protect-mcp 0.7.2 → 0.7.4

package/dist/signing-committed-MMLJ6OGG.mjs

@@ -0,0 +1,15 @@
+import {
+  createSelectiveDisclosurePackage,
+  discloseField,
+  signCommittedDecision,
+  verifySelectiveDisclosurePackage
+} from "./chunk-F2FKQ4XN.mjs";
+import "./chunk-LYKNULYU.mjs";
+import "./chunk-D733KAPG.mjs";
+import "./chunk-PQJP2ZCI.mjs";
+export {
+  createSelectiveDisclosurePackage,
+  discloseField,
+  signCommittedDecision,
+  verifySelectiveDisclosurePackage
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "protect-mcp",
-  "version": "0.7.2",
+  "version": "0.7.4",
   "mcpName": "com.scopeblind/protect-mcp",
   "description": "Fail-closed Cedar policy gate + signed receipts for AI agent tool calls. Blocks what breaks the rules before it runs, denies on any policy error, and proves the gate is live with a startup self-test.",
   "main": "dist/index.js",

package/dist/chunk-ZBKJANP7.mjs

@@ -1,145 +0,0 @@
-import {
-  meetsMinTier
-} from "./chunk-OHUTUFTC.mjs";
-import {
-  checkRateLimit,
-  getToolPolicy,
-  parseRateLimit
-} from "./chunk-546U3A7R.mjs";
-
-// src/simulate.ts
-import { readFileSync } from "fs";
-function parseLogFile(path) {
-  const raw = readFileSync(path, "utf-8");
-  const entries = [];
-  for (const line of raw.split("\n")) {
-    const trimmed = line.trim();
-    if (!trimmed) continue;
-    const jsonStr = trimmed.replace(/^\[PROTECT_MCP\]\s*/, "");
-    try {
-      const parsed = JSON.parse(jsonStr);
-      if (parsed.tool && parsed.decision) {
-        entries.push(parsed);
-      }
-    } catch {
-    }
-  }
-  return entries;
-}
-function simulate(entries, policy, tier = "unknown") {
-  const rateLimitStore = /* @__PURE__ */ new Map();
-  const toolResults = /* @__PURE__ */ new Map();
-  const totals = {
-    allow: 0,
-    block: 0,
-    rate_limited: 0,
-    require_approval: 0,
-    tier_insufficient: 0
-  };
-  const originalTotals = { allow: 0, deny: 0 };
-  const changes = [];
-  for (const entry of entries) {
-    const toolName = entry.tool;
-    const toolPolicy = getToolPolicy(toolName, policy);
-    if (entry.decision === "allow") {
-      originalTotals.allow++;
-    } else {
-      originalTotals.deny++;
-    }
-    let newDecision;
-    if (toolPolicy.block) {
-      newDecision = "block";
-    } else if (toolPolicy.min_tier && !meetsMinTier(tier, toolPolicy.min_tier)) {
-      newDecision = "tier_insufficient";
-    } else if (toolPolicy.require_approval) {
-      newDecision = "require_approval";
-    } else if (toolPolicy.rate_limit) {
-      const limit = parseRateLimit(toolPolicy.rate_limit);
-      const result = checkRateLimit(toolName, limit, rateLimitStore);
-      newDecision = result.allowed ? "allow" : "rate_limited";
-    } else {
-      newDecision = "allow";
-    }
-    totals[newDecision]++;
-    if (!toolResults.has(toolName)) {
-      toolResults.set(toolName, {
-        tool: toolName,
-        calls: 0,
-        results: { allow: 0, block: 0, rate_limited: 0, require_approval: 0, tier_insufficient: 0 },
-        original: { allow: 0, deny: 0 }
-      });
-    }
-    const tr = toolResults.get(toolName);
-    tr.calls++;
-    tr.results[newDecision]++;
-    if (entry.decision === "allow") {
-      tr.original.allow++;
-    } else {
-      tr.original.deny++;
-    }
-  }
-  for (const [tool, result] of toolResults) {
-    const wasAllBlocked = result.original.allow === 0;
-    const nowAllBlocked = result.results.allow === 0;
-    const wasAllAllowed = result.original.deny === 0;
-    if (wasAllAllowed && result.results.block > 0) {
-      changes.push(`${tool}: ${result.results.block} calls would be blocked (was: all allowed)`);
-    }
-    if (wasAllAllowed && result.results.rate_limited > 0) {
-      changes.push(`${tool}: ${result.results.rate_limited} calls would be rate-limited (was: all allowed)`);
-    }
-    if (wasAllAllowed && result.results.require_approval > 0) {
-      changes.push(`${tool}: ${result.results.require_approval} calls would require approval (was: all allowed)`);
-    }
-    if (wasAllAllowed && result.results.tier_insufficient > 0) {
-      changes.push(`${tool}: ${result.results.tier_insufficient} calls would fail tier check (was: all allowed)`);
-    }
-    if (wasAllBlocked && result.results.allow > 0 && !nowAllBlocked) {
-      changes.push(`${tool}: ${result.results.allow} calls would now be allowed (was: all blocked)`);
-    }
-  }
-  return {
-    policy_file: "",
-    log_file: "",
-    total_calls: entries.length,
-    results: totals,
-    original: originalTotals,
-    tool_breakdown: Array.from(toolResults.values()).sort((a, b) => b.calls - a.calls),
-    changes
-  };
-}
-function formatSimulation(summary) {
-  const lines = [];
-  lines.push(`Simulating ${summary.policy_file} against ${summary.total_calls} recorded tool calls:
-`);
-  const maxToolLen = Math.max(...summary.tool_breakdown.map((t) => t.tool.length), 4);
-  for (const tr of summary.tool_breakdown) {
-    const parts = [];
-    if (tr.results.allow > 0) parts.push(`${tr.results.allow} allow`);
-    if (tr.results.block > 0) parts.push(`\x1B[31m${tr.results.block} blocked\x1B[0m`);
-    if (tr.results.rate_limited > 0) parts.push(`\x1B[33m${tr.results.rate_limited} rate_limited\x1B[0m`);
-    if (tr.results.require_approval > 0) parts.push(`\x1B[36m${tr.results.require_approval} require_approval\x1B[0m`);
-    if (tr.results.tier_insufficient > 0) parts.push(`\x1B[35m${tr.results.tier_insufficient} tier_insufficient\x1B[0m`);
-    const originalParts = [];
-    if (tr.original.allow > 0) originalParts.push(`${tr.original.allow} allow`);
-    if (tr.original.deny > 0) originalParts.push(`${tr.original.deny} deny`);
-    lines.push(`  ${tr.tool.padEnd(maxToolLen)}  \xD7 ${String(tr.calls).padStart(3)} \u2192 ${parts.join(", ")}  (was: ${originalParts.join(", ")})`);
-  }
-  lines.push("");
-  lines.push(`Summary: ${summary.results.allow} allow, ${summary.results.block} blocked, ${summary.results.rate_limited} rate_limited, ${summary.results.require_approval} require_approval, ${summary.results.tier_insufficient} tier_insufficient`);
-  lines.push(`  vs original: ${summary.original.allow} allow, ${summary.original.deny} deny`);
-  if (summary.changes.length > 0) {
-    lines.push("");
-    lines.push("Changes:");
-    for (const change of summary.changes) {
-      lines.push(`  \u2022 ${change}`);
-    }
-  }
-  return lines.join("\n");
-}
-
-export {
-  parseLogFile,
-  simulate,
-  formatSimulation
-};