protect-mcp 0.7.6 → 0.9.2

package/dist/cli.js

@@ -469,6 +469,7 @@ function signDecision(entry) {
     if (entry.timing) payload.timing = entry.timing;
     if (entry.swarm) payload.swarm = entry.swarm;
     if (entry.payload_digest) payload.payload_digest = entry.payload_digest;
+    if (entry.enrichment) payload.enrichment = entry.enrichment;
     if (entry.action_readback) payload.action_readback = entry.action_readback;
     if (entry.deny_iteration) payload.deny_iteration = entry.deny_iteration;
     const result = artifactsModule.createSignedArtifact(
@@ -5081,6 +5082,294 @@ var init_sha256 = __esm({
   }
 });
 
+// src/receipt-enrichment.ts
+function canonicalJson(value) {
+  const seen = /* @__PURE__ */ new WeakSet();
+  const enc = (v) => {
+    if (v === null || v === void 0) return "null";
+    const t = typeof v;
+    if (t === "number") return Number.isFinite(v) ? JSON.stringify(v) : "null";
+    if (t === "boolean" || t === "string") return JSON.stringify(v);
+    if (t === "bigint") return JSON.stringify(v.toString());
+    if (t === "function" || t === "symbol") return "null";
+    if (Array.isArray(v)) return "[" + v.map(enc).join(",") + "]";
+    if (t === "object") {
+      const o = v;
+      if (seen.has(o)) return '"[circular]"';
+      seen.add(o);
+      const body = Object.keys(o).sort().map((k) => JSON.stringify(k) + ":" + enc(o[k])).join(",");
+      seen.delete(o);
+      return "{" + body + "}";
+    }
+    return "null";
+  };
+  return enc(value);
+}
+function sha256Hex2(s) {
+  return bytesToHex(sha2562(new TextEncoder().encode(s)));
+}
+function deriveCapabilities(tool, input) {
+  const t = String(tool || "").toLowerCase();
+  let text = "";
+  try {
+    text = canonicalJson(input).toLowerCase();
+  } catch {
+  }
+  const caps = /* @__PURE__ */ new Set();
+  for (const r of RULES) {
+    if (r.tool && r.tool.test(t)) caps.add(r.cap);
+    if (r.text && r.text.test(text)) caps.add(r.cap);
+  }
+  return Array.from(caps).sort();
+}
+function deriveResource(input) {
+  const o = input && typeof input === "object" ? input : {};
+  const path = o.file_path ?? o.path ?? o.filePath ?? o.notebook_path ?? o.filename;
+  if (typeof path === "string" && path.trim()) return { kind: "path", digest: sha256Hex2(path.replace(/\\/g, "/")) };
+  const url = o.url ?? o.uri ?? o.endpoint ?? o.href;
+  if (typeof url === "string" && url.trim()) {
+    try {
+      return { kind: "host", digest: sha256Hex2(new URL(url).host.toLowerCase()) };
+    } catch {
+    }
+  }
+  const cmd = o.command ?? o.cmd ?? o.script;
+  if (typeof cmd === "string" && cmd.trim()) {
+    const first = cmd.trim().split(/\s+/)[0];
+    if (first) return { kind: "command", digest: sha256Hex2(first) };
+  }
+  return void 0;
+}
+function buildEnrichment(tool, input) {
+  const e = {
+    v: ENRICHMENT_VERSION,
+    input_digest: sha256Hex2(canonicalJson(input ?? {})),
+    capabilities: deriveCapabilities(tool, input)
+  };
+  const resource = deriveResource(input);
+  if (resource) e.resource = resource;
+  return e;
+}
+var ENRICHMENT_VERSION, RULES;
+var init_receipt_enrichment = __esm({
+  "src/receipt-enrichment.ts"() {
+    "use strict";
+    init_sha256();
+    init_utils();
+    ENRICHMENT_VERSION = 1;
+    RULES = [
+      { cap: "exec.shell", tool: /bash|shell|exec|terminal|run_command|command/ },
+      { cap: "fs.read", tool: /(^|[_.])(read|cat|glob|grep|search|ls|view|list_files|open)/ },
+      { cap: "fs.write", tool: /write|create_file|save|append|edit|patch|replace|update_file|multiedit|notebook/ },
+      { cap: "fs.delete", tool: /delete|remove|unlink|trash|(^|[_.])rm/ },
+      { cap: "net.egress", tool: /fetch|http|curl|wget|request|download|browse|navigate|webfetch|web_search|scrape/ },
+      { cap: "vcs", tool: /(^|[_.])git/, text: /\bgit\s+(commit|push|pull|clone|reset|checkout|branch|rebase|merge|tag)\b/ },
+      { cap: "package.install", text: /\b(npm|pnpm|yarn)\s+(i|install|add)\b|\bpip3?\s+install\b|\bgo\s+get\b|\bcargo\s+add\b|\bbrew\s+install\b|\bapt(-get)?\s+install\b|\bgem\s+install\b/ },
+      { cap: "secret.adjacent", text: /\.env\b|secret|credential|passwd|password|api[_-]?key|private[_-]?key|\.pem\b|\.key\b|id_rsa|bearer\s|aws_(access|secret)|authorization/ },
+      { cap: "destructive", text: /rm\s+-[a-z]*[rf]|\brmdir\b|drop\s+table|truncate\s+table|delete\s+from|reset\s+--hard|--force\b|\bmkfs\b|\bdd\s+if=|shutdown|reboot|kill\s+-9|>\s*\/dev\/sd/ },
+      { cap: "financial", text: /\b(order|trade|buy|sell|transfer|wire|payment|withdraw|deposit|swap|invoice|charge|refund|settle)\b/ },
+      { cap: "data.query", text: /\bselect\s+[\s\S]+\bfrom\b|\binsert\s+into\b|\bupdate\s+[\s\S]+\bset\b|\bdelete\s+from\b/ }
+    ];
+  }
+});
+
+// src/claim.ts
+var claim_exports = {};
+__export(claim_exports, {
+  ANCHOR_SCHEMA: () => ANCHOR_SCHEMA,
+  CLAIM_TYPE: () => CLAIM_TYPE,
+  DEFAULT_LOG: () => DEFAULT_LOG,
+  anchorClaim: () => anchorClaim,
+  buildAnchorEnvelope: () => buildAnchorEnvelope,
+  buildClaim: () => buildClaim,
+  claimDigest: () => claimDigest,
+  evaluate: () => evaluate,
+  leafHash: () => leafHash,
+  merkleRoot: () => merkleRoot,
+  receiptToLeaf: () => receiptToLeaf,
+  verifyClaim: () => verifyClaim
+});
+function sha256Hex3(input) {
+  const bytes = typeof input === "string" ? new TextEncoder().encode(input) : input;
+  return bytesToHex(sha2562(bytes));
+}
+function receiptToLeaf(e) {
+  const p = e && typeof e.payload === "object" && e.payload || e;
+  const dec = String(p.decision || e.decision || "").toLowerCase();
+  const v = /den|block|reject|refus/.test(dec) ? "blocked" : /ask|approv|hold|escal|review|pending/.test(dec) ? "held" : "allowed";
+  const enr = p.enrichment;
+  const c = enr && Array.isArray(enr.capabilities) ? enr.capabilities.map(String).sort() : [];
+  const tsRaw = e.issued_at || p.timestamp || p.issued_at;
+  const ms = typeof tsRaw === "number" ? tsRaw : typeof tsRaw === "string" ? Date.parse(tsRaw) : NaN;
+  const t = isFinite(ms) ? new Date(ms).toISOString() : "";
+  const d = sha256Hex3(canonicalJson(e));
+  return { d, v, c, t };
+}
+function leafHash(leaf) {
+  return sha256Hex3(canonicalJson(leaf));
+}
+function merkleRoot(leafHashes) {
+  if (leafHashes.length === 0) return sha256Hex3("scopeblind.claim.empty");
+  let level = [...leafHashes].sort();
+  while (level.length > 1) {
+    const next = [];
+    for (let i = 0; i < level.length; i += 2) {
+      const a = level[i];
+      const b = i + 1 < level.length ? level[i + 1] : level[i];
+      next.push(sha256Hex3(a + b));
+    }
+    level = next;
+  }
+  return level[0];
+}
+function evaluate(pred, leaves) {
+  if (pred.kind === "no_capability") {
+    const matched2 = leaves.filter((l) => l.c.indexOf(pred.capability) >= 0).length;
+    return { statement: `No action used capability "${pred.capability}"`, holds: matched2 === 0, matched: matched2 };
+  }
+  if (pred.kind === "only_capabilities") {
+    const allow = new Set(pred.capabilities);
+    const matched2 = leaves.filter((l) => !l.c.every((c) => allow.has(c))).length;
+    return { statement: `All actions were confined to capabilities {${pred.capabilities.join(", ")}}`, holds: matched2 === 0, matched: matched2 };
+  }
+  if (pred.kind === "no_verdict") {
+    const matched2 = leaves.filter((l) => l.v === pred.verdict).length;
+    return { statement: `No action was ${pred.verdict}`, holds: matched2 === 0, matched: matched2 };
+  }
+  const matched = leaves.filter((l) => l.v === pred.verdict).length;
+  return { statement: `${matched} action${matched === 1 ? " was" : "s were"} ${pred.verdict}`, holds: true, matched };
+}
+function messageHash(unsigned) {
+  return sha2562(new TextEncoder().encode(canonicalJson(unsigned)));
+}
+function buildClaim(receipts, predicate, key, issuedAt) {
+  const leaves = receipts.map(receiptToLeaf);
+  const root = merkleRoot(leaves.map(leafHash));
+  const claim = evaluate(predicate, leaves);
+  const times = leaves.map((l) => l.t).filter(Boolean).sort();
+  const unsigned = {
+    type: CLAIM_TYPE,
+    predicate,
+    claim,
+    scope: { total: leaves.length, from: times[0] || "", to: times[times.length - 1] || "" },
+    record: { root },
+    leaves,
+    issuer: { kid: key.kid, publicKey: key.publicKey, issuer: key.issuer || "protect-mcp" },
+    issued_at: issuedAt
+  };
+  const signature = bytesToHex(ed25519.sign(messageHash(unsigned), hexToBytes(key.privateKey)));
+  return { ...unsigned, signature };
+}
+function verifyClaim(pack, overridePublicKey) {
+  const reasons = [];
+  const leaves = Array.isArray(pack.leaves) ? pack.leaves : [];
+  const recomputedRoot = merkleRoot(leaves.map(leafHash));
+  const root_ok = !!pack.record && recomputedRoot === pack.record.root;
+  if (!root_ok) reasons.push("record commitment (Merkle root) does not match the disclosed decisions");
+  const recomputed = evaluate(pack.predicate, leaves);
+  const predicate_ok = !!pack.claim && recomputed.holds === pack.claim.holds && recomputed.matched === pack.claim.matched;
+  if (!predicate_ok) reasons.push("claim result does not match the predicate recomputed over the disclosed decisions");
+  let authentic = false;
+  try {
+    const { signature, ...unsigned } = pack;
+    const pub = overridePublicKey || pack.issuer && pack.issuer.publicKey;
+    if (pub && signature) {
+      authentic = ed25519.verify(hexToBytes(signature), messageHash(unsigned), hexToBytes(pub));
+    }
+  } catch {
+  }
+  if (!authentic) reasons.push("signature does not verify against the issuer public key");
+  return {
+    valid: authentic && root_ok && predicate_ok,
+    authentic,
+    root_ok,
+    predicate_ok,
+    holds: !!(pack.claim && pack.claim.holds),
+    matched: pack.claim ? pack.claim.matched : recomputed.matched,
+    total: leaves.length,
+    statement: pack.claim ? pack.claim.statement : recomputed.statement,
+    reasons
+  };
+}
+function anchorDeepSort(o) {
+  if (o === null || typeof o !== "object") return o;
+  if (Array.isArray(o)) return o.map(anchorDeepSort);
+  const src = o;
+  const out = {};
+  for (const k of Object.keys(src).sort()) out[k] = anchorDeepSort(src[k]);
+  return out;
+}
+function toBase64(bytes) {
+  let bin = "";
+  for (let i = 0; i < bytes.length; i++) bin += String.fromCharCode(bytes[i]);
+  return btoa(bin);
+}
+function claimDigest(pack) {
+  return sha256Hex3(canonicalJson(pack));
+}
+function buildAnchorEnvelope(pack, key, issuedAt) {
+  const signed = {
+    type: "evidence_pack",
+    schema: ANCHOR_SCHEMA,
+    anchors: "protect-mcp-claim",
+    claim_digest: claimDigest(pack),
+    record_root: pack.record.root,
+    statement: pack.claim.statement,
+    holds: pack.claim.holds,
+    matched: pack.claim.matched,
+    total: pack.scope.total,
+    issued_at: issuedAt,
+    verification_key: key.publicKey,
+    disclosure: "internal"
+  };
+  const hash = sha2562(new TextEncoder().encode(JSON.stringify(anchorDeepSort(signed))));
+  const digest = bytesToHex(hash);
+  const signature = bytesToHex(ed25519.sign(hash, hexToBytes(key.privateKey)));
+  return { ...signed, signature, digest };
+}
+async function anchorClaim(pack, key, opts) {
+  const envelope = buildAnchorEnvelope(pack, key, opts.issuedAt);
+  const base = (opts.log || DEFAULT_LOG).replace(/\/+$/, "");
+  const doFetch = opts.fetchImpl || globalThis.fetch;
+  if (!doFetch) return { ok: false, claim_digest: envelope.claim_digest, error: "fetch_unavailable", envelope };
+  const encoded = toBase64(new TextEncoder().encode(JSON.stringify(envelope)));
+  try {
+    const resp = await doFetch(`${base}/fn/log/anchor-pack`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ encoded })
+    });
+    const data = await resp.json().catch(() => null);
+    if (!resp.ok || !data || !data.ok || typeof data.seq !== "number") {
+      return { ok: false, claim_digest: envelope.claim_digest, error: data && data.error || `http_${resp.status}`, envelope };
+    }
+    return {
+      ok: true,
+      claim_digest: envelope.claim_digest,
+      seq: data.seq,
+      entry_url: `${base}/fn/log/${data.seq}`,
+      anchored_at: data.anchored_at,
+      already_anchored: !!data.already_anchored,
+      envelope
+    };
+  } catch {
+    return { ok: false, claim_digest: envelope.claim_digest, error: "network_error", envelope };
+  }
+}
+var CLAIM_TYPE, ANCHOR_SCHEMA, DEFAULT_LOG;
+var init_claim = __esm({
+  "src/claim.ts"() {
+    "use strict";
+    init_sha256();
+    init_utils();
+    init_ed25519();
+    init_receipt_enrichment();
+    CLAIM_TYPE = "scopeblind.claim.v1";
+    ANCHOR_SCHEMA = "scopeblind.protect-mcp.anchor.v1";
+    DEFAULT_LOG = "https://scopeblind.com";
+  }
+});
+
 // src/commitments/merkle.ts
 function hashLeaf(leafBytes) {
   const buf = new Uint8Array(leafBytes.length + 1);
@@ -5095,7 +5384,7 @@ function hashInternal(left, right) {
   buf.set(right, 1 + left.length);
   return sha2562(buf);
 }
-function merkleRoot(leafHashes) {
+function merkleRoot2(leafHashes) {
   if (leafHashes.length === 0) {
     throw new Error("merkleRoot: cannot compute root of empty leaf set");
   }
@@ -5104,8 +5393,8 @@ function merkleRoot(leafHashes) {
   }
   const n = leafHashes.length;
   const k = largestPowerOfTwoLessThan(n);
-  const left = merkleRoot(leafHashes.slice(0, k));
-  const right = merkleRoot(leafHashes.slice(k));
+  const left = merkleRoot2(leafHashes.slice(0, k));
+  const right = merkleRoot2(leafHashes.slice(k));
   return hashInternal(left, right);
 }
 function generateProof(leafHashes, index) {
@@ -5131,21 +5420,21 @@ function collectPath(leaves, index, out) {
   const k = largestPowerOfTwoLessThan(n);
   if (index < k) {
     collectPath(leaves.slice(0, k), index, out);
-    out.push(merkleRoot(leaves.slice(k)));
+    out.push(merkleRoot2(leaves.slice(k)));
   } else {
     collectPath(leaves.slice(k), index - k, out);
-    out.push(merkleRoot(leaves.slice(0, k)));
+    out.push(merkleRoot2(leaves.slice(0, k)));
   }
 }
-function verifyProof(expectedRootHex, leafHash, proof) {
+function verifyProof(expectedRootHex, leafHash2, proof) {
   if (proof.index < 0 || proof.index >= proof.treeSize) return false;
   if (proof.treeSize === 1) {
-    return proof.siblings.length === 0 && bytesToHex(leafHash).toLowerCase() === expectedRootHex.toLowerCase();
+    return proof.siblings.length === 0 && bytesToHex(leafHash2).toLowerCase() === expectedRootHex.toLowerCase();
   }
   let result;
   try {
     result = reconstructRoot(
-      leafHash,
+      leafHash2,
       proof.index,
       proof.treeSize,
       proof.siblings
@@ -5155,12 +5444,12 @@ function verifyProof(expectedRootHex, leafHash, proof) {
   }
   return bytesToHex(result).toLowerCase() === expectedRootHex.toLowerCase();
 }
-function reconstructRoot(leafHash, index, treeSize, siblings) {
+function reconstructRoot(leafHash2, index, treeSize, siblings) {
   if (treeSize === 1) {
     if (siblings.length !== 0) {
       throw new Error("reconstructRoot: extra siblings at single-leaf level");
     }
-    return leafHash;
+    return leafHash2;
   }
   if (siblings.length === 0) {
     throw new Error("reconstructRoot: ran out of siblings before single-leaf");
@@ -5169,11 +5458,11 @@ function reconstructRoot(leafHash, index, treeSize, siblings) {
   const outermostSibling = hexToBytes(siblings[siblings.length - 1]);
   const innerSiblings = siblings.slice(0, -1);
   if (index < k) {
-    const leftHash = reconstructRoot(leafHash, index, k, innerSiblings);
+    const leftHash = reconstructRoot(leafHash2, index, k, innerSiblings);
     return hashInternal(leftHash, outermostSibling);
   } else {
     const rightHash = reconstructRoot(
-      leafHash,
+      leafHash2,
       index - k,
       treeSize - k,
       innerSiblings
@@ -5319,7 +5608,7 @@ function signCommittedDecision(entry, committedFieldNames, signingKey, publicKey
   if (committedFields.length > 0) {
     const { sorted, leafBytes } = leavesFromFields(committedFields);
     const leafHashes = leafBytes.map(hashLeaf);
-    const root = merkleRoot(leafHashes);
+    const root = merkleRoot2(leafHashes);
     committedFieldsRoot = bytesToHex(root);
     sorted.forEach((f, i) => {
       openings[f.name] = { name: f.name, value: f.value, salt: f.salt, index: i };
@@ -5337,8 +5626,8 @@ function signCommittedDecision(entry, committedFieldNames, signingKey, publicKey
     payload.committed_field_names = committedFields.map((f) => f.name);
   }
   const canonical = jcs(payload);
-  const messageHash = sha2562(new TextEncoder().encode(canonical));
-  const signatureBytes = ed25519.sign(messageHash, hexToBytes(signingKey));
+  const messageHash2 = sha2562(new TextEncoder().encode(canonical));
+  const signatureBytes = ed25519.sign(messageHash2, hexToBytes(signingKey));
   const signedReceipt = {
     ...payload,
     signature: {
@@ -5490,9 +5779,9 @@ function verifyCommittedReceiptSignature(receipt) {
     return null;
   }
   const { signature: _signature, ...payloadWithoutSig } = receipt;
-  const messageHash = sha2562(new TextEncoder().encode(jcs(payloadWithoutSig)));
+  const messageHash2 = sha2562(new TextEncoder().encode(jcs(payloadWithoutSig)));
   try {
-    return ed25519.verify(base64urlDecode(sig.sig), messageHash, hexToBytes(sig.public_key));
+    return ed25519.verify(base64urlDecode(sig.sig), messageHash2, hexToBytes(sig.public_key));
   } catch {
     return false;
   }
@@ -6065,6 +6354,9 @@ async function handlePreToolUse(input, state) {
   });
   const payloadDigest = computePayloadDigest(input.toolInput);
   const actionReadback = buildActionReadback(toolName, input.toolInput || {});
+  const enrichment = buildEnrichment(toolName, input.toolInput || {});
+  const inflightRec = state.inflightTools.get(requestId);
+  if (inflightRec) inflightRec.enrichment = enrichment;
   const swarm = {
     ...state.swarmContext,
     ...input.agentId && { agent_id: input.agentId },
@@ -6484,6 +6776,8 @@ function emitDecisionLog(state, entry) {
     ...entry.sandbox_state && { sandbox_state: entry.sandbox_state },
     ...entry.plan_receipt_id && { plan_receipt_id: entry.plan_receipt_id }
   };
+  const enr = state.inflightTools.get(log.request_id)?.enrichment;
+  if (enr) log.enrichment = enr;
   process.stderr.write(`[PROTECT_MCP] ${JSON.stringify(log)}
 `);
   try {
@@ -6846,6 +7140,7 @@ var init_hook_server = __esm({
     init_http_server();
     init_scopeblind_bridge();
     init_action_readback();
+    init_receipt_enrichment();
     DEFAULT_PORT = 9377;
     LOG_FILE3 = ".protect-mcp-log.jsonl";
     RECEIPTS_FILE2 = ".protect-mcp-receipts.jsonl";
@@ -8295,6 +8590,8 @@ Usage:
   protect-mcp digest [--today] [--dir <path>]
   protect-mcp receipts [--last <n>] [--dir <path>]
   protect-mcp record [--dir <path>] [--live] [--no-open]
+  protect-mcp claim [--no <cap>] [--only <c,c>] [--count <verdict>] [--dir <path>] [--output <path>]
+  protect-mcp verify-claim <claim.json> [--key <public-hex>]
   protect-mcp bundle [--output <path>] [--dir <path>]
   protect-mcp simulate --policy <path> [--log <path>] [--tier <tier>] [--json]
   protect-mcp report [--period <days>d] [--format md|json] [--output <path>] [--dir <path>]
@@ -8333,6 +8630,8 @@ Commands:
   digest            Generate a human-readable summary of agent activity
   receipts          Show recent persisted signed receipts
   record            Open a local, searchable view of your record in the browser
+  claim             Attest a signed, position-blind claim over your record (e.g. no egress)
+  verify-claim      Verify a claim attestation offline (signature + predicate + commitment)
   bundle            Export an offline-verifiable audit bundle
 
 Examples:
@@ -10224,7 +10523,13 @@ function mapRecordEntry(e) {
   if (e.receipt_hash) digest = String(e.receipt_hash);
   else if (e.digest) digest = String(e.digest);
   else if (p.payload_digest && p.payload_digest.output_hash) digest = String(p.payload_digest.output_hash);
-  return { ts, tool, verdict, reason, hook, signed, id: String(e.request_id || p.request_id || ""), digest };
+  const enr = p && typeof p.enrichment === "object" && p.enrichment || typeof e.enrichment === "object" && e.enrichment || null;
+  const caps = enr && Array.isArray(enr.capabilities) ? enr.capabilities.map(String) : [];
+  const sw = p && typeof p.swarm === "object" && p.swarm || null;
+  const agent = sw && (sw.agent_name || sw.agent_id || sw.agent_type) ? String(sw.agent_name || sw.agent_id || sw.agent_type) : "main agent";
+  const tm = p && typeof p.timing === "object" && p.timing || null;
+  const dur = tm && typeof tm.tool_duration_ms === "number" ? tm.tool_duration_ms : 0;
+  return { ts, tool, verdict, reason, hook, signed, caps, agent, dur, id: String(e.request_id || p.request_id || ""), digest, raw: e };
 }
 async function handleRecord(argv) {
   const { readFileSync: readFileSync11, existsSync: existsSync9, writeFileSync: writeFileSync4 } = await import("fs");
@@ -10340,53 +10645,319 @@ var RECORD_HTML = `<!doctype html><html lang="en"><head><meta charset="utf-8"><m
 body{margin:0;background:var(--paper);color:var(--ink);font:15px/1.5 system-ui,-apple-system,"Segoe UI",Roboto,sans-serif;-webkit-font-smoothing:antialiased}
 .wrap{max-width:1000px;margin:0 auto;padding:26px 22px 60px}
 h1{font-size:24px;margin:0 0 4px;letter-spacing:-.012em}
-.meta{color:var(--faint);font-size:12.5px;font-family:ui-monospace,Menlo,Consolas,monospace}
-.bar{margin:18px 0 12px}
+.meta{color:var(--faint);font-size:12.5px;font-family:ui-monospace,Menlo,Consolas,monospace;display:flex;align-items:center}
+.pulse{width:7px;height:7px;border-radius:100px;background:var(--g);display:inline-block;margin-left:8px;animation:pl 1.6s ease-in-out infinite}
+@keyframes pl{0%,100%{opacity:.3}50%{opacity:1}}
+@media (prefers-reduced-motion:reduce){.pulse{animation:none}}
+.stats{display:flex;gap:15px;flex-wrap:wrap;align-items:center;margin:14px 0 10px;font-size:13px}
+.stat{display:flex;align-items:center;gap:6px;color:var(--soft)}
+.stat b{color:var(--ink);font-weight:680}
+.dot{width:8px;height:8px;border-radius:100px;display:inline-block}
+.dot.g{background:var(--g)}.dot.a{background:var(--a)}.dot.r{background:var(--r)}
+.stat.sig{margin-left:auto;color:var(--g);font-weight:600}
+.actions{display:flex;gap:8px;flex-wrap:wrap;align-items:center;margin:0 0 16px}
+.btn{cursor:pointer;font:inherit;font-size:12.5px;padding:7px 13px;border-radius:8px;border:1px solid var(--line);background:#fff;color:var(--ink);transition:border-color .12s}
+.btn:hover{border-color:var(--ink)}
+.btn.p{background:var(--ink);color:var(--paper);border-color:var(--ink)}
+.btn:focus-visible{outline:2px solid var(--ink);outline-offset:2px}
+.vhint{font-size:12px;color:var(--faint);margin-left:auto;font-family:ui-monospace,Menlo,monospace}
+.attest{margin:0 0 12px;font-size:12.5px;color:var(--soft);display:flex;gap:8px;align-items:center;flex-wrap:wrap}
+.cmd{font-family:ui-monospace,Menlo,monospace;font-size:12px;background:#efece4;border:1px solid var(--line);border-radius:6px;padding:3px 8px;color:var(--ink)}
+.btn2{cursor:pointer;font:inherit;font-size:12px;padding:4px 9px;border-radius:7px;border:1px solid var(--line);background:#fff;color:var(--ink)}
+.btn2:hover{border-color:var(--ink)}
+.bar{margin:6px 0 12px}
 input{width:100%;padding:10px 13px;border:1px solid var(--line);border-radius:9px;background:#fff;font:inherit}
 .chips{display:flex;gap:6px;flex-wrap:wrap;margin-bottom:14px}
 .chip{cursor:pointer;font-size:12px;padding:3px 10px;border-radius:100px;border:1px solid var(--line);background:#fff;color:var(--soft)}
 .chip.on{background:var(--ink);color:var(--paper);border-color:var(--ink)}
 .count{color:var(--faint);font-size:12px;font-family:ui-monospace,Menlo,monospace;margin-bottom:8px}
 .row{border:1px solid var(--line);border-radius:9px;background:#fcfbf7;padding:11px 13px;margin-bottom:8px;cursor:pointer}
+.row.blocked{background:#fbf3f0}.row.held{background:#fbf7ee}
 .top{display:flex;gap:9px;align-items:center;flex-wrap:wrap}
 .pill{font-size:11px;font-weight:600;padding:2px 9px;border-radius:100px}
 .pill.allowed{background:var(--gb);color:var(--g)}.pill.held{background:var(--ab);color:var(--a)}.pill.blocked{background:var(--rb);color:var(--r)}
 .tag{font-size:11px;padding:1px 7px;border-radius:100px;background:var(--paper);border:1px solid var(--line);color:var(--faint)}
+.cap{font-size:10px;padding:1px 6px;border-radius:100px;background:#eef0ea;border:1px solid var(--line);color:var(--soft)}
+.badge{font-size:10.5px;font-weight:600;padding:1px 7px;border-radius:100px}
+.badge.sgn{background:var(--gb);color:var(--g)}
+.badge.log{background:var(--paper);color:var(--faint);border:1px solid var(--line)}
+.dg{font-size:10.5px;color:var(--faint);font-family:ui-monospace,Menlo,monospace}
 .when{margin-left:auto;font-size:12px;color:var(--faint);font-family:ui-monospace,Menlo,monospace}
 .det{margin-top:8px;padding-top:8px;border-top:1px solid var(--line);font-size:12px;color:var(--soft);font-family:ui-monospace,Menlo,monospace;white-space:pre-wrap;word-break:break-all;display:none}
 .row.open .det{display:block}
 .foot{margin-top:22px;color:var(--faint);font-size:12px;line-height:1.6;border-top:1px solid var(--line);padding-top:14px}
 .foot b{color:var(--soft)}
+.viewtoggle{display:inline-flex;border:1px solid var(--line);border-radius:8px;overflow:hidden}
+.viewtoggle button{border:0;background:#fff;color:var(--soft);font:inherit;font-size:12.5px;padding:7px 12px;cursor:pointer}
+.viewtoggle button.on{background:var(--ink);color:var(--paper)}
+.agent{border:1px solid var(--line);border-radius:10px;background:#fcfbf7;margin-bottom:10px;overflow:hidden}
+.ahead{display:flex;gap:9px;align-items:center;flex-wrap:wrap;padding:11px 13px;cursor:pointer}
+.atwist{color:var(--faint);font-size:11px;transition:transform .12s;display:inline-block}
+.agent.open .atwist{transform:rotate(90deg)}
+.acount{font-size:12px;color:var(--faint)}
+.akids{display:none;padding:2px 12px 12px 24px;border-top:1px solid var(--line)}
+.agent.open .akids{display:block}
+.act{display:flex;gap:10px;align-items:center;flex-wrap:wrap;padding:9px 4px;cursor:pointer;border-bottom:1px solid var(--line)}
+.akids .act:last-child{border-bottom:0}
+.act:hover{background:rgba(0,0,0,.02)}
+.act.blocked{background:#fbf3f0}.act.held{background:#fbf7ee}
+.act .det{flex-basis:100%}
+.act.open .det{display:block}
+.ev{display:flex;gap:8px;align-items:center;font-size:12px;color:var(--faint);padding:5px 10px;margin-top:6px}
+.evdot{width:6px;height:6px;border-radius:100px;background:var(--faint);display:inline-block}
+.evre{color:var(--soft)}
+.badge.blk{background:var(--rb);color:var(--r)}
 </style></head><body><div class="wrap">
 <h1>Your record</h1>
-<div class="meta" id="meta"></div>
+<div class="meta"><span id="meta"></span><span id="live"></span></div>
+<div class="stats" id="stats"></div>
+<div class="actions">
+<div class="viewtoggle"><button id="vlist" class="on" onclick="setView('list')">List</button><button id="vtree" onclick="setView('tree')">Tree</button></div>
+<button class="btn p" onclick="exportJsonl()">Export receipts (.jsonl)</button>
+<button class="btn" onclick="exportMd()">Export report (.md)</button>
+<button class="btn" id="cpv" onclick="copyVerify()">Copy verify command</button>
+<span class="vhint">verify offline: npx @veritasacta/verify</span>
+</div>
 <div class="bar"><input id="q" placeholder="Search your record: tool, reason, verdict"></div>
 <div class="chips" id="chips"></div>
 <div class="count" id="count"></div>
+<div class="attest" id="attest"></div>
 <div id="list"></div>
-<div class="foot">Signed decisions from your own gate. This page is local and nothing was uploaded. Verify authoritatively with <b>npx protect-mcp receipts</b> or the open verifier. protect-mcp governs proposed actions before they run.</div>
+<div class="foot">Signed decisions from your own gate, on this machine. Nothing was uploaded. Each row is Ed25519-signed, and the exports carry the signatures, so anyone you hand them to (an allocator, an auditor, a counterparty) verifies offline with <b>npx @veritasacta/verify</b>, our code removed. For a Merkle-rooted evidence pack: <b>npx protect-mcp bundle</b>. To prove a claim over this record without revealing it (e.g. no egress): <b>npx protect-mcp claim --no net.egress</b>, checked offline with <b>npx protect-mcp verify-claim</b>. protect-mcp governs proposed actions before they run.</div>
 </div>
 <script>
-var RECORDS=__DATA__;var META=__META__;var Q="",ACT={};
+var RECORDS=__DATA__;var META=__META__;var Q="",ACT={},VIEW="list",OPEN={};var NL=String.fromCharCode(10);
 function esc(s){return String(s).replace(/[&<>"]/g,function(c){return{"&":"&amp;","<":"&lt;",">":"&gt;",'"':"&quot;"}[c]})}
 function vlabel(v){return v==="allowed"?"Allowed":v==="held"?"Held":"Blocked"}
 function when(ts){if(!ts)return"";var d=new Date(ts);return d.toLocaleDateString(undefined,{month:"short",day:"numeric"})+" "+d.toLocaleTimeString(undefined,{hour:"2-digit",minute:"2-digit"})}
-function fvals(key){var m={};RECORDS.forEach(function(r){var v=key==="Decision"?vlabel(r.verdict):r[key.toLowerCase()];if(v){m[v]=(m[v]||0)+1}});return Object.keys(m).sort(function(a,b){return m[b]-m[a]}).slice(0,8).map(function(v){return[v,m[v]]})}
-function match(r){if(ACT.Decision&&vlabel(r.verdict)!==ACT.Decision)return false;if(ACT.Tool&&r.tool!==ACT.Tool)return false;if(ACT.Reason&&r.reason!==ACT.Reason)return false;if(Q){var h=(r.tool+" "+r.reason+" "+vlabel(r.verdict)+" "+r.hook).toLowerCase();if(h.indexOf(Q)<0)return false}return true}
+function counts(rows){var c={allowed:0,held:0,blocked:0,signed:0};rows.forEach(function(r){c[r.verdict]=(c[r.verdict]||0)+1;if(r.signed)c.signed++});return c}
+function fvals(key){var m={};RECORDS.forEach(function(r){var vs=key==="Decision"?[vlabel(r.verdict)]:(key==="Capability"?(r.caps||[]):[r[key.toLowerCase()]]);vs.forEach(function(v){if(v){m[v]=(m[v]||0)+1}})});return Object.keys(m).sort(function(a,b){return m[b]-m[a]}).slice(0,10).map(function(v){return[v,m[v]]})}
+function match(r){if(ACT.Decision&&vlabel(r.verdict)!==ACT.Decision)return false;if(ACT.Tool&&r.tool!==ACT.Tool)return false;if(ACT.Reason&&r.reason!==ACT.Reason)return false;if(ACT.Capability&&(r.caps||[]).indexOf(ACT.Capability)<0)return false;if(Q){var h=(r.tool+" "+r.reason+" "+vlabel(r.verdict)+" "+r.hook+" "+(r.caps||[]).join(" ")).toLowerCase();if(h.indexOf(Q)<0)return false}return true}
+function filtered(){return RECORDS.filter(match)}
+function dl(name,text,type){var b=new Blob([text],{type:type||"text/plain"});var u=URL.createObjectURL(b);var a=document.createElement("a");a.href=u;a.download=name;document.body.appendChild(a);a.click();a.remove();setTimeout(function(){URL.revokeObjectURL(u)},1500)}
+function stamp(){return new Date().toISOString().replace(/[:.]/g,"-").slice(0,19)}
+function exportJsonl(){var rows=filtered();if(!rows.length)return;var lines=rows.map(function(r){return JSON.stringify(r.raw||r)}).join(NL);dl("protect-mcp-record-"+stamp()+".jsonl",lines,"application/x-ndjson")}
+function exportMd(){var rows=filtered();if(!rows.length)return;var c=counts(rows);var head=["# Agent decision record","",rows.length+" decisions from "+META.file,c.allowed+" allowed, "+c.held+" held, "+c.blocked+" blocked, "+c.signed+" signed.","","Generated locally by protect-mcp. These are signed receipts; verify offline with npx @veritasacta/verify (our code removed).","","| When | Decision | Tool | Reason | Hook | Signed |","|---|---|---|---|---|---|"];var body=rows.slice(0,3000).map(function(r){return "| "+(r.ts||"")+" | "+vlabel(r.verdict)+" | "+String(r.tool||"").replace(/\\|/g,"/")+" | "+String(r.reason||"").replace(/\\|/g,"/")+" | "+(r.hook||"")+" | "+(r.signed?"yes":"no")+" |"});dl("protect-mcp-record-"+stamp()+".md",head.concat(body).join(NL)+NL,"text/markdown")}
+function copyAttest(){var a=document.getElementById("attest");var cmd=a?a.getAttribute("data-cmd"):"";try{navigator.clipboard&&cmd&&navigator.clipboard.writeText(cmd)}catch(e){}var b=document.getElementById("cpa");if(b){var t=b.textContent;b.textContent="Copied";setTimeout(function(){b.textContent=t},1200)}}
+function copyVerify(){var cmd="npx @veritasacta/verify";try{navigator.clipboard&&navigator.clipboard.writeText(cmd)}catch(e){}var b=document.getElementById("cpv");if(b){var t=b.textContent;b.textContent="Copied";setTimeout(function(){b.textContent=t},1200)}}
+function renderStats(){var c=counts(RECORDS);var p=[];p.push('<span class="stat"><b>'+RECORDS.length+'</b> decisions</span>');p.push('<span class="stat"><span class="dot g"></span>'+c.allowed+' allowed</span>');if(c.held)p.push('<span class="stat"><span class="dot a"></span>'+c.held+' held</span>');p.push('<span class="stat"><span class="dot r"></span>'+c.blocked+' blocked</span>');p.push('<span class="stat sig">'+c.signed+' signed, verifiable offline</span>');document.getElementById("stats").innerHTML=p.join("")}
+function renderList(rows){var html="";rows.slice(0,800).forEach(function(r){var sig=r.signed?'<span class="badge sgn">signed</span>':'<span class="badge log">log</span>';var dg=r.digest?'<span class="dg">'+esc(String(r.digest).slice(0,10))+'</span>':'';var ct=(r.caps||[]).map(function(c){return '<span class="cap">'+esc(c)+'</span>'}).join('');var rk="row:"+(r.id||"")+"|"+(r.ts||"");html+='<div class="row '+r.verdict+(OPEN[rk]?" open":"")+'" data-k="'+esc(rk)+'"><div class="top"><span class="pill '+r.verdict+'">'+vlabel(r.verdict)+"</span><b>"+esc(r.tool)+'</b><span class="tag">'+esc(r.reason)+"</span>"+ct+(r.hook?'<span class="tag">'+esc(r.hook)+"</span>":"")+sig+dg+'<span class="when">'+esc(when(r.ts))+'</span></div><div class="det">'+esc(JSON.stringify(r.raw||r,null,2))+"</div></div>"});document.getElementById("list").innerHTML=html||'<p style="color:#8a837a">No records match.</p>';}
+function isLifecycle(r){var h=r.hook||"";return h==="SessionStart"||h==="SessionEnd"||h==="Stop"||h==="SubagentStart"||h==="SubagentStop"||h==="TaskCreated"||h==="TaskCompleted"||h==="ConfigChange"||h==="Notification"||h==="PreCompact";}
+function buildTree(rows){var ags={},order=[];rows.forEach(function(r){var a=r.agent||"main agent";if(!ags[a]){ags[a]={name:a,byId:{},items:[],caps:{},blocked:0,actions:0};order.push(a);}var g=ags[a];(r.caps||[]).forEach(function(c){g.caps[c]=(g.caps[c]||0)+1;});if(isLifecycle(r)){g.items.push({t:"e",ts:r.ts,r:r});return;}var id=r.id||("_"+r.ts);var n=g.byId[id];if(!n){n={t:"a",id:id,tool:r.tool,verdict:r.verdict,caps:(r.caps||[]).slice(),ts:r.ts,dur:0,signed:!!r.signed,raw:r.raw};g.byId[id]=n;g.items.push(n);g.actions++;}if(r.hook==="PostToolUse"){if(r.dur)n.dur=r.dur;if(!n.raw)n.raw=r.raw;}else{n.verdict=r.verdict;if((r.caps||[]).length)n.caps=r.caps.slice();n.raw=r.raw;n.ts=r.ts;}if(r.signed)n.signed=true;});order.forEach(function(a){var g=ags[a];g.blocked=g.items.filter(function(it){return it.t==="a"&&it.verdict==="blocked";}).length;g.items.sort(function(x,y){return (x.ts<y.ts)?-1:1;});});return order.map(function(a){return ags[a];});}
+function renderTree(ags){if(!ags.length){document.getElementById("list").innerHTML='<p style="color:#8a837a">No records match.</p>';return;}var html="",N=0;ags.forEach(function(g,gi){var capstr=Object.keys(g.caps).sort(function(a,b){return g.caps[b]-g.caps[a];}).slice(0,5).map(function(c){return '<span class="cap">'+esc(c)+'</span>';}).join('');var ak="ag:"+g.name;var op=(OPEN.hasOwnProperty(ak)?OPEN[ak]:(ags.length===1||gi===0))?" open":"";html+='<div class="agent'+op+'" data-k="'+esc(ak)+'"><div class="ahead"><span class="atwist">\u25B8</span><b>'+esc(g.name)+'</b><span class="acount">'+g.actions+' action'+(g.actions===1?'':'s')+'</span>'+(g.blocked?'<span class="badge blk">'+g.blocked+' blocked</span>':'')+capstr+'</div><div class="akids">';g.items.forEach(function(it){if(N++>1500)return;if(it.t==="e"){var r=it.r;html+='<div class="ev"><span class="evdot"></span>'+esc(r.hook||r.tool)+' <span class="evre">'+esc(r.reason)+'</span><span class="when">'+esc(when(r.ts))+'</span></div>';}else{var ct=(it.caps||[]).map(function(c){return '<span class="cap">'+esc(c)+'</span>';}).join('');var dur=it.dur?'<span class="dg">'+it.dur+'ms</span>':'';var ik="act:"+it.id;html+='<div class="act '+it.verdict+(OPEN[ik]?" open":"")+'" data-k="'+esc(ik)+'"><span class="pill '+it.verdict+'">'+vlabel(it.verdict)+'</span><b>'+esc(it.tool)+'</b>'+ct+(it.signed?'<span class="badge sgn">signed</span>':'')+dur+'<span class="when">'+esc(when(it.ts))+'</span><div class="det">'+esc(JSON.stringify(it.raw||{},null,2))+'</div></div>';}});html+='</div></div>';});if(N>1500)html+='<p style="color:#8a837a;font-size:12px;margin-top:10px">Showing the first 1500 items. Search or pick a facet to narrow.</p>';document.getElementById("list").innerHTML=html;}
+function setView(v){VIEW=v;document.getElementById("vlist").className=v==="list"?"on":"";document.getElementById("vtree").className=v==="tree"?"on":"";render();}
 function render(){
 document.getElementById("meta").textContent=META.count+" decisions from "+META.file+(META.signed?" (signed)":" (decision log)")+" - all local"+(META.live?" \xB7 live, updating":"");
-var chips="";["Decision","Tool","Reason"].forEach(function(key){fvals(key).forEach(function(p){var on=ACT[key]===p[0];chips+='<span class="chip'+(on?" on":"")+'" data-k="'+key+'" data-v="'+esc(p[0])+'">'+esc(p[0])+" "+p[1]+"</span>"})});
+document.getElementById("live").innerHTML=META.live?'<span class="pulse"></span>':"";
+renderStats();
+var chips="";["Decision","Tool","Reason","Capability"].forEach(function(key){fvals(key).forEach(function(p){var on=ACT[key]===p[0];chips+='<span class="chip'+(on?" on":"")+'" data-k="'+key+'" data-v="'+esc(p[0])+'">'+esc(p[0])+" "+p[1]+"</span>"})});
 document.getElementById("chips").innerHTML=chips;
 var rows=RECORDS.filter(match);
-document.getElementById("count").textContent=rows.length+" of "+RECORDS.length+" records";
-var html="";rows.slice(0,800).forEach(function(r){html+='<div class="row"><div class="top"><span class="pill '+r.verdict+'">'+vlabel(r.verdict)+"</span><b>"+esc(r.tool)+'</b><span class="tag">'+esc(r.reason)+"</span>"+(r.hook?'<span class="tag">'+esc(r.hook)+"</span>":"")+'<span class="tag">'+(r.signed?"signed":"log")+'</span><span class="when">'+esc(when(r.ts))+'</span></div><div class="det">'+esc(JSON.stringify(r,null,2))+"</div></div>"});
-document.getElementById("list").innerHTML=html||'<p style="color:#8a837a">No records match.</p>'}
+document.getElementById("count").textContent=rows.length+" of "+RECORDS.length+" records"+(VIEW==="tree"?" \xB7 grouped by agent":"");
+var _at=document.getElementById("attest");if(ACT.Capability){var _cmd="npx protect-mcp claim --no "+ACT.Capability;_at.setAttribute("data-cmd",_cmd);_at.innerHTML='Prove it over this record, revealing nothing: <span class="cmd">'+esc(_cmd)+'</span><button class="btn2" id="cpa" onclick="copyAttest()">Copy</button>';}else{_at.innerHTML="";_at.removeAttribute("data-cmd");}
+if(VIEW==="tree"){renderTree(buildTree(rows));}else{renderList(rows);}}
 document.getElementById("q").addEventListener("input",function(e){Q=e.target.value.toLowerCase().trim();render()});
 document.getElementById("chips").addEventListener("click",function(e){var c=e.target.closest(".chip");if(!c)return;var k=c.getAttribute("data-k"),v=c.getAttribute("data-v");ACT[k]=ACT[k]===v?undefined:v;render()});
-document.getElementById("list").addEventListener("click",function(e){var row=e.target.closest(".row");if(row)row.classList.toggle("open")});
+document.getElementById("list").addEventListener("click",function(e){var ah=e.target.closest(".ahead");if(ah){var ag=ah.parentNode;ag.classList.toggle("open");var ak=ag.getAttribute("data-k");if(ak)OPEN[ak]=ag.classList.contains("open");return;}var el=e.target.closest(".act")||e.target.closest(".row");if(el){el.classList.toggle("open");var k=el.getAttribute("data-k");if(k)OPEN[k]=el.classList.contains("open");}});
 render();
-if(META.live){var poll=function(){fetch('/data',{cache:'no-store'}).then(function(r){return r.json()}).then(function(d){RECORDS=d.recs||[];META.count=RECORDS.length;if(typeof d.signed==='boolean')META.signed=d.signed;render()}).catch(function(){})};poll();setInterval(poll,2000);}
+if(META.live){var poll=function(){fetch('/data',{cache:'no-store'}).then(function(r){return r.json()}).then(function(d){var nr=d.recs||[];var changed=nr.length!==RECORDS.length;RECORDS=nr;META.count=RECORDS.length;if(typeof d.signed==='boolean')META.signed=d.signed;if(changed)render()}).catch(function(){})};poll();setInterval(poll,2000);}
 </script></body></html>`;
+async function handleClaim(argv) {
+  const { readFileSync: readFileSync11, existsSync: existsSync9, writeFileSync: writeFileSync4 } = await import("fs");
+  const { join: join8 } = await import("path");
+  const { buildClaim: buildClaim2 } = await Promise.resolve().then(() => (init_claim(), claim_exports));
+  let dir = process.cwd();
+  const di = argv.indexOf("--dir");
+  if (di !== -1 && argv[di + 1]) dir = argv[di + 1];
+  let predicate = null;
+  const noIdx = argv.indexOf("--no"), onlyIdx = argv.indexOf("--only"), nvIdx = argv.indexOf("--no-verdict"), cvIdx = argv.indexOf("--count");
+  if (noIdx !== -1 && argv[noIdx + 1]) predicate = { kind: "no_capability", capability: argv[noIdx + 1] };
+  else if (onlyIdx !== -1 && argv[onlyIdx + 1]) predicate = { kind: "only_capabilities", capabilities: argv[onlyIdx + 1].split(",").map((s) => s.trim()).filter(Boolean) };
+  else if (nvIdx !== -1 && argv[nvIdx + 1]) predicate = { kind: "no_verdict", verdict: argv[nvIdx + 1] };
+  else if (cvIdx !== -1 && argv[cvIdx + 1]) predicate = { kind: "count_verdict", verdict: argv[cvIdx + 1] };
+  if (!predicate) {
+    process.stderr.write(`
+${bold("protect-mcp claim")}
+
+Attest a signed, position-blind claim over your record:
+  --no <capability>        no action used it, e.g. ${dim("--no net.egress")}
+  --only <c1,c2,...>       all actions confined to these capabilities
+  --no-verdict <verdict>   e.g. ${dim("--no-verdict blocked")}
+  --count <verdict>        how many, e.g. ${dim("--count blocked")}
+  --anchor                 also record the claim digest in the public append-only
+                           log so a counterparty can trust it is complete (only the
+                           hash is sent; your record stays local)
+
+Example: ${bold("npx protect-mcp claim --no net.egress --anchor")}
+
+`);
+    process.exit(0);
+    return;
+  }
+  const keyPath = join8(dir, "keys", "gateway.json");
+  if (!existsSync9(keyPath)) {
+    process.stderr.write(`
+${bold("protect-mcp claim")}
+
+No signing key at ${keyPath}. A claim must be signed. Run ${bold("npx protect-mcp init")} first.
+
+`);
+    process.exit(1);
+    return;
+  }
+  let key;
+  try {
+    key = JSON.parse(readFileSync11(keyPath, "utf-8"));
+  } catch {
+    process.stderr.write(`
+protect-mcp claim: ${keyPath} is not valid JSON.
+
+`);
+    process.exit(1);
+    return;
+  }
+  if (!key.privateKey || !key.publicKey) {
+    process.stderr.write(`
+protect-mcp claim: ${keyPath} is missing privateKey/publicKey.
+
+`);
+    process.exit(1);
+    return;
+  }
+  const recPath = join8(dir, ".protect-mcp-receipts.jsonl");
+  if (!existsSync9(recPath)) {
+    process.stderr.write(`
+${bold("protect-mcp claim")}
+
+No signed receipts in ${dir}. Run the gate with signing on, then try again.
+
+`);
+    process.exit(0);
+    return;
+  }
+  const receipts = readFileSync11(recPath, "utf-8").split(/\r?\n/).map((l) => l.trim()).filter(Boolean).map((l) => {
+    try {
+      return JSON.parse(l);
+    } catch {
+      return null;
+    }
+  }).filter((x) => x !== null);
+  if (!receipts.length) {
+    process.stderr.write(`
+protect-mcp claim: no readable receipts in ${recPath}.
+
+`);
+    process.exit(0);
+    return;
+  }
+  const pack = buildClaim2(receipts, predicate, { privateKey: key.privateKey, publicKey: key.publicKey, kid: key.kid || "gateway", issuer: "protect-mcp" }, (/* @__PURE__ */ new Date()).toISOString());
+  const oi = argv.indexOf("--output");
+  const out = oi !== -1 && argv[oi + 1] ? argv[oi + 1] : join8(dir, "claim-" + Date.now() + ".json");
+  writeFileSync4(out, JSON.stringify(pack, null, 2) + "\n");
+  process.stdout.write(`
+${bold("\u{1F6E1}\uFE0F  Signed claim")}
+`);
+  process.stdout.write(`  ${pack.claim.statement}: ${pack.claim.holds ? green("holds") : yellow("does not hold")}  ${dim("(" + pack.claim.matched + " matched of " + pack.scope.total + " decisions)")}
+`);
+  process.stdout.write(`  ${dim("Position-blind: reveals decision categories, never tool inputs, outputs, or data. Ed25519-signed.")}
+`);
+  process.stdout.write(`  Written to ${out}
+`);
+  process.stdout.write(`  Hand it to anyone. They verify offline: ${bold("npx protect-mcp verify-claim " + out)}
+`);
+  if (argv.indexOf("--anchor") !== -1) {
+    const { anchorClaim: anchorClaim2 } = await Promise.resolve().then(() => (init_claim(), claim_exports));
+    const li = argv.indexOf("--log");
+    const logBase = li !== -1 && argv[li + 1] ? argv[li + 1] : void 0;
+    process.stdout.write(`
+  ${dim("Anchoring the claim digest to the public append-only log (only the hash leaves your machine)...")}
+`);
+    const res = await anchorClaim2(
+      pack,
+      { privateKey: key.privateKey, publicKey: key.publicKey, kid: key.kid || "gateway", issuer: "protect-mcp" },
+      { log: logBase, issuedAt: (/* @__PURE__ */ new Date()).toISOString() }
+    );
+    if (res.ok) {
+      const sidecar = out.replace(/\.json$/, "") + ".anchor.json";
+      writeFileSync4(sidecar, JSON.stringify({ log: logBase || "https://scopeblind.com", seq: res.seq, entry_url: res.entry_url, anchored_at: res.anchored_at, claim_digest: res.claim_digest, envelope: res.envelope }, null, 2) + "\n");
+      process.stdout.write(`  ${green("Anchored")} as log entry ${bold("#" + res.seq)}${res.already_anchored ? dim(" (already present)") : ""}  ${dim(res.entry_url || "")}
+`);
+      process.stdout.write(`  ${dim("A counterparty can now confirm this exact claim existed at " + (res.anchored_at || "this time") + " and cannot be quietly re-cut.")}
+`);
+      process.stdout.write(`  ${dim("Anchor record written to " + sidecar + ". Only the digest was sent; your record stayed local.")}
+`);
+      process.stdout.write(`  ${dim("To anchor as your enrolled org identity (a key a counterparty can pin), see")} ${bold("scopeblind.com/enroll")}
+`);
+    } else {
+      process.stdout.write(`  ${yellow("Anchor skipped")} ${dim("(" + (res.error || "unavailable") + "). The claim above is complete and verifiable offline without it.")}
+`);
+    }
+  }
+  process.stdout.write(`
+`);
+  process.exit(0);
+}
+async function handleVerifyClaim(argv) {
+  const { readFileSync: readFileSync11, existsSync: existsSync9 } = await import("fs");
+  const { verifyClaim: verifyClaim2 } = await Promise.resolve().then(() => (init_claim(), claim_exports));
+  const file = argv.find((a) => !a.startsWith("--"));
+  if (!file || !existsSync9(file)) {
+    process.stderr.write(`
+${bold("protect-mcp verify-claim")} <claim.json> [--key <public-hex>]
+
+Provide a claim pack file.
+
+`);
+    process.exit(2);
+    return;
+  }
+  let pack;
+  try {
+    pack = JSON.parse(readFileSync11(file, "utf-8"));
+  } catch {
+    process.stderr.write(`
+protect-mcp verify-claim: ${file} is not valid JSON.
+
+`);
+    process.exit(2);
+    return;
+  }
+  if (!pack || pack.type !== "scopeblind.claim.v1") {
+    process.stderr.write(`
+protect-mcp verify-claim: not a scopeblind.claim.v1 pack.
+
+`);
+    process.exit(2);
+    return;
+  }
+  const ki = argv.indexOf("--key");
+  const v = verifyClaim2(pack, ki !== -1 ? argv[ki + 1] : void 0);
+  const ok = (b) => b ? green("\u2713") : red("\u2717");
+  process.stdout.write(`
+${bold("protect-mcp verify-claim")}
+`);
+  process.stdout.write(`  Claim:      ${pack.claim ? pack.claim.statement : "(none)"}
+`);
+  process.stdout.write(`  Holds:      ${v.holds ? green("yes") : yellow("no")}  ${dim("(" + v.matched + " matched of " + v.total + " decisions)")}
+`);
+  process.stdout.write(`  Signature:  ${ok(v.authentic)} ${v.authentic ? "valid" : "INVALID"}  ${dim("issuer kid " + (pack.issuer && pack.issuer.kid || "?"))}
+`);
+  process.stdout.write(`  Commitment: ${ok(v.root_ok)} ${v.root_ok ? "Merkle root matches the " + v.total + " disclosed decisions" : "MISMATCH"}
+`);
+  process.stdout.write(`  Predicate:  ${ok(v.predicate_ok)} ${v.predicate_ok ? "recomputed independently and matches" : "MISMATCH"}
+`);
+  process.stdout.write(`
+  ${v.valid ? green("VALID") : red("INVALID")} attestation.
+`);
+  process.stdout.write(`  ${dim("Proves the pack came from the issuer key and the claim is true over the disclosed decision")}
+`);
+  process.stdout.write(`  ${dim("categories (verdict + capabilities), which reveal no tool inputs, outputs, or data. Completeness")}
+`);
+  process.stdout.write(`  ${dim("of the disclosed set is attested by the issuer; pin the key or anchor to the log for more.")}
+
+`);
+  process.exit(v.valid ? 0 : 1);
+}
 async function handleBundle(argv) {
   const { readFileSync: readFileSync11, writeFileSync: writeFileSync4, existsSync: existsSync9 } = await import("fs");
   const { join: join8 } = await import("path");
@@ -11884,6 +12455,14 @@ async function main() {
     await handleRecord(args.slice(1));
     return;
   }
+  if (args[0] === "claim") {
+    await handleClaim(args.slice(1));
+    return;
+  }
+  if (args[0] === "verify-claim") {
+    await handleVerifyClaim(args.slice(1));
+    return;
+  }
   if (args[0] === "init-hooks") {
     await handleInitHooks(args.slice(1));
     process.exit(0);