protect-mcp 0.7.2 → 0.7.4

package/dist/demo-server.d.mts

@@ -12,6 +12,9 @@
  *  - delete_file  (destructive, blocked by default policy)
  *  - web_search   (rate-limited)
  *  - deploy       (high-privilege)
+ *  - github_create_pr (source-control mutation)
+ *  - send_email   (external communication)
+ *  - pms_book_fill (mock portfolio-management booking)
  */
 /**
  * Smithery sandbox server — returns a McpServer instance

package/dist/demo-server.d.ts

@@ -12,6 +12,9 @@
  *  - delete_file  (destructive, blocked by default policy)
  *  - web_search   (rate-limited)
  *  - deploy       (high-privilege)
+ *  - github_create_pr (source-control mutation)
+ *  - send_email   (external communication)
+ *  - pms_book_fill (mock portfolio-management booking)
  */
 /**
  * Smithery sandbox server — returns a McpServer instance

package/dist/demo-server.js

@@ -35064,6 +35064,48 @@ var TOOLS = [
       },
       required: ["environment"]
     }
+  },
+  {
+    name: "github_create_pr",
+    description: "Create a GitHub pull request",
+    inputSchema: {
+      type: "object",
+      properties: {
+        repo: { type: "string", description: "Repository name" },
+        branch: { type: "string", description: "Source branch" },
+        title: { type: "string", description: "Pull request title" }
+      },
+      required: ["repo", "branch", "title"]
+    }
+  },
+  {
+    name: "send_email",
+    description: "Send an email",
+    inputSchema: {
+      type: "object",
+      properties: {
+        to: { type: "string", description: "Recipient email address" },
+        subject: { type: "string", description: "Subject line" },
+        body: { type: "string", description: "Message body" }
+      },
+      required: ["to", "subject"]
+    }
+  },
+  {
+    name: "pms_book_fill",
+    description: "Book a fill into the mock portfolio management system",
+    inputSchema: {
+      type: "object",
+      properties: {
+        account: { type: "string", description: "Portfolio or fund account" },
+        symbol: { type: "string", description: "Instrument symbol" },
+        side: { type: "string", enum: ["BUY", "SELL"] },
+        quantity: { type: "number" },
+        price: { type: "number" },
+        strategy: { type: "string" }
+      },
+      required: ["account", "symbol", "side", "quantity", "price"]
+    }
   }
 ];
 function handleRequest(request) {
@@ -35111,6 +35153,15 @@ Contents: Hello from protect-mcp demo server!`;
       case "deploy":
         resultText = `[demo] Deployed to ${args.environment || "staging"}${args.reason ? ` (reason: ${args.reason})` : ""}`;
         break;
+      case "github_create_pr":
+        resultText = `[demo] Created PR in ${args.repo || "scopeblind/demo"} from ${args.branch || "agent/demo"}: ${args.title || "Agent change"}`;
+        break;
+      case "send_email":
+        resultText = `[demo] Drafted email to ${args.to || "pm@example.com"}: ${args.subject || "Agent update"}`;
+        break;
+      case "pms_book_fill":
+        resultText = `[demo] Booked ${args.side || "BUY"} ${args.quantity || 0} ${args.symbol || "AAPL"} @ ${args.price || 0} into ${args.account || "Demo Fund"} (${args.strategy || "Unassigned"})`;
+        break;
       default:
         resultText = `[demo] Unknown tool: ${toolName}`;
     }
@@ -35183,6 +35234,30 @@ function createSandboxServer() {
     { environment: z.enum(["staging", "production"]).describe("Target environment"), reason: z.string().optional().describe("Deployment reason") },
     async (args) => ({ content: [{ type: "text", text: `[demo] Deployed to ${args.environment}` }] })
   );
+  server.tool("github_create_pr", "Create a GitHub pull request", {
+    repo: z.string(),
+    branch: z.string(),
+    title: z.string()
+  }, async (args) => ({
+    content: [{ type: "text", text: `[demo] PR created in ${args.repo} from ${args.branch}: ${args.title}` }]
+  }));
+  server.tool("send_email", "Send an email", {
+    to: z.string(),
+    subject: z.string(),
+    body: z.string().optional()
+  }, async (args) => ({
+    content: [{ type: "text", text: `[demo] Email prepared for ${args.to}: ${args.subject}` }]
+  }));
+  server.tool("pms_book_fill", "Book a fill into a mock PMS", {
+    account: z.string(),
+    symbol: z.string(),
+    side: z.enum(["BUY", "SELL"]),
+    quantity: z.number(),
+    price: z.number(),
+    strategy: z.string().optional()
+  }, async (args) => ({
+    content: [{ type: "text", text: `[demo] Booked ${args.side} ${args.quantity} ${args.symbol} @ ${args.price} into ${args.account}` }]
+  }));
   return server;
 }
 // Annotate the CommonJS export names for ESM import in node:

package/dist/demo-server.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   createSandboxServer
-} from "./chunk-J6L4XCTE.mjs";
+} from "./chunk-KPSICBAJ.mjs";
 import "./chunk-PQJP2ZCI.mjs";
 export {
   createSandboxServer

package/dist/hook-server.js

@@ -24,7 +24,7 @@ __export(hook_server_exports, {
 });
 module.exports = __toCommonJS(hook_server_exports);
 var import_node_http2 = require("http");
-var import_node_crypto3 = require("crypto");
+var import_node_crypto4 = require("crypto");
 var import_node_fs5 = require("fs");
 var import_node_path3 = require("path");
 
@@ -320,6 +320,7 @@ function signDecision(entry) {
     if (entry.timing) payload.timing = entry.timing;
     if (entry.swarm) payload.swarm = entry.swarm;
     if (entry.payload_digest) payload.payload_digest = entry.payload_digest;
+    if (entry.action_readback) payload.action_readback = entry.action_readback;
     if (entry.deny_iteration) payload.deny_iteration = entry.deny_iteration;
     const result = artifactsModule.createSignedArtifact(
       artifactType,
@@ -613,6 +614,95 @@ function getScopeBlindBridge() {
   return singleton;
 }
 
+// src/action-readback.ts
+var import_node_crypto3 = require("crypto");
+var SECRET_KEY_RE = /(api[_-]?key|authorization|bearer|credential|password|secret|session|token|private[_-]?key)/i;
+var DESTINATION_KEYS = [
+  "path",
+  "file_path",
+  "filePath",
+  "url",
+  "uri",
+  "endpoint",
+  "host",
+  "hostname",
+  "repo",
+  "repository",
+  "branch",
+  "channel",
+  "to",
+  "recipient",
+  "symbol",
+  "account",
+  "bucket",
+  "database",
+  "table",
+  "service"
+];
+function stableStringify(value) {
+  if (value === null || typeof value !== "object") return JSON.stringify(value);
+  if (Array.isArray(value)) return `[${value.map(stableStringify).join(",")}]`;
+  const obj = value;
+  return `{${Object.keys(obj).sort().map((key) => `${JSON.stringify(key)}:${stableStringify(obj[key])}`).join(",")}}`;
+}
+function redact(value, path = [], redacted = [], disclosed = [], depth = 0) {
+  if (depth > 4) return "[truncated-depth]";
+  if (value === null || value === void 0) return value;
+  if (typeof value !== "object") {
+    if (path.length > 0) disclosed.push(path.join("."));
+    if (typeof value === "string" && value.length > 240) return `${value.slice(0, 240)}...`;
+    return value;
+  }
+  if (Array.isArray(value)) {
+    return value.slice(0, 20).map((item, idx) => redact(item, [...path, String(idx)], redacted, disclosed, depth + 1));
+  }
+  const out = {};
+  for (const [key, child] of Object.entries(value)) {
+    const childPath = [...path, key];
+    if (SECRET_KEY_RE.test(key)) {
+      redacted.push(childPath.join("."));
+      out[key] = "[redacted]";
+      continue;
+    }
+    out[key] = redact(child, childPath, redacted, disclosed, depth + 1);
+  }
+  return out;
+}
+function firstStringValue(input, keys) {
+  for (const key of keys) {
+    const value = input[key];
+    if (typeof value === "string" && value.trim()) return value.trim();
+    if (typeof value === "number" || typeof value === "boolean") return String(value);
+  }
+  return void 0;
+}
+function actionFor(tool, input) {
+  const explicit = firstStringValue(input, ["action", "operation", "method", "verb", "command"]);
+  if (explicit) return explicit.length > 90 ? `${explicit.slice(0, 90)}...` : explicit;
+  return tool;
+}
+function buildActionReadback(tool, input) {
+  const normalized = input && typeof input === "object" && !Array.isArray(input) ? input : { value: input };
+  const canonical = stableStringify(normalized);
+  const redactedFields = [];
+  const disclosedFields = [];
+  const payloadPreview = redact(normalized, [], redactedFields, disclosedFields);
+  const action = actionFor(tool, normalized);
+  const destination = firstStringValue(normalized, DESTINATION_KEYS);
+  const summary = destination ? `${tool} -> ${destination}` : `${tool} request`;
+  return {
+    tool,
+    action,
+    destination,
+    payload_preview: payloadPreview,
+    payload_hash: (0, import_node_crypto3.createHash)("sha256").update(canonical).digest("hex"),
+    payload_bytes: Buffer.byteLength(canonical, "utf-8"),
+    disclosed_fields: [...new Set(disclosedFields)].slice(0, 80),
+    redacted_fields: [...new Set(redactedFields)].slice(0, 80),
+    summary
+  };
+}
+
 // src/hook-server.ts
 var DEFAULT_PORT = 9377;
 var LOG_FILE = ".protect-mcp-log.jsonl";
@@ -641,7 +731,7 @@ function computePayloadDigest(input) {
     return void 0;
   }
   return {
-    input_hash: (0, import_node_crypto3.createHash)("sha256").update(content).digest("hex"),
+    input_hash: (0, import_node_crypto4.createHash)("sha256").update(content).digest("hex"),
     input_size: size,
     truncated: true,
     preview: content.slice(0, 256)
@@ -654,7 +744,7 @@ function computeOutputDigest(output) {
     return void 0;
   }
   return {
-    output_hash: (0, import_node_crypto3.createHash)("sha256").update(content).digest("hex"),
+    output_hash: (0, import_node_crypto4.createHash)("sha256").update(content).digest("hex"),
     output_size: size
   };
 }
@@ -677,13 +767,14 @@ function detectSandboxState() {
 async function handlePreToolUse(input, state) {
   const hookStart = Date.now();
   const toolName = input.toolName || "unknown";
-  const requestId = input.toolUseId || (0, import_node_crypto3.randomUUID)().slice(0, 12);
+  const requestId = input.toolUseId || (0, import_node_crypto4.randomUUID)().slice(0, 12);
   state.inflightTools.set(requestId, {
     tool: toolName,
     startedAt: hookStart,
     requestId
   });
   const payloadDigest = computePayloadDigest(input.toolInput);
+  const actionReadback = buildActionReadback(toolName, input.toolInput || {});
   const swarm = {
     ...state.swarmContext,
     ...input.agentId && { agent_id: input.agentId },
@@ -701,7 +792,10 @@ async function handlePreToolUse(input, state) {
         context: {
           hook_event: "PreToolUse",
           ...input.toolInput || {}
-        }
+        },
+        // Also expose the raw tool input under context.input so policies written
+        // against the documented nested shape match on the hook path too.
+        toolInput: input.toolInput || {}
       });
       if (!cedarDecision.allowed) {
         const reason = cedarDecision.reason || "cedar_deny";
@@ -720,6 +814,7 @@ async function handlePreToolUse(input, state) {
           swarm: swarm.team_name ? swarm : void 0,
           timing: { hook_latency_ms: hookLatency2, started_at: hookStart },
           payload_digest: payloadDigest,
+          action_readback: actionReadback,
           deny_iteration: denyCount,
           sandbox_state: detectSandboxState(),
           plan_receipt_id: state.activePlanReceiptId || void 0
@@ -740,10 +835,30 @@ async function handlePreToolUse(input, state) {
         };
       }
     } catch (err) {
-      if (state.verbose) {
-        process.stderr.write(`[PROTECT_MCP] Cedar eval error: ${err instanceof Error ? err.message : err}
-`);
-      }
+      const hookLatency2 = Date.now() - hookStart;
+      process.stderr.write(
+        `[PROTECT_MCP] Cedar eval threw for "${toolName}", failing closed: ${err instanceof Error ? err.message : err}
+`
+      );
+      emitDecisionLog(state, {
+        tool: toolName,
+        decision: "deny",
+        reason_code: "cedar_eval_error",
+        request_id: requestId,
+        hook_event: "PreToolUse",
+        swarm: swarm.team_name ? swarm : void 0,
+        timing: { hook_latency_ms: hookLatency2, started_at: hookStart },
+        payload_digest: payloadDigest,
+        action_readback: actionReadback,
+        sandbox_state: detectSandboxState()
+      });
+      return {
+        hookSpecificOutput: {
+          hookEventName: "PreToolUse",
+          permissionDecision: "deny",
+          permissionDecisionReason: `[ScopeBlind] Denied: the policy engine errored while evaluating "${toolName}", so the gate fails closed rather than allow an unverified call. Check the policy set and server logs.`
+        }
+      };
     }
   }
   if (state.jsonPolicy?.policy) {
@@ -759,6 +874,7 @@ async function handlePreToolUse(input, state) {
         swarm: swarm.team_name ? swarm : void 0,
         timing: { hook_latency_ms: hookLatency2, started_at: hookStart },
         payload_digest: payloadDigest,
+        action_readback: actionReadback,
         sandbox_state: detectSandboxState()
       });
       return {
@@ -779,13 +895,15 @@ async function handlePreToolUse(input, state) {
         hook_event: "PreToolUse",
         swarm: swarm.team_name ? swarm : void 0,
         timing: { hook_latency_ms: hookLatency2, started_at: hookStart },
+        payload_digest: payloadDigest,
+        action_readback: actionReadback,
         sandbox_state: detectSandboxState()
       });
       return {
         hookSpecificOutput: {
           hookEventName: "PreToolUse",
           permissionDecision: "ask",
-          permissionDecisionReason: `[ScopeBlind] "${toolName}" requires human approval. Policy: ${state.policyDigest}`
+          permissionDecisionReason: `[ScopeBlind] Approval required for exactly this action: ${actionReadback.summary}. Payload hash: ${actionReadback.payload_hash.slice(0, 16)}\u2026 Policy: ${state.policyDigest}`
         }
       };
     }
@@ -830,6 +948,7 @@ async function handlePreToolUse(input, state) {
     swarm: swarm.team_name ? swarm : void 0,
     timing: { hook_latency_ms: hookLatency, started_at: hookStart },
     payload_digest: payloadDigest,
+    action_readback: actionReadback,
     sandbox_state: detectSandboxState(),
     plan_receipt_id: state.activePlanReceiptId || void 0
   });
@@ -846,7 +965,7 @@ async function handlePreToolUse(input, state) {
 }
 async function handlePostToolUse(input, state) {
   const toolName = input.toolName || "unknown";
-  const requestId = input.toolUseId || (0, import_node_crypto3.randomUUID)().slice(0, 12);
+  const requestId = input.toolUseId || (0, import_node_crypto4.randomUUID)().slice(0, 12);
   const now = Date.now();
   const inflight = state.inflightTools.get(requestId);
   const timing = {
@@ -858,7 +977,7 @@ async function handlePostToolUse(input, state) {
     state.inflightTools.delete(requestId);
   }
   const outputDigest = computeOutputDigest(input.toolResult);
-  const receiptId = (0, import_node_crypto3.randomUUID)().slice(0, 8);
+  const receiptId = (0, import_node_crypto4.randomUUID)().slice(0, 8);
   const policyName = state.cedarPolicies ? `cedar:${state.policyDigest}` : state.policyDigest;
   const additionalContext = `[ScopeBlind] Tool call receipted. Policy: ${policyName}. Decision: allow. Receipt: #${receiptId}.` + (timing.tool_duration_ms !== void 0 ? ` Duration: ${timing.tool_duration_ms}ms.` : "") + (timing.hook_latency_ms !== void 0 ? ` Overhead: ${timing.hook_latency_ms}ms.` : "");
   emitDecisionLog(state, {
@@ -890,7 +1009,7 @@ function handleSubagentStart(input, state) {
     tool: `subagent:${agentId}`,
     decision: "allow",
     reason_code: "subagent_started",
-    request_id: (0, import_node_crypto3.randomUUID)().slice(0, 12),
+    request_id: (0, import_node_crypto4.randomUUID)().slice(0, 12),
     hook_event: "SubagentStart",
     swarm: {
       ...state.swarmContext,
@@ -911,7 +1030,7 @@ function handleSubagentStop(input, state) {
     tool: `subagent:${agentId}`,
     decision: "allow",
     reason_code: "subagent_stopped",
-    request_id: (0, import_node_crypto3.randomUUID)().slice(0, 12),
+    request_id: (0, import_node_crypto4.randomUUID)().slice(0, 12),
     hook_event: "SubagentStop",
     swarm: {
       ...state.swarmContext,
@@ -926,7 +1045,7 @@ function handleTaskCreated(input, state) {
     tool: `task:${input.taskId || "unknown"}`,
     decision: "allow",
     reason_code: "task_created",
-    request_id: (0, import_node_crypto3.randomUUID)().slice(0, 12),
+    request_id: (0, import_node_crypto4.randomUUID)().slice(0, 12),
     hook_event: "TaskCreated",
     swarm: {
       ...state.swarmContext,
@@ -940,7 +1059,7 @@ function handleTaskCompleted(input, state) {
     tool: `task:${input.taskId || "unknown"}`,
     decision: "allow",
     reason_code: "task_completed",
-    request_id: (0, import_node_crypto3.randomUUID)().slice(0, 12),
+    request_id: (0, import_node_crypto4.randomUUID)().slice(0, 12),
     hook_event: "TaskCompleted",
     swarm: state.swarmContext
   });
@@ -951,7 +1070,7 @@ function handleSessionStart(input, state) {
     tool: "session",
     decision: "allow",
     reason_code: "session_started",
-    request_id: input.sessionId || (0, import_node_crypto3.randomUUID)().slice(0, 12),
+    request_id: input.sessionId || (0, import_node_crypto4.randomUUID)().slice(0, 12),
     hook_event: "SessionStart",
     swarm: state.swarmContext,
     sandbox_state: detectSandboxState()
@@ -974,7 +1093,7 @@ function handleSessionEnd(input, state) {
     tool: "session",
     decision: "allow",
     reason_code: "session_ended",
-    request_id: input.sessionId || (0, import_node_crypto3.randomUUID)().slice(0, 12),
+    request_id: input.sessionId || (0, import_node_crypto4.randomUUID)().slice(0, 12),
     hook_event: "SessionEnd",
     swarm: state.swarmContext
   });
@@ -985,7 +1104,7 @@ function handleTeammateIdle(input, state) {
     tool: `teammate:${input.agentId || "unknown"}`,
     decision: "allow",
     reason_code: "teammate_idle",
-    request_id: (0, import_node_crypto3.randomUUID)().slice(0, 12),
+    request_id: (0, import_node_crypto4.randomUUID)().slice(0, 12),
     hook_event: "TeammateIdle",
     swarm: {
       ...state.swarmContext,
@@ -1013,7 +1132,7 @@ function handleConfigChange(input, state) {
       tool: "config",
       decision: "deny",
       reason_code: "config_tamper_detected",
-      request_id: (0, import_node_crypto3.randomUUID)().slice(0, 12),
+      request_id: (0, import_node_crypto4.randomUUID)().slice(0, 12),
       hook_event: "ConfigChange",
       swarm: state.swarmContext
     });
@@ -1022,7 +1141,7 @@ function handleConfigChange(input, state) {
       tool: "config",
       decision: "allow",
       reason_code: "config_changed",
-      request_id: (0, import_node_crypto3.randomUUID)().slice(0, 12),
+      request_id: (0, import_node_crypto4.randomUUID)().slice(0, 12),
       hook_event: "ConfigChange"
     });
   }
@@ -1044,7 +1163,7 @@ function handleStop(input, state) {
     tool: "session",
     decision: "allow",
     reason_code: "agent_stopped",
-    request_id: (0, import_node_crypto3.randomUUID)().slice(0, 12),
+    request_id: (0, import_node_crypto4.randomUUID)().slice(0, 12),
     hook_event: "Stop",
     swarm: state.swarmContext
   });
@@ -1052,8 +1171,8 @@ function handleStop(input, state) {
 }
 function emitDecisionLog(state, entry) {
   const mode = state.enforce ? "enforce" : "shadow";
-  const otelTraceId = (0, import_node_crypto3.randomBytes)(16).toString("hex");
-  const otelSpanId = (0, import_node_crypto3.randomBytes)(8).toString("hex");
+  const otelTraceId = (0, import_node_crypto4.randomBytes)(16).toString("hex");
+  const otelSpanId = (0, import_node_crypto4.randomBytes)(8).toString("hex");
   const log = {
     v: 2,
     tool: entry.tool || "unknown",
@@ -1061,7 +1180,7 @@ function emitDecisionLog(state, entry) {
     reason_code: entry.reason_code || "default_allow",
     policy_digest: state.policyDigest,
     policy_engine: state.cedarPolicies ? "cedar" : "built-in",
-    request_id: entry.request_id || (0, import_node_crypto3.randomUUID)().slice(0, 12),
+    request_id: entry.request_id || (0, import_node_crypto4.randomUUID)().slice(0, 12),
     timestamp: Date.now(),
     mode,
     otel_trace_id: otelTraceId,

package/dist/hook-server.mjs

@@ -1,7 +1,7 @@
 import {
   startHookServer
-} from "./chunk-X63ELMU4.mjs";
-import "./chunk-546U3A7R.mjs";
+} from "./chunk-NVJHGXXG.mjs";
+import "./chunk-D2RDY2JR.mjs";
 import "./chunk-PQJP2ZCI.mjs";
 export {
   startHookServer

package/dist/{http-transport-R5AO7X6D.mjs → http-transport-4GMMRPW7.mjs}

@@ -1,7 +1,7 @@
 import {
   ProtectGateway
-} from "./chunk-OHUTUFTC.mjs";
-import "./chunk-546U3A7R.mjs";
+} from "./chunk-UBZJ3VI2.mjs";
+import "./chunk-D2RDY2JR.mjs";
 import "./chunk-PQJP2ZCI.mjs";
 
 // src/http-transport.ts

package/dist/index.d.mts

@@ -190,6 +190,18 @@ interface DecisionLog {
     plan_receipt_id?: string;
     /** Hook event that triggered this log entry */
     hook_event?: HookEventName;
+    /** Redacted exact-action readback shown to humans before approving */
+    action_readback?: {
+        tool: string;
+        action: string;
+        destination?: string;
+        payload_preview: unknown;
+        payload_hash: string;
+        payload_bytes: number;
+        disclosed_fields: string[];
+        redacted_fields: string[];
+        summary: string;
+    };
     /** IETF specification version — ties every receipt to the standard */
     spec?: string;
     /** Issuer certification level:
@@ -977,6 +989,31 @@ interface MinimalDisclosure {
     /** Merkle inclusion proof. */
     proof: MerkleProof;
 }
+interface SelectiveDisclosurePackageV0 {
+    type: 'scopeblind.selective_disclosure.v0';
+    version: 0;
+    parent_receipt_hash: string;
+    committed_fields_root: string;
+    disclosed_fields: string[];
+    hidden_fields: string[];
+    disclosures: MinimalDisclosure[];
+    verifier_explanation: {
+        summary: string;
+        disclosed: string;
+        hidden: string;
+        limitation: string;
+    };
+}
+interface SelectiveDisclosureVerification {
+    valid: boolean;
+    receipt_hash_valid: boolean;
+    signature_valid: boolean | null;
+    commitment_root_valid: boolean;
+    disclosed_fields: string[];
+    hidden_fields: string[];
+    errors: string[];
+    explanation: string[];
+}
 /**
  * Sign a DecisionLog in commitment mode.
  *
@@ -1007,6 +1044,8 @@ declare function signCommittedDecision(entry: DecisionLog, committedFieldNames:
  * @standard draft-farley-acta-signed-receipts-01 §commitment-disclosure
  */
 declare function discloseField(receiptHash: string, fieldName: string, openings: Record<string, CommittedFieldOpening>): MinimalDisclosure;
+declare function createSelectiveDisclosurePackage(receipt: Record<string, unknown>, fieldNames: string[], openings: Record<string, CommittedFieldOpening>): SelectiveDisclosurePackageV0;
+declare function verifySelectiveDisclosurePackage(receipt: Record<string, unknown>, disclosure: SelectiveDisclosurePackageV0): SelectiveDisclosureVerification;
 
 /**
  * @scopeblind/protect-mcp — External PDP Adapter
@@ -1076,6 +1115,8 @@ interface AuditBundleOptions {
     receipts: Record<string, unknown>[];
     /** Optional audit anchors */
     anchors?: Record<string, unknown>[];
+    /** Optional selective-disclosure packages opening selected committed fields */
+    selectiveDisclosures?: SelectiveDisclosurePackageV0[];
     /** JWK signing keys used by the receipts */
     signingKeys: Array<{
         kty: string;
@@ -1096,6 +1137,14 @@ interface AuditBundle {
     } | null;
     receipts: Record<string, unknown>[];
     anchors: Record<string, unknown>[];
+    selective_disclosures: SelectiveDisclosurePackageV0[];
+    privacy: {
+        selective_disclosure: {
+            supported: true;
+            model: 'salted_commitments_merkle_v0';
+            statement: string;
+        };
+    };
     verification: {
         algorithm: 'ed25519';
         signing_keys: Array<{
@@ -1620,6 +1669,71 @@ declare function generateCedarSchema(tools: McpToolDescription[], config?: Schem
  */
 declare function generateSchemaStub(namespace?: string): string;
 
+interface PolicyPack {
+    id: string;
+    name: string;
+    description: string;
+    recommendedMode: 'shadow-first' | 'enforce-ready';
+    files: Array<{
+        path: string;
+        contents: string;
+    }>;
+}
+declare const POLICY_PACKS: PolicyPack[];
+declare function getPolicyPack(id: string): PolicyPack | undefined;
+declare function policyPackIds(): string[];
+
+type ConnectorPilotId = 'github' | 'email-gmail' | 'filesystem-git' | 'slack-teams' | 'finance-pms';
+interface ConnectorEnvVar {
+    name: string;
+    required: boolean;
+    description: string;
+}
+interface ConnectorAction {
+    name: string;
+    tool: string;
+    risk: 'low' | 'medium' | 'high';
+    mode: 'observe' | 'require_approval' | 'deny';
+    description: string;
+}
+interface ConnectorPilot {
+    id: ConnectorPilotId;
+    category: string;
+    name: string;
+    status: 'usable-pilot';
+    description: string;
+    value: string;
+    env: ConnectorEnvVar[];
+    tools: string[];
+    actions: ConnectorAction[];
+    setup: string[];
+    config: Record<string, unknown>;
+    cedar: string;
+}
+interface InstalledConnectorPilot {
+    id: string;
+    name: string;
+    category: string;
+    status: string;
+    config_path: string;
+    policy_path: string;
+}
+declare const CONNECTOR_PILOTS: ConnectorPilot[];
+declare function connectorPilotIds(): ConnectorPilotId[];
+declare function getConnectorPilot(id: string): ConnectorPilot | undefined;
+declare function connectorDirectory(dir: string): string;
+declare function writeConnectorPilots(opts: {
+    dir: string;
+    ids?: string[];
+    force?: boolean;
+}): {
+    written: string[];
+    pilots: ConnectorPilot[];
+    directory: string;
+};
+declare function readInstalledConnectorPilots(dir: string): InstalledConnectorPilot[];
+declare function connectorDoctor(dir: string, env?: NodeJS.ProcessEnv): Array<Record<string, unknown>>;
+
 /**
  * Sigstore Rekor Transparency Log Anchoring
  *
@@ -3015,4 +3129,4 @@ declare function getScopeBlindBridge(): ScopeBlindBridge;
 /** Convenience: forward a signed receipt without instantiating yourself. */
 declare function forwardReceipt(signedReceipt: any): void;
 
-export { type ActionReceipt, type AdmissionResult, type AgentId, type AgentManifest, type ApprovalAssertion, type ApprovalChallenge, type ApprovalNotification, type ApprovalResult, type ArenaPayload, type ArenaReceipt, type AttestationDocument, type AttestationPayload, type AttestationProvider, type AttestationReceipt, type AttestationResult, type AuditBundle, type AuditBundleOptions, type BenchmarkPayload, type BenchmarkReceipt, type BuilderId, type C2PAAssertion, type C2PAIngredient, type C2PAManifest, type C2PAOptions, type CCRConnectorConfig, type CCRSessionContext, type CalibrationScore, type CedarEvalOptions, type CedarEvalRequest, type CedarPolicySet, type CedarSchema, type CedarSchemaResult, type CommittedFieldOpening, type CommittedSignResult, type ComplianceReport, ConfidentialGate, type ConfidentialGateConfig, type ConfidentialInferenceConfig, type CredentialConfig, type DecisionContext, type DecisionLog, type DelegationReceipt, type DisclosureMode, type Ed25519PublicKey, type EvidenceAttestation, type EvidenceAttestationInput, type EvidenceIssuer, type EvidenceReceipt, type EvidenceReceiptBase, type EvidenceSummary, type EvidenceSummaryEntry, type EvidenceType, type ExternalDecision, type ExternalPDPConfig, type HFDatasetMetadata, type HFReceiptRow, type HookEventName, type HookInput, type HookResponse, type IssuerType, type JsonRpcRequest, type JsonRpcResponse, type LeaseCompatibility, type ManifestBuilder, type ManifestCapabilities, type ManifestConfig, type ManifestIdentity, type ManifestPresentation, type ManifestSignature, type ManifestStatus, type McpToolDescription, type MinimalDisclosure, type NotificationConfig, type PassportTokenClaims, type PayloadDigest, type PlanReceipt, type PolicyEngineMode, type PredictionReceipt, type PredictionResolution, type PropagatorConfig, type ProtectConfig, ProtectGateway, type ProtectPolicy, type RateLimit, ReceiptPropagator, type RedactedResult, type RedactionSalt, type RekorAnchor, type RekorVerification, type RestraintPayload, type RestraintReceipt, type SHA256Hash, type SafetyTranscript, type Sandbox, type SandboxConfig, type SandboxReceipt, type SandboxResult, type SandboxToolCall, type SchemaGeneratorConfig, ScopeBlindBridge, type SelfTestCase, type SelfTestReport, type SigningConfig, type SimulationResult, type SimulationSummary, type SwarmContext, type TierOverrides, type TimingMetrics, type ToolPolicy, type TrustTier, type WorkPayload, type WorkReceipt, anchorToRekor, buildDecisionContext, checkRateLimit, collectSignedReceipts, computeCalibration, confidentialInference, createApprovalChallenge, createApprovalReceiptPayload, createAttestationField, createAuditBundle, createC2PAManifest, createDisclosurePackage, createEvidenceAttestation, createLogAnchorField, createReceiptChannel, createSandbox, destroySandbox, discloseField, ed25519ToDIDKey, evaluateCedar, evaluateTier, exportC2PAManifestJSON, exportJSONL, formatReportMarkdown, formatSimulation, forwardReceipt, generateC2PACommand, generateCedarSchema, generateDatasetCard, generateHFMetadata, generateReport, generateSafetyTranscript, generateSchemaStub, getScopeBlindBridge, getSignerInfo, getToolPolicy, hashReceipt, hashResponseBody, initSigning, isAgentId, isCedarAvailable, isDisclosureMode, isEvidenceType, isManifestStatus, isSigningEnabled, listCredentialLabels, loadCedarPolicies, loadPolicy, manifestToVC, meetsMinTier, parseLogFile, parseNotificationConfigFromEnv, parseRateLimit, policySetFromSource, queryExternalPDP, receiptToVP, receiptsToHFRows, redactFields, resolveCredential, revealField, runEvaluatorSelfTest, runInSandbox, sendApprovalNotification, signCommittedDecision, signDecision, simulate, toCredentialRequestOptions, toManifoldFormat, toMetaculusFormat, validateCredentials, validateEvidenceReceipt, validateManifest, verifyActaC2PAAssertions, verifyAllCommitments, verifyApprovalAssertion, verifyCommitment, verifyEvidenceAttestation, verifyRekorAnchor };
+export { type ActionReceipt, type AdmissionResult, type AgentId, type AgentManifest, type ApprovalAssertion, type ApprovalChallenge, type ApprovalNotification, type ApprovalResult, type ArenaPayload, type ArenaReceipt, type AttestationDocument, type AttestationPayload, type AttestationProvider, type AttestationReceipt, type AttestationResult, type AuditBundle, type AuditBundleOptions, type BenchmarkPayload, type BenchmarkReceipt, type BuilderId, type C2PAAssertion, type C2PAIngredient, type C2PAManifest, type C2PAOptions, type CCRConnectorConfig, type CCRSessionContext, CONNECTOR_PILOTS, type CalibrationScore, type CedarEvalOptions, type CedarEvalRequest, type CedarPolicySet, type CedarSchema, type CedarSchemaResult, type CommittedFieldOpening, type CommittedSignResult, type ComplianceReport, ConfidentialGate, type ConfidentialGateConfig, type ConfidentialInferenceConfig, type ConnectorAction, type ConnectorEnvVar, type ConnectorPilot, type ConnectorPilotId, type CredentialConfig, type DecisionContext, type DecisionLog, type DelegationReceipt, type DisclosureMode, type Ed25519PublicKey, type EvidenceAttestation, type EvidenceAttestationInput, type EvidenceIssuer, type EvidenceReceipt, type EvidenceReceiptBase, type EvidenceSummary, type EvidenceSummaryEntry, type EvidenceType, type ExternalDecision, type ExternalPDPConfig, type HFDatasetMetadata, type HFReceiptRow, type HookEventName, type HookInput, type HookResponse, type InstalledConnectorPilot, type IssuerType, type JsonRpcRequest, type JsonRpcResponse, type LeaseCompatibility, type ManifestBuilder, type ManifestCapabilities, type ManifestConfig, type ManifestIdentity, type ManifestPresentation, type ManifestSignature, type ManifestStatus, type McpToolDescription, type MinimalDisclosure, type NotificationConfig, POLICY_PACKS, type PassportTokenClaims, type PayloadDigest, type PlanReceipt, type PolicyEngineMode, type PolicyPack, type PredictionReceipt, type PredictionResolution, type PropagatorConfig, type ProtectConfig, ProtectGateway, type ProtectPolicy, type RateLimit, ReceiptPropagator, type RedactedResult, type RedactionSalt, type RekorAnchor, type RekorVerification, type RestraintPayload, type RestraintReceipt, type SHA256Hash, type SafetyTranscript, type Sandbox, type SandboxConfig, type SandboxReceipt, type SandboxResult, type SandboxToolCall, type SchemaGeneratorConfig, ScopeBlindBridge, type SelectiveDisclosurePackageV0, type SelectiveDisclosureVerification, type SelfTestCase, type SelfTestReport, type SigningConfig, type SimulationResult, type SimulationSummary, type SwarmContext, type TierOverrides, type TimingMetrics, type ToolPolicy, type TrustTier, type WorkPayload, type WorkReceipt, anchorToRekor, buildDecisionContext, checkRateLimit, collectSignedReceipts, computeCalibration, confidentialInference, connectorDirectory, connectorDoctor, connectorPilotIds, createApprovalChallenge, createApprovalReceiptPayload, createAttestationField, createAuditBundle, createC2PAManifest, createDisclosurePackage, createEvidenceAttestation, createLogAnchorField, createReceiptChannel, createSandbox, createSelectiveDisclosurePackage, destroySandbox, discloseField, ed25519ToDIDKey, evaluateCedar, evaluateTier, exportC2PAManifestJSON, exportJSONL, formatReportMarkdown, formatSimulation, forwardReceipt, generateC2PACommand, generateCedarSchema, generateDatasetCard, generateHFMetadata, generateReport, generateSafetyTranscript, generateSchemaStub, getConnectorPilot, getPolicyPack, getScopeBlindBridge, getSignerInfo, getToolPolicy, hashReceipt, hashResponseBody, initSigning, isAgentId, isCedarAvailable, isDisclosureMode, isEvidenceType, isManifestStatus, isSigningEnabled, listCredentialLabels, loadCedarPolicies, loadPolicy, manifestToVC, meetsMinTier, parseLogFile, parseNotificationConfigFromEnv, parseRateLimit, policyPackIds, policySetFromSource, queryExternalPDP, readInstalledConnectorPilots, receiptToVP, receiptsToHFRows, redactFields, resolveCredential, revealField, runEvaluatorSelfTest, runInSandbox, sendApprovalNotification, signCommittedDecision, signDecision, simulate, toCredentialRequestOptions, toManifoldFormat, toMetaculusFormat, validateCredentials, validateEvidenceReceipt, validateManifest, verifyActaC2PAAssertions, verifyAllCommitments, verifyApprovalAssertion, verifyCommitment, verifyEvidenceAttestation, verifyRekorAnchor, verifySelectiveDisclosurePackage, writeConnectorPilots };