@agent-custody/receipts 0.6.0 → 0.6.1

package/README.md

@@ -228,6 +228,7 @@ src/config.ts      gateway and SDK config schemas, path resolution
 src/crypto.ts      canonical JSON, sha256, Ed25519 keys, DSSE sign/verify
 src/log.ts         Merkle log: append, root, inclusion and consistency proofs, verify, JSONL persistence
 src/log-check.ts   the outside monitor: verifies the head, checkpoints, and witness of a running log
+src/portal.ts      the tenant portal: register, first key, usage against plan, keys, Stripe billing, export, on the log's Postgres
 src/log-export.ts  a tenant's export of their own log, self-checked, as a log file the verifier reads
 src/witness.ts     the witness: countersigns the log's checkpoints from another operator's machine, or refuses with an alarm
 src/signer.ts      the signer: the log's key in its own process, the key document verifiers fetch
@@ -287,6 +288,7 @@ The design is two producers feeding one verifier. The SDK is the top of the funn
 - Remote log: the issuer can append to a log run by someone else over HTTP, whose key then signs the tree heads, so a verifier learns the receipt was in a log the operator could not rewrite. Includes the reference log server, bearer-token auth, and a root endpoint for auditors.
 - Framework adapters, each tested against the real package with a scripted model and no network: OpenAI Agents SDK (`wrapTools` enforces, `observeRunner` records from lifecycle events), Vercel AI SDK (`wrapTools` over a real `generateText` loop), LangChain (`ReceiptCallbackHandler` records, `issuer.wrap` enforces).
 
+- Plans and the tenant portal: every tenant is on a plan (free, ten thousand appends a month; team, a million; enterprise, no allowance) enforced at append with a clear 429; the portal at the operator's `PORTAL_HOST` lets a team register, get its tenant and first key, watch usage against the plan, mint and revoke keys, buy the team plan through Stripe, and copy the export command, with every action in the audit trail.
 - An audit trail of administrative actions: every tenant created or disabled and every token minted or revoked is recorded with who did it, from the admin page or the command line, shown on the page and carried in the tenant's export.
 - A tenant's export: `log-export` takes, with the tenant's own token, every leaf hash, the signed head, the published keys, the checkpoints, and their usage, checks that they add up, and writes a log copy the verifier reads offline; the evidence never depends on the operator staying in business.
 - Monitoring and metering: `log-check`, the outside probe that verifies the head, the checkpoints, and the witness and exits 1 on trouble, run every ten minutes by the `monitor` workflow; `GET /health`; and usage per tenant per month on the admin page and as CSV.

package/dist/cli.js

@@ -14,6 +14,7 @@ import { connectSigner, fetchLogKeys, localSigner, serveSigner } from "./signer.
 import { fetchWitnessKeys, Witness } from "./witness.js";
 import { checkLog, formatLogCheck } from "./log-check.js";
 import { serveHttp } from "./gateway-http.js";
+import { servePortal } from "./portal.js";
 import { exportLog, formatExport } from "./log-export.js";
 import { CheckpointPublisher, fileResolver } from "./log-sink.js";
 import { createRequire } from "node:module";
@@ -70,9 +71,12 @@ const USAGE = `agent-custody <command>
                                                  into <dir>; refuses and writes an alarm otherwise. Serve <dir> from a host of your own.
   signer  --key <log.key> --port 8790 [--host 127.0.0.1] [--token-env NAME] [--retired-key <pub>]...
                                                  the one process that holds the log's key: POST /sign, GET /keys
-  log-admin --db-env NAME tenant add <id> [--log-id <id>] | tenant list | tenant disable <id>
+  log-admin --db-env NAME tenant add <id> [--log-id <id>] | tenant list | tenant disable <id> | tenant plan <id> <free|team|enterprise>
   log-admin --db-env NAME token add <tenant> --label <text> | token list <tenant> | token revoke <tenant> <hash-prefix>
-  log-admin --db-env NAME audit [--tenant <id>]   who did what to tenants and tokens, newest first
+  log-admin --db-env NAME audit [--tenant <id>]
+  portal  --db-env NAME --secret-env NAME --public-url <log url> [--checkpoints-url <url>] [--portal-url <url>] [--port 8792] [--host 127.0.0.1]
+          [--stripe-key-env NAME --stripe-webhook-env NAME --stripe-price-team <price id>] [--trust-proxy]
+                                                   the tenant portal: register, first key, usage against plan, keys, billing, export   who did what to tenants and tokens, newest first
   log-admin --db-env NAME import --file <log.jsonl> [--tenant default]      copies a file log into the database as hashes
   audit   --older <bundle.json> --newer <bundle.json> (--log <log.jsonl> | --log-url <url>) [--issuer-key <pub>] [--log-key <pub>] [--log-id <id>] [--witness-key <pub> | --witness-url <url>] [--json]
                                                  with --log-url the log's published keys are fetched and pinned by keyid; with a witness key or
@@ -261,6 +265,38 @@ async function main(argv) {
             await running.close();
             return 0;
         }
+        case "portal": {
+            const { values } = parseArgs({ args: rest, options: { "db-env": { type: "string" }, "secret-env": { type: "string" }, "public-url": { type: "string" }, "checkpoints-url": { type: "string" }, "portal-url": { type: "string" }, port: { type: "string", default: "8792" }, host: { type: "string", default: "127.0.0.1" }, "stripe-key-env": { type: "string" }, "stripe-webhook-env": { type: "string" }, "stripe-price-team": { type: "string" }, "trust-proxy": { type: "boolean", default: false } } });
+            if (!values["db-env"] || !values["secret-env"] || !values["public-url"])
+                throw new Error("portal needs --db-env, --secret-env, and --public-url");
+            const secret = process.env[values["secret-env"]];
+            if (!secret || secret.length < 32)
+                throw new Error(`environment variable ${values["secret-env"]} must hold a secret of at least 32 characters`);
+            let stripe;
+            if (values["stripe-key-env"] || values["stripe-webhook-env"] || values["stripe-price-team"]) {
+                if (!values["stripe-key-env"] || !values["stripe-webhook-env"] || !values["stripe-price-team"])
+                    throw new Error("billing needs all three of --stripe-key-env, --stripe-webhook-env, --stripe-price-team");
+                const secretKey = process.env[values["stripe-key-env"]];
+                const webhookSecret = process.env[values["stripe-webhook-env"]];
+                if (!secretKey || !webhookSecret)
+                    throw new Error("the Stripe key and webhook secret variables must both be set");
+                stripe = { secretKey, webhookSecret, priceTeam: values["stripe-price-team"] };
+            }
+            const client = openPostgres(values["db-env"]);
+            const tenancy = new PostgresTenancy(client);
+            let keyid;
+            try {
+                keyid = (await fetchLogKeys(values["public-url"])).keys[0]?.keyid;
+            }
+            catch {
+                // the log may not be reachable from here at start; the sheet then omits the keyid
+            }
+            const running = await servePortal({ tenancy, client, secret, publicUrl: values["public-url"], ...(values["checkpoints-url"] ? { checkpointsUrl: values["checkpoints-url"] } : {}), ...(values["portal-url"] ? { portalUrl: values["portal-url"] } : {}), ...(keyid ? { keyid } : {}), ...(stripe ? { stripe } : {}), trustProxy: values["trust-proxy"] }, { port: Number(values.port), host: values.host });
+            console.error(`agent-custody portal: ${running.url} log=${values["public-url"]} billing=${stripe ? "stripe" : "off"}${values["trust-proxy"] ? " trust-proxy" : ""}`);
+            await new Promise((resolve) => process.once("SIGINT", resolve));
+            await running.close();
+            return 0;
+        }
         case "log-admin": {
             const { values, positionals } = parseArgs({ args: rest, allowPositionals: true, options: { "db-env": { type: "string" }, "log-id": { type: "string" }, label: { type: "string" }, file: { type: "string" }, tenant: { type: "string", default: "default" } } });
             if (!values["db-env"])
@@ -274,7 +310,11 @@ async function main(argv) {
             }
             else if (what === "tenant" && verb === "list") {
                 for (const t of await tenancy.listTenants())
-                    console.log(`${t.id.padEnd(24)} log=${t.logId.padEnd(28)} created ${t.createdAt}${t.disabledAt ? `  DISABLED ${t.disabledAt}` : ""}`);
+                    console.log(`${t.id.padEnd(24)} log=${t.logId.padEnd(28)} plan=${t.plan.padEnd(10)} created ${t.createdAt}${t.disabledAt ? `  DISABLED ${t.disabledAt}` : ""}`);
+            }
+            else if (what === "tenant" && verb === "plan" && args[0] && args[1]) {
+                const t = await tenancy.setPlan(args[0], args[1], actor);
+                console.log(`tenant ${t.id} on plan ${t.plan}`);
             }
             else if (what === "tenant" && verb === "disable" && args[0]) {
                 await tenancy.disableTenant(args[0], actor);

package/dist/index.d.ts

@@ -5,11 +5,14 @@ export { buildRequest, restUpstream } from "./rest.ts";
 export { openExporter, otlpExporter, spanFor } from "./otel.ts";
 export { hecEvent, splunkExporter } from "./splunk.ts";
 export { GRANT_HEADER, grantHeader, parseGrantHeader, serveHttp } from "./gateway-http.ts";
+export { PortalStore, portalHandler, readSession, servePortal, signSession, stripeRequest, verifyStripeSignature } from "./portal.ts";
+export type { PortalOptions, PortalUser, RunningPortal, StripeOptions } from "./portal.ts";
 export type { HttpGatewayOptions, RunningHttpGateway } from "./gateway-http.ts";
 export { exportLog, formatExport } from "./log-export.ts";
 export type { ExportOptions, ExportResult } from "./log-export.ts";
 export { fileBackend, importLogFile, PostgresLog, PostgresTenancy, RateLimiter } from "./log-store.ts";
-export type { AuditEntry } from "./log-store.ts";
+export type { AuditEntry, Plan, QuotaState } from "./log-store.ts";
+export { PLAN_QUOTAS, PLANS } from "./log-store.ts";
 export { connectSigner, fetchLogKeys, localSigner, serveSigner, signerHandler } from "./signer.ts";
 export type { KeyDocument, RemoteSignerOptions, RetiredKey, RunningSigner, Signer, SignerServerOptions } from "./signer.ts";
 export { bothCheckpoints, dirCheckpoints, postgresCheckpoints } from "./checkpoints.ts";

package/dist/index.js

@@ -4,8 +4,10 @@ export { buildRequest, restUpstream } from "./rest.js";
 export { openExporter, otlpExporter, spanFor } from "./otel.js";
 export { hecEvent, splunkExporter } from "./splunk.js";
 export { GRANT_HEADER, grantHeader, parseGrantHeader, serveHttp } from "./gateway-http.js";
+export { PortalStore, portalHandler, readSession, servePortal, signSession, stripeRequest, verifyStripeSignature } from "./portal.js";
 export { exportLog, formatExport } from "./log-export.js";
 export { fileBackend, importLogFile, PostgresLog, PostgresTenancy, RateLimiter } from "./log-store.js";
+export { PLAN_QUOTAS, PLANS } from "./log-store.js";
 export { connectSigner, fetchLogKeys, localSigner, serveSigner, signerHandler } from "./signer.js";
 export { bothCheckpoints, dirCheckpoints, postgresCheckpoints } from "./checkpoints.js";
 export { adminRoutes, welcomeSheet } from "./log-admin.js";

package/dist/log-admin.js

@@ -5,7 +5,7 @@
 // throttled. A minted token is shown once, beside the welcome sheet the tenant gets. Nothing here touches
 // receipts; the log holds hashes and the panel holds names.
 import { timingSafeEqual } from "node:crypto";
-import { RateLimiter } from "./log-store.js";
+import { RateLimiter, PLANS } from "./log-store.js";
 import { clientAddress } from "./log-sink.js";
 const same = (a, b) => {
     const x = Buffer.from(a);
@@ -114,7 +114,7 @@ export function adminRoutes(opts) {
             }
             else if (req.method === "GET" && parts.length === 2 && parts[1] === "usage.csv") {
                 const u = await t.usage(month);
-                const csv = ["month,tenant,log_id,appends,total_leaves,live_tokens,disabled", ...u.tenants.map((x) => [u.month, x.id, x.logId, x.appends, x.totalLeaves, x.liveTokens, x.disabled].join(","))].join("\n") + "\n";
+                const csv = ["month,tenant,log_id,plan,quota,appends,total_leaves,live_tokens,disabled", ...u.tenants.map((x) => [u.month, x.id, x.logId, x.plan, x.quota ?? "", x.appends, x.totalLeaves, x.liveTokens, x.disabled].join(","))].join("\n") + "\n";
                 res.writeHead(200, { "content-type": "text/csv; charset=utf-8", "content-disposition": `attachment; filename="agent-custody-usage-${u.month}.csv"`, "cache-control": "no-store" });
                 res.end(csv);
             }
@@ -138,6 +138,12 @@ export function adminRoutes(opts) {
                     return json(400, { error: "id must be a plain identifier" }), true;
                 json(200, await t.addTenant(b.id, typeof b.logId === "string" && b.logId ? b.logId : b.id, actor));
             }
+            else if (req.method === "POST" && parts.length === 4 && parts[1] === "tenants" && parts[3] === "plan") {
+                const b = await body();
+                if (typeof b.plan !== "string" || !PLANS.includes(b.plan))
+                    return json(400, { error: `plan must be one of ${PLANS.join(", ")}` }), true;
+                json(200, await t.setPlan(parts[2], b.plan, actor));
+            }
             else if (req.method === "POST" && parts.length === 4 && parts[1] === "tenants" && parts[3] === "disable") {
                 await t.disableTenant(parts[2], actor);
                 json(200, { disabled: parts[2] });
@@ -200,7 +206,7 @@ const ADMIN_PAGE = `<!doctype html>
   <p class="sub" id="where">Tenants and tokens on this log.</p>
   <section id="app">
     <h2>Tenants</h2>
-    <table><thead><tr><th>tenant</th><th>log id</th><th>live tokens</th><th>created</th><th></th></tr></thead><tbody id="tenants"></tbody></table>
+    <table><thead><tr><th>tenant</th><th>log id</th><th>plan</th><th>live tokens</th><th>created</th><th></th></tr></thead><tbody id="tenants"></tbody></table>
     <h2>New tenant</h2>
     <div class="row">
       <label>tenant id (in the URL)<input id="tid" placeholder="acme" autocomplete="off"></label>
@@ -221,7 +227,7 @@ const ADMIN_PAGE = `<!doctype html>
     </div>
     <h2>Usage</h2>
     <div class="row"><label>month<input id="month" type="month"></label><button class="quiet" id="loadUsage">Show</button><a id="csv" class="quiet" href="#" style="align-self:center">Download CSV</a></div>
-    <table><thead><tr><th>tenant</th><th>log id</th><th>appends this month</th><th>leaves in total</th><th>live tokens</th></tr></thead><tbody id="usage"></tbody></table>
+    <table><thead><tr><th>tenant</th><th>log id</th><th>plan</th><th>appends this month</th><th>quota</th><th>leaves in total</th><th>live tokens</th></tr></thead><tbody id="usage"></tbody></table>
     <h2>Tokens of a tenant</h2>
     <div class="row"><label>tenant<input id="ltid" placeholder="acme" autocomplete="off"></label><button class="quiet" id="listTokens">List</button></div>
     <table><thead><tr><th>label</th><th>hash</th><th>created</th><th>state</th><th></th></tr></thead><tbody id="tokens"></tbody></table>
@@ -246,7 +252,8 @@ const ADMIN_PAGE = `<!doctype html>
   const say = (t, cls) => { $("msg").textContent = t; $("msg").className = cls || "muted"; };
   const loadTenants = async () => {
     const list = await api("GET", "/admin/tenants");
-    $("tenants").innerHTML = list.map((t) => "<tr><td><code>" + esc(t.id) + "</code></td><td><code>" + esc(t.logId) + "</code></td><td>" + t.tokens + "</td><td>" + esc(t.createdAt.slice(0, 10)) + "</td><td>" + (t.disabledAt ? "<span class=muted>disabled</span>" : "<button class=quiet data-disable=\\"" + esc(t.id) + "\\">Disable</button>") + "</td></tr>").join("") || "<tr><td colspan=5 class=muted>none yet</td></tr>";
+    const planPick = (t) => "<select data-plan=\\"" + esc(t.id) + "\\">" + ["free", "team", "enterprise"].map((p) => "<option" + (p === t.plan ? " selected" : "") + ">" + p + "</option>").join("") + "</select>";
+    $("tenants").innerHTML = list.map((t) => "<tr><td><code>" + esc(t.id) + "</code></td><td><code>" + esc(t.logId) + "</code></td><td>" + planPick(t) + "</td><td>" + t.tokens + "</td><td>" + esc(t.createdAt.slice(0, 10)) + "</td><td>" + (t.disabledAt ? "<span class=muted>disabled</span>" : "<button class=quiet data-disable=\\"" + esc(t.id) + "\\">Disable</button>") + "</td></tr>").join("") || "<tr><td colspan=6 class=muted>none yet</td></tr>";
   };
   const loadTokens = async (id) => {
     const list = await api("GET", "/admin/tenants/" + encodeURIComponent(id) + "/tokens");
@@ -278,7 +285,7 @@ const ADMIN_PAGE = `<!doctype html>
     const month = $("month").value || new Date().toISOString().slice(0, 7);
     const u = await api("GET", "/admin/usage?month=" + encodeURIComponent(month));
     $("csv").href = "/admin/usage.csv?month=" + encodeURIComponent(month);
-    $("usage").innerHTML = u.tenants.map((t) => "<tr><td><code>" + esc(t.id) + "</code>" + (t.disabled ? " <span class=muted>disabled</span>" : "") + "</td><td><code>" + esc(t.logId) + "</code></td><td>" + t.appends + "</td><td>" + t.totalLeaves + "</td><td>" + t.liveTokens + "</td></tr>").join("") || "<tr><td colspan=5 class=muted>no tenants</td></tr>";
+    $("usage").innerHTML = u.tenants.map((t) => "<tr><td><code>" + esc(t.id) + "</code>" + (t.disabled ? " <span class=muted>disabled</span>" : "") + "</td><td><code>" + esc(t.logId) + "</code></td><td>" + esc(t.plan) + "</td><td>" + t.appends + "</td><td>" + (t.quota === null ? "none" : t.quota) + "</td><td>" + t.totalLeaves + "</td><td>" + t.liveTokens + "</td></tr>").join("") || "<tr><td colspan=7 class=muted>no tenants</td></tr>";
   };
   const loadAudit = async () => {
     const a = await api("GET", "/admin/audit?limit=100");
@@ -286,6 +293,10 @@ const ADMIN_PAGE = `<!doctype html>
   };
   $("loadUsage").onclick = () => loadUsage().catch((e) => say(e.message, "err"));
   $("month").value = new Date().toISOString().slice(0, 7);
+  document.addEventListener("change", async (e) => {
+    const s = e.target.closest("select[data-plan]"); if (!s) return;
+    try { await api("POST", "/admin/tenants/" + encodeURIComponent(s.dataset.plan) + "/plan", { plan: s.value }); say("plan of " + s.dataset.plan + " set to " + s.value, "ok"); await loadUsage(); await loadAudit(); } catch (err) { say(err.message, "err"); await loadTenants(); }
+  });
   document.addEventListener("click", async (e) => {
     const b = e.target.closest("button"); if (!b) return;
     if (b.dataset.disable && confirm("Disable tenant " + b.dataset.disable + "? Its paths answer 404 within ten seconds.")) { try { await api("POST", "/admin/tenants/" + encodeURIComponent(b.dataset.disable) + "/disable"); await loadTenants(); await loadAudit(); say("disabled " + b.dataset.disable, "ok"); } catch (err) { say(err.message, "err"); } }

package/dist/log-sink.d.ts

@@ -1,7 +1,7 @@
 import { type IncomingMessage, type ServerResponse } from "node:http";
 import { type Envelope, type KeyPair } from "./crypto.ts";
 import { type InclusionProof } from "./log.ts";
-import { type AuditEntry, type LogBackend, type PostgresTenancy, type RateLimitOptions } from "./log-store.ts";
+import { type AuditEntry, type QuotaState, type LogBackend, type PostgresTenancy, type RateLimitOptions } from "./log-store.ts";
 import { type Signer } from "./signer.ts";
 import type { Checkpoint, CheckpointStore } from "./checkpoints.ts";
 import { type AdminOptions } from "./log-admin.ts";
@@ -92,6 +92,10 @@ export interface ResolvedLog {
     usage?(month: string): Promise<TenantUsage>;
     /** administrative actions on this log, newest first, where the store keeps them */
     audit?(limit: number): Promise<AuditEntry[]>;
+    /** the plan's monthly allowance and what is used, where the store keeps plans */
+    quota?(): Promise<QuotaState>;
+    /** told after an append lands, so a cached quota count stays honest */
+    appended?(): void;
 }
 /** Turns the tenant in a path, or null for the root paths, into a log. */
 export interface LogResolver {

package/dist/log-sink.js

@@ -155,6 +155,8 @@ export function postgresResolver(tenancy, opts = {}) {
                     return { month, appends: row?.appends ?? 0, totalLeaves: row?.totalLeaves ?? 0, liveTokens: row?.liveTokens ?? 0 };
                 },
                 audit: (limit) => tenancy.audit({ tenant: id, limit }),
+                quota: () => tenancy.quota(id),
+                appended: () => tenancy.noteAppend(id),
             };
         },
         async tenants() {
@@ -289,6 +291,16 @@ export function logHandler(source, keyOrSigner, opts = {}) {
                 const token = bearer(req);
                 if (!(await which.authorize(token)))
                     return json(401, { error: "unauthorized" });
+                if (which.quota) {
+                    // The plan's monthly allowance. Over it, the append is refused with the numbers, and the gateway behind it
+                    // withholds pre-committed calls: a tenant out of quota never acts without evidence.
+                    const q = await which.quota();
+                    if (q.quota !== null && q.used >= q.quota) {
+                        const now = new Date();
+                        const monthEnd = Date.UTC(now.getUTCFullYear(), now.getUTCMonth() + 1, 1);
+                        return json(429, { error: `monthly quota reached: ${q.used} of ${q.quota} appends on the ${q.plan} plan; it resets at the start of next month, or move to a larger plan` }, { "retry-after": String(Math.max(1, Math.ceil((monthEnd - now.getTime()) / 1000))) });
+                    }
+                }
                 const limitKey = token ? createHash("sha256").update(token).digest("hex").slice(0, 16) : `addr:${clientAddress(req, opts.trustProxy)}`;
                 if (!limiter.take(limitKey))
                     return json(429, { error: "too many appends; retry shortly" }, { "retry-after": "1" });
@@ -308,11 +320,15 @@ export function logHandler(source, keyOrSigner, opts = {}) {
                 if (typeof parsed.leafHash === "string") {
                     if (!/^[0-9a-f]{64}$/.test(parsed.leafHash))
                         return json(400, { error: "leafHash must be 64 lowercase hex characters" });
-                    return json(200, await appendSigned(log, signer, { leafHash: parsed.leafHash }, logId));
+                    const r = await appendSigned(log, signer, { leafHash: parsed.leafHash }, logId);
+                    which.appended?.();
+                    return json(200, r);
                 }
                 if (typeof parsed.leaf !== "string" || parsed.leaf.length === 0)
                     return json(400, { error: "leaf must be a non-empty string, or send leafHash" });
-                return json(200, await appendSigned(log, signer, { leaf: parsed.leaf }, logId));
+                const r = await appendSigned(log, signer, { leaf: parsed.leaf }, logId);
+                which.appended?.();
+                return json(200, r);
             }
             const current = await log.size();
             // A tenant's own data, with their token: every leaf hash, in pages, and their metering. The export command
@@ -334,7 +350,9 @@ export function logHandler(source, keyOrSigner, opts = {}) {
                     const month = url.searchParams.get("month") ?? new Date().toISOString().slice(0, 7);
                     if (!/^\d{4}-(0[1-9]|1[0-2])$/.test(month))
                         return json(400, { error: "month must be YYYY-MM" });
-                    return json(200, await which.usage(month), { "cache-control": "no-store" });
+                    const u = await which.usage(month);
+                    const q = which.quota ? await which.quota() : null;
+                    return json(200, { ...u, ...(q ? { plan: q.plan, quota: q.quota } : {}) }, { "cache-control": "no-store" });
                 }
                 const since = url.searchParams.has("since") ? Number(url.searchParams.get("since")) : 0;
                 const limit = url.searchParams.has("limit") ? Number(url.searchParams.get("limit")) : 10_000;

package/dist/log-store.d.ts

@@ -57,12 +57,24 @@ export declare class PostgresLog implements LogBackend {
     root(size?: number): Promise<string>;
     consistencyProof(oldSize: number, newSize?: number): Promise<string[]>;
 }
+/** A tenant's plan decides its monthly append quota; enterprise has none. The names are what the pricing page sells. */
+export type Plan = "free" | "team" | "enterprise";
+export declare const PLANS: readonly Plan[];
+export declare const PLAN_QUOTAS: Readonly<Record<Plan, number | null>>;
 export interface Tenant {
     id: string;
     logId: string;
+    plan: Plan;
     createdAt: string;
     disabledAt: string | null;
 }
+export interface QuotaState {
+    plan: Plan;
+    /** appends so far this calendar month, UTC */
+    used: number;
+    /** the plan's monthly allowance, or null for none */
+    quota: number | null;
+}
 export interface TokenRecord {
     tenantId: string;
     label: string;
@@ -76,7 +88,7 @@ export interface AuditEntry {
     id: number;
     at: string;
     actor: string;
-    action: "tenant.add" | "tenant.disable" | "token.add" | "token.revoke";
+    action: "tenant.add" | "tenant.disable" | "tenant.plan" | "token.add" | "token.revoke";
     tenantId: string | null;
     detail: Record<string, unknown>;
 }
@@ -87,8 +99,12 @@ export declare class PostgresTenancy {
     private readonly logs;
     private readonly tenantCache;
     private readonly tokenCache;
+    private readonly quotaCache;
+    private readonly quotas;
     private ready;
-    constructor(client: PostgresLike, opts?: PostgresLogOptions);
+    constructor(client: PostgresLike, opts?: PostgresLogOptions & {
+        quotas?: Partial<Record<Plan, number | null>>;
+    });
     private init;
     private record;
     /** Administrative actions, newest first; for one tenant when given. What the admin page shows and a tenant's export carries. */
@@ -105,6 +121,12 @@ export declare class PostgresTenancy {
     log(tenantId: string): Promise<PostgresLog>;
     /** Creates a tenant, or renames its log id. `by` names who did it in the audit trail. */
     addTenant(id: string, logId?: string, by?: string): Promise<Tenant>;
+    /** Moves a tenant to a plan; the quota applies from the next append. */
+    setPlan(id: string, plan: Plan, by?: string): Promise<Tenant>;
+    /** The tenant's plan, appends this month, and the plan's quota. Cached ten seconds, so a burst may overshoot slightly. */
+    quota(id: string): Promise<QuotaState>;
+    /** Called after an append lands, so the cached count stays honest between refreshes. */
+    noteAppend(id: string): void;
     disableTenant(id: string, by?: string): Promise<void>;
     listTenants(): Promise<Tenant[]>;
     /** Mints a token for a tenant. The token is returned once and stored only as its hash. */
@@ -123,6 +145,8 @@ export declare class PostgresTenancy {
         tenants: {
             id: string;
             logId: string;
+            plan: Plan;
+            quota: number | null;
             appends: number;
             totalLeaves: number;
             liveTokens: number;

package/dist/log-store.js

@@ -170,6 +170,8 @@ export class PostgresLog {
         return this.cache.subproof(oldSize, 0, n, true).map((b) => b.toString("hex"));
     }
 }
+export const PLANS = ["free", "team", "enterprise"];
+export const PLAN_QUOTAS = { free: 10_000, team: 1_000_000, enterprise: null };
 const sha256hex = (s) => createHash("sha256").update(s).digest("hex");
 /** Tenants and their tokens, in Postgres. Tokens are stored hashed; a lookup hashes what the caller presented. */
 export class PostgresTenancy {
@@ -178,10 +180,13 @@ export class PostgresTenancy {
     logs = new Map();
     tenantCache = new Map();
     tokenCache = new Map();
+    quotaCache = new Map();
+    quotas;
     ready = null;
     constructor(client, opts = {}) {
         this.client = client;
         this.prefix = ident(opts.prefix ?? "log_", "prefix");
+        this.quotas = { ...PLAN_QUOTAS, ...(opts.quotas ?? {}) };
     }
     init() {
         if (!this.ready) {
@@ -189,6 +194,7 @@ export class PostgresTenancy {
             this.ready = (async () => {
                 await PostgresLog.ensureSchema(this.client, p);
                 await this.client.query(`CREATE TABLE IF NOT EXISTS ${p}tenants (id TEXT PRIMARY KEY, log_id TEXT NOT NULL, created_at TIMESTAMPTZ NOT NULL DEFAULT now(), disabled_at TIMESTAMPTZ)`);
+                await this.client.query(`ALTER TABLE ${p}tenants ADD COLUMN IF NOT EXISTS plan TEXT NOT NULL DEFAULT 'free'`);
                 await this.client.query(`CREATE TABLE IF NOT EXISTS ${p}tokens (token_hash TEXT PRIMARY KEY, tenant_id TEXT NOT NULL REFERENCES ${p}tenants(id), label TEXT NOT NULL, created_at TIMESTAMPTZ NOT NULL DEFAULT now(), revoked_at TIMESTAMPTZ)`);
                 await this.client.query(`CREATE TABLE IF NOT EXISTS ${p}audit (id BIGSERIAL PRIMARY KEY, at TIMESTAMPTZ NOT NULL DEFAULT now(), actor TEXT NOT NULL, action TEXT NOT NULL, tenant_id TEXT, detail JSONB NOT NULL DEFAULT '{}')`);
             })();
@@ -208,7 +214,7 @@ export class PostgresTenancy {
         return rows.map((r) => ({ id: Number(r.id), at: new Date(r.at).toISOString(), actor: String(r.actor), action: r.action, tenantId: r.tenant_id === null || r.tenant_id === undefined ? null : String(r.tenant_id), detail: (typeof r.detail === "string" ? JSON.parse(r.detail) : r.detail) }));
     }
     row(r) {
-        return { id: String(r.id), logId: String(r.log_id), createdAt: new Date(r.created_at).toISOString(), disabledAt: r.disabled_at ? new Date(r.disabled_at).toISOString() : null };
+        return { id: String(r.id), logId: String(r.log_id), plan: PLANS.includes(String(r.plan)) ? String(r.plan) : "free", createdAt: new Date(r.created_at).toISOString(), disabledAt: r.disabled_at ? new Date(r.disabled_at).toISOString() : null };
     }
     /** The tenant, or null. Answers from a ten-second cache, so a disabled tenant is refused within that. */
     async tenant(id) {
@@ -216,7 +222,7 @@ export class PostgresTenancy {
         const hit = this.tenantCache.get(id);
         if (hit && Date.now() - hit.at < 10_000)
             return hit.tenant;
-        const rows = (await this.client.query(`SELECT id, log_id, created_at, disabled_at FROM ${this.prefix}tenants WHERE id = $1`, [id])).rows;
+        const rows = (await this.client.query(`SELECT id, log_id, plan, created_at, disabled_at FROM ${this.prefix}tenants WHERE id = $1`, [id])).rows;
         const tenant = rows[0] ? this.row(rows[0]) : null;
         this.tenantCache.set(id, { at: Date.now(), tenant });
         return tenant;
@@ -251,11 +257,47 @@ export class PostgresTenancy {
         if (!/^[A-Za-z0-9_.-]+$/.test(id))
             throw new Error(`tenant id must be a plain identifier; got "${id}"`);
         await this.init();
-        const rows = (await this.client.query(`INSERT INTO ${this.prefix}tenants (id, log_id) VALUES ($1, $2) ON CONFLICT (id) DO UPDATE SET log_id = EXCLUDED.log_id RETURNING id, log_id, created_at, disabled_at`, [id, logId])).rows;
+        const rows = (await this.client.query(`INSERT INTO ${this.prefix}tenants (id, log_id) VALUES ($1, $2) ON CONFLICT (id) DO UPDATE SET log_id = EXCLUDED.log_id RETURNING id, log_id, plan, created_at, disabled_at`, [id, logId])).rows;
         this.tenantCache.delete(id);
         await this.record(by, "tenant.add", id, { logId });
         return this.row(rows[0]);
     }
+    /** Moves a tenant to a plan; the quota applies from the next append. */
+    async setPlan(id, plan, by) {
+        if (!PLANS.includes(plan))
+            throw new Error(`unknown plan ${plan}; one of ${PLANS.join(", ")}`);
+        await this.init();
+        const rows = (await this.client.query(`UPDATE ${this.prefix}tenants SET plan = $2 WHERE id = $1 RETURNING id, log_id, plan, created_at, disabled_at`, [id, plan])).rows;
+        if (!rows[0])
+            throw new Error(`unknown tenant ${id}`);
+        this.tenantCache.delete(id);
+        await this.record(by, "tenant.plan", id, { plan });
+        return this.row(rows[0]);
+    }
+    /** The tenant's plan, appends this month, and the plan's quota. Cached ten seconds, so a burst may overshoot slightly. */
+    async quota(id) {
+        const t = await this.tenant(id);
+        if (!t)
+            throw new Error(`unknown tenant ${id}`);
+        const cached = this.quotaCache.get(id);
+        let used;
+        if (cached && Date.now() - cached.at < 10_000) {
+            used = cached.used;
+        }
+        else {
+            const start = `${new Date().toISOString().slice(0, 7)}-01T00:00:00Z`;
+            const rows = (await this.client.query(`SELECT COUNT(*) AS n FROM ${this.prefix}leaves WHERE tenant_id = $1 AND appended_at >= $2::timestamptz`, [id, start])).rows;
+            used = Number(rows[0]?.n ?? 0);
+            this.quotaCache.set(id, { at: Date.now(), used });
+        }
+        return { plan: t.plan, used, quota: this.quotas[t.plan] };
+    }
+    /** Called after an append lands, so the cached count stays honest between refreshes. */
+    noteAppend(id) {
+        const c = this.quotaCache.get(id);
+        if (c)
+            c.used += 1;
+    }
     async disableTenant(id, by) {
         await this.init();
         await this.client.query(`UPDATE ${this.prefix}tenants SET disabled_at = now() WHERE id = $1 AND disabled_at IS NULL`, [id]);
@@ -264,7 +306,7 @@ export class PostgresTenancy {
     }
     async listTenants() {
         await this.init();
-        return (await this.client.query(`SELECT id, log_id, created_at, disabled_at FROM ${this.prefix}tenants ORDER BY created_at`)).rows.map((r) => this.row(r));
+        return (await this.client.query(`SELECT id, log_id, plan, created_at, disabled_at FROM ${this.prefix}tenants ORDER BY created_at`)).rows.map((r) => this.row(r));
     }
     /** Mints a token for a tenant. The token is returned once and stored only as its hash. */
     async addToken(tenantId, label, by) {
@@ -301,12 +343,12 @@ export class PostgresTenancy {
         const [y, m] = month.split("-").map(Number);
         const end = `${m === 12 ? y + 1 : y}-${String(m === 12 ? 1 : m + 1).padStart(2, "0")}-01T00:00:00Z`;
         const p = this.prefix;
-        const rows = (await this.client.query(`SELECT t.id, t.log_id, t.disabled_at,
+        const rows = (await this.client.query(`SELECT t.id, t.log_id, t.plan, t.disabled_at,
               (SELECT COUNT(*) FROM ${p}leaves l WHERE l.tenant_id = t.id AND l.appended_at >= $1::timestamptz AND l.appended_at < $2::timestamptz) AS appends,
               (SELECT COUNT(*) FROM ${p}leaves l WHERE l.tenant_id = t.id) AS total,
               (SELECT COUNT(*) FROM ${p}tokens k WHERE k.tenant_id = t.id AND k.revoked_at IS NULL) AS live
        FROM ${p}tenants t ORDER BY t.created_at`, [start, end])).rows;
-        return { month, tenants: rows.map((r) => ({ id: String(r.id), logId: String(r.log_id), appends: Number(r.appends), totalLeaves: Number(r.total), liveTokens: Number(r.live), disabled: !!r.disabled_at })) };
+        return { month, tenants: rows.map((r) => { const plan = PLANS.includes(String(r.plan)) ? String(r.plan) : "free"; return { id: String(r.id), logId: String(r.log_id), plan, quota: this.quotas[plan], appends: Number(r.appends), totalLeaves: Number(r.total), liveTokens: Number(r.live), disabled: !!r.disabled_at }; }) };
     }
     async listTokens(tenantId) {
         await this.init();

package/dist/portal.d.ts

@@ -0,0 +1,75 @@
+import { type IncomingMessage, type ServerResponse } from "node:http";
+import { type PostgresLike, type PostgresTenancy } from "./log-store.ts";
+export interface StripeOptions {
+    secretKey: string;
+    webhookSecret: string;
+    /** the Stripe price id of the team plan's monthly subscription */
+    priceTeam: string;
+    fetch?: typeof fetch;
+}
+export interface PortalOptions {
+    tenancy: PostgresTenancy;
+    /** the Postgres client the tenancy uses; the portal's own tables live beside the log's */
+    client: PostgresLike;
+    /** signs session cookies; rotate to sign everyone out */
+    secret: string;
+    /** the log's public base URL, for the welcome sheet and the export command */
+    publicUrl: string;
+    checkpointsUrl?: string;
+    /** the log's current signing keyid, for the sheet */
+    keyid?: string;
+    /** the portal's own public URL, for Stripe's return addresses */
+    portalUrl?: string;
+    stripe?: StripeOptions;
+    /** key throttles by X-Forwarded-For; only behind a proxy you run. Also marks cookies Secure. */
+    trustProxy?: boolean;
+    /** table prefix; default portal_ */
+    prefix?: string;
+    log?: (message: string) => void;
+}
+export interface PortalUser {
+    id: string;
+    email: string;
+    createdAt: string;
+}
+/** Users, memberships, and billing records, beside the log's tables. */
+export declare class PortalStore {
+    private readonly client;
+    private readonly p;
+    private ready;
+    constructor(client: PostgresLike, prefix?: string);
+    private init;
+    static hashPassword(password: string): string;
+    static checkPassword(password: string, stored: string): boolean;
+    createUser(email: string, password: string): Promise<PortalUser>;
+    authenticate(email: string, password: string): Promise<PortalUser | null>;
+    user(id: string): Promise<PortalUser | null>;
+    addMember(userId: string, tenantId: string): Promise<void>;
+    /** the user's tenant; one per account today */
+    tenantOf(userId: string): Promise<string | null>;
+    setBilling(tenantId: string, b: {
+        customerId?: string | null;
+        subscriptionId?: string | null;
+        status: string;
+    }): Promise<void>;
+    billing(tenantId: string): Promise<{
+        customerId: string | null;
+        subscriptionId: string | null;
+        status: string;
+    } | null>;
+    tenantBySubscription(subscriptionId: string): Promise<string | null>;
+}
+export declare function signSession(secret: string, userId: string, ttlMs?: number): string;
+export declare function readSession(secret: string, cookie: string | undefined): string | null;
+export declare function stripeRequest(s: StripeOptions, path: string, body: Record<string, string>): Promise<Record<string, unknown>>;
+/** Stripe-Signature: t=<unix>,v1=<hmac>; the mac is over `${t}.${rawBody}` with the endpoint secret. */
+export declare function verifyStripeSignature(header: string | undefined, rawBody: string, secret: string, now?: number, toleranceMs?: number): boolean;
+export interface RunningPortal {
+    url: string;
+    close(): Promise<void>;
+}
+export declare function portalHandler(o: PortalOptions): (req: IncomingMessage, res: ServerResponse) => Promise<void>;
+export declare function servePortal(o: PortalOptions, opts: {
+    port: number;
+    host?: string;
+}): Promise<RunningPortal>;

package/dist/portal.js

@@ -0,0 +1,547 @@
+// The tenant portal: where a team registers, gets its tenant on the hosted log and its first API key, watches its
+// usage against its plan, mints and revokes keys, and pays. One process beside the log, on the same Postgres, with
+// its own tables under `portal_`. Everything a tenant can do here they could also do by asking the operator; the
+// portal removes the asking. It holds no receipts and never sees a receipt: the numbers it shows are the log's
+// counts, the hashes it lists are the same hashes the export carries.
+//
+// Sessions are a signed cookie, passwords are scrypt, the page is one inline file with no framework and a strict
+// content-security policy, and every API write requires a JSON body, which with a SameSite=Strict cookie is what
+// keeps a cross-site page from acting as the user. Billing is Stripe Checkout for the team plan; the webhook moves
+// the tenant's plan, and nothing about a card ever passes through here.
+import { createHmac, randomBytes, randomUUID, scryptSync, timingSafeEqual } from "node:crypto";
+import { createServer } from "node:http";
+import { postgresCheckpoints } from "./checkpoints.js";
+import { welcomeSheet } from "./log-admin.js";
+import { clientAddress } from "./log-sink.js";
+import { RateLimiter } from "./log-store.js";
+const ident = (s) => {
+    if (!/^[a-z_][a-z0-9_]*$/.test(s))
+        throw new Error(`prefix must be a plain identifier; got "${s}"`);
+    return s;
+};
+/** Users, memberships, and billing records, beside the log's tables. */
+export class PortalStore {
+    client;
+    p;
+    ready = null;
+    // no parameter properties: the CLI runs on plain Node type stripping
+    constructor(client, prefix = "portal_") {
+        this.client = client;
+        this.p = ident(prefix);
+    }
+    init() {
+        if (!this.ready) {
+            const p = this.p;
+            this.ready = (async () => {
+                await this.client.query(`CREATE TABLE IF NOT EXISTS ${p}users (id TEXT PRIMARY KEY, email TEXT NOT NULL UNIQUE, password_hash TEXT NOT NULL, created_at TIMESTAMPTZ NOT NULL DEFAULT now())`);
+                await this.client.query(`CREATE TABLE IF NOT EXISTS ${p}members (user_id TEXT NOT NULL REFERENCES ${p}users(id), tenant_id TEXT NOT NULL, role TEXT NOT NULL DEFAULT 'owner', created_at TIMESTAMPTZ NOT NULL DEFAULT now(), PRIMARY KEY (user_id, tenant_id))`);
+                await this.client.query(`CREATE TABLE IF NOT EXISTS ${p}billing (tenant_id TEXT PRIMARY KEY, customer_id TEXT, subscription_id TEXT, status TEXT NOT NULL, updated_at TIMESTAMPTZ NOT NULL DEFAULT now())`);
+            })();
+        }
+        return this.ready;
+    }
+    static hashPassword(password) {
+        const salt = randomBytes(16);
+        return `scrypt$${salt.toString("hex")}$${scryptSync(password, salt, 64).toString("hex")}`;
+    }
+    static checkPassword(password, stored) {
+        const [alg, saltHex, hashHex] = stored.split("$");
+        if (alg !== "scrypt" || !saltHex || !hashHex)
+            return false;
+        const expected = Buffer.from(hashHex, "hex");
+        const got = scryptSync(password, Buffer.from(saltHex, "hex"), expected.length);
+        return got.length === expected.length && timingSafeEqual(got, expected);
+    }
+    async createUser(email, password) {
+        await this.init();
+        const id = randomUUID();
+        const rows = (await this.client.query(`INSERT INTO ${this.p}users (id, email, password_hash) VALUES ($1, $2, $3) ON CONFLICT (email) DO NOTHING RETURNING id, email, created_at`, [id, email, PortalStore.hashPassword(password)])).rows;
+        if (!rows[0])
+            throw new Error("an account with this email already exists");
+        return { id, email, createdAt: new Date(rows[0].created_at).toISOString() };
+    }
+    async authenticate(email, password) {
+        await this.init();
+        const rows = (await this.client.query(`SELECT id, email, password_hash, created_at FROM ${this.p}users WHERE email = $1`, [email])).rows;
+        const r = rows[0];
+        if (!r || !PortalStore.checkPassword(password, String(r.password_hash)))
+            return null;
+        return { id: String(r.id), email: String(r.email), createdAt: new Date(r.created_at).toISOString() };
+    }
+    async user(id) {
+        await this.init();
+        const rows = (await this.client.query(`SELECT id, email, created_at FROM ${this.p}users WHERE id = $1`, [id])).rows;
+        const r = rows[0];
+        return r ? { id: String(r.id), email: String(r.email), createdAt: new Date(r.created_at).toISOString() } : null;
+    }
+    async addMember(userId, tenantId) {
+        await this.init();
+        await this.client.query(`INSERT INTO ${this.p}members (user_id, tenant_id) VALUES ($1, $2) ON CONFLICT DO NOTHING`, [userId, tenantId]);
+    }
+    /** the user's tenant; one per account today */
+    async tenantOf(userId) {
+        await this.init();
+        const rows = (await this.client.query(`SELECT tenant_id FROM ${this.p}members WHERE user_id = $1 ORDER BY created_at LIMIT 1`, [userId])).rows;
+        return rows[0]?.tenant_id ?? null;
+    }
+    async setBilling(tenantId, b) {
+        await this.init();
+        await this.client.query(`INSERT INTO ${this.p}billing (tenant_id, customer_id, subscription_id, status, updated_at) VALUES ($1, $2, $3, $4, now())
+       ON CONFLICT (tenant_id) DO UPDATE SET customer_id = COALESCE(EXCLUDED.customer_id, ${this.p}billing.customer_id), subscription_id = COALESCE(EXCLUDED.subscription_id, ${this.p}billing.subscription_id), status = EXCLUDED.status, updated_at = now()`, [tenantId, b.customerId ?? null, b.subscriptionId ?? null, b.status]);
+    }
+    async billing(tenantId) {
+        await this.init();
+        const rows = (await this.client.query(`SELECT customer_id, subscription_id, status FROM ${this.p}billing WHERE tenant_id = $1`, [tenantId])).rows;
+        const r = rows[0];
+        return r ? { customerId: r.customer_id ? String(r.customer_id) : null, subscriptionId: r.subscription_id ? String(r.subscription_id) : null, status: String(r.status) } : null;
+    }
+    async tenantBySubscription(subscriptionId) {
+        await this.init();
+        const rows = (await this.client.query(`SELECT tenant_id FROM ${this.p}billing WHERE subscription_id = $1`, [subscriptionId])).rows;
+        return rows[0]?.tenant_id ?? null;
+    }
+}
+// ---- sessions ----
+const b64u = (b) => b.toString("base64url");
+export function signSession(secret, userId, ttlMs = 14 * 86_400_000) {
+    const body = b64u(Buffer.from(JSON.stringify({ u: userId, e: Date.now() + ttlMs })));
+    return `${body}.${createHmac("sha256", secret).update(body).digest("base64url")}`;
+}
+export function readSession(secret, cookie) {
+    if (!cookie)
+        return null;
+    const [body, mac] = cookie.split(".");
+    if (!body || !mac)
+        return null;
+    const expected = createHmac("sha256", secret).update(body).digest("base64url");
+    if (expected.length !== mac.length || !timingSafeEqual(Buffer.from(expected), Buffer.from(mac)))
+        return null;
+    try {
+        const { u, e } = JSON.parse(Buffer.from(body, "base64url").toString());
+        return typeof u === "string" && typeof e === "number" && e > Date.now() ? u : null;
+    }
+    catch {
+        return null;
+    }
+}
+// ---- Stripe, over its REST API; no SDK ----
+const form = (o) => new URLSearchParams(o).toString();
+export async function stripeRequest(s, path, body) {
+    const f = s.fetch ?? fetch;
+    const res = await f(`https://api.stripe.com/v1/${path}`, { method: "POST", headers: { authorization: `Bearer ${s.secretKey}`, "content-type": "application/x-www-form-urlencoded" }, body: form(body), signal: AbortSignal.timeout(15_000) });
+    const json = (await res.json());
+    if (!res.ok)
+        throw new Error(`stripe ${path}: ${json.error?.message ?? res.status}`);
+    return json;
+}
+/** Stripe-Signature: t=<unix>,v1=<hmac>; the mac is over `${t}.${rawBody}` with the endpoint secret. */
+export function verifyStripeSignature(header, rawBody, secret, now = Date.now(), toleranceMs = 5 * 60_000) {
+    if (!header)
+        return false;
+    const parts = Object.fromEntries(header.split(",").map((kv) => kv.split("=")));
+    const t = Number(parts.t);
+    if (!Number.isFinite(t) || Math.abs(now - t * 1000) > toleranceMs)
+        return false;
+    const expected = createHmac("sha256", secret).update(`${parts.t}.${rawBody}`).digest("hex");
+    return header
+        .split(",")
+        .filter((kv) => kv.startsWith("v1="))
+        .some((kv) => {
+        const sig = kv.slice(3);
+        return sig.length === expected.length && timingSafeEqual(Buffer.from(sig), Buffer.from(expected));
+    });
+}
+const TENANT_ID = /^[a-z0-9][a-z0-9-]{1,38}[a-z0-9]$/;
+const EMAIL = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+const RESERVED = new Set(["default", "admin", "api", "www", "log", "checkpoints", "app", "portal", "stripe", "health", "t"]);
+export function portalHandler(o) {
+    const store = new PortalStore(o.client, o.prefix);
+    const heads = postgresCheckpoints(o.client);
+    const log = o.log ?? ((m) => console.error(m));
+    const loginFailures = new RateLimiter({ perSecond: 1 / 30, burst: 8 });
+    const registrations = new RateLimiter({ perSecond: 1 / 600, burst: 5 });
+    const base = o.publicUrl.endsWith("/") ? o.publicUrl : `${o.publicUrl}/`;
+    const cookieName = "custody_session";
+    const sheet = (tenant, logId) => welcomeSheet({ tenant, logId, publicUrl: base, ...(o.checkpointsUrl ? { checkpointsUrl: o.checkpointsUrl } : {}), ...(o.keyid ? { keyid: o.keyid } : {}) });
+    const exportCommand = (tenant) => `npx @agent-custody/receipts log-export --log-url ${base} --tenant ${tenant} --token-env AGENT_CUSTODY_LOG_TOKEN --out custody-export/`;
+    return async (req, res) => {
+        const url = new URL(req.url ?? "/", "http://localhost");
+        const addr = clientAddress(req, o.trustProxy);
+        const json = (status, body, headers = {}) => {
+            res.writeHead(status, { "content-type": "application/json", "cache-control": "no-store", ...headers });
+            res.end(JSON.stringify(body));
+        };
+        const setCookie = (value) => `${cookieName}=${value ?? ""}; Path=/; HttpOnly; SameSite=Strict${o.trustProxy ? "; Secure" : ""}; Max-Age=${value ? 14 * 86_400 : 0}`;
+        const cookies = Object.fromEntries((req.headers.cookie ?? "").split(";").map((c) => c.trim().split("=")).filter(([k]) => k));
+        const userId = readSession(o.secret, cookies[cookieName]);
+        const rawBody = async () => {
+            let text = "";
+            for await (const chunk of req) {
+                text += chunk;
+                if (text.length > 65_536)
+                    throw new Error("body too large");
+            }
+            return text;
+        };
+        const jsonBody = async () => {
+            if (!(req.headers["content-type"] ?? "").startsWith("application/json"))
+                throw new Error("expected a JSON body");
+            const t = await rawBody();
+            return t ? JSON.parse(t) : {};
+        };
+        try {
+            if (req.method === "GET" && url.pathname === "/health")
+                return json(200, { ok: true, stripe: !!o.stripe });
+            if (req.method === "GET" && url.pathname === "/") {
+                res.writeHead(200, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store", "x-frame-options": "DENY", "content-security-policy": "default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline'; connect-src 'self'; form-action 'self'; base-uri 'none'" });
+                return void res.end(PORTAL_PAGE);
+            }
+            // ---- Stripe's webhook: the only caller that is not a browser with a session ----
+            if (req.method === "POST" && url.pathname === "/stripe/webhook") {
+                if (!o.stripe)
+                    return json(503, { error: "billing is not configured" });
+                const raw = await rawBody();
+                if (!verifyStripeSignature(req.headers["stripe-signature"], raw, o.stripe.webhookSecret))
+                    return json(400, { error: "bad signature" });
+                const event = JSON.parse(raw);
+                const obj = event.data.object;
+                if (event.type === "checkout.session.completed") {
+                    const tenant = String(obj.client_reference_id ?? "");
+                    if (tenant && (await o.tenancy.tenant(tenant))) {
+                        await store.setBilling(tenant, { customerId: obj.customer ? String(obj.customer) : null, subscriptionId: obj.subscription ? String(obj.subscription) : null, status: "active" });
+                        await o.tenancy.setPlan(tenant, "team", "stripe:checkout");
+                        log(`agent-custody portal: tenant ${tenant} moved to team by checkout ${String(obj.id ?? "")}`);
+                    }
+                }
+                else if (event.type === "customer.subscription.deleted" || event.type === "customer.subscription.updated") {
+                    const tenant = await store.tenantBySubscription(String(obj.id ?? ""));
+                    if (tenant) {
+                        const status = event.type === "customer.subscription.deleted" ? "canceled" : String(obj.status ?? "unknown");
+                        await store.setBilling(tenant, { status });
+                        const plan = status === "active" || status === "trialing" || status === "past_due" ? "team" : "free";
+                        const current = (await o.tenancy.tenant(tenant))?.plan;
+                        if (current !== "enterprise" && current !== plan)
+                            await o.tenancy.setPlan(tenant, plan, `stripe:${event.type}`);
+                    }
+                }
+                return json(200, { received: true });
+            }
+            // ---- registration and login ----
+            if (req.method === "POST" && url.pathname === "/api/register") {
+                if (!registrations.take(`reg:${addr}`))
+                    return json(429, { error: "too many registrations from this address; try again later" });
+                const b = await jsonBody();
+                const email = String(b.email ?? "").trim().toLowerCase();
+                const password = String(b.password ?? "");
+                const tenant = String(b.tenant ?? "").trim().toLowerCase();
+                if (!EMAIL.test(email))
+                    return json(400, { error: "a valid email address is needed" });
+                if (password.length < 10)
+                    return json(400, { error: "the password needs at least ten characters" });
+                if (!TENANT_ID.test(tenant) || RESERVED.has(tenant))
+                    return json(400, { error: "the tenant id is the name in your log's URL: three to forty lowercase letters, digits, or hyphens, and not a reserved word" });
+                if (await o.tenancy.tenant(tenant))
+                    return json(409, { error: "that tenant id is taken" });
+                let user;
+                try {
+                    user = await store.createUser(email, password);
+                }
+                catch (e) {
+                    return json(409, { error: e instanceof Error ? e.message : String(e) });
+                }
+                const t = await o.tenancy.addTenant(tenant, tenant, `portal:${email}`);
+                await store.addMember(user.id, tenant);
+                const minted = await o.tenancy.addToken(tenant, "first key", `portal:${email}`);
+                log(`agent-custody portal: ${email} registered tenant ${tenant}`);
+                return json(200, { tenant: t.id, logId: t.logId, plan: t.plan, token: minted.token, tokenHash: minted.tokenHash.slice(0, 12), welcome: sheet(t.id, t.logId), exportCommand: exportCommand(t.id) }, { "set-cookie": setCookie(signSession(o.secret, user.id)) });
+            }
+            if (req.method === "POST" && url.pathname === "/api/login") {
+                if (!loginFailures.take(`login:${addr}`))
+                    return json(429, { error: "too many attempts; wait a minute" });
+                const b = await jsonBody();
+                const user = await store.authenticate(String(b.email ?? "").trim().toLowerCase(), String(b.password ?? ""));
+                if (!user)
+                    return json(401, { error: "email or password not recognised" });
+                return json(200, { email: user.email }, { "set-cookie": setCookie(signSession(o.secret, user.id)) });
+            }
+            if (req.method === "POST" && url.pathname === "/api/logout")
+                return json(200, { ok: true }, { "set-cookie": setCookie(null) });
+            // ---- everything below needs a session ----
+            if (!url.pathname.startsWith("/api/"))
+                return json(404, { error: "not found" });
+            const user = userId ? await store.user(userId) : null;
+            if (!user)
+                return json(401, { error: "sign in first" });
+            const tenantId = await store.tenantOf(user.id);
+            if (!tenantId)
+                return json(409, { error: "this account has no tenant" });
+            const tenant = await o.tenancy.tenant(tenantId);
+            if (!tenant)
+                return json(409, { error: "the tenant no longer exists" });
+            if (req.method !== "GET" && !(req.headers["content-type"] ?? "").startsWith("application/json"))
+                return json(415, { error: "expected a JSON body" });
+            if (req.method === "GET" && url.pathname === "/api/me") {
+                const q = await o.tenancy.quota(tenantId);
+                return json(200, { email: user.email, tenant: tenantId, logId: tenant.logId, plan: q.plan, used: q.used, quota: q.quota, disabled: !!tenant.disabledAt, billing: !!o.stripe });
+            }
+            if (req.method === "GET" && url.pathname === "/api/overview") {
+                const q = await o.tenancy.quota(tenantId);
+                const backend = await o.tenancy.log(tenantId);
+                const size = await backend.size();
+                const latest = await heads.latest(tenantId);
+                const months = [];
+                for (let i = 5; i >= 0; i--) {
+                    const d = new Date();
+                    const month = new Date(Date.UTC(d.getUTCFullYear(), d.getUTCMonth() - i, 1)).toISOString().slice(0, 7);
+                    const u = await o.tenancy.usage(month);
+                    months.push({ month, appends: u.tenants.find((t) => t.id === tenantId)?.appends ?? 0 });
+                }
+                const keys = (await o.tenancy.listTokens(tenantId)).map((k) => ({ label: k.label, hash: k.tokenHash.slice(0, 12), createdAt: k.createdAt, revokedAt: k.revokedAt }));
+                const audit = await o.tenancy.audit({ tenant: tenantId, limit: 50 });
+                const billing = await store.billing(tenantId);
+                return json(200, { tenant: tenantId, logId: tenant.logId, plan: q.plan, used: q.used, quota: q.quota, treeSize: size, rootHash: size ? await backend.root(size) : null, latestCheckpoint: latest ? { treeSize: latest.treeSize, signedAt: latest.signedAt } : null, months, keys, audit, billing: billing ? { status: billing.status } : null, urls: { log: `${base}t/${tenantId}/`, keys: `${base}.well-known/agent-custody-log.json`, checkpoints: o.checkpointsUrl ? `${o.checkpointsUrl.replace(/\/?$/, "/")}${tenantId}/latest.json` : null }, exportCommand: exportCommand(tenantId), welcome: sheet(tenantId, tenant.logId), stripe: !!o.stripe });
+            }
+            if (req.method === "GET" && url.pathname === "/api/keys") {
+                return json(200, { keys: (await o.tenancy.listTokens(tenantId)).map((k) => ({ label: k.label, hash: k.tokenHash.slice(0, 12), createdAt: k.createdAt, revokedAt: k.revokedAt })) });
+            }
+            if (req.method === "POST" && url.pathname === "/api/keys") {
+                const b = await jsonBody();
+                const label = String(b.label ?? "").trim().slice(0, 64) || "key";
+                const minted = await o.tenancy.addToken(tenantId, label, `portal:${user.email}`);
+                return json(200, { token: minted.token, tokenHash: minted.tokenHash.slice(0, 12), label });
+            }
+            const revoke = /^\/api\/keys\/([0-9a-f]{8,64})\/revoke$/.exec(url.pathname);
+            if (req.method === "POST" && revoke) {
+                await jsonBody();
+                return json(200, { revoked: await o.tenancy.revokeToken(tenantId, revoke[1], `portal:${user.email}`) });
+            }
+            if (req.method === "POST" && url.pathname === "/api/checkout") {
+                if (!o.stripe)
+                    return json(503, { error: "billing is not configured on this portal yet; email us and we move the plan by hand" });
+                await jsonBody();
+                if (tenant.plan !== "free")
+                    return json(409, { error: `this tenant is already on the ${tenant.plan} plan` });
+                const portalUrl = (o.portalUrl ?? "http://localhost/").replace(/\/?$/, "/");
+                const session = await stripeRequest(o.stripe, "checkout/sessions", { mode: "subscription", "line_items[0][price]": o.stripe.priceTeam, "line_items[0][quantity]": "1", client_reference_id: tenantId, customer_email: user.email, success_url: `${portalUrl}?upgraded=1`, cancel_url: `${portalUrl}?cancelled=1`, "metadata[tenant]": tenantId });
+                return json(200, { url: String(session.url) });
+            }
+            if (req.method === "POST" && url.pathname === "/api/billing-portal") {
+                if (!o.stripe)
+                    return json(503, { error: "billing is not configured" });
+                await jsonBody();
+                const b = await store.billing(tenantId);
+                if (!b?.customerId)
+                    return json(409, { error: "no billing record for this tenant" });
+                const session = await stripeRequest(o.stripe, "billing_portal/sessions", { customer: b.customerId, return_url: (o.portalUrl ?? "http://localhost/").replace(/\/?$/, "/") });
+                return json(200, { url: String(session.url) });
+            }
+            return json(404, { error: "not found" });
+        }
+        catch (e) {
+            if (!res.headersSent)
+                json(500, { error: e instanceof Error ? e.message : String(e) });
+        }
+    };
+}
+export function servePortal(o, opts) {
+    const host = opts.host ?? "127.0.0.1";
+    const handler = portalHandler(o);
+    const server = createServer((req, res) => void handler(req, res));
+    return new Promise((resolve) => {
+        server.listen(opts.port, host, () => {
+            const { port } = server.address();
+            resolve({ url: `http://${host}:${port}/`, close: () => new Promise((r) => { server.closeAllConnections?.(); server.close(() => r()); }) });
+        });
+    });
+}
+// ---- the page: one file, no framework, no outside requests ----
+const PORTAL_PAGE = `<!doctype html>
+<meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
+<title>agent-custody</title>
+<style>
+  :root { color-scheme: light dark; --ink: #1b2430; --ink2: #5b6b7a; --line: #d7dfe5; --bg: #f5f7f9; --panel: #ffffff; --accent: #0f6e63; --accent-bg: #e8f3f1; --warn: #b3731a; --bad: #b3261e; --ok: #1f7a4d; --mono: ui-monospace, "SF Mono", Menlo, Consolas, monospace; }
+  @media (prefers-color-scheme: dark) { :root { --ink: #e6ecf0; --ink2: #9fb0bd; --line: #27333c; --bg: #0e1418; --panel: #151d23; --accent: #4fc3b0; --accent-bg: #16302b; --warn: #e2b862; --bad: #ff8a80; --ok: #6fd39a; } }
+  * { box-sizing: border-box; }
+  body { margin: 0; background: var(--bg); color: var(--ink); font: 15px/1.5 system-ui, -apple-system, "Segoe UI", sans-serif; }
+  .top { display: flex; align-items: center; gap: 1rem; padding: .7rem 1.25rem; border-bottom: 1px solid var(--line); background: var(--panel); }
+  .brand { font-weight: 700; letter-spacing: .04em; } .brand b { color: var(--accent); }
+  .top .who { margin-left: auto; color: var(--ink2); font-size: .9rem; }
+  .pill { display: inline-block; padding: .05rem .5rem; border-radius: 999px; font: 600 .72rem/1.6 var(--mono); letter-spacing: .06em; text-transform: uppercase; background: var(--accent-bg); color: var(--accent); }
+  .layout { display: grid; grid-template-columns: 15rem 1fr; min-height: calc(100vh - 3.3rem); }
+  nav { border-right: 1px solid var(--line); background: var(--panel); padding: 1rem 0; }
+  nav .group { font: 600 .68rem/1.4 var(--mono); letter-spacing: .12em; text-transform: uppercase; color: var(--accent); padding: 1rem 1.25rem .35rem; }
+  nav a { display: flex; justify-content: space-between; padding: .45rem 1.25rem; color: var(--ink); text-decoration: none; border-left: 3px solid transparent; }
+  nav a.on { border-left-color: var(--accent); background: var(--accent-bg); }
+  nav a span.n { color: var(--ink2); font-family: var(--mono); font-size: .8rem; }
+  main { padding: 1.5rem; max-width: 72rem; }
+  h1 { font-size: 1.25rem; margin: 0 0 1rem; } h2 { font: 600 .72rem/1.4 var(--mono); letter-spacing: .1em; text-transform: uppercase; color: var(--ink2); margin: 1.5rem 0 .6rem; }
+  .cards { display: grid; grid-template-columns: repeat(auto-fit, minmax(13rem, 1fr)); gap: .9rem; }
+  .card { background: var(--panel); border: 1px solid var(--line); border-top: 3px solid var(--accent); border-radius: 6px; padding: 1rem 1.1rem; }
+  .card.warn { border-top-color: var(--warn); } .card.bad { border-top-color: var(--bad); } .card.ok { border-top-color: var(--ok); }
+  .card .k { font: 600 .68rem/1.4 var(--mono); letter-spacing: .1em; text-transform: uppercase; color: var(--ink2); }
+  .card .v { font-size: 1.9rem; font-weight: 700; margin: .2rem 0 0; font-variant-numeric: tabular-nums; }
+  .card .s { color: var(--ink2); font-size: .88rem; }
+  .panel { background: var(--panel); border: 1px solid var(--line); border-radius: 6px; padding: 1rem 1.1rem; margin-top: .9rem; }
+  table { border-collapse: collapse; width: 100%; font-size: .92rem; }
+  th, td { text-align: left; padding: .45rem .5rem .45rem 0; border-bottom: 1px solid var(--line); vertical-align: top; }
+  th { font: 600 .68rem/1.4 var(--mono); letter-spacing: .08em; text-transform: uppercase; color: var(--ink2); }
+  code, pre, .mono { font-family: var(--mono); font-size: .86em; }
+  pre { background: var(--bg); border: 1px solid var(--line); border-radius: 4px; padding: .8rem .9rem; overflow-x: auto; white-space: pre-wrap; }
+  .bars { display: grid; grid-template-columns: repeat(6, 1fr); gap: .6rem; align-items: end; height: 9rem; }
+  .bar { display: flex; flex-direction: column; justify-content: flex-end; align-items: center; height: 100%; font-size: .75rem; color: var(--ink2); }
+  .bar i { display: block; width: 70%; background: var(--accent); border-radius: 3px 3px 0 0; min-height: 2px; }
+  .bar b { font-family: var(--mono); font-weight: 400; margin-top: .3rem; }
+  label { display: grid; gap: .25rem; font-size: .85rem; color: var(--ink2); margin: 0 0 .8rem; }
+  input, select { font: inherit; padding: .5rem .6rem; border: 1px solid var(--line); border-radius: 4px; background: var(--bg); color: var(--ink); }
+  button { font: inherit; padding: .5rem .9rem; border-radius: 4px; border: 1px solid var(--accent); background: var(--accent); color: #fff; cursor: pointer; }
+  button.quiet { background: transparent; color: var(--accent); }
+  button.link { background: none; border: 0; padding: 0; color: var(--accent); text-decoration: underline; }
+  .auth { max-width: 26rem; margin: 4rem auto; }
+  .once { border: 1px solid var(--warn); background: color-mix(in srgb, var(--warn) 10%, var(--panel)); border-radius: 6px; padding: 1rem 1.1rem; margin: 1rem 0; }
+  .tok { font-family: var(--mono); word-break: break-all; padding: .6rem; background: var(--bg); border-radius: 4px; }
+  .msg { min-height: 1.4rem; margin: .6rem 0; color: var(--ink2); } .msg.err { color: var(--bad); } .msg.ok { color: var(--ok); }
+  .muted { color: var(--ink2); }
+  [hidden] { display: none !important; }
+  @media (max-width: 48rem) { .layout { grid-template-columns: 1fr; } nav { display: flex; flex-wrap: wrap; padding: .3rem; border-right: 0; border-bottom: 1px solid var(--line); } nav .group { display: none; } nav a { border-left: 0; border-bottom: 3px solid transparent; } nav a.on { border-bottom-color: var(--accent); } }
+</style>
+<div class="top"><span class="brand"><b>◆</b> agent-custody</span><span id="tenantTag" class="pill" hidden></span><span id="planTag" class="pill" hidden></span><span class="who" id="who"></span></div>
+<section id="auth" class="auth" hidden>
+  <h1 id="authTitle">Sign in</h1>
+  <form id="authForm">
+    <label>Email<input id="email" type="email" autocomplete="email" required></label>
+    <label>Password<input id="password" type="password" autocomplete="current-password" minlength="10" required></label>
+    <label id="tenantField" hidden>Tenant id, the name in your log's URL<input id="tenant" placeholder="acme" pattern="[a-z0-9][a-z0-9-]{1,38}[a-z0-9]"></label>
+    <button id="authGo" type="submit">Sign in</button>
+    <p class="msg" id="authMsg"></p>
+  </form>
+  <p class="muted"><button class="link" id="authSwap" type="button">Create an account and a tenant instead</button></p>
+  <p class="muted">The free plan is ten thousand appends a month, no card. Your gateway sends only hashes; nothing you log here can be read by us.</p>
+</section>
+<section id="welcome" class="auth" hidden>
+  <h1>Your tenant is ready</h1>
+  <div class="once"><p><b>Your first API key, shown once.</b> Put it in the environment your gateway reads as <code>AGENT_CUSTODY_LOG_TOKEN</code>. We keep only its hash.</p><p class="tok" id="firstToken"></p><button class="quiet" id="copyFirst">Copy key</button></div>
+  <h2>Your welcome sheet</h2>
+  <pre id="firstSheet"></pre>
+  <button id="toDash">Go to the dashboard</button>
+</section>
+<div class="layout" id="app" hidden>
+  <nav>
+    <div class="group">Monitor</div>
+    <a href="#overview" data-view="overview">Overview</a>
+    <a href="#usage" data-view="usage">Usage</a>
+    <div class="group">Configure</div>
+    <a href="#keys" data-view="keys">API keys <span class="n" id="nKeys"></span></a>
+    <a href="#billing" data-view="billing">Billing</a>
+    <a href="#export" data-view="export">Export</a>
+    <div class="group">Account</div>
+    <a href="#" id="signout">Sign out</a>
+  </nav>
+  <main>
+    <div data-pane="overview">
+      <h1>Overview</h1>
+      <div class="cards">
+        <div class="card" id="cUsed"><div class="k">Appends this month</div><div class="v" id="vUsed">–</div><div class="s" id="sUsed"></div></div>
+        <div class="card" id="cSize"><div class="k">Receipts in your log</div><div class="v" id="vSize">–</div><div class="s">leaf hashes, all time</div></div>
+        <div class="card" id="cKeys"><div class="k">Live keys</div><div class="v" id="vKeys">–</div><div class="s" id="sKeys"></div></div>
+        <div class="card" id="cCp"><div class="k">Latest checkpoint</div><div class="v" id="vCp">–</div><div class="s" id="sCp"></div></div>
+      </div>
+      <h2>Your log</h2>
+      <div class="panel"><table><tbody id="urls"></tbody></table></div>
+      <h2>Recent activity</h2>
+      <div class="panel"><table><thead><tr><th>when</th><th>who</th><th>action</th><th>detail</th></tr></thead><tbody id="audit"></tbody></table></div>
+    </div>
+    <div data-pane="usage" hidden>
+      <h1>Usage</h1>
+      <div class="panel"><div class="bars" id="bars"></div></div>
+      <p class="muted" id="usageNote"></p>
+    </div>
+    <div data-pane="keys" hidden>
+      <h1>API keys</h1>
+      <p class="muted">A key is a bearer token your gateway presents on append. It is shown once when minted; we keep only its hash. Mint a second key before revoking the first to rotate without a gap.</p>
+      <div class="panel"><form id="mintForm" style="display:flex;gap:.6rem;align-items:end;flex-wrap:wrap"><label style="margin:0">Label<input id="label" placeholder="support fleet"></label><button type="submit">Mint key</button></form>
+        <div id="minted" class="once" hidden><p><b>Shown once.</b></p><p class="tok" id="mintedTok"></p><button class="quiet" id="copyMinted">Copy key</button></div>
+        <table style="margin-top:1rem"><thead><tr><th>label</th><th>hash</th><th>created</th><th>state</th><th></th></tr></thead><tbody id="keys"></tbody></table></div>
+      <p class="msg" id="keysMsg"></p>
+    </div>
+    <div data-pane="billing" hidden>
+      <h1>Billing</h1>
+      <div class="panel" id="billingPanel"></div>
+      <p class="msg" id="billingMsg"></p>
+    </div>
+    <div data-pane="export" hidden>
+      <h1>Export</h1>
+      <p class="muted">Everything the log holds about you, any time, with your key: every leaf hash as a log file the verifier reads offline, the signed head, the published keys, the checkpoints, your usage, and the actions taken on your tenant. It checks itself before writing.</p>
+      <pre id="exportCmd"></pre>
+      <h2>Welcome sheet</h2>
+      <pre id="sheet"></pre>
+    </div>
+  </main>
+</div>
+<script>
+(() => {
+  const $ = (id) => document.getElementById(id);
+  const esc = (s) => String(s).replace(/[&<>"]/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;" }[c]));
+  const api = async (method, path, body) => {
+    const r = await fetch(path, { method, headers: body !== undefined ? { "content-type": "application/json" } : {}, body: body !== undefined ? JSON.stringify(body) : undefined, credentials: "same-origin" });
+    const j = await r.json().catch(() => ({}));
+    if (!r.ok) { const e = new Error(j.error || r.statusText); e.status = r.status; throw e; }
+    return j;
+  };
+  const fmt = (n) => Number(n).toLocaleString();
+  const ago = (iso) => { const m = Math.round((Date.now() - Date.parse(iso)) / 60000); return m < 60 ? m + " min ago" : m < 1440 ? Math.round(m / 60) + " h ago" : Math.round(m / 1440) + " d ago"; };
+  let registering = false;
+  const show = (id) => { for (const s of ["auth", "welcome", "app"]) $(s).hidden = s !== id; };
+  const view = (name) => {
+    for (const p of document.querySelectorAll("[data-pane]")) p.hidden = p.dataset.pane !== name;
+    for (const a of document.querySelectorAll("nav a[data-view]")) a.classList.toggle("on", a.dataset.view === name);
+    location.hash = name;
+  };
+  $("authSwap").onclick = () => { registering = !registering; $("authTitle").textContent = registering ? "Create your tenant" : "Sign in"; $("authGo").textContent = registering ? "Create tenant" : "Sign in"; $("tenantField").hidden = !registering; $("tenant").required = registering; $("password").autocomplete = registering ? "new-password" : "current-password"; $("authSwap").textContent = registering ? "I already have an account" : "Create an account and a tenant instead"; };
+  $("authForm").onsubmit = async (e) => {
+    e.preventDefault(); $("authMsg").className = "msg"; $("authMsg").textContent = "";
+    try {
+      if (registering) {
+        const r = await api("POST", "/api/register", { email: $("email").value, password: $("password").value, tenant: $("tenant").value });
+        $("firstToken").textContent = r.token; $("firstSheet").textContent = r.welcome; show("welcome");
+      } else { await api("POST", "/api/login", { email: $("email").value, password: $("password").value }); await enter(); }
+    } catch (err) { $("authMsg").className = "msg err"; $("authMsg").textContent = err.message; }
+  };
+  $("copyFirst").onclick = () => navigator.clipboard.writeText($("firstToken").textContent);
+  $("toDash").onclick = () => enter();
+  $("signout").onclick = async (e) => { e.preventDefault(); await api("POST", "/api/logout", {}); location.hash = ""; show("auth"); };
+  for (const a of document.querySelectorAll("nav a[data-view]")) a.onclick = (e) => { e.preventDefault(); view(a.dataset.view); };
+  const render = (o) => {
+    $("tenantTag").textContent = o.tenant; $("tenantTag").hidden = false; $("planTag").textContent = o.plan + " plan"; $("planTag").hidden = false;
+    const pct = o.quota ? o.used / o.quota : 0;
+    $("cUsed").className = "card " + (o.quota === null ? "ok" : pct >= 1 ? "bad" : pct >= .8 ? "warn" : "ok");
+    $("vUsed").textContent = fmt(o.used); $("sUsed").textContent = o.quota === null ? "no allowance on " + o.plan : "of " + fmt(o.quota) + " on " + o.plan + (pct >= 1 ? ": appends are refused until next month" : "");
+    $("vSize").textContent = fmt(o.treeSize);
+    const live = o.keys.filter((k) => !k.revokedAt).length; $("vKeys").textContent = live; $("sKeys").textContent = o.keys.length - live + " revoked"; $("nKeys").textContent = live;
+    $("cCp").className = "card " + (o.latestCheckpoint ? (Date.now() - Date.parse(o.latestCheckpoint.signedAt) < 7 * 3600e3 ? "ok" : "warn") : "warn");
+    $("vCp").textContent = o.latestCheckpoint ? "size " + fmt(o.latestCheckpoint.treeSize) : "none yet"; $("sCp").textContent = o.latestCheckpoint ? "signed " + ago(o.latestCheckpoint.signedAt) : "published after your first append";
+    $("urls").innerHTML = [["Append here", o.urls.log], ["Log id on tree heads", o.logId], ["The log's keys", o.urls.keys], ["Your checkpoints", o.urls.checkpoints || "(not published)"], ["Current root", o.rootHash || "(empty)"]].map(([k, v]) => "<tr><th>" + esc(k) + "</th><td class=mono>" + esc(v) + "</td></tr>").join("");
+    $("audit").innerHTML = o.audit.map((e) => "<tr><td>" + esc(e.at.replace("T", " ").slice(0, 16)) + "</td><td class=mono>" + esc(e.actor) + "</td><td>" + esc(e.action) + "</td><td class=muted>" + esc(Object.entries(e.detail).map(([k, v]) => k + "=" + v).join(" ")) + "</td></tr>").join("") || "<tr><td colspan=4 class=muted>nothing yet</td></tr>";
+    const max = Math.max(1, ...o.months.map((m) => m.appends));
+    $("bars").innerHTML = o.months.map((m) => "<div class=bar><span class=mono>" + fmt(m.appends) + "</span><i style=\\"height:" + Math.max(2, Math.round(100 * m.appends / max)) + "%\\"></i><b>" + esc(m.month.slice(2)) + "</b></div>").join("");
+    $("usageNote").textContent = "Appends per calendar month, UTC. Your plan allows " + (o.quota === null ? "any number" : fmt(o.quota)) + " a month; the count resets on the first.";
+    $("keys").innerHTML = o.keys.map((k) => "<tr><td>" + esc(k.label) + "</td><td class=mono>" + esc(k.hash) + "</td><td>" + esc(k.createdAt.slice(0, 10)) + "</td><td>" + (k.revokedAt ? "revoked " + esc(k.revokedAt.slice(0, 10)) : "live") + "</td><td>" + (k.revokedAt ? "" : "<button class=quiet data-revoke=\\"" + esc(k.hash) + "\\">Revoke</button>") + "</td></tr>").join("");
+    $("billingPanel").innerHTML = o.plan === "free"
+      ? "<p>You are on the <b>free</b> plan: ten thousand appends a month, no card.</p><p>The <b>team</b> plan is <b>$50 a month</b>: a million appends, email support within two working days, the same export and audit trail. No availability commitment yet, and the design fails closed: when the log is unreachable your gateway withholds pre-committed calls.</p>" + (o.stripe ? "<button id=upgrade>Upgrade to team, $50/month</button>" : "<p class=muted>Card payments are not switched on for this portal yet; email us and we move the plan by hand.</p>")
+      : "<p>You are on the <b>" + esc(o.plan) + "</b> plan" + (o.billing ? " (subscription " + esc(o.billing.status) + ")" : "") + ".</p>" + (o.stripe && o.billing ? "<button class=quiet id=manage>Manage billing</button>" : "");
+    $("exportCmd").textContent = o.exportCommand; $("sheet").textContent = o.welcome;
+    const up = $("upgrade"); if (up) up.onclick = async () => { try { const r = await api("POST", "/api/checkout", {}); location.href = r.url; } catch (err) { $("billingMsg").className = "msg err"; $("billingMsg").textContent = err.message; } };
+    const mg = $("manage"); if (mg) mg.onclick = async () => { try { const r = await api("POST", "/api/billing-portal", {}); location.href = r.url; } catch (err) { $("billingMsg").className = "msg err"; $("billingMsg").textContent = err.message; } };
+  };
+  const load = async () => render(await api("GET", "/api/overview"));
+  const enter = async () => {
+    try { const me = await api("GET", "/api/me"); $("who").textContent = me.email; show("app"); await load(); view((location.hash || "#overview").slice(1) || "overview"); }
+    catch (err) { if (err.status === 401) show("auth"); else { show("app"); $("who").textContent = err.message; } }
+  };
+  $("mintForm").onsubmit = async (e) => { e.preventDefault(); try { const r = await api("POST", "/api/keys", { label: $("label").value }); $("mintedTok").textContent = r.token; $("minted").hidden = false; $("keysMsg").className = "msg ok"; $("keysMsg").textContent = "minted " + r.label + ", stored as hash " + r.tokenHash; await load(); } catch (err) { $("keysMsg").className = "msg err"; $("keysMsg").textContent = err.message; } };
+  $("copyMinted").onclick = () => navigator.clipboard.writeText($("mintedTok").textContent);
+  document.addEventListener("click", async (e) => { const b = e.target.closest("button[data-revoke]"); if (!b) return; if (!confirm("Revoke key " + b.dataset.revoke + "? A gateway using it stops appending at once.")) return; try { await api("POST", "/api/keys/" + b.dataset.revoke + "/revoke", {}); $("keysMsg").className = "msg ok"; $("keysMsg").textContent = "revoked"; await load(); } catch (err) { $("keysMsg").className = "msg err"; $("keysMsg").textContent = err.message; } });
+  if (new URLSearchParams(location.search).get("upgraded")) history.replaceState(null, "", "/#billing");
+  enter();
+})();
+</script>
+`;

package/docs/usage.md

@@ -107,7 +107,7 @@ An upstream need not be an MCP server. A plain HTTP API is described as tools:
   "log": { "url": "https://log.example.com/", "tokenEnv": "AGENT_CUSTODY_LOG_TOKEN" }
 ```
 
-Exactly one of the two. The bearer token comes from the named environment variable, never from the file, and a missing variable fails at startup. Add `"hashOnly": true` for any log run by someone else: the gateway then sends only the leaf hash, sha256 of the receipt envelope with the RFC 6962 prefix, so the log commits to the receipt without ever holding it, and the receipts with their arguments and results stay in `receiptsDir`. The verifier does not change; it hashes the envelope itself. A log that serves several tenants is reached at `<url>/t/<tenant>/`, and each of its tree heads names its log, which a verifier checks with `--log-id`. With a remote log the tree head in each receipt is signed by the log's key, and a verifier must be given that key with `--log-key`. An append that gets no answer within `timeoutMs` (default 10000) counts as unreachable and is retried like a server error, so a log that accepts connections and never answers cannot hold a call forever. If the log refuses a leaf, the receipt is not issued and the call returns an error to the agent. For an ordinary call the upstream action has already happened by then, and the error says so; a receipt that was never logged must not be handed out. For a tool named in `precommit` the order is reversed, below, and the action never happens. The reference log server is `node src/cli.ts log --file log.jsonl --key keys/log.key --port 8787 --token-env AGENT_CUSTODY_LOG_TOKEN [--log-id <id>] [--tenants tenants.json]`. It serves `POST /append` with `{leaf}` or `{leafHash}` (token required when one is configured), `GET /root?size=N`, `GET /consistency?old=M&new=N`, and `GET /head`; [verification.md](verification.md) says what each proves. `--log-id` writes that id into every tree head. `--tenants` names a JSON file, `{ "acme": { "file": "acme.jsonl", "tokenEnv": "ACME_TOKEN", "logId": "acme-eu" } }`, and each tenant is its own log at `/t/acme/…` with its own token and id; the default log stays at the root paths. With `--db-env DATABASE_URL` the server keeps its logs in Postgres instead of files, and needs the `pg` package beside it: leaves as hashes in one table keyed by tenant, one writer per tenant enforced with an advisory lock so a second instance is safe, tenants and their tokens in tables of their own with tokens stored only as hashes, and rate limits per token (50 appends a second, burst 100, a 64 KB body cap; a refused append answers 429 with `retry-after`, and the gateway's sink retries a few times). Tenants are managed with `log-admin --db-env DATABASE_URL`: `tenant add <id> [--log-id <id>]`, `token add <tenant> --label <text>` (the token is printed once), `token revoke <tenant> <hash-prefix>`, `tenant disable <id>`, and `import --file log.jsonl [--tenant default]` to bring an existing file log in as hashes. The root paths serve the tenant `default`, created on first start with `--log-id`, and `--token-env` still works for it. The key that signs tree heads can live in its own process: `agent-custody signer --key keys/log.key --port 8790 --token-env SIGNER_TOKEN` holds it and answers `POST /sign` with the shared secret and `GET /keys` to anyone; the log server then runs with `--signer-url http://signer:8790/ --signer-token-env SIGNER_TOKEN` instead of `--key`, and the process that faces the internet never holds the key. Either way the log serves its keys at `/.well-known/agent-custody-log.json`, current key first and retired keys (`--retired-key old.pub`) after it, so verifiers fetch and pin them with `verify --log-url` and `audit --log-url` rather than receiving a key file from the operator. With `--checkpoint-dir <dir>` the server publishes a signed checkpoint, every `--checkpoint-every` seconds (default 300), for each log whose tree has grown, and every `--checkpoint-heartbeat` seconds (default 21600, six hours) for a log that has not, so a quiet log's latest checkpoint is never more than six hours old and the monitor can tell quiet from stalled, as `<dir>/<tenant>/<treeSize>.json` and `latest.json`, and with a database also as rows; `GET /checkpoints?since=<size>` and `GET /t/<tenant>/checkpoints` list them. Serve the directory read-only from a second host, so the record of what the log signed does not depend on the log's API being up; a verifier who kept an earlier head audits against a later checkpoint with `audit --older <bundle> --newer <checkpoint> --log-url <url>`. With `--admin-token-env ADMIN_TOKEN` (Postgres only) the server also serves the operator's page at `/admin` and its API under `/admin/`: list and create tenants, mint a token that is shown once beside the tenant's welcome sheet, revoke tokens, disable tenants. Everything under `/admin`, the page included, needs the admin token: the browser asks for it (any user name, the token as the password) and an API client sends it as a bearer; a handful of wrong attempts from one address are throttled for a minute. Every change made there or with `log-admin` is recorded: who (the name entered at the browser prompt and the address, `bearer` for an API client, or the user and host for the command line), what (`tenant.add`, `tenant.disable`, `token.add`, `token.revoke`), which tenant, and the detail, never the token itself; the page shows it under Activity, `GET /admin/audit?tenant=&limit=` and `log-admin audit` list it, and a tenant reads their own rows at `GET /t/<name>/audit` with their token. Nothing else is stored by the page. Behind a reverse proxy, start the server with `--trust-proxy` so those per-address limits key on `X-Forwarded-For` instead of on the proxy's own address, and only there, since the header is otherwise the client's to forge. `--public-url` and `--checkpoints-url` fill the sheet in. The witness closes the last gap: `agent-custody witness --key witness.key --log-url <url> --checkpoints-url <url> --out <dir> [--tenant <name>]...` runs on a machine the log's operator does not control, fetches each watched log's latest checkpoint, verifies it against the log's published keys, proves with the log's consistency proof that it extends the last head the witness signed, and countersigns it into `<dir>/<tenant>/<size>.json` and `latest.json`; a checkpoint that does not extend, or a second history at the same size, gets `ALARM.json` instead. Its key document is `<dir>/.well-known/agent-custody-witness.json`. Serve `<dir>` from the witness's own host; verifiers add `--witness-url` (or `--witness-key`) to `audit`, and the newer head must then carry the witness's signature. Two more things an operator needs. `agent-custody log-check --log-url <url> --checkpoints-url <url> [--witness-url <url>] [--tenant <name>]... [--max-lag <seconds>]` is the outside monitor: it verifies the head against the published keys, that the latest checkpoint verifies and keeps up with the head, that the head extends the checkpoint, and, with a witness, that the witness has countersigned, keeps up, and has raised no alarm; it exits 1 on any failure, so cron or a scheduled workflow on a machine that is not the log's turns it into an alert. `GET /health` on the server is the liveness check for a load balancer. And `GET /admin/usage?month=YYYY-MM`, on the admin page and as `/admin/usage.csv`, is the metering: appends per tenant for the month, leaves in total, live tokens, the numbers any invoice rests on. A tenant needs none of that to leave with their evidence: `agent-custody log-export --log-url <url> --tenant <name> --token-env AGENT_CUSTODY_LOG_TOKEN --out <dir>` fetches, with their own token, every leaf hash (`GET /t/<name>/leaves?since=&limit=`, pages of up to ten thousand), the signed head, the published keys, the signed checkpoints, their own usage (`GET /t/<name>/usage?month=`), and the administrative actions on their tenant (`GET /t/<name>/audit`, into `audit.json`), checks that the head and every checkpoint verify against the keys and that the leaves fetched hash to their roots, and writes `log.jsonl` in the format `verify --log` and `audit --log` read, so the export verifies receipts with no server at all. It exits 1 and says what did not add up if anything does not. Both routes answer only to that tenant's token. [deploy/](../../deploy/README.md) runs the server, the signer, Postgres, and the checkpoints host as containers, and [deploy/witness/](../../deploy/witness/) the witness.
+Exactly one of the two. The bearer token comes from the named environment variable, never from the file, and a missing variable fails at startup. Add `"hashOnly": true` for any log run by someone else: the gateway then sends only the leaf hash, sha256 of the receipt envelope with the RFC 6962 prefix, so the log commits to the receipt without ever holding it, and the receipts with their arguments and results stay in `receiptsDir`. The verifier does not change; it hashes the envelope itself. A log that serves several tenants is reached at `<url>/t/<tenant>/`, and each of its tree heads names its log, which a verifier checks with `--log-id`. With a remote log the tree head in each receipt is signed by the log's key, and a verifier must be given that key with `--log-key`. An append that gets no answer within `timeoutMs` (default 10000) counts as unreachable and is retried like a server error, so a log that accepts connections and never answers cannot hold a call forever. If the log refuses a leaf, the receipt is not issued and the call returns an error to the agent. For an ordinary call the upstream action has already happened by then, and the error says so; a receipt that was never logged must not be handed out. For a tool named in `precommit` the order is reversed, below, and the action never happens. The reference log server is `node src/cli.ts log --file log.jsonl --key keys/log.key --port 8787 --token-env AGENT_CUSTODY_LOG_TOKEN [--log-id <id>] [--tenants tenants.json]`. It serves `POST /append` with `{leaf}` or `{leafHash}` (token required when one is configured), `GET /root?size=N`, `GET /consistency?old=M&new=N`, and `GET /head`; [verification.md](verification.md) says what each proves. `--log-id` writes that id into every tree head. `--tenants` names a JSON file, `{ "acme": { "file": "acme.jsonl", "tokenEnv": "ACME_TOKEN", "logId": "acme-eu" } }`, and each tenant is its own log at `/t/acme/…` with its own token and id; the default log stays at the root paths. With `--db-env DATABASE_URL` the server keeps its logs in Postgres instead of files, and needs the `pg` package beside it: leaves as hashes in one table keyed by tenant, one writer per tenant enforced with an advisory lock so a second instance is safe, tenants and their tokens in tables of their own with tokens stored only as hashes, and rate limits per token (50 appends a second, burst 100, a 64 KB body cap; a refused append answers 429 with `retry-after`, and the gateway's sink retries a few times). Tenants are managed with `log-admin --db-env DATABASE_URL`: `tenant add <id> [--log-id <id>]`, `token add <tenant> --label <text>` (the token is printed once), `token revoke <tenant> <hash-prefix>`, `tenant disable <id>`, `tenant plan <id> <free|team|enterprise>`, and `import --file log.jsonl [--tenant default]` to bring an existing file log in as hashes. Every tenant is on a plan, `free` unless moved: free allows ten thousand appends a calendar month, team a million, enterprise has no allowance. An append past the allowance is refused with 429, the numbers, and a `retry-after` that reaches the start of next month; the gateway behind it then withholds pre-committed calls, so a tenant out of quota never acts without evidence. The tenant's own `GET /t/<name>/usage` reports the plan and quota beside the month's appends. The tenant portal, `agent-custody portal --db-env DATABASE_URL --secret-env PORTAL_SECRET --public-url <log url> [--checkpoints-url <url>] [--portal-url <url>] [--stripe-key-env NAME --stripe-webhook-env NAME --stripe-price-team <price id>] [--trust-proxy]`, is the self-serve front of the same tables: a team registers with an email, a password (scrypt), and a tenant id and gets the tenant and its first key shown once with the welcome sheet; the dashboard shows appends against the plan, the tree size and root, the latest checkpoint, the log's URLs, keys, and the audit rows; keys are minted and revoked there, recorded as `portal:<email>`; the export command is on the page; and with the three Stripe variables the team plan is bought through Stripe Checkout, the signed webhook moving the plan (`stripe:<event>` in the audit trail) and the customer portal handling cancellation. Sessions are a signed cookie, `SameSite=Strict`, and every write needs a JSON body. The compose file runs it as the `portal` service at `PORTAL_HOST`. The root paths serve the tenant `default`, created on first start with `--log-id`, and `--token-env` still works for it. The key that signs tree heads can live in its own process: `agent-custody signer --key keys/log.key --port 8790 --token-env SIGNER_TOKEN` holds it and answers `POST /sign` with the shared secret and `GET /keys` to anyone; the log server then runs with `--signer-url http://signer:8790/ --signer-token-env SIGNER_TOKEN` instead of `--key`, and the process that faces the internet never holds the key. Either way the log serves its keys at `/.well-known/agent-custody-log.json`, current key first and retired keys (`--retired-key old.pub`) after it, so verifiers fetch and pin them with `verify --log-url` and `audit --log-url` rather than receiving a key file from the operator. With `--checkpoint-dir <dir>` the server publishes a signed checkpoint, every `--checkpoint-every` seconds (default 300), for each log whose tree has grown, and every `--checkpoint-heartbeat` seconds (default 21600, six hours) for a log that has not, so a quiet log's latest checkpoint is never more than six hours old and the monitor can tell quiet from stalled, as `<dir>/<tenant>/<treeSize>.json` and `latest.json`, and with a database also as rows; `GET /checkpoints?since=<size>` and `GET /t/<tenant>/checkpoints` list them. Serve the directory read-only from a second host, so the record of what the log signed does not depend on the log's API being up; a verifier who kept an earlier head audits against a later checkpoint with `audit --older <bundle> --newer <checkpoint> --log-url <url>`. With `--admin-token-env ADMIN_TOKEN` (Postgres only) the server also serves the operator's page at `/admin` and its API under `/admin/`: list and create tenants, mint a token that is shown once beside the tenant's welcome sheet, revoke tokens, disable tenants. Everything under `/admin`, the page included, needs the admin token: the browser asks for it (any user name, the token as the password) and an API client sends it as a bearer; a handful of wrong attempts from one address are throttled for a minute. Every change made there or with `log-admin` is recorded: who (the name entered at the browser prompt and the address, `bearer` for an API client, or the user and host for the command line), what (`tenant.add`, `tenant.disable`, `token.add`, `token.revoke`), which tenant, and the detail, never the token itself; the page shows it under Activity, `GET /admin/audit?tenant=&limit=` and `log-admin audit` list it, and a tenant reads their own rows at `GET /t/<name>/audit` with their token. Nothing else is stored by the page. Behind a reverse proxy, start the server with `--trust-proxy` so those per-address limits key on `X-Forwarded-For` instead of on the proxy's own address, and only there, since the header is otherwise the client's to forge. `--public-url` and `--checkpoints-url` fill the sheet in. The witness closes the last gap: `agent-custody witness --key witness.key --log-url <url> --checkpoints-url <url> --out <dir> [--tenant <name>]...` runs on a machine the log's operator does not control, fetches each watched log's latest checkpoint, verifies it against the log's published keys, proves with the log's consistency proof that it extends the last head the witness signed, and countersigns it into `<dir>/<tenant>/<size>.json` and `latest.json`; a checkpoint that does not extend, or a second history at the same size, gets `ALARM.json` instead. Its key document is `<dir>/.well-known/agent-custody-witness.json`. Serve `<dir>` from the witness's own host; verifiers add `--witness-url` (or `--witness-key`) to `audit`, and the newer head must then carry the witness's signature. Two more things an operator needs. `agent-custody log-check --log-url <url> --checkpoints-url <url> [--witness-url <url>] [--tenant <name>]... [--max-lag <seconds>]` is the outside monitor: it verifies the head against the published keys, that the latest checkpoint verifies and keeps up with the head, that the head extends the checkpoint, and, with a witness, that the witness has countersigned, keeps up, and has raised no alarm; it exits 1 on any failure, so cron or a scheduled workflow on a machine that is not the log's turns it into an alert. `GET /health` on the server is the liveness check for a load balancer. And `GET /admin/usage?month=YYYY-MM`, on the admin page and as `/admin/usage.csv`, is the metering: appends per tenant for the month, leaves in total, live tokens, the numbers any invoice rests on. A tenant needs none of that to leave with their evidence: `agent-custody log-export --log-url <url> --tenant <name> --token-env AGENT_CUSTODY_LOG_TOKEN --out <dir>` fetches, with their own token, every leaf hash (`GET /t/<name>/leaves?since=&limit=`, pages of up to ten thousand), the signed head, the published keys, the signed checkpoints, their own usage (`GET /t/<name>/usage?month=`), and the administrative actions on their tenant (`GET /t/<name>/audit`, into `audit.json`), checks that the head and every checkpoint verify against the keys and that the leaves fetched hash to their roots, and writes `log.jsonl` in the format `verify --log` and `audit --log` read, so the export verifies receipts with no server at all. It exits 1 and says what did not add up if anything does not. Both routes answer only to that tenant's token. [deploy/](../../deploy/README.md) runs the server, the signer, Postgres, and the checkpoints host as containers, and [deploy/witness/](../../deploy/witness/) the witness.
 
 `otel`, optional in both the gateway and SDK configs, sends every receipt to the collector you already run as one span over OTLP/HTTP, after the receipt is issued: `"otel": { "url": "http://localhost:4318", "headersEnv": { "x-api-key": "OTEL_KEY" }, "serviceName": "support-agents" }`. The span's trace id is the receipt id, its attributes carry the tool, agent, principal, execution status, policy decision, and log position, and its status is an error only when the upstream failed or errored, since a denial is the policy working. Export is best effort: a collector that is down or refuses costs a line on stderr, never a receipt. Tutorial 18 shows it against a stand-in collector.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-custody/receipts",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Chain of custody for AI agents: signed, independently verifiable receipts for tool calls. MCP gateway + Cedar policy + Merkle transparency log",
   "license": "Apache-2.0",
   "repository": {