@agent-custody/receipts 0.5.1 → 0.5.3

package/dist/cli.js

@@ -42,6 +42,7 @@ const USAGE = `agent-custody <command>
                                                  sign with a key in this process, or through a signer process that holds it; publish a signed
                                                  checkpoint per log that has grown, every 300 s by default, to the directory (and, with a
                                                  database, to its heads table); serve the key document at /.well-known/agent-custody-log.json
+  log     ... [--trust-proxy]                    behind a reverse proxy you run: key per-address limits by X-Forwarded-For
   log     ... --db-env NAME --admin-token-env NAME [--public-url <https://log.example.com/>] [--checkpoints-url <https://checkpoints.example.com/>]
                                                  the operator's admin page at /admin and its API, behind the admin token: tenants, tokens shown once,
                                                  the welcome sheet; the public URLs fill the sheet in
@@ -229,7 +230,7 @@ async function main(argv) {
         case "log": {
             const { values } = parseArgs({
                 args: rest,
-                options: { file: { type: "string" }, key: { type: "string" }, port: { type: "string", default: "8787" }, host: { type: "string", default: "127.0.0.1" }, "token-env": { type: "string" }, "log-id": { type: "string" }, tenants: { type: "string" }, "db-env": { type: "string" }, "signer-url": { type: "string" }, "signer-token-env": { type: "string" }, "retired-key": { type: "string", multiple: true }, "checkpoint-dir": { type: "string" }, "checkpoint-every": { type: "string", default: "300" }, "admin-token-env": { type: "string" }, "public-url": { type: "string" }, "checkpoints-url": { type: "string" } },
+                options: { file: { type: "string" }, key: { type: "string" }, port: { type: "string", default: "8787" }, host: { type: "string", default: "127.0.0.1" }, "token-env": { type: "string" }, "log-id": { type: "string" }, tenants: { type: "string" }, "db-env": { type: "string" }, "signer-url": { type: "string" }, "signer-token-env": { type: "string" }, "retired-key": { type: "string", multiple: true }, "checkpoint-dir": { type: "string" }, "checkpoint-every": { type: "string", default: "300" }, "admin-token-env": { type: "string" }, "public-url": { type: "string" }, "checkpoints-url": { type: "string" }, "trust-proxy": { type: "boolean", default: false } },
             });
             if (!values.key === !values["signer-url"])
                 throw new Error("log needs exactly one of --key or --signer-url");
@@ -281,7 +282,7 @@ async function main(argv) {
                 resolver = fileResolver(values.file, { ...(token ? { tokens: [token] } : {}), ...(values["log-id"] ? { logId: values["log-id"] } : {}), ...(tenants ? { tenants } : {}) });
                 where = `file=${values.file}${values["log-id"] ? ` log=${values["log-id"]}` : ""} ${token ? "bearer token required" : "open, anyone may append"}${tenants ? ` tenants=${Object.keys(tenants).join(",")}` : ""}`;
             }
-            const running = await serveLog(resolver, signer, { port: Number(values.port), host: values.host, ...(checkpoints ? { checkpoints } : {}), ...(admin ? { admin } : {}) });
+            const running = await serveLog(resolver, signer, { port: Number(values.port), host: values.host, ...(checkpoints ? { checkpoints } : {}), ...(admin ? { admin } : {}), trustProxy: values["trust-proxy"] });
             const publisher = checkpoints ? new CheckpointPublisher(resolver, signer, checkpoints, everyMs) : null;
             publisher?.start();
             console.error(`agent-custody log: ${running.url} keyid=${signer.keyid} ${values["signer-url"] ? `signer=${values["signer-url"]} ` : ""}${where}${checkpoints ? ` checkpoints every ${values["checkpoint-every"]}s${values["checkpoint-dir"] ? ` to ${values["checkpoint-dir"]}` : ""}` : ""}${admin ? " admin page at /admin" : ""}`);

package/dist/log-admin.d.ts

@@ -1,5 +1,5 @@
 import type { IncomingMessage, ServerResponse } from "node:http";
-import type { PostgresTenancy } from "./log-store.ts";
+import { type PostgresTenancy } from "./log-store.ts";
 export interface AdminOptions {
     tenancy: PostgresTenancy;
     /** the admin token; every /admin route needs it as a bearer */
@@ -10,6 +10,8 @@ export interface AdminOptions {
     checkpointsUrl?: string;
     /** the current signing keyid, for the sheet */
     keyid?: string;
+    /** key the failure throttle by X-Forwarded-For's first address; only behind a proxy you run */
+    trustProxy?: boolean;
 }
 /** The welcome sheet as text, the same one deploy/onboard-tenant.sh prints. */
 export declare function welcomeSheet(o: {

package/dist/log-admin.js

@@ -1,8 +1,12 @@
 // The operator's admin surface for a hosted log: tenants and their tokens, over HTTP behind an admin token, and a
-// single page at /admin that drives it. It is for whoever runs the log, never for tenants: every route needs the
-// admin token, the page keeps that token in the browser session only, and a minted token is shown once, beside the
-// welcome sheet the tenant gets. Nothing here touches receipts; the log holds hashes and the panel holds names.
+// single page at /admin that drives it. It is for whoever runs the log, never for tenants. Everything under /admin,
+// the page included, needs the admin token: the browser's own prompt supplies it as HTTP Basic (any user name,
+// the token as the password) and an API client sends it as a bearer. Failed attempts from one address are
+// throttled. A minted token is shown once, beside the welcome sheet the tenant gets. Nothing here touches
+// receipts; the log holds hashes and the panel holds names.
 import { timingSafeEqual } from "node:crypto";
+import { RateLimiter } from "./log-store.js";
+import { clientAddress } from "./log-sink.js";
 const same = (a, b) => {
     const x = Buffer.from(a);
     const y = Buffer.from(b);
@@ -48,23 +52,39 @@ export function welcomeSheet(o) {
  *   POST /admin/tenants/:id/tokens/:prefix/revoke { revoked }
  */
 export function adminRoutes(opts) {
+    // Five wrong tokens from one address, then one more a minute: enough to stop guessing, not enough to lock out a typo.
+    const failures = new RateLimiter({ perSecond: 1 / 60, burst: 5 });
+    const presented = (req) => {
+        const h = req.headers.authorization ?? "";
+        if (h.startsWith("Bearer ") && h.length > 7)
+            return h.slice(7);
+        if (h.startsWith("Basic ") && h.length > 6) {
+            const pair = Buffer.from(h.slice(6), "base64").toString();
+            const at = pair.indexOf(":");
+            return at >= 0 ? pair.slice(at + 1) : pair;
+        }
+        return null;
+    };
     return async (req, res, url) => {
         if (url.pathname !== "/admin" && !url.pathname.startsWith("/admin/"))
             return false;
-        const json = (status, body) => {
-            res.writeHead(status, { "content-type": "application/json", "cache-control": "no-store" });
+        const json = (status, body, headers = {}) => {
+            res.writeHead(status, { "content-type": "application/json", "cache-control": "no-store", ...headers });
             res.end(JSON.stringify(body));
         };
+        const addr = clientAddress(req, opts.trustProxy);
+        const given = presented(req);
+        if (given === null || !same(given, opts.token)) {
+            if (!failures.take(`admin:${addr}`))
+                return json(429, { error: "too many attempts; wait a minute" }, { "retry-after": "60" }), true;
+            // The challenge makes the browser ask; the same 401 tells an API client what is missing.
+            return json(401, { error: "admin token required" }, { "www-authenticate": 'Basic realm="agent-custody log admin", charset="UTF-8"' }), true;
+        }
         if (req.method === "GET" && url.pathname === "/admin") {
             res.writeHead(200, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store", "x-frame-options": "DENY", "content-security-policy": "default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline'; connect-src 'self'" });
             res.end(ADMIN_PAGE);
             return true;
         }
-        const h = req.headers.authorization ?? "";
-        if (!(h.startsWith("Bearer ") && h.length > 7 && same(h.slice(7), opts.token))) {
-            json(401, { error: "admin token required" });
-            return true;
-        }
         const body = async () => {
             let text = "";
             for await (const chunk of req) {
@@ -120,7 +140,7 @@ export function adminRoutes(opts) {
         return true;
     };
 }
-/** The page. One file, no framework, no third-party requests; the admin token lives in sessionStorage for the tab. */
+/** The page. One file, no framework, no third-party requests; the browser holds the admin credential it prompted for. */
 const ADMIN_PAGE = `<!doctype html>
 <meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
 <title>agent-custody log admin</title>
@@ -149,12 +169,8 @@ const ADMIN_PAGE = `<!doctype html>
 </style>
 <main>
   <h1>Log admin</h1>
-  <p class="sub" id="where">Tenants and tokens on this log. The admin token stays in this tab.</p>
-  <section id="login">
-    <div class="row"><label>Admin token<input id="token" type="password" autocomplete="off"></label><button id="enter">Enter</button></div>
-    <p class="err" id="loginErr" hidden></p>
-  </section>
-  <section id="app" hidden>
+  <p class="sub" id="where">Tenants and tokens on this log.</p>
+  <section id="app">
     <h2>Tenants</h2>
     <table><thead><tr><th>tenant</th><th>log id</th><th>live tokens</th><th>created</th><th></th></tr></thead><tbody id="tenants"></tbody></table>
     <h2>New tenant</h2>
@@ -184,10 +200,11 @@ const ADMIN_PAGE = `<!doctype html>
 <script>
 (() => {
   const $ = (id) => document.getElementById(id);
-  let token = sessionStorage.getItem("agent-custody-admin") || "";
+  // The browser sends the credential it prompted for on every request under /admin; nothing is stored by this page.
   const api = async (method, path, body) => {
-    const r = await fetch(path, { method, headers: { authorization: "Bearer " + token, ...(body ? { "content-type": "application/json" } : {}) }, body: body ? JSON.stringify(body) : undefined });
+    const r = await fetch(path, { method, headers: body ? { "content-type": "application/json" } : {}, body: body ? JSON.stringify(body) : undefined, credentials: "same-origin" });
     const j = await r.json().catch(() => ({}));
+    if (r.status === 401) throw new Error("the admin token was not accepted; reload the page and enter it again");
     if (!r.ok) throw new Error(j.error || r.statusText);
     return j;
   };
@@ -205,13 +222,9 @@ const ADMIN_PAGE = `<!doctype html>
     try {
       const info = await api("GET", "/admin/info");
       $("where").textContent = (info.publicUrl || location.origin) + " · keyid " + (info.keyid ? info.keyid.slice(0, 12) : "?") + (info.checkpointsUrl ? " · checkpoints at " + info.checkpointsUrl : "");
-      $("login").hidden = true; $("app").hidden = false;
-      sessionStorage.setItem("agent-custody-admin", token);
       await loadTenants();
-    } catch (e) { $("loginErr").hidden = false; $("loginErr").textContent = e.message; }
+    } catch (e) { say(e.message, "err"); }
   };
-  $("enter").onclick = () => { token = $("token").value.trim(); enter(); };
-  $("token").onkeydown = (e) => { if (e.key === "Enter") $("enter").click(); };
   $("addTenant").onclick = async () => { try { const t = await api("POST", "/admin/tenants", { id: $("tid").value.trim(), logId: $("lid").value.trim() }); say("tenant " + t.id + " created; reached at /t/" + t.id + "/", "ok"); $("ttid").value = t.id; await loadTenants(); } catch (e) { say(e.message, "err"); } };
   $("mint").onclick = async () => {
     try {
@@ -229,7 +242,7 @@ const ADMIN_PAGE = `<!doctype html>
     if (b.dataset.disable && confirm("Disable tenant " + b.dataset.disable + "? Its paths answer 404 within ten seconds.")) { try { await api("POST", "/admin/tenants/" + encodeURIComponent(b.dataset.disable) + "/disable"); await loadTenants(); say("disabled " + b.dataset.disable, "ok"); } catch (err) { say(err.message, "err"); } }
     if (b.dataset.revoke) { const [id, prefix] = b.dataset.revoke.split("|"); if (confirm("Revoke token " + prefix + " of " + id + "?")) { try { await api("POST", "/admin/tenants/" + encodeURIComponent(id) + "/tokens/" + prefix + "/revoke"); await loadTokens(id); await loadTenants(); say("revoked", "ok"); } catch (err) { say(err.message, "err"); } } }
   });
-  if (token) enter();
+  enter();
 })();
 </script>
 `;

package/dist/log-sink.d.ts

@@ -65,7 +65,15 @@ export interface LogServerOptions {
     checkpoints?: CheckpointStore;
     /** the operator's admin API and page under /admin, behind its own token; only with a Postgres tenancy */
     admin?: AdminOptions;
+    /**
+     * Behind a reverse proxy every request arrives from the proxy's address, so per-address limits would be shared by
+     * everyone. With this on, the first address in X-Forwarded-For is the client. Only set it when a proxy you run
+     * is the only way to reach this server, since the header is otherwise the client's to forge.
+     */
+    trustProxy?: boolean;
 }
+/** The address a limit is keyed by: the socket's, or the proxy's forwarded one when the proxy is trusted. */
+export declare function clientAddress(req: IncomingMessage, trustProxy?: boolean): string;
 /** One log as the handler sees it, whatever stands behind it. */
 export interface ResolvedLog {
     backend: LogBackend;

package/dist/log-sink.js

@@ -94,6 +94,16 @@ export function openLog(cfg, key) {
         throw new Error("config needs logFile or log.url");
     return fileLog(cfg.logFile, key);
 }
+/** The address a limit is keyed by: the socket's, or the proxy's forwarded one when the proxy is trusted. */
+export function clientAddress(req, trustProxy = false) {
+    if (trustProxy) {
+        const xff = req.headers["x-forwarded-for"];
+        const first = (Array.isArray(xff) ? xff[0] : xff)?.split(",")[0]?.trim();
+        if (first)
+            return first;
+    }
+    return req.socket.remoteAddress ?? "?";
+}
 const tokenMatches = (tokens, token) => {
     if (tokens.length === 0)
         return true;
@@ -212,7 +222,7 @@ export class CheckpointPublisher {
 export function logHandler(source, keyOrSigner, opts = {}) {
     const resolver = typeof source === "string" ? fileResolver(source, opts) : source;
     const signer = "privateKey" in keyOrSigner ? localSigner(keyOrSigner) : keyOrSigner;
-    const admin = opts.admin ? adminRoutes({ ...opts.admin, keyid: opts.admin.keyid ?? signer.keyid }) : null;
+    const admin = opts.admin ? adminRoutes({ ...opts.admin, keyid: opts.admin.keyid ?? signer.keyid, trustProxy: opts.trustProxy ?? opts.admin.trustProxy }) : null;
     const limiter = new RateLimiter(opts.rateLimit);
     const maxBody = opts.maxBodyBytes ?? 65_536;
     const bearer = (req) => {
@@ -254,7 +264,7 @@ export function logHandler(source, keyOrSigner, opts = {}) {
                 const token = bearer(req);
                 if (!(await which.authorize(token)))
                     return json(401, { error: "unauthorized" });
-                const limitKey = token ? createHash("sha256").update(token).digest("hex").slice(0, 16) : `addr:${req.socket.remoteAddress ?? "?"}`;
+                const limitKey = token ? createHash("sha256").update(token).digest("hex").slice(0, 16) : `addr:${clientAddress(req, opts.trustProxy)}`;
                 if (!limiter.take(limitKey))
                     return json(429, { error: "too many appends; retry shortly" }, { "retry-after": "1" });
                 let body = "";

package/docs/usage.md

@@ -105,7 +105,7 @@ An upstream need not be an MCP server. A plain HTTP API is described as tools:
   "log": { "url": "https://log.example.com/", "tokenEnv": "AGENT_CUSTODY_LOG_TOKEN" }
 ```
 
-Exactly one of the two. The bearer token comes from the named environment variable, never from the file, and a missing variable fails at startup. Add `"hashOnly": true` for any log run by someone else: the gateway then sends only the leaf hash, sha256 of the receipt envelope with the RFC 6962 prefix, so the log commits to the receipt without ever holding it, and the receipts with their arguments and results stay in `receiptsDir`. The verifier does not change; it hashes the envelope itself. A log that serves several tenants is reached at `<url>/t/<tenant>/`, and each of its tree heads names its log, which a verifier checks with `--log-id`. With a remote log the tree head in each receipt is signed by the log's key, and a verifier must be given that key with `--log-key`. If the log refuses a leaf, the receipt is not issued and the call returns an error to the agent. For an ordinary call the upstream action has already happened by then, and the error says so; a receipt that was never logged must not be handed out. For a tool named in `precommit` the order is reversed, below, and the action never happens. The reference log server is `node src/cli.ts log --file log.jsonl --key keys/log.key --port 8787 --token-env AGENT_CUSTODY_LOG_TOKEN [--log-id <id>] [--tenants tenants.json]`. It serves `POST /append` with `{leaf}` or `{leafHash}` (token required when one is configured), `GET /root?size=N`, `GET /consistency?old=M&new=N`, and `GET /head`; [verification.md](verification.md) says what each proves. `--log-id` writes that id into every tree head. `--tenants` names a JSON file, `{ "acme": { "file": "acme.jsonl", "tokenEnv": "ACME_TOKEN", "logId": "acme-eu" } }`, and each tenant is its own log at `/t/acme/…` with its own token and id; the default log stays at the root paths. With `--db-env DATABASE_URL` the server keeps its logs in Postgres instead of files, and needs the `pg` package beside it: leaves as hashes in one table keyed by tenant, one writer per tenant enforced with an advisory lock so a second instance is safe, tenants and their tokens in tables of their own with tokens stored only as hashes, and rate limits per token (50 appends a second, burst 100, a 64 KB body cap; a refused append answers 429 with `retry-after`, and the gateway's sink retries a few times). Tenants are managed with `log-admin --db-env DATABASE_URL`: `tenant add <id> [--log-id <id>]`, `token add <tenant> --label <text>` (the token is printed once), `token revoke <tenant> <hash-prefix>`, `tenant disable <id>`, and `import --file log.jsonl [--tenant default]` to bring an existing file log in as hashes. The root paths serve the tenant `default`, created on first start with `--log-id`, and `--token-env` still works for it. The key that signs tree heads can live in its own process: `agent-custody signer --key keys/log.key --port 8790 --token-env SIGNER_TOKEN` holds it and answers `POST /sign` with the shared secret and `GET /keys` to anyone; the log server then runs with `--signer-url http://signer:8790/ --signer-token-env SIGNER_TOKEN` instead of `--key`, and the process that faces the internet never holds the key. Either way the log serves its keys at `/.well-known/agent-custody-log.json`, current key first and retired keys (`--retired-key old.pub`) after it, so verifiers fetch and pin them with `verify --log-url` and `audit --log-url` rather than receiving a key file from the operator. With `--checkpoint-dir <dir>` the server publishes a signed checkpoint, every `--checkpoint-every` seconds (default 300), for each log whose tree has grown, as `<dir>/<tenant>/<treeSize>.json` and `latest.json`, and with a database also as rows; `GET /checkpoints?since=<size>` and `GET /t/<tenant>/checkpoints` list them. Serve the directory read-only from a second host, so the record of what the log signed does not depend on the log's API being up; a verifier who kept an earlier head audits against a later checkpoint with `audit --older <bundle> --newer <checkpoint> --log-url <url>`. With `--admin-token-env ADMIN_TOKEN` (Postgres only) the server also serves the operator's page at `/admin` and its API under `/admin/`: list and create tenants, mint a token that is shown once beside the tenant's welcome sheet, revoke tokens, disable tenants. Every route needs the admin token as a bearer; the page keeps it in the browser session. `--public-url` and `--checkpoints-url` fill the sheet in. [deploy/](../../deploy/README.md) runs the server, the signer, Postgres, and the checkpoints host as containers.
+Exactly one of the two. The bearer token comes from the named environment variable, never from the file, and a missing variable fails at startup. Add `"hashOnly": true` for any log run by someone else: the gateway then sends only the leaf hash, sha256 of the receipt envelope with the RFC 6962 prefix, so the log commits to the receipt without ever holding it, and the receipts with their arguments and results stay in `receiptsDir`. The verifier does not change; it hashes the envelope itself. A log that serves several tenants is reached at `<url>/t/<tenant>/`, and each of its tree heads names its log, which a verifier checks with `--log-id`. With a remote log the tree head in each receipt is signed by the log's key, and a verifier must be given that key with `--log-key`. If the log refuses a leaf, the receipt is not issued and the call returns an error to the agent. For an ordinary call the upstream action has already happened by then, and the error says so; a receipt that was never logged must not be handed out. For a tool named in `precommit` the order is reversed, below, and the action never happens. The reference log server is `node src/cli.ts log --file log.jsonl --key keys/log.key --port 8787 --token-env AGENT_CUSTODY_LOG_TOKEN [--log-id <id>] [--tenants tenants.json]`. It serves `POST /append` with `{leaf}` or `{leafHash}` (token required when one is configured), `GET /root?size=N`, `GET /consistency?old=M&new=N`, and `GET /head`; [verification.md](verification.md) says what each proves. `--log-id` writes that id into every tree head. `--tenants` names a JSON file, `{ "acme": { "file": "acme.jsonl", "tokenEnv": "ACME_TOKEN", "logId": "acme-eu" } }`, and each tenant is its own log at `/t/acme/…` with its own token and id; the default log stays at the root paths. With `--db-env DATABASE_URL` the server keeps its logs in Postgres instead of files, and needs the `pg` package beside it: leaves as hashes in one table keyed by tenant, one writer per tenant enforced with an advisory lock so a second instance is safe, tenants and their tokens in tables of their own with tokens stored only as hashes, and rate limits per token (50 appends a second, burst 100, a 64 KB body cap; a refused append answers 429 with `retry-after`, and the gateway's sink retries a few times). Tenants are managed with `log-admin --db-env DATABASE_URL`: `tenant add <id> [--log-id <id>]`, `token add <tenant> --label <text>` (the token is printed once), `token revoke <tenant> <hash-prefix>`, `tenant disable <id>`, and `import --file log.jsonl [--tenant default]` to bring an existing file log in as hashes. The root paths serve the tenant `default`, created on first start with `--log-id`, and `--token-env` still works for it. The key that signs tree heads can live in its own process: `agent-custody signer --key keys/log.key --port 8790 --token-env SIGNER_TOKEN` holds it and answers `POST /sign` with the shared secret and `GET /keys` to anyone; the log server then runs with `--signer-url http://signer:8790/ --signer-token-env SIGNER_TOKEN` instead of `--key`, and the process that faces the internet never holds the key. Either way the log serves its keys at `/.well-known/agent-custody-log.json`, current key first and retired keys (`--retired-key old.pub`) after it, so verifiers fetch and pin them with `verify --log-url` and `audit --log-url` rather than receiving a key file from the operator. With `--checkpoint-dir <dir>` the server publishes a signed checkpoint, every `--checkpoint-every` seconds (default 300), for each log whose tree has grown, as `<dir>/<tenant>/<treeSize>.json` and `latest.json`, and with a database also as rows; `GET /checkpoints?since=<size>` and `GET /t/<tenant>/checkpoints` list them. Serve the directory read-only from a second host, so the record of what the log signed does not depend on the log's API being up; a verifier who kept an earlier head audits against a later checkpoint with `audit --older <bundle> --newer <checkpoint> --log-url <url>`. With `--admin-token-env ADMIN_TOKEN` (Postgres only) the server also serves the operator's page at `/admin` and its API under `/admin/`: list and create tenants, mint a token that is shown once beside the tenant's welcome sheet, revoke tokens, disable tenants. Everything under `/admin`, the page included, needs the admin token: the browser asks for it (any user name, the token as the password) and an API client sends it as a bearer; a handful of wrong attempts from one address are throttled for a minute. Nothing is stored by the page. Behind a reverse proxy, start the server with `--trust-proxy` so those per-address limits key on `X-Forwarded-For` instead of on the proxy's own address, and only there, since the header is otherwise the client's to forge. `--public-url` and `--checkpoints-url` fill the sheet in. [deploy/](../../deploy/README.md) runs the server, the signer, Postgres, and the checkpoints host as containers.
 
 `otel`, optional in both the gateway and SDK configs, sends every receipt to the collector you already run as one span over OTLP/HTTP, after the receipt is issued: `"otel": { "url": "http://localhost:4318", "headersEnv": { "x-api-key": "OTEL_KEY" }, "serviceName": "support-agents" }`. The span's trace id is the receipt id, its attributes carry the tool, agent, principal, execution status, policy decision, and log position, and its status is an error only when the upstream failed or errored, since a denial is the policy working. Export is best effort: a collector that is down or refuses costs a line on stderr, never a receipt. Tutorial 18 shows it against a stand-in collector.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-custody/receipts",
-  "version": "0.5.1",
+  "version": "0.5.3",
   "description": "Chain of custody for AI agents: signed, independently verifiable receipts for tool calls. MCP gateway + Cedar policy + Merkle transparency log",
   "license": "Apache-2.0",
   "repository": {