protect-mcp 0.9.2 → 0.9.4

package/dist/cli.mjs

@@ -11,11 +11,11 @@ import {
   readInstalledConnectorPilots,
   simulate,
   writeConnectorPilots
-} from "./chunk-CXW2EIRM.mjs";
+} from "./chunk-7MHK5RF4.mjs";
 import {
   ProtectGateway,
   validateCredentials
-} from "./chunk-GHR65WVD.mjs";
+} from "./chunk-PB3TC7E3.mjs";
 import {
   buildActionReadback,
   evaluateCedar,
@@ -26,7 +26,7 @@ import {
   policySetFromSource,
   runEvaluatorSelfTest,
   signDecision
-} from "./chunk-IDUH2O4Q.mjs";
+} from "./chunk-XLJUZ4WO.mjs";
 import "./chunk-PQJP2ZCI.mjs";
 
 // src/cli.ts
@@ -100,8 +100,12 @@ Commands:
   digest            Generate a human-readable summary of agent activity
   receipts          Show recent persisted signed receipts
   record            Open a local, searchable view of your record in the browser
-  claim             Attest a signed, position-blind claim over your record (e.g. no egress)
-  verify-claim      Verify a claim attestation offline (signature + predicate + commitment)
+  claim             Attest a signed, position-blind claim over your record (e.g. no egress,
+                    no payment, every payment under a cap)
+  verify-claim      Verify a claim attestation offline (signature + predicate + commitment
+                    + the anchor sidecar and issuer identity when present)
+  anchor-record     Checkpoint the record's Merkle root + count into the public log
+                    (heartbeat-friendly: skips when unchanged; only hashes leave)
   bundle            Export an offline-verifiable audit bundle
 
 Examples:
@@ -2033,6 +2037,16 @@ Start the gate with ${bold("npx protect-mcp serve")}, use your agent, then run t
       return null;
     }
   }).filter((x) => x !== null).map(mapRecordEntry);
+  let pinnedKey = "";
+  let pinnedKid = "";
+  try {
+    const kd = JSON.parse(readFileSync(join(dir, "keys", "gateway.json"), "utf-8"));
+    if (kd && typeof kd.publicKey === "string" && /^[0-9a-f]{64}$/i.test(kd.publicKey)) {
+      pinnedKey = kd.publicKey;
+      pinnedKid = typeof kd.kid === "string" ? kd.kid : "";
+    }
+  } catch {
+  }
   const openTarget = (target) => {
     if (argv.includes("--no-open")) return;
     const platform = process.platform;
@@ -2060,7 +2074,7 @@ Start the gate with ${bold("npx protect-mcp serve")}, use your agent, then run t
         res.end(JSON.stringify({ recs: recs2, signed: f === recPath }));
         return;
       }
-      const meta2 = { file: chosen, signed: pick() === recPath, count: 0, live: true };
+      const meta2 = { file: chosen, signed: pick() === recPath, count: 0, live: true, pinned_key: pinnedKey, pinned_kid: pinnedKid };
       const page = RECORD_HTML.replace("__DATA__", () => "[]").replace("__META__", () => JSON.stringify(meta2));
       res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
       res.end(page);
@@ -2085,7 +2099,7 @@ ${bold("\u{1F6E1}\uFE0F  Your record")} ${dim("\xB7")} live at ${url}
     return;
   }
   const recs = readRecs(chosen);
-  const meta = { file: chosen, signed: chosen === recPath, count: recs.length, live: false };
+  const meta = { file: chosen, signed: chosen === recPath, count: recs.length, live: false, pinned_key: pinnedKey, pinned_kid: pinnedKid };
   const html = RECORD_HTML.replace("__DATA__", () => JSON.stringify(recs)).replace("__META__", () => JSON.stringify(meta));
   const out = join(osMod.tmpdir(), "protect-mcp-record-" + Date.now() + ".html");
   writeFileSync(out, html);
@@ -2151,6 +2165,9 @@ input{width:100%;padding:10px 13px;border:1px solid var(--line);border-radius:9p
 .badge{font-size:10.5px;font-weight:600;padding:1px 7px;border-radius:100px}
 .badge.sgn{background:var(--gb);color:var(--g)}
 .badge.log{background:var(--paper);color:var(--faint);border:1px solid var(--line)}
+.badge.vbad{background:#fbecec;color:#b3382f;border:1px solid #edc6c2}
+.badge.vfor{background:#fbf3df;color:#8a6d1a;border:1px solid #e8d8ae}
+.stat .badk{color:#b3382f;font-weight:680}.stat .warnk{color:#8a6d1a}.stat .dim2{color:var(--faint);font-weight:400}
 .dg{font-size:10.5px;color:var(--faint);font-family:ui-monospace,Menlo,monospace}
 .when{margin-left:auto;font-size:12px;color:var(--faint);font-family:ui-monospace,Menlo,monospace}
 .det{margin-top:8px;padding-top:8px;border-top:1px solid var(--line);font-size:12px;color:var(--soft);font-family:ui-monospace,Menlo,monospace;white-space:pre-wrap;word-break:break-all;display:none}
@@ -2197,6 +2214,30 @@ input{width:100%;padding:10px 13px;border:1px solid var(--line);border-radius:9p
 </div>
 <script>
 var RECORDS=__DATA__;var META=__META__;var Q="",ACT={},VIEW="list",OPEN={};var NL=String.fromCharCode(10);
+// In-browser signature verification. Mirrors @veritasacta/artifacts exactly:
+// preimage = JCS-style canonical JSON (sorted keys) of the receipt minus its
+// signature, verified with WebCrypto Ed25519. Pinned key (your keys/gateway.json
+// public half, injected by the CLI) = authenticity; key embedded in the receipt
+// payload (0.9.3+) = self-consistency. Everything runs locally.
+var VSTATE={},VDONE=false,VBUSY=false,VUNSUP=false;
+function vkey(r){return "row:"+(r.id||"")+"|"+(r.ts||"")}
+function hexb(h){h=String(h||"");var a=new Uint8Array(h.length>>1);for(var i=0;i<a.length;i++)a[i]=parseInt(h.substr(i*2,2),16);return a}
+function canon(v){return JSON.stringify(v,function(k,x){if(x&&typeof x==="object"&&!Array.isArray(x)){var s={},ks=Object.keys(x).sort();for(var i=0;i<ks.length;i++)s[ks[i]]=x[ks[i]];return s}return x})}
+async function edv(sig,msg,pub){var key=await crypto.subtle.importKey("raw",hexb(pub),{name:"Ed25519"},false,["verify"]);return crypto.subtle.verify({name:"Ed25519"},key,hexb(sig),msg)}
+async function verifyRow(r){var raw=r.raw;if(!raw||typeof raw.signature!=="string")return"unsigned";
+var rest={},k;for(k in raw)if(k!=="signature")rest[k]=raw[k];
+var msg=new TextEncoder().encode(canon(rest));
+var pin=String(META.pinned_key||"").toLowerCase();
+var emb=String((raw.payload&&raw.payload.public_key)||raw.public_key||"").toLowerCase();
+if(!/^[0-9a-f]{64}$/.test(emb))emb="";
+if(pin){if(await edv(raw.signature,msg,pin))return"ok";if(emb&&emb!==pin&&await edv(raw.signature,msg,emb))return"foreign";return"bad"}
+if(emb)return(await edv(raw.signature,msg,emb))?"ok":"bad";
+return"nokey"}
+function vsum(){var s={ok:0,bad:0,foreign:0,nokey:0};RECORDS.forEach(function(r){if(!r.signed)return;var v=VSTATE[vkey(r)];if(v&&s[v]!==undefined)s[v]++});return s}
+async function kickVerify(){if(VBUSY||VUNSUP||!(window.crypto&&crypto.subtle))return;VBUSY=true;
+try{var rows=RECORDS.slice(0,1500);for(var i=0;i<rows.length;i++){var r=rows[i],kk=vkey(r);if(VSTATE[kk])continue;
+try{VSTATE[kk]=await verifyRow(r)}catch(e){if(e&&e.name==="NotSupportedError"){VUNSUP=true;break}VSTATE[kk]="bad"}}}
+finally{VDONE=true;VBUSY=false;render()}}
 function esc(s){return String(s).replace(/[&<>"]/g,function(c){return{"&":"&amp;","<":"&lt;",">":"&gt;",'"':"&quot;"}[c]})}
 function vlabel(v){return v==="allowed"?"Allowed":v==="held"?"Held":"Blocked"}
 function when(ts){if(!ts)return"";var d=new Date(ts);return d.toLocaleDateString(undefined,{month:"short",day:"numeric"})+" "+d.toLocaleTimeString(undefined,{hour:"2-digit",minute:"2-digit"})}
@@ -2210,8 +2251,9 @@ function exportJsonl(){var rows=filtered();if(!rows.length)return;var lines=rows
 function exportMd(){var rows=filtered();if(!rows.length)return;var c=counts(rows);var head=["# Agent decision record","",rows.length+" decisions from "+META.file,c.allowed+" allowed, "+c.held+" held, "+c.blocked+" blocked, "+c.signed+" signed.","","Generated locally by protect-mcp. These are signed receipts; verify offline with npx @veritasacta/verify (our code removed).","","| When | Decision | Tool | Reason | Hook | Signed |","|---|---|---|---|---|---|"];var body=rows.slice(0,3000).map(function(r){return "| "+(r.ts||"")+" | "+vlabel(r.verdict)+" | "+String(r.tool||"").replace(/\\|/g,"/")+" | "+String(r.reason||"").replace(/\\|/g,"/")+" | "+(r.hook||"")+" | "+(r.signed?"yes":"no")+" |"});dl("protect-mcp-record-"+stamp()+".md",head.concat(body).join(NL)+NL,"text/markdown")}
 function copyAttest(){var a=document.getElementById("attest");var cmd=a?a.getAttribute("data-cmd"):"";try{navigator.clipboard&&cmd&&navigator.clipboard.writeText(cmd)}catch(e){}var b=document.getElementById("cpa");if(b){var t=b.textContent;b.textContent="Copied";setTimeout(function(){b.textContent=t},1200)}}
 function copyVerify(){var cmd="npx @veritasacta/verify";try{navigator.clipboard&&navigator.clipboard.writeText(cmd)}catch(e){}var b=document.getElementById("cpv");if(b){var t=b.textContent;b.textContent="Copied";setTimeout(function(){b.textContent=t},1200)}}
-function renderStats(){var c=counts(RECORDS);var p=[];p.push('<span class="stat"><b>'+RECORDS.length+'</b> decisions</span>');p.push('<span class="stat"><span class="dot g"></span>'+c.allowed+' allowed</span>');if(c.held)p.push('<span class="stat"><span class="dot a"></span>'+c.held+' held</span>');p.push('<span class="stat"><span class="dot r"></span>'+c.blocked+' blocked</span>');p.push('<span class="stat sig">'+c.signed+' signed, verifiable offline</span>');document.getElementById("stats").innerHTML=p.join("")}
-function renderList(rows){var html="";rows.slice(0,800).forEach(function(r){var sig=r.signed?'<span class="badge sgn">signed</span>':'<span class="badge log">log</span>';var dg=r.digest?'<span class="dg">'+esc(String(r.digest).slice(0,10))+'</span>':'';var ct=(r.caps||[]).map(function(c){return '<span class="cap">'+esc(c)+'</span>'}).join('');var rk="row:"+(r.id||"")+"|"+(r.ts||"");html+='<div class="row '+r.verdict+(OPEN[rk]?" open":"")+'" data-k="'+esc(rk)+'"><div class="top"><span class="pill '+r.verdict+'">'+vlabel(r.verdict)+"</span><b>"+esc(r.tool)+'</b><span class="tag">'+esc(r.reason)+"</span>"+ct+(r.hook?'<span class="tag">'+esc(r.hook)+"</span>":"")+sig+dg+'<span class="when">'+esc(when(r.ts))+'</span></div><div class="det">'+esc(JSON.stringify(r.raw||r,null,2))+"</div></div>"});document.getElementById("list").innerHTML=html||'<p style="color:#8a837a">No records match.</p>';}
+function renderStats(){var c=counts(RECORDS);var p=[];p.push('<span class="stat"><b>'+RECORDS.length+'</b> decisions</span>');p.push('<span class="stat"><span class="dot g"></span>'+c.allowed+' allowed</span>');if(c.held)p.push('<span class="stat"><span class="dot a"></span>'+c.held+' held</span>');p.push('<span class="stat"><span class="dot r"></span>'+c.blocked+' blocked</span>');var st;if(!c.signed){st='0 signed, verifiable offline'}else if(VUNSUP||!(window.crypto&&crypto.subtle)){st=c.signed+' signed, verifiable offline <span class="dim2">(in-browser check unavailable here; run npx protect-mcp receipts)</span>'}else if(!VDONE){st=c.signed+' signed \xB7 verifying in your browser\u2026'}else{var s=vsum();st=s.ok+' of '+c.signed+' signatures verified in your browser';if(s.foreign)st+=' <span class="warnk">\xB7 '+s.foreign+' signed by an unpinned key</span>';if(s.bad)st+=' <span class="badk">\xB7 '+s.bad+' INVALID</span>';if(s.nokey)st+=' <span class="dim2">\xB7 '+s.nokey+' need a key to check</span>'}
+p.push('<span class="stat sig">'+st+'</span>');document.getElementById("stats").innerHTML=p.join("")}
+function renderList(rows){var html="";rows.slice(0,800).forEach(function(r){var vs=VSTATE[vkey(r)];var sig=!r.signed?'<span class="badge log">log</span>':vs==="ok"?'<span class="badge sgn">\u2713 verified</span>':vs==="bad"?'<span class="badge vbad">\u2717 invalid signature</span>':vs==="foreign"?'<span class="badge vfor">signed \xB7 unpinned key</span>':'<span class="badge sgn">signed</span>';var dg=r.digest?'<span class="dg">'+esc(String(r.digest).slice(0,10))+'</span>':'';var ct=(r.caps||[]).map(function(c){return '<span class="cap">'+esc(c)+'</span>'}).join('');var rk="row:"+(r.id||"")+"|"+(r.ts||"");html+='<div class="row '+r.verdict+(OPEN[rk]?" open":"")+'" data-k="'+esc(rk)+'"><div class="top"><span class="pill '+r.verdict+'">'+vlabel(r.verdict)+"</span><b>"+esc(r.tool)+'</b><span class="tag">'+esc(r.reason)+"</span>"+ct+(r.hook?'<span class="tag">'+esc(r.hook)+"</span>":"")+sig+dg+'<span class="when">'+esc(when(r.ts))+'</span></div><div class="det">'+esc(JSON.stringify(r.raw||r,null,2))+"</div></div>"});document.getElementById("list").innerHTML=html||'<p style="color:#8a837a">No records match.</p>';}
 function isLifecycle(r){var h=r.hook||"";return h==="SessionStart"||h==="SessionEnd"||h==="Stop"||h==="SubagentStart"||h==="SubagentStop"||h==="TaskCreated"||h==="TaskCompleted"||h==="ConfigChange"||h==="Notification"||h==="PreCompact";}
 function buildTree(rows){var ags={},order=[];rows.forEach(function(r){var a=r.agent||"main agent";if(!ags[a]){ags[a]={name:a,byId:{},items:[],caps:{},blocked:0,actions:0};order.push(a);}var g=ags[a];(r.caps||[]).forEach(function(c){g.caps[c]=(g.caps[c]||0)+1;});if(isLifecycle(r)){g.items.push({t:"e",ts:r.ts,r:r});return;}var id=r.id||("_"+r.ts);var n=g.byId[id];if(!n){n={t:"a",id:id,tool:r.tool,verdict:r.verdict,caps:(r.caps||[]).slice(),ts:r.ts,dur:0,signed:!!r.signed,raw:r.raw};g.byId[id]=n;g.items.push(n);g.actions++;}if(r.hook==="PostToolUse"){if(r.dur)n.dur=r.dur;if(!n.raw)n.raw=r.raw;}else{n.verdict=r.verdict;if((r.caps||[]).length)n.caps=r.caps.slice();n.raw=r.raw;n.ts=r.ts;}if(r.signed)n.signed=true;});order.forEach(function(a){var g=ags[a];g.blocked=g.items.filter(function(it){return it.t==="a"&&it.verdict==="blocked";}).length;g.items.sort(function(x,y){return (x.ts<y.ts)?-1:1;});});return order.map(function(a){return ags[a];});}
 function renderTree(ags){if(!ags.length){document.getElementById("list").innerHTML='<p style="color:#8a837a">No records match.</p>';return;}var html="",N=0;ags.forEach(function(g,gi){var capstr=Object.keys(g.caps).sort(function(a,b){return g.caps[b]-g.caps[a];}).slice(0,5).map(function(c){return '<span class="cap">'+esc(c)+'</span>';}).join('');var ak="ag:"+g.name;var op=(OPEN.hasOwnProperty(ak)?OPEN[ak]:(ags.length===1||gi===0))?" open":"";html+='<div class="agent'+op+'" data-k="'+esc(ak)+'"><div class="ahead"><span class="atwist">\u25B8</span><b>'+esc(g.name)+'</b><span class="acount">'+g.actions+' action'+(g.actions===1?'':'s')+'</span>'+(g.blocked?'<span class="badge blk">'+g.blocked+' blocked</span>':'')+capstr+'</div><div class="akids">';g.items.forEach(function(it){if(N++>1500)return;if(it.t==="e"){var r=it.r;html+='<div class="ev"><span class="evdot"></span>'+esc(r.hook||r.tool)+' <span class="evre">'+esc(r.reason)+'</span><span class="when">'+esc(when(r.ts))+'</span></div>';}else{var ct=(it.caps||[]).map(function(c){return '<span class="cap">'+esc(c)+'</span>';}).join('');var dur=it.dur?'<span class="dg">'+it.dur+'ms</span>':'';var ik="act:"+it.id;html+='<div class="act '+it.verdict+(OPEN[ik]?" open":"")+'" data-k="'+esc(ik)+'"><span class="pill '+it.verdict+'">'+vlabel(it.verdict)+'</span><b>'+esc(it.tool)+'</b>'+ct+(it.signed?'<span class="badge sgn">signed</span>':'')+dur+'<span class="when">'+esc(when(it.ts))+'</span><div class="det">'+esc(JSON.stringify(it.raw||{},null,2))+'</div></div>';}});html+='</div></div>';});if(N>1500)html+='<p style="color:#8a837a;font-size:12px;margin-top:10px">Showing the first 1500 items. Search or pick a facet to narrow.</p>';document.getElementById("list").innerHTML=html;}
@@ -2229,31 +2271,34 @@ if(VIEW==="tree"){renderTree(buildTree(rows));}else{renderList(rows);}}
 document.getElementById("q").addEventListener("input",function(e){Q=e.target.value.toLowerCase().trim();render()});
 document.getElementById("chips").addEventListener("click",function(e){var c=e.target.closest(".chip");if(!c)return;var k=c.getAttribute("data-k"),v=c.getAttribute("data-v");ACT[k]=ACT[k]===v?undefined:v;render()});
 document.getElementById("list").addEventListener("click",function(e){var ah=e.target.closest(".ahead");if(ah){var ag=ah.parentNode;ag.classList.toggle("open");var ak=ag.getAttribute("data-k");if(ak)OPEN[ak]=ag.classList.contains("open");return;}var el=e.target.closest(".act")||e.target.closest(".row");if(el){el.classList.toggle("open");var k=el.getAttribute("data-k");if(k)OPEN[k]=el.classList.contains("open");}});
-render();
-if(META.live){var poll=function(){fetch('/data',{cache:'no-store'}).then(function(r){return r.json()}).then(function(d){var nr=d.recs||[];var changed=nr.length!==RECORDS.length;RECORDS=nr;META.count=RECORDS.length;if(typeof d.signed==='boolean')META.signed=d.signed;if(changed)render()}).catch(function(){})};poll();setInterval(poll,2000);}
+render();kickVerify();
+if(META.live){var poll=function(){fetch('/data',{cache:'no-store'}).then(function(r){return r.json()}).then(function(d){var nr=d.recs||[];var changed=nr.length!==RECORDS.length;RECORDS=nr;META.count=RECORDS.length;if(typeof d.signed==='boolean')META.signed=d.signed;if(changed){render();kickVerify()}}).catch(function(){})};poll();setInterval(poll,2000);}
 </script></body></html>`;
 async function handleClaim(argv) {
   const { readFileSync, existsSync, writeFileSync } = await import("fs");
   const { join } = await import("path");
-  const { buildClaim } = await import("./claim-TUDH2WPB.mjs");
+  const { buildClaim } = await import("./claim-RIXFOQM7.mjs");
   let dir = process.cwd();
   const di = argv.indexOf("--dir");
   if (di !== -1 && argv[di + 1]) dir = argv[di + 1];
   let predicate = null;
-  const noIdx = argv.indexOf("--no"), onlyIdx = argv.indexOf("--only"), nvIdx = argv.indexOf("--no-verdict"), cvIdx = argv.indexOf("--count");
+  const noIdx = argv.indexOf("--no"), onlyIdx = argv.indexOf("--only"), nvIdx = argv.indexOf("--no-verdict"), cvIdx = argv.indexOf("--count"), puIdx = argv.indexOf("--payment-under");
   if (noIdx !== -1 && argv[noIdx + 1]) predicate = { kind: "no_capability", capability: argv[noIdx + 1] };
   else if (onlyIdx !== -1 && argv[onlyIdx + 1]) predicate = { kind: "only_capabilities", capabilities: argv[onlyIdx + 1].split(",").map((s) => s.trim()).filter(Boolean) };
   else if (nvIdx !== -1 && argv[nvIdx + 1]) predicate = { kind: "no_verdict", verdict: argv[nvIdx + 1] };
   else if (cvIdx !== -1 && argv[cvIdx + 1]) predicate = { kind: "count_verdict", verdict: argv[cvIdx + 1] };
+  else if (puIdx !== -1 && argv[puIdx + 1] && isFinite(parseFloat(argv[puIdx + 1]))) predicate = { kind: "payment_under", cap: parseFloat(argv[puIdx + 1]) };
   if (!predicate) {
     process.stderr.write(`
 ${bold("protect-mcp claim")}
 
 Attest a signed, position-blind claim over your record:
-  --no <capability>        no action used it, e.g. ${dim("--no net.egress")}
+  --no <capability>        no action used it, e.g. ${dim("--no net.egress")} or ${dim("--no payment")}
   --only <c1,c2,...>       all actions confined to these capabilities
   --no-verdict <verdict>   e.g. ${dim("--no-verdict blocked")}
   --count <verdict>        how many, e.g. ${dim("--count blocked")}
+  --payment-under <cap>    every agent payment stayed under the cap (amounts the
+                           gate could not read count as OVER, so this cannot lie)
   --anchor                 also record the claim digest in the public append-only
                            log so a counterparty can trust it is complete (only the
                            hash is sent; your record stays local)
@@ -2336,7 +2381,7 @@ ${bold("\u{1F6E1}\uFE0F  Signed claim")}
   process.stdout.write(`  Hand it to anyone. They verify offline: ${bold("npx protect-mcp verify-claim " + out)}
 `);
   if (argv.indexOf("--anchor") !== -1) {
-    const { anchorClaim } = await import("./claim-TUDH2WPB.mjs");
+    const { anchorClaim } = await import("./claim-RIXFOQM7.mjs");
     const li = argv.indexOf("--log");
     const logBase = li !== -1 && argv[li + 1] ? argv[li + 1] : void 0;
     process.stdout.write(`
@@ -2356,8 +2401,18 @@ ${bold("\u{1F6E1}\uFE0F  Signed claim")}
 `);
       process.stdout.write(`  ${dim("Anchor record written to " + sidecar + ". Only the digest was sent; your record stayed local.")}
 `);
-      process.stdout.write(`  ${dim("To anchor as your enrolled org identity (a key a counterparty can pin), see")} ${bold("scopeblind.com/enroll")}
+      const { lookupPinnedIdentity } = await import("./claim-RIXFOQM7.mjs");
+      const who = await lookupPinnedIdentity(key.publicKey, { log: logBase });
+      if (who && who.found && !who.revoked) {
+        process.stdout.write(`  ${green("Identity:")} anchored as ${bold(who.name || who.slug || "enrolled org")} ${dim("(key pinned in the ScopeBlind directory" + (who.enrolled_at ? ", enrolled " + who.enrolled_at.slice(0, 10) : "") + ")")}
 `);
+      } else if (who && who.found && who.revoked) {
+        process.stdout.write(`  ${red("Identity: this key is REVOKED in the ScopeBlind directory.")}
+`);
+      } else {
+        process.stdout.write(`  ${dim("Identity: anonymous (key not enrolled). To anchor as a named org a counterparty can pin, see")} ${bold("scopeblind.com/enroll")}
+`);
+      }
     } else {
       process.stdout.write(`  ${yellow("Anchor skipped")} ${dim("(" + (res.error || "unavailable") + "). The claim above is complete and verifiable offline without it.")}
 `);
@@ -2367,9 +2422,135 @@ ${bold("\u{1F6E1}\uFE0F  Signed claim")}
 `);
   process.exit(0);
 }
+async function handleAnchorRecord(argv) {
+  const { readFileSync, existsSync, appendFileSync } = await import("fs");
+  const { join } = await import("path");
+  const { anchorRecordCheckpoint, buildRecordCheckpoint, lookupPinnedIdentity } = await import("./claim-RIXFOQM7.mjs");
+  let dir = process.cwd();
+  const di = argv.indexOf("--dir");
+  if (di !== -1 && argv[di + 1]) dir = argv[di + 1];
+  const li = argv.indexOf("--log");
+  const logBase = li !== -1 && argv[li + 1] ? argv[li + 1] : void 0;
+  const keyPath = join(dir, "keys", "gateway.json");
+  if (!existsSync(keyPath)) {
+    process.stderr.write(`
+${bold("protect-mcp anchor-record")}
+
+No signing key at ${keyPath}. A checkpoint must be signed. Run ${bold("npx protect-mcp init")} first.
+
+`);
+    process.exit(1);
+    return;
+  }
+  let key;
+  try {
+    key = JSON.parse(readFileSync(keyPath, "utf-8"));
+  } catch {
+    process.stderr.write(`
+protect-mcp anchor-record: ${keyPath} is not valid JSON.
+
+`);
+    process.exit(1);
+    return;
+  }
+  if (!key.privateKey || !key.publicKey) {
+    process.stderr.write(`
+protect-mcp anchor-record: ${keyPath} is missing privateKey/publicKey.
+
+`);
+    process.exit(1);
+    return;
+  }
+  const recPath = join(dir, ".protect-mcp-receipts.jsonl");
+  if (!existsSync(recPath)) {
+    process.stderr.write(`
+${bold("protect-mcp anchor-record")}
+
+No signed receipts in ${dir}. Run the gate with signing on, then try again.
+
+`);
+    process.exit(0);
+    return;
+  }
+  const receipts = readFileSync(recPath, "utf-8").split(/\r?\n/).map((l) => l.trim()).filter(Boolean).map((l) => {
+    try {
+      return JSON.parse(l);
+    } catch {
+      return null;
+    }
+  }).filter((x) => x !== null);
+  if (!receipts.length) {
+    process.stderr.write(`
+protect-mcp anchor-record: no readable receipts in ${recPath}.
+
+`);
+    process.exit(0);
+    return;
+  }
+  const claimKey = { privateKey: key.privateKey, publicKey: key.publicKey, kid: key.kid || "gateway", issuer: "protect-mcp" };
+  const historyPath = join(dir, ".protect-mcp-anchors.jsonl");
+  const preview = buildRecordCheckpoint(receipts, claimKey, "preview");
+  if (!argv.includes("--force") && existsSync(historyPath)) {
+    const lines = readFileSync(historyPath, "utf-8").split(/\r?\n/).filter(Boolean);
+    const last = lines.length ? (() => {
+      try {
+        return JSON.parse(lines[lines.length - 1]);
+      } catch {
+        return null;
+      }
+    })() : null;
+    if (last && last.record_root === preview.record_root && last.total === preview.total) {
+      process.stdout.write(`
+${bold("\u{1F6E1}\uFE0F  Record checkpoint")}
+`);
+      process.stdout.write(`  Unchanged since entry ${bold("#" + last.seq)} ${dim("(" + last.total + " receipts, anchored " + (last.anchored_at || "") + ")")}. Nothing new to anchor.
+`);
+      process.stdout.write(`  ${dim("Use --force to re-anchor anyway.")}
+
+`);
+      process.exit(0);
+      return;
+    }
+  }
+  const res = await anchorRecordCheckpoint(receipts, claimKey, { log: logBase, issuedAt: (/* @__PURE__ */ new Date()).toISOString() });
+  process.stdout.write(`
+${bold("\u{1F6E1}\uFE0F  Record checkpoint")}
+`);
+  process.stdout.write(`  ${res.total} receipts ${dim("\xB7")} root ${dim(res.record_root.slice(0, 16) + "\u2026")} ${dim("(" + res.checkpoint.from.slice(0, 10) + " \u2192 " + res.checkpoint.to.slice(0, 10) + ")")}
+`);
+  if (!res.ok) {
+    process.stdout.write(`  ${yellow("Anchor failed")} ${dim("(" + (res.error || "unavailable") + "). Nothing was recorded; try again.")}
+
+`);
+    process.exit(1);
+    return;
+  }
+  appendFileSync(historyPath, JSON.stringify({ schema: res.checkpoint.schema, seq: res.seq, anchored_at: res.anchored_at, total: res.total, record_root: res.record_root, entry_url: res.entry_url, digest: res.checkpoint.digest }) + "\n");
+  process.stdout.write(`  ${green("Anchored")} as log entry ${bold("#" + res.seq)}  ${dim(res.entry_url || "")}
+`);
+  process.stdout.write(`  ${dim("Only the root, count, and time range were sent. History: " + historyPath)}
+`);
+  const who = await lookupPinnedIdentity(claimKey.publicKey, { log: logBase });
+  if (who && who.found && !who.revoked) {
+    process.stdout.write(`  ${green("Identity:")} anchored as ${bold(who.name || who.slug || "enrolled org")} ${dim("(key pinned in the ScopeBlind directory)")}
+`);
+  } else if (who && who.found && who.revoked) {
+    process.stdout.write(`  ${red("Identity: this key is REVOKED in the ScopeBlind directory.")}
+`);
+  } else {
+    process.stdout.write(`  ${dim("Identity: anonymous (key not enrolled). Named identity: scopeblind.com/enroll")}
+`);
+  }
+  process.stdout.write(`  ${dim("A claim whose commitment matches this root is provably over the complete record as of")}
+`);
+  process.stdout.write(`  ${dim("this checkpoint. Run this on a heartbeat (e.g. cron) to keep the anchored history growing.")}
+
+`);
+  process.exit(0);
+}
 async function handleVerifyClaim(argv) {
   const { readFileSync, existsSync } = await import("fs");
-  const { verifyClaim } = await import("./claim-TUDH2WPB.mjs");
+  const { verifyClaim } = await import("./claim-RIXFOQM7.mjs");
   const file = argv.find((a) => !a.startsWith("--"));
   if (!file || !existsSync(file)) {
     process.stderr.write(`
@@ -2416,17 +2597,79 @@ ${bold("protect-mcp verify-claim")}
 `);
   process.stdout.write(`  Predicate:  ${ok(v.predicate_ok)} ${v.predicate_ok ? "recomputed independently and matches" : "MISMATCH"}
 `);
+  const ai = argv.indexOf("--anchor-file");
+  const sidecarPath = ai !== -1 && argv[ai + 1] ? argv[ai + 1] : file.replace(/\.json$/, "") + ".anchor.json";
+  const requireAnchor = argv.includes("--check-anchor");
+  let anchorOk = true;
+  if (existsSync(sidecarPath)) {
+    const { checkClaimAnchor } = await import("./claim-RIXFOQM7.mjs");
+    let sidecar = null;
+    try {
+      sidecar = JSON.parse(readFileSync(sidecarPath, "utf-8"));
+    } catch {
+    }
+    if (!sidecar) {
+      anchorOk = false;
+      process.stdout.write(`  Anchor:     ${red("\u2717")} ${sidecarPath} is not valid JSON
+`);
+    } else {
+      const a = await checkClaimAnchor(pack, sidecar, { offline: argv.includes("--offline") });
+      anchorOk = a.local_ok && a.log_ok !== false;
+      if (a.local_ok) {
+        process.stdout.write(`  Anchor:     ${green("\u2713")} anchored envelope binds this exact claim and its record root
+`);
+        process.stdout.write(`              ${green("\u2713")} envelope signed by the claim issuer's key
+`);
+      } else {
+        for (const r of a.reasons.slice(0, 3)) process.stdout.write(`  Anchor:     ${red("\u2717")} ${r}
+`);
+      }
+      if (a.log_ok === true) {
+        process.stdout.write(`              ${green("\u2713")} public log confirms it${typeof a.seq === "number" ? ": entry " + bold("#" + a.seq) : ""}${a.anchored_at ? dim(" \xB7 anchored " + a.anchored_at) : ""}
+`);
+      } else if (a.log_ok === false) {
+        process.stdout.write(`              ${red("\u2717")} ${a.reasons[a.reasons.length - 1]}
+`);
+      } else if (a.local_ok) {
+        process.stdout.write(`              ${yellow("~")} log not checked ${dim(argv.includes("--offline") ? "(--offline)" : "(unreachable; local binding checks stand)")}
+`);
+      }
+      if (!argv.includes("--offline") && sidecar.envelope) {
+        const { lookupPinnedIdentity } = await import("./claim-RIXFOQM7.mjs");
+        const who = await lookupPinnedIdentity(sidecar.envelope.verification_key, {});
+        if (who && who.found && !who.revoked) {
+          process.stdout.write(`              ${green("\u2713")} issuer key pinned to ${bold(who.name || who.slug || "an enrolled org")} ${dim("(ScopeBlind key directory)")}
+`);
+        } else if (who && who.found && who.revoked) {
+          anchorOk = false;
+          process.stdout.write(`              ${red("\u2717")} issuer key is REVOKED in the ScopeBlind key directory
+`);
+        } else if (who && !who.found) {
+          process.stdout.write(`              ${dim("issuer key not enrolled (anonymous issuer); named identities pin via scopeblind.com/enroll")}
+`);
+        }
+      }
+    }
+  } else if (requireAnchor) {
+    anchorOk = false;
+    process.stdout.write(`  Anchor:     ${red("\u2717")} no anchor sidecar at ${sidecarPath} ${dim("(mint with: protect-mcp claim ... --anchor)")}
+`);
+  } else {
+    process.stdout.write(`  Anchor:     ${dim("none found (" + sidecarPath + "). Anchoring proves the claim was fixed at a time: claim ... --anchor")}
+`);
+  }
+  const finalValid = v.valid && anchorOk;
   process.stdout.write(`
-  ${v.valid ? green("VALID") : red("INVALID")} attestation.
+  ${finalValid ? green("VALID") : red("INVALID")} attestation${v.valid && !anchorOk ? red(" (anchor check failed)") : ""}.
 `);
   process.stdout.write(`  ${dim("Proves the pack came from the issuer key and the claim is true over the disclosed decision")}
 `);
   process.stdout.write(`  ${dim("categories (verdict + capabilities), which reveal no tool inputs, outputs, or data. Completeness")}
 `);
-  process.stdout.write(`  ${dim("of the disclosed set is attested by the issuer; pin the key or anchor to the log for more.")}
+  process.stdout.write(`  ${dim("of the disclosed set is attested by the issuer; the anchor fixes it in a public append-only log.")}
 
 `);
-  process.exit(v.valid ? 0 : 1);
+  process.exit(finalValid ? 0 : 1);
 }
 async function handleBundle(argv) {
   const { readFileSync, writeFileSync, existsSync } = await import("fs");
@@ -3933,6 +4176,10 @@ async function main() {
     await handleVerifyClaim(args.slice(1));
     return;
   }
+  if (args[0] === "anchor-record") {
+    await handleAnchorRecord(args.slice(1));
+    return;
+  }
   if (args[0] === "init-hooks") {
     await handleInitHooks(args.slice(1));
     process.exit(0);
@@ -4121,7 +4368,7 @@ async function main() {
   if (useHttp) {
     const portIdx = args.indexOf("--port");
     const httpPort = portIdx >= 0 && args[portIdx + 1] ? parseInt(args[portIdx + 1]) : 3e3;
-    const { startHttpTransport } = await import("./http-transport-D7C64PIA.mjs");
+    const { startHttpTransport } = await import("./http-transport-HLSMVBI6.mjs");
     startHttpTransport({ port: httpPort, config, serverCommand: childCommand });
     return;
   }

package/dist/hook-server.js

@@ -307,7 +307,13 @@ function signDecision(entry) {
       // - scopeblind:verified  = issued via ScopeBlind VOPRF backend (paid tier)
       // - self-signed          = signed with local Ed25519 key (free tier, protect-mcp default)
       // - uncertified          = unsigned receipt (shadow mode, no signing configured)
-      issuer_certification: signerState ? "self-signed" : "uncertified"
+      issuer_certification: signerState ? "self-signed" : "uncertified",
+      // The signer's PUBLIC key, inside the signed payload, so a receipt is
+      // self-contained: any verifier (including the record viewer, in-browser)
+      // can check the signature without a side channel. Binding the key inside
+      // the signature means it cannot be swapped without breaking the signature;
+      // authenticity (that the key is YOUR gate's) still comes from pinning it.
+      public_key: signerState.publicKey
     };
     if (entry.tier) payload.tier = entry.tier;
     if (entry.credential_ref) payload.credential_ref = entry.credential_ref;
@@ -1039,7 +1045,7 @@ var sha256 = /* @__PURE__ */ createHasher(() => new SHA256());
 var sha2562 = sha256;
 
 // src/receipt-enrichment.ts
-var ENRICHMENT_VERSION = 1;
+var ENRICHMENT_VERSION = 2;
 function canonicalJson(value) {
   const seen = /* @__PURE__ */ new WeakSet();
   const enc = (v) => {
@@ -1076,7 +1082,11 @@ var RULES = [
   { cap: "secret.adjacent", text: /\.env\b|secret|credential|passwd|password|api[_-]?key|private[_-]?key|\.pem\b|\.key\b|id_rsa|bearer\s|aws_(access|secret)|authorization/ },
   { cap: "destructive", text: /rm\s+-[a-z]*[rf]|\brmdir\b|drop\s+table|truncate\s+table|delete\s+from|reset\s+--hard|--force\b|\bmkfs\b|\bdd\s+if=|shutdown|reboot|kill\s+-9|>\s*\/dev\/sd/ },
   { cap: "financial", text: /\b(order|trade|buy|sell|transfer|wire|payment|withdraw|deposit|swap|invoice|charge|refund|settle)\b/ },
-  { cap: "data.query", text: /\bselect\s+[\s\S]+\bfrom\b|\binsert\s+into\b|\bupdate\s+[\s\S]+\bset\b|\bdelete\s+from\b/ }
+  { cap: "data.query", text: /\bselect\s+[\s\S]+\bfrom\b|\binsert\s+into\b|\bupdate\s+[\s\S]+\bset\b|\bdelete\s+from\b/ },
+  // Agent payments (x402 / value transfer). Deliberately BROAD: a false positive
+  // only makes a `claim --no payment` harder to assert (conservative); a false
+  // negative would let a real payment escape the record's payment claims.
+  { cap: "payment", tool: /(^|[_.-])(pay|payment|x402|checkout)($|[_.-])|wallet.*send|send.*payment/, text: /x402|x-payment|paymentrequirements|maxamountrequired|payto|"pay_to"|eip-3009|transferwithauthorization|payment_intent|send_payment|create_payment/ }
 ];
 function deriveCapabilities(tool, input) {
   const t = String(tool || "").toLowerCase();
@@ -1110,6 +1120,33 @@ function deriveResource(input) {
   }
   return void 0;
 }
+function findField(input, names, depth = 0) {
+  if (depth > 4 || input === null || typeof input !== "object") return void 0;
+  const o = input;
+  const keys = Object.keys(o).sort();
+  for (const k of keys) {
+    if (names.indexOf(k.toLowerCase()) >= 0 && o[k] !== void 0 && o[k] !== null) return o[k];
+  }
+  for (const k of keys) {
+    const v = findField(o[k], names, depth + 1);
+    if (v !== void 0) return v;
+  }
+  return void 0;
+}
+function derivePayment(tool, input) {
+  if (deriveCapabilities(tool, input).indexOf("payment") < 0) return void 0;
+  const p = { amount: null, asset: null, recipient_digest: null };
+  const amt = findField(input, ["amount"]);
+  if (typeof amt === "number" && Number.isFinite(amt) && amt >= 0) p.amount = amt;
+  else if (typeof amt === "string" && /^\d{1,15}(\.\d{1,18})?$/.test(amt.trim()) && amt.indexOf(".") >= 0) p.amount = parseFloat(amt);
+  const asset = findField(input, ["asset", "currency", "token"]);
+  if (typeof asset === "string" && asset.trim()) p.asset = asset.trim().slice(0, 64);
+  const to = findField(input, ["payto", "pay_to", "recipient", "destination", "to"]);
+  if (typeof to === "string" && to.trim()) p.recipient_digest = sha256Hex(to.trim().toLowerCase());
+  const scheme = findField(input, ["scheme"]);
+  if (typeof scheme === "string" && scheme.trim()) p.scheme = scheme.trim().slice(0, 32);
+  return p;
+}
 function buildEnrichment(tool, input) {
   const e = {
     v: ENRICHMENT_VERSION,
@@ -1118,6 +1155,8 @@ function buildEnrichment(tool, input) {
   };
   const resource = deriveResource(input);
   if (resource) e.resource = resource;
+  const payment = derivePayment(tool, input);
+  if (payment) e.payment = payment;
   return e;
 }
 

package/dist/hook-server.mjs

@@ -1,9 +1,9 @@
 import {
   startHookServer
-} from "./chunk-744JMCY4.mjs";
-import "./chunk-KMNXHGGT.mjs";
+} from "./chunk-H332ZNJ6.mjs";
+import "./chunk-WWPQNIVF.mjs";
 import "./chunk-AYNQIEN7.mjs";
-import "./chunk-IDUH2O4Q.mjs";
+import "./chunk-XLJUZ4WO.mjs";
 import "./chunk-JIDDQUSQ.mjs";
 import "./chunk-D733KAPG.mjs";
 import "./chunk-PQJP2ZCI.mjs";

package/dist/{http-transport-D7C64PIA.mjs → http-transport-HLSMVBI6.mjs}

@@ -1,7 +1,7 @@
 import {
   ProtectGateway
-} from "./chunk-GHR65WVD.mjs";
-import "./chunk-IDUH2O4Q.mjs";
+} from "./chunk-PB3TC7E3.mjs";
+import "./chunk-XLJUZ4WO.mjs";
 import "./chunk-PQJP2ZCI.mjs";
 
 // src/http-transport.ts

package/dist/index.d.mts

@@ -3,6 +3,16 @@ export { BUILTIN_PATTERNS, HookPattern, generateHookSettings, generateSampleCeda
 export { createSandboxServer } from './demo-server.mjs';
 import 'node:http';
 
+interface PaymentInfo {
+    /** Normalized human amount in `asset` units, when derivable; else null. */
+    amount: number | null;
+    /** Asset symbol (e.g. 'USDC') or contract address, when derivable; else null. */
+    asset: string | null;
+    /** SHA-256 (hex) of the lowercased recipient: position-blind, when present. */
+    recipient_digest: string | null;
+    /** x402 scheme ('exact' | 'upto' | ...) when present. */
+    scheme?: string;
+}
 interface ReceiptEnrichment {
     /** Rule/schema version, so derivations stay reproducible as rules evolve. */
     v: number;
@@ -15,6 +25,8 @@ interface ReceiptEnrichment {
         kind: 'path' | 'host' | 'command';
         digest: string;
     };
+    /** Minimum-disclosure facts about a value transfer (x402 / agent payment). */
+    payment?: PaymentInfo;
 }
 
 interface ProtectPolicy {

package/dist/index.d.ts

@@ -3,6 +3,16 @@ export { BUILTIN_PATTERNS, HookPattern, generateHookSettings, generateSampleCeda
 export { createSandboxServer } from './demo-server.js';
 import 'node:http';
 
+interface PaymentInfo {
+    /** Normalized human amount in `asset` units, when derivable; else null. */
+    amount: number | null;
+    /** Asset symbol (e.g. 'USDC') or contract address, when derivable; else null. */
+    asset: string | null;
+    /** SHA-256 (hex) of the lowercased recipient: position-blind, when present. */
+    recipient_digest: string | null;
+    /** x402 scheme ('exact' | 'upto' | ...) when present. */
+    scheme?: string;
+}
 interface ReceiptEnrichment {
     /** Rule/schema version, so derivations stay reproducible as rules evolve. */
     v: number;
@@ -15,6 +25,8 @@ interface ReceiptEnrichment {
         kind: 'path' | 'host' | 'command';
         digest: string;
     };
+    /** Minimum-disclosure facts about a value transfer (x402 / agent payment). */
+    payment?: PaymentInfo;
 }
 
 interface ProtectPolicy {