protect-mcp 0.9.7 → 0.10.0

package/CHANGELOG.md

@@ -1,5 +1,64 @@
 # Changelog
 
+## 0.10.0: receipts migrate to the draft-02 Acta envelope
+
+Receipts are now emitted in the envelope the IETF draft actually specifies
+(draft-farley-acta-signed-receipts-02): a two-field
+`{ payload, signature: { alg: "EdDSA", kid, sig } }` envelope, with the
+access-decision fields from section 3.1 (`type: "protectmcp:decision"`,
+`tool_name`, `decision`, `reason`, `policy_digest`), `issuer_id` equal to
+`signature.kid` (section 2.2), the signature computed as PureEdDSA directly
+over the JCS bytes of the payload with no pre-hash (section 5.6), and new
+keys defaulting to the section 2.1.1 recommended
+`sb:issuer:<base58-fingerprint>` kid format (existing key files keep their
+explicit kid). Previously the package emitted an internal envelope shape
+that predated the published draft.
+
+Receipt logs are now hash-chained per section 5.7: each receipt's
+`previousReceiptHash` is the bare-hex SHA-256 of the JCS bytes of the
+previous log line exactly as written, signature included. The hook server
+resumes the chain across restarts from the tail of the existing log, and
+signing-failure tombstones participate in the chain so an unsigned gap
+cannot be silently dropped.
+
+Verification is dual-shape everywhere (the `verify_receipt` MCP tool, the
+`serve --enforce` self-test, the embedded record viewer, and the exported
+`verifyReceipt` API): receipts written by protect-mcp 0.9.x and earlier
+(flat v1 artifacts and structured v2 envelopes with a top-level signature
+string) continue to verify, and a mixed pre/post-migration log replays
+cleanly, including the chain link that spans the boundary. Verified against
+3,352 real receipts from a production gate log: all verify. The published
+`@veritasacta/verify` CLI (0.9.2) verifies the new envelopes as-is via its
+passport path; no verifier upgrade is required.
+
+New module `acta-envelope` (exported from the package root):
+`createReceiptEnvelope`, `verifyReceipt`, `receiptHash`, `receiptIdentity`,
+`computeSbIssuerKid`. `signDecision` accepts an optional previous-chain-hash
+argument and returns the emitted receipt's chain hash. `@noble/curves` and
+`@noble/hashes` moved from optional to regular dependencies.
+
+Fixed: importing the package as a library no longer attaches the demo
+server's stdin JSON-RPC listener (it now only starts when demo-server is
+the process entry point). Previously any `require("protect-mcp")` kept the
+host process's event loop alive and answered JSON-RPC on stdout.
+
+Note for strict draft conformance: `decision` may be "require_approval" for
+held-for-co-sign flows, an extension value beyond the section 3.1 set
+(allow, deny, rate_limit), pending a revision of the draft.
+
+
+## 0.9.7: the gate as an MCP server
+
+`protect-mcp mcp` boots a stdio MCP server exposing the gate itself as four
+tools, so an agent can call the gate directly instead of only through the
+PreToolUse/PostToolUse hooks: `evaluate_action` (Cedar decision, fail-closed),
+`sign_decision` (Ed25519 receipt, byte-compatible with the runtime gate's),
+`verify_receipt` (offline check), and `self_test` (proves a known-forbidden
+action is denied and a signed receipt round-trips). All four are read-only
+and annotated with what they return. A bare-spawnable bin,
+`protect-mcp-mcp`, is included alongside the `mcp` subcommand so any MCP
+host or registry can point at either.
+
 ## 0.9.6: policy you can see and change
 
 The gate is default-deny and fail-closed, but a deny used to be a dead end: an

package/dist/chunk-3AVIMUNP.mjs

@@ -0,0 +1,113 @@
+// src/acta-envelope.ts
+import { ed25519 } from "@noble/curves/ed25519";
+import { sha256 } from "@noble/hashes/sha256";
+import { bytesToHex, hexToBytes, utf8ToBytes } from "@noble/hashes/utils";
+function canonicalize(obj) {
+  return JSON.stringify(obj, (_key, value) => {
+    if (value && typeof value === "object" && !Array.isArray(value)) {
+      const sorted = {};
+      for (const k of Object.keys(value).sort()) {
+        if (!/^[\x20-\x7E]*$/.test(k)) {
+          throw new Error(`Non-ASCII key "${k}" in receipt payload. Only ASCII keys are permitted.`);
+        }
+        sorted[k] = value[k];
+      }
+      return sorted;
+    }
+    return value;
+  });
+}
+function receiptHash(obj) {
+  return bytesToHex(sha256(utf8ToBytes(canonicalize(obj))));
+}
+var B58_ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
+function base58(bytes) {
+  let n = BigInt("0x" + bytesToHex(bytes));
+  let out = "";
+  while (n > 0n) {
+    out = B58_ALPHABET[Number(n % 58n)] + out;
+    n /= 58n;
+  }
+  for (const b of bytes) {
+    if (b === 0) out = "1" + out;
+    else break;
+  }
+  return out;
+}
+function computeSbIssuerKid(publicKeyHex) {
+  return `sb:issuer:${base58(hexToBytes(publicKeyHex)).slice(0, 12)}`;
+}
+function createReceiptEnvelope(fields, privateKeyHex, kid, issuedAt) {
+  if (!fields.type) throw new Error("receipt payload requires a type");
+  if (!kid) throw new Error("kid is required");
+  const payload = {
+    ...fields,
+    issued_at: fields.issued_at || issuedAt || (/* @__PURE__ */ new Date()).toISOString(),
+    issuer_id: kid
+  };
+  const sig = bytesToHex(ed25519.sign(utf8ToBytes(canonicalize(payload)), hexToBytes(privateKeyHex)));
+  const envelope = { payload, signature: { alg: "EdDSA", kid, sig } };
+  return { envelope, hash: receiptHash(envelope) };
+}
+function verifyReceipt(envelope, publicKeyHex) {
+  try {
+    if (!envelope || typeof envelope !== "object") {
+      return { valid: false, shape: null, error: "not_an_object" };
+    }
+    const env = envelope;
+    const signature = env.signature;
+    if (signature && typeof signature === "object" && !Array.isArray(signature)) {
+      const sigObj = signature;
+      if (sigObj.alg !== "EdDSA") {
+        return { valid: false, shape: "acta-02", error: `unsupported_alg:${String(sigObj.alg)}` };
+      }
+      if (typeof sigObj.sig !== "string" || !env.payload || typeof env.payload !== "object") {
+        return { valid: false, shape: "acta-02", error: "malformed_envelope" };
+      }
+      const message = utf8ToBytes(canonicalize(env.payload));
+      const valid = ed25519.verify(hexToBytes(sigObj.sig), message, hexToBytes(publicKeyHex));
+      return valid ? { valid: true, shape: "acta-02", hash: receiptHash(env) } : { valid: false, shape: "acta-02", error: "invalid_signature" };
+    }
+    if (typeof signature === "string") {
+      const rest = {};
+      for (const k of Object.keys(env)) if (k !== "signature") rest[k] = env[k];
+      const message = utf8ToBytes(canonicalize(rest));
+      const valid = ed25519.verify(hexToBytes(signature), message, hexToBytes(publicKeyHex));
+      const shape = env.v === 2 ? "legacy-v2" : "legacy-v1";
+      return valid ? { valid: true, shape, hash: receiptHash(env) } : { valid: false, shape, error: "invalid_signature" };
+    }
+    return { valid: false, shape: null, error: "missing_signature" };
+  } catch (err) {
+    return {
+      valid: false,
+      shape: null,
+      error: `verification_error:${err instanceof Error ? err.message : "unknown"}`
+    };
+  }
+}
+function receiptIdentity(envelope) {
+  if (!envelope || typeof envelope !== "object") return { kid: null, issuer: null, type: null };
+  const env = envelope;
+  if (env.signature && typeof env.signature === "object") {
+    const payload = env.payload || {};
+    const sig = env.signature;
+    return {
+      kid: typeof sig.kid === "string" ? sig.kid : null,
+      issuer: typeof payload.issuer_id === "string" ? payload.issuer_id : typeof payload.issuer_name === "string" ? payload.issuer_name : null,
+      type: typeof payload.type === "string" ? payload.type : null
+    };
+  }
+  return {
+    kid: typeof env.kid === "string" ? env.kid : null,
+    issuer: typeof env.issuer === "string" ? env.issuer : null,
+    type: typeof env.type === "string" ? env.type : null
+  };
+}
+
+export {
+  receiptHash,
+  computeSbIssuerKid,
+  createReceiptEnvelope,
+  verifyReceipt,
+  receiptIdentity
+};

package/dist/{chunk-YM6SOJBR.mjs → chunk-622KQ4KW.mjs}

@@ -7,7 +7,7 @@ import {
   parseRateLimit,
   signDecision,
   startStatusServer
-} from "./chunk-G6X763MH.mjs";
+} from "./chunk-VWGRAUWI.mjs";
 import {
   evaluateCedar
 } from "./chunk-MWXDXYWH.mjs";

package/dist/{chunk-JQDVKZBN.mjs → chunk-HULPW5WR.mjs}

@@ -1,3 +1,7 @@
+import {
+  receiptIdentity
+} from "./chunk-3AVIMUNP.mjs";
+
 // src/report.ts
 import { readFileSync, existsSync } from "fs";
 function generateReport(logPath, receiptPath, periodDays) {
@@ -34,8 +38,9 @@ function generateReport(logPath, receiptPath, periodDays) {
         const parsed = JSON.parse(trimmed);
         if (parsed.signature) {
           receiptsSigned++;
-          if (parsed.kid && !signerKid) signerKid = parsed.kid;
-          if (parsed.issuer && !signerIssuer) signerIssuer = parsed.issuer;
+          const identity = receiptIdentity(parsed);
+          if (identity.kid && !signerKid) signerKid = identity.kid;
+          if (identity.issuer && !signerIssuer) signerIssuer = identity.issuer;
         }
       } catch {
       }

package/dist/{chunk-UWB5ALVO.mjs → chunk-K7AEEQWW.mjs}

@@ -1,22 +1,11 @@
-import {
-  sha256
-} from "./chunk-AYNQIEN7.mjs";
-import {
-  ed25519
-} from "./chunk-FFVJL3KQ.mjs";
-import {
-  Hash,
-  abytes,
-  aexists,
-  ahash,
-  bytesToHex,
-  clean,
-  hexToBytes,
-  randomBytes,
-  toBytes
-} from "./chunk-D733KAPG.mjs";
+// src/signing-committed.ts
+import { ed25519 } from "@noble/curves/ed25519";
+import { sha256 as sha2563 } from "@noble/hashes/sha256";
+import { bytesToHex as bytesToHex3, hexToBytes as hexToBytes3, randomBytes as randomBytes2 } from "@noble/hashes/utils";
 
 // src/commitments/merkle.ts
+import { sha256 } from "@noble/hashes/sha256";
+import { bytesToHex, hexToBytes } from "@noble/hashes/utils";
 var DOMAIN_LEAF = 0;
 var DOMAIN_INTERNAL = 1;
 function hashLeaf(leafBytes) {
@@ -127,75 +116,10 @@ function largestPowerOfTwoLessThan(n) {
   return k;
 }
 
-// node_modules/@noble/hashes/esm/hmac.js
-var HMAC = class extends Hash {
-  constructor(hash, _key) {
-    super();
-    this.finished = false;
-    this.destroyed = false;
-    ahash(hash);
-    const key = toBytes(_key);
-    this.iHash = hash.create();
-    if (typeof this.iHash.update !== "function")
-      throw new Error("Expected instance of class which extends utils.Hash");
-    this.blockLen = this.iHash.blockLen;
-    this.outputLen = this.iHash.outputLen;
-    const blockLen = this.blockLen;
-    const pad = new Uint8Array(blockLen);
-    pad.set(key.length > blockLen ? hash.create().update(key).digest() : key);
-    for (let i = 0; i < pad.length; i++)
-      pad[i] ^= 54;
-    this.iHash.update(pad);
-    this.oHash = hash.create();
-    for (let i = 0; i < pad.length; i++)
-      pad[i] ^= 54 ^ 92;
-    this.oHash.update(pad);
-    clean(pad);
-  }
-  update(buf) {
-    aexists(this);
-    this.iHash.update(buf);
-    return this;
-  }
-  digestInto(out) {
-    aexists(this);
-    abytes(out, this.outputLen);
-    this.finished = true;
-    this.iHash.digestInto(out);
-    this.oHash.update(out);
-    this.oHash.digestInto(out);
-    this.destroy();
-  }
-  digest() {
-    const out = new Uint8Array(this.oHash.outputLen);
-    this.digestInto(out);
-    return out;
-  }
-  _cloneInto(to) {
-    to || (to = Object.create(Object.getPrototypeOf(this), {}));
-    const { oHash, iHash, finished, destroyed, blockLen, outputLen } = this;
-    to = to;
-    to.finished = finished;
-    to.destroyed = destroyed;
-    to.blockLen = blockLen;
-    to.outputLen = outputLen;
-    to.oHash = oHash._cloneInto(to.oHash);
-    to.iHash = iHash._cloneInto(to.iHash);
-    return to;
-  }
-  clone() {
-    return this._cloneInto();
-  }
-  destroy() {
-    this.destroyed = true;
-    this.oHash.destroy();
-    this.iHash.destroy();
-  }
-};
-var hmac = (hash, key, message) => new HMAC(hash, key).update(message).digest();
-hmac.create = (hash, key) => new HMAC(hash, key);
-
 // src/commitments/primitives.ts
+import { sha256 as sha2562 } from "@noble/hashes/sha256";
+import { hmac } from "@noble/hashes/hmac";
+import { bytesToHex as bytesToHex2, hexToBytes as hexToBytes2, randomBytes } from "@noble/hashes/utils";
 function jcs(value) {
   if (value === null || value === void 0) return "null";
   if (typeof value === "boolean" || typeof value === "number")
@@ -257,7 +181,7 @@ function leavesFromFields(fields) {
 
 // src/signing-committed.ts
 function freshSalt() {
-  return randomBytes(32);
+  return randomBytes2(32);
 }
 function signCommittedDecision(entry, committedFieldNames, signingKey, publicKey, kid, issuer) {
   const allFields = {
@@ -297,7 +221,7 @@ function signCommittedDecision(entry, committedFieldNames, signingKey, publicKey
     const { sorted, leafBytes } = leavesFromFields(committedFields);
     const leafHashes = leafBytes.map(hashLeaf);
     const root = merkleRoot(leafHashes);
-    committedFieldsRoot = bytesToHex(root);
+    committedFieldsRoot = bytesToHex3(root);
     sorted.forEach((f, i) => {
       openings[f.name] = { name: f.name, value: f.value, salt: f.salt, index: i };
     });
@@ -314,8 +238,8 @@ function signCommittedDecision(entry, committedFieldNames, signingKey, publicKey
     payload.committed_field_names = committedFields.map((f) => f.name);
   }
   const canonical = jcs(payload);
-  const messageHash = sha256(new TextEncoder().encode(canonical));
-  const signatureBytes = ed25519.sign(messageHash, hexToBytes(signingKey));
+  const messageHash = sha2563(new TextEncoder().encode(canonical));
+  const signatureBytes = ed25519.sign(messageHash, hexToBytes3(signingKey));
   const signedReceipt = {
     ...payload,
     signature: {
@@ -328,7 +252,7 @@ function signCommittedDecision(entry, committedFieldNames, signingKey, publicKey
     }
   };
   const signedJson = JSON.stringify(signedReceipt);
-  const receiptHash = bytesToHex(sha256(new TextEncoder().encode(jcs(signedReceipt))));
+  const receiptHash = bytesToHex3(sha2563(new TextEncoder().encode(jcs(signedReceipt))));
   return {
     signed: signedJson,
     artifact_type: "decision_receipt_committed_v1",
@@ -457,7 +381,7 @@ function committedFieldNamesFromReceipt(receipt, openings) {
   return Array.from(new Set(names)).sort();
 }
 function receiptHashHex(receipt) {
-  return bytesToHex(sha256(new TextEncoder().encode(jcs(receipt))));
+  return bytesToHex3(sha2563(new TextEncoder().encode(jcs(receipt))));
 }
 function verifyCommittedReceiptSignature(receipt) {
   const signature = receipt.signature;
@@ -467,16 +391,15 @@ function verifyCommittedReceiptSignature(receipt) {
     return null;
   }
   const { signature: _signature, ...payloadWithoutSig } = receipt;
-  const messageHash = sha256(new TextEncoder().encode(jcs(payloadWithoutSig)));
+  const messageHash = sha2563(new TextEncoder().encode(jcs(payloadWithoutSig)));
   try {
-    return ed25519.verify(base64urlDecode(sig.sig), messageHash, hexToBytes(sig.public_key));
+    return ed25519.verify(base64urlDecode(sig.sig), messageHash, hexToBytes3(sig.public_key));
   } catch {
     return false;
   }
 }
 
 export {
-  hmac,
   signCommittedDecision,
   discloseField,
   createSelectiveDisclosurePackage,

package/dist/{chunk-WWPQNIVF.mjs → chunk-KRKZ2YX7.mjs}

@@ -1,11 +1,6 @@
-import {
-  sha256
-} from "./chunk-AYNQIEN7.mjs";
-import {
-  bytesToHex
-} from "./chunk-D733KAPG.mjs";
-
 // src/receipt-enrichment.ts
+import { sha256 } from "@noble/hashes/sha256";
+import { bytesToHex } from "@noble/hashes/utils";
 var ENRICHMENT_VERSION = 2;
 function canonicalJson(value) {
   const seen = /* @__PURE__ */ new WeakSet();

package/dist/{chunk-MOXINIMB.mjs → chunk-SPDIFFGP.mjs}

@@ -1,11 +1,11 @@
 import {
   meetsMinTier
-} from "./chunk-YM6SOJBR.mjs";
+} from "./chunk-622KQ4KW.mjs";
 import {
   checkRateLimit,
   getToolPolicy,
   parseRateLimit
-} from "./chunk-G6X763MH.mjs";
+} from "./chunk-VWGRAUWI.mjs";
 
 // src/simulate.ts
 import { readFileSync } from "fs";

package/dist/{chunk-G6X763MH.mjs → chunk-VWGRAUWI.mjs}

@@ -1,3 +1,8 @@
+import {
+  computeSbIssuerKid,
+  createReceiptEnvelope
+} from "./chunk-3AVIMUNP.mjs";
+
 // src/policy.ts
 import { createHash } from "crypto";
 import { readFileSync } from "fs";
@@ -77,13 +82,11 @@ function checkRateLimit(key, limit, store) {
 // src/signing.ts
 import { readFileSync as readFileSync2, existsSync } from "fs";
 var signerState = null;
-var artifactsModule = null;
 var signingConfigured = false;
 var signingInitError = null;
 async function initSigning(config) {
   const warnings = [];
   signerState = null;
-  artifactsModule = null;
   signingConfigured = Boolean(config && config.enabled !== false);
   signingInitError = null;
   if (!config || config.enabled === false) {
@@ -112,32 +115,22 @@ async function initSigning(config) {
     warnings.push(`signing: ${signingInitError}`);
     return warnings;
   }
-  try {
-    const moduleName = "@veritasacta/artifacts";
-    artifactsModule = await import(
-      /* @vite-ignore */
-      moduleName
-    );
-  } catch {
-    signingInitError = "@veritasacta/artifacts not available";
-    warnings.push(`signing: ${signingInitError} \u2014 enforce mode will fail closed`);
-    return warnings;
-  }
   try {
     signerState = {
       privateKey: keyData.privateKey,
       publicKey: keyData.publicKey,
-      kid: keyData.kid || artifactsModule.computeKid(keyData.publicKey),
+      // kid is opaque per draft-02; existing key files keep their explicit kid,
+      // and keys without one get the s2.1.1 RECOMMENDED sb:issuer format.
+      kid: keyData.kid || computeSbIssuerKid(keyData.publicKey),
       issuer: config.issuer || keyData.issuer || "protect-mcp"
     };
   } catch (err) {
     signingInitError = `failed to initialize signer: ${err instanceof Error ? err.message : err}`;
-    artifactsModule = null;
     warnings.push(`signing: ${signingInitError} \u2014 enforce mode will fail closed`);
   }
   return warnings;
 }
-function signDecision(entry) {
+function signDecision(entry, prevReceiptHash) {
   const artifactType = entry.decision === "deny" ? "gateway_restraint" : "decision_receipt";
   if (signingConfigured && signingInitError) {
     return {
@@ -148,7 +141,7 @@ function signDecision(entry) {
       error: signingInitError
     };
   }
-  if (signingConfigured && (!signerState || !artifactsModule)) {
+  if (signingConfigured && !signerState) {
     const error = "signing was configured but no signer is ready";
     return {
       ok: false,
@@ -158,21 +151,24 @@ function signDecision(entry) {
       error
     };
   }
-  if (!signerState || !artifactsModule) {
+  if (!signerState) {
     return { ok: false, signed: null, artifact_type: "none" };
   }
   try {
     const payload = {
-      tool: entry.tool,
+      // draft-02 s3.1 access-decision fields
+      type: "protectmcp:decision",
+      tool_name: entry.tool,
       decision: entry.decision,
-      reason_code: entry.reason_code,
+      reason: entry.reason_code,
       policy_digest: entry.policy_digest,
+      // Extension fields (signed alongside the s3.1 core)
       scope: entry.request_id,
       // request scope
       mode: entry.mode,
       request_id: entry.request_id,
       // Spec version: ties every receipt to the IETF standard
-      spec: "draft-farley-acta-signed-receipts-01",
+      spec: "draft-farley-acta-signed-receipts-02",
       // Issuer certification: distinguishes VOPRF-backed receipts from self-signed ones
       // - scopeblind:verified  = issued via ScopeBlind VOPRF backend (paid tier)
       // - self-signed          = signed with local Ed25519 key (free tier, protect-mcp default)
@@ -185,6 +181,10 @@ function signDecision(entry) {
       // authenticity (that the key is YOUR gate's) still comes from pinning it.
       public_key: signerState.publicKey
     };
+    if (signerState.issuer && signerState.issuer !== signerState.kid) {
+      payload.issuer_name = signerState.issuer;
+    }
+    if (prevReceiptHash) payload.previousReceiptHash = prevReceiptHash;
     if (entry.tier) payload.tier = entry.tier;
     if (entry.credential_ref) payload.credential_ref = entry.credential_ref;
     if (entry.rate_limit_remaining !== void 0) {
@@ -199,19 +199,17 @@ function signDecision(entry) {
     if (entry.enrichment) payload.enrichment = entry.enrichment;
     if (entry.action_readback) payload.action_readback = entry.action_readback;
     if (entry.deny_iteration) payload.deny_iteration = entry.deny_iteration;
-    const result = artifactsModule.createSignedArtifact(
-      artifactType,
+    const result = createReceiptEnvelope(
       payload,
       signerState.privateKey,
-      {
-        kid: signerState.kid,
-        issuer: signerState.issuer
-      }
+      signerState.kid,
+      Number.isFinite(entry.timestamp) ? new Date(entry.timestamp).toISOString() : void 0
     );
     return {
       ok: true,
-      signed: JSON.stringify(result.artifact),
-      artifact_type: artifactType
+      signed: JSON.stringify(result.envelope),
+      artifact_type: artifactType,
+      receipt_hash: result.hash
     };
   } catch (err) {
     const message = err instanceof Error ? err.message : "unknown error";
@@ -233,7 +231,7 @@ function getSignerInfo() {
   };
 }
 function isSigningEnabled() {
-  return signingConfigured && signingInitError === null && signerState !== null && artifactsModule !== null;
+  return signingConfigured && signingInitError === null && signerState !== null;
 }
 
 // src/http-server.ts

package/dist/{chunk-SETXVE2K.mjs → chunk-ZG6NAATA.mjs}

@@ -35158,20 +35158,23 @@ Contents: Hello from protect-mcp demo server!`;
   }
   return "";
 }
-var rl = createInterface({ input: process.stdin, crlfDelay: Infinity });
-rl.on("line", (line) => {
-  const trimmed = line.trim();
-  if (!trimmed) return;
-  try {
-    const request = JSON.parse(trimmed);
-    const response = handleRequest(request);
-    if (response) {
-      process.stdout.write(response + "\n");
-    }
-  } catch {
-  }
-});
-process.stderr.write("[DEMO_SERVER] protect-mcp demo server started \u2014 5 tools registered\n");
+var isMainModule = /demo-server\.(js|cjs|mjs|ts)$/.test(process.argv[1] || "");
+if (isMainModule) {
+  const rl = createInterface({ input: process.stdin, crlfDelay: Infinity });
+  rl.on("line", (line) => {
+    const trimmed = line.trim();
+    if (!trimmed) return;
+    try {
+      const request = JSON.parse(trimmed);
+      const response = handleRequest(request);
+      if (response) {
+        process.stdout.write(response + "\n");
+      }
+    } catch {
+    }
+  });
+  process.stderr.write("[DEMO_SERVER] protect-mcp demo server started \u2014 5 tools registered\n");
+}
 function createSandboxServer() {
   const { McpServer } = require_mcp();
   const { z } = require_zod();

package/dist/{chunk-AUUAVWQM.mjs → chunk-ZLZPSUCY.mjs}

@@ -1,6 +1,6 @@
 import {
   buildEnrichment
-} from "./chunk-WWPQNIVF.mjs";
+} from "./chunk-KRKZ2YX7.mjs";
 import {
   ReceiptBuffer,
   buildActionReadback,
@@ -12,12 +12,15 @@ import {
   loadPolicy,
   parseRateLimit,
   signDecision
-} from "./chunk-G6X763MH.mjs";
+} from "./chunk-VWGRAUWI.mjs";
 import {
   evaluateCedar,
   isCedarAvailable,
   loadCedarPolicies
 } from "./chunk-MWXDXYWH.mjs";
+import {
+  receiptHash
+} from "./chunk-3AVIMUNP.mjs";
 
 // src/hook-server.ts
 import { createServer } from "http";
@@ -181,6 +184,16 @@ var DEFAULT_PORT = 9377;
 var LOG_FILE = ".protect-mcp-log.jsonl";
 var RECEIPTS_FILE = ".protect-mcp-receipts.jsonl";
 var PAYLOAD_HASH_THRESHOLD = 1024;
+function resumeReceiptChain(receiptFilePath) {
+  try {
+    if (!existsSync(receiptFilePath)) return null;
+    const lines = readFileSync(receiptFilePath, "utf-8").split("\n").filter((l) => l.trim());
+    if (lines.length === 0) return null;
+    return receiptHash(JSON.parse(lines[lines.length - 1]));
+  } catch {
+    return null;
+  }
+}
 function detectSwarmContext() {
   const teamName = process.env.CLAUDE_CODE_TEAM_NAME;
   const agentId = process.env.CLAUDE_CODE_AGENT_ID;
@@ -683,10 +696,11 @@ function emitDecisionLog(state, entry) {
   } catch {
   }
   if (isSigningEnabled()) {
-    const signed = signDecision(log);
+    const signed = signDecision(log, state.lastReceiptHash || void 0);
     if (signed.signed) {
       try {
         appendFileSync(state.receiptFilePath, signed.signed + "\n");
+        if (signed.receipt_hash) state.lastReceiptHash = signed.receipt_hash;
       } catch {
       }
       state.receiptBuffer.add(log.request_id, signed.signed);
@@ -701,16 +715,19 @@ function emitDecisionLog(state, entry) {
 `);
       }
     } else if (signed.error) {
-      const tombstone = JSON.stringify({
+      const tombstoneObj = {
         type: "scopeblind.signing_failure.v1",
         request_id: log.request_id,
         tool: log.tool,
         decision: log.decision,
         error: signed.error,
-        at: new Date(log.timestamp).toISOString()
-      });
+        at: new Date(log.timestamp).toISOString(),
+        ...state.lastReceiptHash ? { previousReceiptHash: state.lastReceiptHash } : {}
+      };
+      const tombstone = JSON.stringify(tombstoneObj);
       try {
         appendFileSync(state.receiptFilePath, tombstone + "\n");
+        state.lastReceiptHash = receiptHash(tombstoneObj);
       } catch {
       }
       process.stderr.write(`[PROTECT_MCP_SIGNING_FAILURE] ${tombstone}
@@ -826,6 +843,7 @@ async function startHookServer(options = {}) {
     policyDigest,
     logFilePath: join(process.cwd(), LOG_FILE),
     receiptFilePath: join(process.cwd(), RECEIPTS_FILE),
+    lastReceiptHash: resumeReceiptChain(join(process.cwd(), RECEIPTS_FILE)),
     permissionSuggestions: /* @__PURE__ */ new Map(),
     configAlerts: []
   };