiptBase, type EvidenceSummary, type EvidenceSummaryEntry, type EvidenceType, type ExternalDecision, type ExternalPDPConfig, type HFDatasetMetadata, type HFReceiptRow, type HookEventName, type HookInput, type HookResponse, type IssuerType, type JsonRpcRequest, type JsonRpcResponse, type LeaseCompatibility, type ManifestBuilder, type ManifestCapabilities, type ManifestConfig, type ManifestIdentity, type ManifestPresentation, type ManifestSignature, type ManifestStatus, type McpToolDescription, type MinimalDisclosure, type NotificationConfig, type PassportTokenClaims, type PayloadDigest, type PlanReceipt, type PolicyEngineMode, type PredictionReceipt, type PredictionResolution, type PropagatorConfig, type ProtectConfig, ProtectGateway, type ProtectPolicy, type RateLimit, ReceiptPropagator, type RedactedResult, type RedactionSalt, type RekorAnchor, type RekorVerification, type RestraintPayload, type RestraintReceipt, type SHA256Hash, type SafetyTranscript, type Sandbox, type SandboxConfig, type SandboxReceipt, type SandboxResult, type SandboxToolCall, type SchemaGeneratorConfig, type SigningConfig, type SimulationResult, type SimulationSummary, type SwarmContext, type TierOverrides, type TimingMetrics, type ToolPolicy, type TrustTier, type WorkPayload, type WorkReceipt, anchorToRekor, buildDecisionContext, checkRateLimit, collectSignedReceipts, computeCalibration, confidentialInference, createApprovalChallenge, createApprovalReceiptPayload, createAttestationField, createAuditBundle, createC2PAManifest, createDisclosurePackage, createEvidenceAttestation, createLogAnchorField, createReceiptChannel, createSandbox, destroySandbox, discloseField, ed25519ToDIDKey, evaluateCedar, evaluateTier, exportC2PAManifestJSON, exportJSONL, formatReportMarkdown, formatSimulation, generateC2PACommand, generateCedarSchema, generateDatasetCard, generateHFMetadata, generateReport, generateSafetyTranscript, generateSchemaStub, getSignerInfo, getToolPolicy, hashReceipt, hashResponseBody, initSigning, isAgentId, isCedarAvailable, isDisclosureMode, isEvidenceType, isManifestStatus, isSigningEnabled, listCredentialLabels, loadCedarPolicies, loadPolicy, manifestToVC, meetsMinTier, parseLogFile, parseNotificationConfigFromEnv, parseRateLimit, queryExternalPDP, receiptToVP, receiptsToHFRows, redactFields, resolveCredential, revealField, runInSandbox, sendApprovalNotification, signCommittedDecision, signDecision, simulate, toCredentialRequestOptions, toManifoldFormat, toMetaculusFormat, validateCredentials, validateEvidenceReceipt, validateManifest, verifyActaC2PAAssertions, verifyAllCommitments, verifyApprovalAssertion, verifyCommitment, verifyEvidenceAttestation, verifyRekorAnchor };