protect-mcp 0.7.3 → 0.7.5

package/dist/index.d.mts

@@ -190,6 +190,18 @@ interface DecisionLog {
     plan_receipt_id?: string;
     /** Hook event that triggered this log entry */
     hook_event?: HookEventName;
+    /** Redacted exact-action readback shown to humans before approving */
+    action_readback?: {
+        tool: string;
+        action: string;
+        destination?: string;
+        payload_preview: unknown;
+        payload_hash: string;
+        payload_bytes: number;
+        disclosed_fields: string[];
+        redacted_fields: string[];
+        summary: string;
+    };
     /** IETF specification version — ties every receipt to the standard */
     spec?: string;
     /** Issuer certification level:
@@ -977,6 +989,31 @@ interface MinimalDisclosure {
     /** Merkle inclusion proof. */
     proof: MerkleProof;
 }
+interface SelectiveDisclosurePackageV0 {
+    type: 'scopeblind.selective_disclosure.v0';
+    version: 0;
+    parent_receipt_hash: string;
+    committed_fields_root: string;
+    disclosed_fields: string[];
+    hidden_fields: string[];
+    disclosures: MinimalDisclosure[];
+    verifier_explanation: {
+        summary: string;
+        disclosed: string;
+        hidden: string;
+        limitation: string;
+    };
+}
+interface SelectiveDisclosureVerification {
+    valid: boolean;
+    receipt_hash_valid: boolean;
+    signature_valid: boolean | null;
+    commitment_root_valid: boolean;
+    disclosed_fields: string[];
+    hidden_fields: string[];
+    errors: string[];
+    explanation: string[];
+}
 /**
  * Sign a DecisionLog in commitment mode.
  *
@@ -1007,6 +1044,8 @@ declare function signCommittedDecision(entry: DecisionLog, committedFieldNames:
  * @standard draft-farley-acta-signed-receipts-01 §commitment-disclosure
  */
 declare function discloseField(receiptHash: string, fieldName: string, openings: Record<string, CommittedFieldOpening>): MinimalDisclosure;
+declare function createSelectiveDisclosurePackage(receipt: Record<string, unknown>, fieldNames: string[], openings: Record<string, CommittedFieldOpening>): SelectiveDisclosurePackageV0;
+declare function verifySelectiveDisclosurePackage(receipt: Record<string, unknown>, disclosure: SelectiveDisclosurePackageV0): SelectiveDisclosureVerification;
 
 /**
  * @scopeblind/protect-mcp — External PDP Adapter
@@ -1076,6 +1115,8 @@ interface AuditBundleOptions {
     receipts: Record<string, unknown>[];
     /** Optional audit anchors */
     anchors?: Record<string, unknown>[];
+    /** Optional selective-disclosure packages opening selected committed fields */
+    selectiveDisclosures?: SelectiveDisclosurePackageV0[];
     /** JWK signing keys used by the receipts */
     signingKeys: Array<{
         kty: string;
@@ -1096,6 +1137,14 @@ interface AuditBundle {
     } | null;
     receipts: Record<string, unknown>[];
     anchors: Record<string, unknown>[];
+    selective_disclosures: SelectiveDisclosurePackageV0[];
+    privacy: {
+        selective_disclosure: {
+            supported: true;
+            model: 'salted_commitments_merkle_v0';
+            statement: string;
+        };
+    };
     verification: {
         algorithm: 'ed25519';
         signing_keys: Array<{
@@ -1620,6 +1669,77 @@ declare function generateCedarSchema(tools: McpToolDescription[], config?: Schem
  */
 declare function generateSchemaStub(namespace?: string): string;
 
+interface PolicyPack {
+    id: string;
+    name: string;
+    description: string;
+    recommendedMode: 'shadow-first' | 'enforce-ready';
+    files: Array<{
+        path: string;
+        contents: string;
+    }>;
+}
+declare const POLICY_PACKS: PolicyPack[];
+declare function getPolicyPack(id: string): PolicyPack | undefined;
+declare function policyPackIds(): string[];
+
+type ConnectorPilotId = 'github' | 'email-gmail' | 'filesystem-git' | 'slack-teams' | 'finance-pms' | 'nautilus-trader';
+interface ConnectorEnvVar {
+    name: string;
+    required: boolean;
+    description: string;
+}
+interface ConnectorAction {
+    name: string;
+    tool: string;
+    risk: 'low' | 'medium' | 'high';
+    mode: 'observe' | 'require_approval' | 'deny';
+    description: string;
+}
+interface ConnectorArtifact {
+    path: string;
+    contents: string;
+    executable?: boolean;
+}
+interface ConnectorPilot {
+    id: ConnectorPilotId;
+    category: string;
+    name: string;
+    status: 'usable-pilot';
+    description: string;
+    value: string;
+    env: ConnectorEnvVar[];
+    tools: string[];
+    actions: ConnectorAction[];
+    setup: string[];
+    config: Record<string, unknown>;
+    cedar: string;
+    artifacts?: ConnectorArtifact[];
+}
+interface InstalledConnectorPilot {
+    id: string;
+    name: string;
+    category: string;
+    status: string;
+    config_path: string;
+    policy_path: string;
+}
+declare const CONNECTOR_PILOTS: ConnectorPilot[];
+declare function connectorPilotIds(): ConnectorPilotId[];
+declare function getConnectorPilot(id: string): ConnectorPilot | undefined;
+declare function connectorDirectory(dir: string): string;
+declare function writeConnectorPilots(opts: {
+    dir: string;
+    ids?: string[];
+    force?: boolean;
+}): {
+    written: string[];
+    pilots: ConnectorPilot[];
+    directory: string;
+};
+declare function readInstalledConnectorPilots(dir: string): InstalledConnectorPilot[];
+declare function connectorDoctor(dir: string, env?: NodeJS.ProcessEnv): Array<Record<string, unknown>>;
+
 /**
  * Sigstore Rekor Transparency Log Anchoring
  *
@@ -2052,6 +2172,29 @@ interface ApprovalResult {
     contextHash: string;
     /** Timestamp of approval */
     approvedAt: string;
+    /** On failure, a machine-readable reason (e.g. 'invalid_signature'). */
+    reason?: string;
+}
+/**
+ * The registered credential public key, extracted from the COSE_Key at
+ * registration. ES256 keys are an uncompressed P-256 point; EdDSA keys are a
+ * 32-byte Ed25519 public key.
+ */
+interface CredentialPublicKey {
+    /** COSE algorithm: -7 = ES256 (P-256 / ECDSA), -8 = EdDSA (Ed25519). */
+    alg: -7 | -8;
+    /** Public key, hex. ES256: 65-byte uncompressed point (0x04 || x || y). EdDSA: 32-byte key. */
+    publicKeyHex: string;
+}
+interface VerifyAssertionOptions {
+    /** Allowed origin(s) the assertion must come from, e.g. 'https://app.scopeblind.com'. Defaults to https://<rpId>. */
+    expectedOrigin?: string | string[];
+    /** Require the UV (user-verified / biometric or PIN) flag. Default true. */
+    requireUserVerification?: boolean;
+    /** The signCount stored from the previous assertion; a non-increasing counter signals a cloned authenticator. */
+    prevSignCount?: number;
+    /** Override 'now' (ms) for testing. */
+    now?: number;
 }
 /**
  * Create a WebAuthn challenge for approving a tool call.
@@ -2088,17 +2231,22 @@ declare function toCredentialRequestOptions(challenge: ApprovalChallenge, allowC
     };
 };
 /**
- * Verify a WebAuthn assertion from the client.
- *
- * This is a simplified verification that checks the structure
- * and extracts the authenticator data. For production use with
- * full signature verification, use the @simplewebauthn/server package.
+ * Verify a WebAuthn assertion: full, fail-closed verification of a passkey or
+ * security-key co-sign. This proves a SPECIFIC human authorized a SPECIFIC
+ * action with a hardware-held key the host operator cannot exfiltrate. It
+ * checks, in order: challenge freshness; clientDataJSON type, challenge, and
+ * origin; the rpIdHash; the UP (and, by default, UV) flags; the authenticator
+ * signature over authenticatorData || SHA-256(clientDataJSON) using the
+ * registered credential public key (ES256 or EdDSA); and signCount monotonicity
+ * (clone detection) when a previous count is supplied. Any failure returns
+ * valid:false with a reason; nothing is trusted on a partial check.
  *
- * @param challenge - The original challenge
- * @param assertion - The assertion from navigator.credentials.get()
- * @returns ApprovalResult with verification details
+ * @param challenge - the original challenge
+ * @param assertion - the assertion from navigator.credentials.get()
+ * @param credentialPublicKey - the registered public key for assertion.credentialId
+ * @param opts - origin / UV / signCount / clock options
  */
-declare function verifyApprovalAssertion(challenge: ApprovalChallenge, assertion: ApprovalAssertion): ApprovalResult;
+declare function verifyApprovalAssertion(challenge: ApprovalChallenge, assertion: ApprovalAssertion, credentialPublicKey?: CredentialPublicKey, opts?: VerifyAssertionOptions): ApprovalResult;
 /**
  * Create the approval receipt payload for embedding in an Acta receipt.
  *
@@ -3015,4 +3163,4 @@ declare function getScopeBlindBridge(): ScopeBlindBridge;
 /** Convenience: forward a signed receipt without instantiating yourself. */
 declare function forwardReceipt(signedReceipt: any): void;
 
-export { type ActionReceipt, type AdmissionResult, type AgentId, type AgentManifest, type ApprovalAssertion, type ApprovalChallenge, type ApprovalNotification, type ApprovalResult, type ArenaPayload, type ArenaReceipt, type AttestationDocument, type AttestationPayload, type AttestationProvider, type AttestationReceipt, type AttestationResult, type AuditBundle, type AuditBundleOptions, type BenchmarkPayload, type BenchmarkReceipt, type BuilderId, type C2PAAssertion, type C2PAIngredient, type C2PAManifest, type C2PAOptions, type CCRConnectorConfig, type CCRSessionContext, type CalibrationScore, type CedarEvalOptions, type CedarEvalRequest, type CedarPolicySet, type CedarSchema, type CedarSchemaResult, type CommittedFieldOpening, type CommittedSignResult, type ComplianceReport, ConfidentialGate, type ConfidentialGateConfig, type ConfidentialInferenceConfig, type CredentialConfig, type DecisionContext, type DecisionLog, type DelegationReceipt, type DisclosureMode, type Ed25519PublicKey, type EvidenceAttestation, type EvidenceAttestationInput, type EvidenceIssuer, type EvidenceReceipt, type EvidenceReceiptBase, type EvidenceSummary, type EvidenceSummaryEntry, type EvidenceType, type ExternalDecision, type ExternalPDPConfig, type HFDatasetMetadata, type HFReceiptRow, type HookEventName, type HookInput, type HookResponse, type IssuerType, type JsonRpcRequest, type JsonRpcResponse, type LeaseCompatibility, type ManifestBuilder, type ManifestCapabilities, type ManifestConfig, type ManifestIdentity, type ManifestPresentation, type ManifestSignature, type ManifestStatus, type McpToolDescription, type MinimalDisclosure, type NotificationConfig, type PassportTokenClaims, type PayloadDigest, type PlanReceipt, type PolicyEngineMode, type PredictionReceipt, type PredictionResolution, type PropagatorConfig, type ProtectConfig, ProtectGateway, type ProtectPolicy, type RateLimit, ReceiptPropagator, type RedactedResult, type RedactionSalt, type RekorAnchor, type RekorVerification, type RestraintPayload, type RestraintReceipt, type SHA256Hash, type SafetyTranscript, type Sandbox, type SandboxConfig, type SandboxReceipt, type SandboxResult, type SandboxToolCall, type SchemaGeneratorConfig, ScopeBlindBridge, type SelfTestCase, type SelfTestReport, type SigningConfig, type SimulationResult, type SimulationSummary, type SwarmContext, type TierOverrides, type TimingMetrics, type ToolPolicy, type TrustTier, type WorkPayload, type WorkReceipt, anchorToRekor, buildDecisionContext, checkRateLimit, collectSignedReceipts, computeCalibration, confidentialInference, createApprovalChallenge, createApprovalReceiptPayload, createAttestationField, createAuditBundle, createC2PAManifest, createDisclosurePackage, createEvidenceAttestation, createLogAnchorField, createReceiptChannel, createSandbox, destroySandbox, discloseField, ed25519ToDIDKey, evaluateCedar, evaluateTier, exportC2PAManifestJSON, exportJSONL, formatReportMarkdown, formatSimulation, forwardReceipt, generateC2PACommand, generateCedarSchema, generateDatasetCard, generateHFMetadata, generateReport, generateSafetyTranscript, generateSchemaStub, getScopeBlindBridge, getSignerInfo, getToolPolicy, hashReceipt, hashResponseBody, initSigning, isAgentId, isCedarAvailable, isDisclosureMode, isEvidenceType, isManifestStatus, isSigningEnabled, listCredentialLabels, loadCedarPolicies, loadPolicy, manifestToVC, meetsMinTier, parseLogFile, parseNotificationConfigFromEnv, parseRateLimit, policySetFromSource, queryExternalPDP, receiptToVP, receiptsToHFRows, redactFields, resolveCredential, revealField, runEvaluatorSelfTest, runInSandbox, sendApprovalNotification, signCommittedDecision, signDecision, simulate, toCredentialRequestOptions, toManifoldFormat, toMetaculusFormat, validateCredentials, validateEvidenceReceipt, validateManifest, verifyActaC2PAAssertions, verifyAllCommitments, verifyApprovalAssertion, verifyCommitment, verifyEvidenceAttestation, verifyRekorAnchor };
+export { type ActionReceipt, type AdmissionResult, type AgentId, type AgentManifest, type ApprovalAssertion, type ApprovalChallenge, type ApprovalNotification, type ApprovalResult, type ArenaPayload, type ArenaReceipt, type AttestationDocument, type AttestationPayload, type AttestationProvider, type AttestationReceipt, type AttestationResult, type AuditBundle, type AuditBundleOptions, type BenchmarkPayload, type BenchmarkReceipt, type BuilderId, type C2PAAssertion, type C2PAIngredient, type C2PAManifest, type C2PAOptions, type CCRConnectorConfig, type CCRSessionContext, CONNECTOR_PILOTS, type CalibrationScore, type CedarEvalOptions, type CedarEvalRequest, type CedarPolicySet, type CedarSchema, type CedarSchemaResult, type CommittedFieldOpening, type CommittedSignResult, type ComplianceReport, ConfidentialGate, type ConfidentialGateConfig, type ConfidentialInferenceConfig, type ConnectorAction, type ConnectorEnvVar, type ConnectorPilot, type ConnectorPilotId, type CredentialConfig, type DecisionContext, type DecisionLog, type DelegationReceipt, type DisclosureMode, type Ed25519PublicKey, type EvidenceAttestation, type EvidenceAttestationInput, type EvidenceIssuer, type EvidenceReceipt, type EvidenceReceiptBase, type EvidenceSummary, type EvidenceSummaryEntry, type EvidenceType, type ExternalDecision, type ExternalPDPConfig, type HFDatasetMetadata, type HFReceiptRow, type HookEventName, type HookInput, type HookResponse, type InstalledConnectorPilot, type IssuerType, type JsonRpcRequest, type JsonRpcResponse, type LeaseCompatibility, type ManifestBuilder, type ManifestCapabilities, type ManifestConfig, type ManifestIdentity, type ManifestPresentation, type ManifestSignature, type ManifestStatus, type McpToolDescription, type MinimalDisclosure, type NotificationConfig, POLICY_PACKS, type PassportTokenClaims, type PayloadDigest, type PlanReceipt, type PolicyEngineMode, type PolicyPack, type PredictionReceipt, type PredictionResolution, type PropagatorConfig, type ProtectConfig, ProtectGateway, type ProtectPolicy, type RateLimit, ReceiptPropagator, type RedactedResult, type RedactionSalt, type RekorAnchor, type RekorVerification, type RestraintPayload, type RestraintReceipt, type SHA256Hash, type SafetyTranscript, type Sandbox, type SandboxConfig, type SandboxReceipt, type SandboxResult, type SandboxToolCall, type SchemaGeneratorConfig, ScopeBlindBridge, type SelectiveDisclosurePackageV0, type SelectiveDisclosureVerification, type SelfTestCase, type SelfTestReport, type SigningConfig, type SimulationResult, type SimulationSummary, type SwarmContext, type TierOverrides, type TimingMetrics, type ToolPolicy, type TrustTier, type WorkPayload, type WorkReceipt, anchorToRekor, buildDecisionContext, checkRateLimit, collectSignedReceipts, computeCalibration, confidentialInference, connectorDirectory, connectorDoctor, connectorPilotIds, createApprovalChallenge, createApprovalReceiptPayload, createAttestationField, createAuditBundle, createC2PAManifest, createDisclosurePackage, createEvidenceAttestation, createLogAnchorField, createReceiptChannel, createSandbox, createSelectiveDisclosurePackage, destroySandbox, discloseField, ed25519ToDIDKey, evaluateCedar, evaluateTier, exportC2PAManifestJSON, exportJSONL, formatReportMarkdown, formatSimulation, forwardReceipt, generateC2PACommand, generateCedarSchema, generateDatasetCard, generateHFMetadata, generateReport, generateSafetyTranscript, generateSchemaStub, getConnectorPilot, getPolicyPack, getScopeBlindBridge, getSignerInfo, getToolPolicy, hashReceipt, hashResponseBody, initSigning, isAgentId, isCedarAvailable, isDisclosureMode, isEvidenceType, isManifestStatus, isSigningEnabled, listCredentialLabels, loadCedarPolicies, loadPolicy, manifestToVC, meetsMinTier, parseLogFile, parseNotificationConfigFromEnv, parseRateLimit, policyPackIds, policySetFromSource, queryExternalPDP, readInstalledConnectorPilots, receiptToVP, receiptsToHFRows, redactFields, resolveCredential, revealField, runEvaluatorSelfTest, runInSandbox, sendApprovalNotification, signCommittedDecision, signDecision, simulate, toCredentialRequestOptions, toManifoldFormat, toMetaculusFormat, validateCredentials, validateEvidenceReceipt, validateManifest, verifyActaC2PAAssertions, verifyAllCommitments, verifyApprovalAssertion, verifyCommitment, verifyEvidenceAttestation, verifyRekorAnchor, verifySelectiveDisclosurePackage, writeConnectorPilots };

package/dist/index.d.ts

@@ -190,6 +190,18 @@ interface DecisionLog {
     plan_receipt_id?: string;
     /** Hook event that triggered this log entry */
     hook_event?: HookEventName;
+    /** Redacted exact-action readback shown to humans before approving */
+    action_readback?: {
+        tool: string;
+        action: string;
+        destination?: string;
+        payload_preview: unknown;
+        payload_hash: string;
+        payload_bytes: number;
+        disclosed_fields: string[];
+        redacted_fields: string[];
+        summary: string;
+    };
     /** IETF specification version — ties every receipt to the standard */
     spec?: string;
     /** Issuer certification level:
@@ -977,6 +989,31 @@ interface MinimalDisclosure {
     /** Merkle inclusion proof. */
     proof: MerkleProof;
 }
+interface SelectiveDisclosurePackageV0 {
+    type: 'scopeblind.selective_disclosure.v0';
+    version: 0;
+    parent_receipt_hash: string;
+    committed_fields_root: string;
+    disclosed_fields: string[];
+    hidden_fields: string[];
+    disclosures: MinimalDisclosure[];
+    verifier_explanation: {
+        summary: string;
+        disclosed: string;
+        hidden: string;
+        limitation: string;
+    };
+}
+interface SelectiveDisclosureVerification {
+    valid: boolean;
+    receipt_hash_valid: boolean;
+    signature_valid: boolean | null;
+    commitment_root_valid: boolean;
+    disclosed_fields: string[];
+    hidden_fields: string[];
+    errors: string[];
+    explanation: string[];
+}
 /**
  * Sign a DecisionLog in commitment mode.
  *
@@ -1007,6 +1044,8 @@ declare function signCommittedDecision(entry: DecisionLog, committedFieldNames:
  * @standard draft-farley-acta-signed-receipts-01 §commitment-disclosure
  */
 declare function discloseField(receiptHash: string, fieldName: string, openings: Record<string, CommittedFieldOpening>): MinimalDisclosure;
+declare function createSelectiveDisclosurePackage(receipt: Record<string, unknown>, fieldNames: string[], openings: Record<string, CommittedFieldOpening>): SelectiveDisclosurePackageV0;
+declare function verifySelectiveDisclosurePackage(receipt: Record<string, unknown>, disclosure: SelectiveDisclosurePackageV0): SelectiveDisclosureVerification;
 
 /**
  * @scopeblind/protect-mcp — External PDP Adapter
@@ -1076,6 +1115,8 @@ interface AuditBundleOptions {
     receipts: Record<string, unknown>[];
     /** Optional audit anchors */
     anchors?: Record<string, unknown>[];
+    /** Optional selective-disclosure packages opening selected committed fields */
+    selectiveDisclosures?: SelectiveDisclosurePackageV0[];
     /** JWK signing keys used by the receipts */
     signingKeys: Array<{
         kty: string;
@@ -1096,6 +1137,14 @@ interface AuditBundle {
     } | null;
     receipts: Record<string, unknown>[];
     anchors: Record<string, unknown>[];
+    selective_disclosures: SelectiveDisclosurePackageV0[];
+    privacy: {
+        selective_disclosure: {
+            supported: true;
+            model: 'salted_commitments_merkle_v0';
+            statement: string;
+        };
+    };
     verification: {
         algorithm: 'ed25519';
         signing_keys: Array<{
@@ -1620,6 +1669,77 @@ declare function generateCedarSchema(tools: McpToolDescription[], config?: Schem
  */
 declare function generateSchemaStub(namespace?: string): string;
 
+interface PolicyPack {
+    id: string;
+    name: string;
+    description: string;
+    recommendedMode: 'shadow-first' | 'enforce-ready';
+    files: Array<{
+        path: string;
+        contents: string;
+    }>;
+}
+declare const POLICY_PACKS: PolicyPack[];
+declare function getPolicyPack(id: string): PolicyPack | undefined;
+declare function policyPackIds(): string[];
+
+type ConnectorPilotId = 'github' | 'email-gmail' | 'filesystem-git' | 'slack-teams' | 'finance-pms' | 'nautilus-trader';
+interface ConnectorEnvVar {
+    name: string;
+    required: boolean;
+    description: string;
+}
+interface ConnectorAction {
+    name: string;
+    tool: string;
+    risk: 'low' | 'medium' | 'high';
+    mode: 'observe' | 'require_approval' | 'deny';
+    description: string;
+}
+interface ConnectorArtifact {
+    path: string;
+    contents: string;
+    executable?: boolean;
+}
+interface ConnectorPilot {
+    id: ConnectorPilotId;
+    category: string;
+    name: string;
+    status: 'usable-pilot';
+    description: string;
+    value: string;
+    env: ConnectorEnvVar[];
+    tools: string[];
+    actions: ConnectorAction[];
+    setup: string[];
+    config: Record<string, unknown>;
+    cedar: string;
+    artifacts?: ConnectorArtifact[];
+}
+interface InstalledConnectorPilot {
+    id: string;
+    name: string;
+    category: string;
+    status: string;
+    config_path: string;
+    policy_path: string;
+}
+declare const CONNECTOR_PILOTS: ConnectorPilot[];
+declare function connectorPilotIds(): ConnectorPilotId[];
+declare function getConnectorPilot(id: string): ConnectorPilot | undefined;
+declare function connectorDirectory(dir: string): string;
+declare function writeConnectorPilots(opts: {
+    dir: string;
+    ids?: string[];
+    force?: boolean;
+}): {
+    written: string[];
+    pilots: ConnectorPilot[];
+    directory: string;
+};
+declare function readInstalledConnectorPilots(dir: string): InstalledConnectorPilot[];
+declare function connectorDoctor(dir: string, env?: NodeJS.ProcessEnv): Array<Record<string, unknown>>;
+
 /**
  * Sigstore Rekor Transparency Log Anchoring
  *
@@ -2052,6 +2172,29 @@ interface ApprovalResult {
     contextHash: string;
     /** Timestamp of approval */
     approvedAt: string;
+    /** On failure, a machine-readable reason (e.g. 'invalid_signature'). */
+    reason?: string;
+}
+/**
+ * The registered credential public key, extracted from the COSE_Key at
+ * registration. ES256 keys are an uncompressed P-256 point; EdDSA keys are a
+ * 32-byte Ed25519 public key.
+ */
+interface CredentialPublicKey {
+    /** COSE algorithm: -7 = ES256 (P-256 / ECDSA), -8 = EdDSA (Ed25519). */
+    alg: -7 | -8;
+    /** Public key, hex. ES256: 65-byte uncompressed point (0x04 || x || y). EdDSA: 32-byte key. */
+    publicKeyHex: string;
+}
+interface VerifyAssertionOptions {
+    /** Allowed origin(s) the assertion must come from, e.g. 'https://app.scopeblind.com'. Defaults to https://<rpId>. */
+    expectedOrigin?: string | string[];
+    /** Require the UV (user-verified / biometric or PIN) flag. Default true. */
+    requireUserVerification?: boolean;
+    /** The signCount stored from the previous assertion; a non-increasing counter signals a cloned authenticator. */
+    prevSignCount?: number;
+    /** Override 'now' (ms) for testing. */
+    now?: number;
 }
 /**
  * Create a WebAuthn challenge for approving a tool call.
@@ -2088,17 +2231,22 @@ declare function toCredentialRequestOptions(challenge: ApprovalChallenge, allowC
     };
 };
 /**
- * Verify a WebAuthn assertion from the client.
- *
- * This is a simplified verification that checks the structure
- * and extracts the authenticator data. For production use with
- * full signature verification, use the @simplewebauthn/server package.
+ * Verify a WebAuthn assertion: full, fail-closed verification of a passkey or
+ * security-key co-sign. This proves a SPECIFIC human authorized a SPECIFIC
+ * action with a hardware-held key the host operator cannot exfiltrate. It
+ * checks, in order: challenge freshness; clientDataJSON type, challenge, and
+ * origin; the rpIdHash; the UP (and, by default, UV) flags; the authenticator
+ * signature over authenticatorData || SHA-256(clientDataJSON) using the
+ * registered credential public key (ES256 or EdDSA); and signCount monotonicity
+ * (clone detection) when a previous count is supplied. Any failure returns
+ * valid:false with a reason; nothing is trusted on a partial check.
  *
- * @param challenge - The original challenge
- * @param assertion - The assertion from navigator.credentials.get()
- * @returns ApprovalResult with verification details
+ * @param challenge - the original challenge
+ * @param assertion - the assertion from navigator.credentials.get()
+ * @param credentialPublicKey - the registered public key for assertion.credentialId
+ * @param opts - origin / UV / signCount / clock options
  */
-declare function verifyApprovalAssertion(challenge: ApprovalChallenge, assertion: ApprovalAssertion): ApprovalResult;
+declare function verifyApprovalAssertion(challenge: ApprovalChallenge, assertion: ApprovalAssertion, credentialPublicKey?: CredentialPublicKey, opts?: VerifyAssertionOptions): ApprovalResult;
 /**
  * Create the approval receipt payload for embedding in an Acta receipt.
  *
@@ -3015,4 +3163,4 @@ declare function getScopeBlindBridge(): ScopeBlindBridge;
 /** Convenience: forward a signed receipt without instantiating yourself. */
 declare function forwardReceipt(signedReceipt: any): void;
 
-export { type ActionReceipt, type AdmissionResult, type AgentId, type AgentManifest, type ApprovalAssertion, type ApprovalChallenge, type ApprovalNotification, type ApprovalResult, type ArenaPayload, type ArenaReceipt, type AttestationDocument, type AttestationPayload, type AttestationProvider, type AttestationReceipt, type AttestationResult, type AuditBundle, type AuditBundleOptions, type BenchmarkPayload, type BenchmarkReceipt, type BuilderId, type C2PAAssertion, type C2PAIngredient, type C2PAManifest, type C2PAOptions, type CCRConnectorConfig, type CCRSessionContext, type CalibrationScore, type CedarEvalOptions, type CedarEvalRequest, type CedarPolicySet, type CedarSchema, type CedarSchemaResult, type CommittedFieldOpening, type CommittedSignResult, type ComplianceReport, ConfidentialGate, type ConfidentialGateConfig, type ConfidentialInferenceConfig, type CredentialConfig, type DecisionContext, type DecisionLog, type DelegationReceipt, type DisclosureMode, type Ed25519PublicKey, type EvidenceAttestation, type EvidenceAttestationInput, type EvidenceIssuer, type EvidenceReceipt, type EvidenceReceiptBase, type EvidenceSummary, type EvidenceSummaryEntry, type EvidenceType, type ExternalDecision, type ExternalPDPConfig, type HFDatasetMetadata, type HFReceiptRow, type HookEventName, type HookInput, type HookResponse, type IssuerType, type JsonRpcRequest, type JsonRpcResponse, type LeaseCompatibility, type ManifestBuilder, type ManifestCapabilities, type ManifestConfig, type ManifestIdentity, type ManifestPresentation, type ManifestSignature, type ManifestStatus, type McpToolDescription, type MinimalDisclosure, type NotificationConfig, type PassportTokenClaims, type PayloadDigest, type PlanReceipt, type PolicyEngineMode, type PredictionReceipt, type PredictionResolution, type PropagatorConfig, type ProtectConfig, ProtectGateway, type ProtectPolicy, type RateLimit, ReceiptPropagator, type RedactedResult, type RedactionSalt, type RekorAnchor, type RekorVerification, type RestraintPayload, type RestraintReceipt, type SHA256Hash, type SafetyTranscript, type Sandbox, type SandboxConfig, type SandboxReceipt, type SandboxResult, type SandboxToolCall, type SchemaGeneratorConfig, ScopeBlindBridge, type SelfTestCase, type SelfTestReport, type SigningConfig, type SimulationResult, type SimulationSummary, type SwarmContext, type TierOverrides, type TimingMetrics, type ToolPolicy, type TrustTier, type WorkPayload, type WorkReceipt, anchorToRekor, buildDecisionContext, checkRateLimit, collectSignedReceipts, computeCalibration, confidentialInference, createApprovalChallenge, createApprovalReceiptPayload, createAttestationField, createAuditBundle, createC2PAManifest, createDisclosurePackage, createEvidenceAttestation, createLogAnchorField, createReceiptChannel, createSandbox, destroySandbox, discloseField, ed25519ToDIDKey, evaluateCedar, evaluateTier, exportC2PAManifestJSON, exportJSONL, formatReportMarkdown, formatSimulation, forwardReceipt, generateC2PACommand, generateCedarSchema, generateDatasetCard, generateHFMetadata, generateReport, generateSafetyTranscript, generateSchemaStub, getScopeBlindBridge, getSignerInfo, getToolPolicy, hashReceipt, hashResponseBody, initSigning, isAgentId, isCedarAvailable, isDisclosureMode, isEvidenceType, isManifestStatus, isSigningEnabled, listCredentialLabels, loadCedarPolicies, loadPolicy, manifestToVC, meetsMinTier, parseLogFile, parseNotificationConfigFromEnv, parseRateLimit, policySetFromSource, queryExternalPDP, receiptToVP, receiptsToHFRows, redactFields, resolveCredential, revealField, runEvaluatorSelfTest, runInSandbox, sendApprovalNotification, signCommittedDecision, signDecision, simulate, toCredentialRequestOptions, toManifoldFormat, toMetaculusFormat, validateCredentials, validateEvidenceReceipt, validateManifest, verifyActaC2PAAssertions, verifyAllCommitments, verifyApprovalAssertion, verifyCommitment, verifyEvidenceAttestation, verifyRekorAnchor };
+export { type ActionReceipt, type AdmissionResult, type AgentId, type AgentManifest, type ApprovalAssertion, type ApprovalChallenge, type ApprovalNotification, type ApprovalResult, type ArenaPayload, type ArenaReceipt, type AttestationDocument, type AttestationPayload, type AttestationProvider, type AttestationReceipt, type AttestationResult, type AuditBundle, type AuditBundleOptions, type BenchmarkPayload, type BenchmarkReceipt, type BuilderId, type C2PAAssertion, type C2PAIngredient, type C2PAManifest, type C2PAOptions, type CCRConnectorConfig, type CCRSessionContext, CONNECTOR_PILOTS, type CalibrationScore, type CedarEvalOptions, type CedarEvalRequest, type CedarPolicySet, type CedarSchema, type CedarSchemaResult, type CommittedFieldOpening, type CommittedSignResult, type ComplianceReport, ConfidentialGate, type ConfidentialGateConfig, type ConfidentialInferenceConfig, type ConnectorAction, type ConnectorEnvVar, type ConnectorPilot, type ConnectorPilotId, type CredentialConfig, type DecisionContext, type DecisionLog, type DelegationReceipt, type DisclosureMode, type Ed25519PublicKey, type EvidenceAttestation, type EvidenceAttestationInput, type EvidenceIssuer, type EvidenceReceipt, type EvidenceReceiptBase, type EvidenceSummary, type EvidenceSummaryEntry, type EvidenceType, type ExternalDecision, type ExternalPDPConfig, type HFDatasetMetadata, type HFReceiptRow, type HookEventName, type HookInput, type HookResponse, type InstalledConnectorPilot, type IssuerType, type JsonRpcRequest, type JsonRpcResponse, type LeaseCompatibility, type ManifestBuilder, type ManifestCapabilities, type ManifestConfig, type ManifestIdentity, type ManifestPresentation, type ManifestSignature, type ManifestStatus, type McpToolDescription, type MinimalDisclosure, type NotificationConfig, POLICY_PACKS, type PassportTokenClaims, type PayloadDigest, type PlanReceipt, type PolicyEngineMode, type PolicyPack, type PredictionReceipt, type PredictionResolution, type PropagatorConfig, type ProtectConfig, ProtectGateway, type ProtectPolicy, type RateLimit, ReceiptPropagator, type RedactedResult, type RedactionSalt, type RekorAnchor, type RekorVerification, type RestraintPayload, type RestraintReceipt, type SHA256Hash, type SafetyTranscript, type Sandbox, type SandboxConfig, type SandboxReceipt, type SandboxResult, type SandboxToolCall, type SchemaGeneratorConfig, ScopeBlindBridge, type SelectiveDisclosurePackageV0, type SelectiveDisclosureVerification, type SelfTestCase, type SelfTestReport, type SigningConfig, type SimulationResult, type SimulationSummary, type SwarmContext, type TierOverrides, type TimingMetrics, type ToolPolicy, type TrustTier, type WorkPayload, type WorkReceipt, anchorToRekor, buildDecisionContext, checkRateLimit, collectSignedReceipts, computeCalibration, confidentialInference, connectorDirectory, connectorDoctor, connectorPilotIds, createApprovalChallenge, createApprovalReceiptPayload, createAttestationField, createAuditBundle, createC2PAManifest, createDisclosurePackage, createEvidenceAttestation, createLogAnchorField, createReceiptChannel, createSandbox, createSelectiveDisclosurePackage, destroySandbox, discloseField, ed25519ToDIDKey, evaluateCedar, evaluateTier, exportC2PAManifestJSON, exportJSONL, formatReportMarkdown, formatSimulation, forwardReceipt, generateC2PACommand, generateCedarSchema, generateDatasetCard, generateHFMetadata, generateReport, generateSafetyTranscript, generateSchemaStub, getConnectorPilot, getPolicyPack, getScopeBlindBridge, getSignerInfo, getToolPolicy, hashReceipt, hashResponseBody, initSigning, isAgentId, isCedarAvailable, isDisclosureMode, isEvidenceType, isManifestStatus, isSigningEnabled, listCredentialLabels, loadCedarPolicies, loadPolicy, manifestToVC, meetsMinTier, parseLogFile, parseNotificationConfigFromEnv, parseRateLimit, policyPackIds, policySetFromSource, queryExternalPDP, readInstalledConnectorPilots, receiptToVP, receiptsToHFRows, redactFields, resolveCredential, revealField, runEvaluatorSelfTest, runInSandbox, sendApprovalNotification, signCommittedDecision, signDecision, simulate, toCredentialRequestOptions, toManifoldFormat, toMetaculusFormat, validateCredentials, validateEvidenceReceipt, validateManifest, verifyActaC2PAAssertions, verifyAllCommitments, verifyApprovalAssertion, verifyCommitment, verifyEvidenceAttestation, verifyRekorAnchor, verifySelectiveDisclosurePackage, writeConnectorPilots };