@agentguard-run/spend 0.14.0 → 0.15.0

package/dist/workflow/receipt.js

@@ -11,6 +11,8 @@ exports.verifyReceipt = verifyReceipt;
 exports.roundUsd = roundUsd;
 const crypto_1 = require("crypto");
 const decision_log_1 = require("../decision-log");
+const ED25519_PKCS8_SEED_PREFIX = Buffer.from('302e020100300506032b657004220420', 'hex');
+const ED25519_SPKI_PUBLIC_PREFIX = Buffer.from('302a300506032b6570032100', 'hex');
 function canonicalJSONStringify(value) {
     return (0, decision_log_1.canonicalJson)(value);
 }
@@ -20,25 +22,26 @@ function sha256(input) {
 function workflowReceiptId(prefix = 'ag_r') {
     return `${prefix}_${(0, crypto_1.randomUUID)().replace(/-/g, '').slice(0, 16)}`;
 }
-function signReceiptPayload(payload) {
-    return (0, decision_log_1.sha256Hex)((0, decision_log_1.canonicalJson)(payload));
+async function signReceiptPayload(payload, signingKeys) {
+    const resolved = resolveWorkflowSigningKey(signingKeys);
+    const canonical = (0, decision_log_1.canonicalJson)(payload);
+    return {
+        signature: (0, crypto_1.sign)(null, Buffer.from(canonical, 'utf8'), resolved.privateKey).toString('hex'),
+        public_key_fingerprint: resolved.publicKeyFingerprint,
+        public_key_hex: resolved.publicKeyHex,
+    };
 }
-function buildReceipt(args) {
+async function buildReceipt(args) {
     if (!Number.isFinite(args.cost_usd) || args.cost_usd < 0) {
         throw new Error('Workflow receipt cost must be a finite non-negative number');
     }
-    const publicKeyFingerprint = (0, crypto_1.createHash)('sha256')
-        .update(args.workflow_id || args.user_id || 'agentguard-workflow')
-        .digest('hex')
-        .slice(0, 16);
     const unsigned = {
-        receipt_id: workflowReceiptId(args.is_checkpoint ? 'ag_cp' : 'ag_r'),
+        receipt_id: args.receipt_id ?? workflowReceiptId(args.is_checkpoint ? 'ag_cp' : 'ag_r'),
         schema_version: 2,
         outcome_name: args.outcome_name,
         user_id: args.user_id,
         cost_usd: roundUsd(args.cost_usd),
-        signed_at: new Date().toISOString(),
-        public_key_fingerprint: publicKeyFingerprint,
+        signed_at: args.signed_at ?? new Date().toISOString(),
         workflow_id: args.workflow_id,
         parent_receipt_id: args.parent_receipt_id,
         chain_validation_hash: args.chain_validation_hash,
@@ -50,27 +53,111 @@ function buildReceipt(args) {
         receipt_type: args.receipt_type ?? (args.is_checkpoint ? 'checkpoint' : 'outcome'),
         cancelled_reason: args.cancelled_reason ?? null,
     };
-    return { ...unsigned, signature: signReceiptPayload(unsigned) };
+    return { ...unsigned, ...(await signReceiptPayload(unsigned, args.signingKeys)) };
 }
-function buildReceiptV3(args) {
-    const v2 = buildReceipt(args);
+async function buildReceiptV3(args) {
+    const v2 = await buildReceipt(args);
     const unsigned = {
-        ...v2,
+        ...stripReceiptSignature(v2),
         schema_version: 3,
         provenance: args.provenance,
     };
-    const { signature: _oldSignature, ...withoutSignature } = unsigned;
-    return { ...withoutSignature, signature: signReceiptPayload(withoutSignature) };
+    return { ...unsigned, ...(await signReceiptPayload(unsigned, args.signingKeys)) };
 }
-function verifyAnyReceipt(receipt) {
-    const { signature: _signature, ...unsigned } = receipt;
-    return signReceiptPayload(unsigned) === receipt.signature;
+function verifyAnyReceipt(receipt, options = {}) {
+    return verifyReceipt(receipt, options);
 }
-function verifyReceipt(receipt) {
-    const { signature: _signature, ...unsigned } = receipt;
-    return signReceiptPayload(unsigned) === receipt.signature;
+function verifyReceipt(receipt, options = {}) {
+    const { signature, public_key_hex: embeddedPublicKeyHex, public_key_fingerprint: fingerprint, ...unsigned } = receipt;
+    if (!signature || !/^[0-9a-fA-F]{128}$/.test(String(signature)))
+        return false;
+    const publicKeyHex = String(options.publicKeyHex || embeddedPublicKeyHex || '').toLowerCase();
+    if (!/^[0-9a-f]{64}$/.test(publicKeyHex))
+        return false;
+    const allowed = normalizeAllowedSignerKeys(options.allowedSignerPublicKeysHex);
+    if (allowed && !allowed.has(publicKeyHex))
+        return false;
+    const publicKeyRaw = Buffer.from(publicKeyHex, 'hex');
+    if (fingerprint && computePublicKeyFingerprint(publicKeyRaw) !== String(fingerprint))
+        return false;
+    const publicKey = (0, crypto_1.createPublicKey)({ key: Buffer.concat([ED25519_SPKI_PUBLIC_PREFIX, publicKeyRaw]), format: 'der', type: 'spki' });
+    try {
+        return (0, crypto_1.verify)(null, Buffer.from((0, decision_log_1.canonicalJson)(unsigned), 'utf8'), publicKey, Buffer.from(signature, 'hex'));
+    }
+    catch {
+        return false;
+    }
 }
 function roundUsd(value) {
     return Math.round(value * 1_000_000) / 1_000_000;
 }
+function stripReceiptSignature(receipt) {
+    const { signature: _signature, public_key_fingerprint: _fingerprint, public_key_hex: _publicKeyHex, ...unsigned } = receipt;
+    return unsigned;
+}
+function resolveWorkflowSigningKey(signingKeys) {
+    if (signingKeys)
+        return keyFromSeed(signingKeys.privateKey, signingKeys.publicKey);
+    const raw = process.env.AGENTGUARD_SIGNING_KEY_ED25519_PRIVATE;
+    if (!raw)
+        throw new Error('Workflow receipt signing key is required');
+    return keyFromEnvironment(raw);
+}
+function keyFromSeed(seed, expectedPublicKey) {
+    if (seed.length !== 32)
+        throw new Error(`Ed25519 private seed must be 32 bytes, got ${seed.length} bytes`);
+    const privateKey = (0, crypto_1.createPrivateKey)({ key: Buffer.concat([ED25519_PKCS8_SEED_PREFIX, Buffer.from(seed)]), format: 'der', type: 'pkcs8' });
+    const publicKeyRaw = rawPublicKeyFromPrivate(privateKey);
+    if (expectedPublicKey && Buffer.compare(publicKeyRaw, Buffer.from(expectedPublicKey)) !== 0) {
+        throw new Error('Workflow receipt public key does not match private seed');
+    }
+    return resolved(privateKey, publicKeyRaw);
+}
+function keyFromEnvironment(raw) {
+    const value = raw.trim();
+    let privateKey;
+    if (value.startsWith('-----BEGIN')) {
+        privateKey = (0, crypto_1.createPrivateKey)(value);
+    }
+    else if (value.startsWith('{')) {
+        privateKey = (0, crypto_1.createPrivateKey)({ key: JSON.parse(value), format: 'jwk' });
+    }
+    else {
+        const clean = value.replace(/^0x/, '');
+        let bytes;
+        if (/^[0-9a-fA-F]+$/.test(clean) && clean.length % 2 === 0)
+            bytes = Buffer.from(clean, 'hex');
+        else
+            bytes = Buffer.from(value, 'base64');
+        privateKey = bytes.length === 32
+            ? (0, crypto_1.createPrivateKey)({ key: Buffer.concat([ED25519_PKCS8_SEED_PREFIX, bytes]), format: 'der', type: 'pkcs8' })
+            : (0, crypto_1.createPrivateKey)({ key: bytes, format: 'der', type: 'pkcs8' });
+    }
+    return resolved(privateKey, rawPublicKeyFromPrivate(privateKey));
+}
+function rawPublicKeyFromPrivate(privateKey) {
+    const der = (0, crypto_1.createPublicKey)(privateKey).export({ format: 'der', type: 'spki' });
+    return Buffer.from(der).subarray(-32);
+}
+function resolved(privateKey, publicKeyRaw) {
+    return {
+        privateKey,
+        publicKeyRaw,
+        publicKeyHex: publicKeyRaw.toString('hex'),
+        publicKeyFingerprint: computePublicKeyFingerprint(publicKeyRaw),
+    };
+}
+function computePublicKeyFingerprint(publicKeyRaw) {
+    return (0, crypto_1.createHash)('sha256').update(publicKeyRaw).digest('hex').slice(0, 16);
+}
+function normalizeAllowedSignerKeys(explicit) {
+    const values = [...(explicit ?? [])];
+    const envAllowed = process.env.AGENTGUARD_ALLOWED_SIGNER_PUBKEYS_HEX;
+    if (envAllowed)
+        values.push(...envAllowed.split(','));
+    if (values.length === 0)
+        return null;
+    const clean = values.map((value) => String(value).trim().toLowerCase()).filter((value) => /^[0-9a-f]{64}$/.test(value));
+    return new Set(clean);
+}
 //# sourceMappingURL=receipt.js.map

package/dist/workflow/receipt.js.map

@@ -1 +1 @@
-{"version":3,"file":"receipt.js","sourceRoot":"","sources":["../../src/workflow/receipt.ts"],"names":[],"mappings":";;AAKA,wDAEC;AAED,wBAEC;AAED,8CAEC;AAED,gDAEC;AAED,oCA2CC;AAID,wCAwBC;AAED,4CAGC;AAED,sCAGC;AAED,4BAEC;AA1GD,mCAAgD;AAChD,kDAA2D;AAI3D,SAAgB,sBAAsB,CAAC,KAAc;IACnD,OAAO,IAAA,4BAAa,EAAC,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,SAAgB,MAAM,CAAC,KAAa;IAClC,OAAO,IAAA,wBAAS,EAAC,KAAK,CAAC,CAAC;AAC1B,CAAC;AAED,SAAgB,iBAAiB,CAAC,MAAM,GAAG,MAAM;IAC/C,OAAO,GAAG,MAAM,IAAI,IAAA,mBAAU,GAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AACpE,CAAC;AAED,SAAgB,kBAAkB,CAAC,OAAgB;IACjD,OAAO,IAAA,wBAAS,EAAC,IAAA,4BAAa,EAAC,OAAO,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,SAAgB,YAAY,CAAC,IAc5B;IACC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,oBAAoB,GAAG,IAAA,mBAAU,EAAC,QAAQ,CAAC;SAC9C,MAAM,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,OAAO,IAAI,qBAAqB,CAAC;SACjE,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChB,MAAM,QAAQ,GAAiC;QAC7C,UAAU,EAAE,iBAAiB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;QACpE,cAAc,EAAE,CAAC;QACjB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC;QACjC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,sBAAsB,EAAE,oBAAoB;QAC5C,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;QACjD,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;QACrD,gCAAgC,EAC9B,IAAI,CAAC,gCAAgC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,gCAAgC,CAAC;QACzG,aAAa,EAAE,IAAI,CAAC,aAAa,KAAK,IAAI;QAC1C,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,IAAI,IAAI;QAC/C,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,IAAI,IAAI;QAC/C,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;QAClF,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,IAAI,IAAI;KAChD,CAAC;IACF,OAAO,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;AAClE,CAAC;AAID,SAAgB,cAAc,CAAC,IAe9B;IACC,MAAM,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,QAAQ,GAAiC;QAC7C,GAAG,EAAE;QACL,cAAc,EAAE,CAAC;QACjB,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC;IACF,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,gBAAgB,EAAE,GAAG,QAAiE,CAAC;IAC5H,OAAO,EAAE,GAAG,gBAAgB,EAAE,SAAS,EAAE,kBAAkB,CAAC,gBAAgB,CAAC,EAAE,CAAC;AAClF,CAAC;AAED,SAAgB,gBAAgB,CAAC,OAA8B;IAC7D,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,QAAQ,EAAE,GAAG,OAAO,CAAC;IACvD,OAAO,kBAAkB,CAAC,QAAQ,CAAC,KAAK,OAAO,CAAC,SAAS,CAAC;AAC5D,CAAC;AAED,SAAgB,aAAa,CAAC,OAAkB;IAC9C,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,QAAQ,EAAE,GAAG,OAAO,CAAC;IACvD,OAAO,kBAAkB,CAAC,QAAQ,CAAC,KAAK,OAAO,CAAC,SAAS,CAAC;AAC5D,CAAC;AAED,SAAgB,QAAQ,CAAC,KAAa;IACpC,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,SAAS,CAAC,GAAG,SAAS,CAAC;AACnD,CAAC"}
+{"version":3,"file":"receipt.js","sourceRoot":"","sources":["../../src/workflow/receipt.ts"],"names":[],"mappings":";;AAsBA,wDAEC;AAED,wBAEC;AAED,8CAEC;AAED,gDAYC;AAED,oCAyCC;AAED,wCA0BC;AAED,4CAEC;AAED,sCAeC;AAED,4BAEC;AA9ID,mCAA+I;AAC/I,kDAA2D;AAI3D,MAAM,yBAAyB,GAAG,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE,KAAK,CAAC,CAAC;AACzF,MAAM,0BAA0B,GAAG,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAC;AAgBlF,SAAgB,sBAAsB,CAAC,KAAc;IACnD,OAAO,IAAA,4BAAa,EAAC,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,SAAgB,MAAM,CAAC,KAAa;IAClC,OAAO,IAAA,wBAAS,EAAC,KAAK,CAAC,CAAC;AAC1B,CAAC;AAED,SAAgB,iBAAiB,CAAC,MAAM,GAAG,MAAM;IAC/C,OAAO,GAAG,MAAM,IAAI,IAAA,mBAAU,GAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AACpE,CAAC;AAEM,KAAK,UAAU,kBAAkB,CAAC,OAAgB,EAAE,WAAiC;IAK1F,MAAM,QAAQ,GAAG,yBAAyB,CAAC,WAAW,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,IAAA,4BAAa,EAAC,OAAO,CAAC,CAAC;IACzC,OAAO;QACL,SAAS,EAAE,IAAA,aAAU,EAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAChG,sBAAsB,EAAE,QAAQ,CAAC,oBAAoB;QACrD,cAAc,EAAE,QAAQ,CAAC,YAAY;KACtC,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,YAAY,CAAC,IAiBlC;IACC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,QAAQ,GAA+E;QAC3F,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,iBAAiB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;QACvF,cAAc,EAAE,CAAC;QACjB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC;QACjC,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACrD,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;QACjD,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;QACrD,gCAAgC,EAC9B,IAAI,CAAC,gCAAgC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,gCAAgC,CAAC;QACzG,aAAa,EAAE,IAAI,CAAC,aAAa,KAAK,IAAI;QAC1C,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,IAAI,IAAI;QAC/C,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,IAAI,IAAI;QAC/C,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;QAClF,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,IAAI,IAAI;KAChD,CAAC;IACF,OAAO,EAAE,GAAG,QAAQ,EAAE,GAAG,CAAC,MAAM,kBAAkB,CAAC,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;AACpF,CAAC;AAEM,KAAK,UAAU,cAAc,CAAC,IAkBpC;IACC,MAAM,EAAE,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,QAAQ,GAA+E;QAC3F,GAAG,qBAAqB,CAAC,EAAE,CAAC;QAC5B,cAAc,EAAE,CAAC;QACjB,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC;IACF,OAAO,EAAE,GAAG,QAAQ,EAAE,GAAG,CAAC,MAAM,kBAAkB,CAAC,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;AACpF,CAAC;AAED,SAAgB,gBAAgB,CAAC,OAA8B,EAAE,UAAwC,EAAE;IACzG,OAAO,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AACzC,CAAC;AAED,SAAgB,aAAa,CAAC,OAA8B,EAAE,UAAwC,EAAE;IACtG,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,WAAW,EAAE,GAAG,QAAQ,EAAE,GAAG,OAAkD,CAAC;IACjK,IAAI,CAAC,SAAS,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9E,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,IAAI,oBAAoB,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9F,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC;QAAE,OAAO,KAAK,CAAC;IACvD,MAAM,OAAO,GAAG,0BAA0B,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAC/E,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QAAE,OAAO,KAAK,CAAC;IACxD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IACtD,IAAI,WAAW,IAAI,2BAA2B,CAAC,YAAY,CAAC,KAAK,MAAM,CAAC,WAAW,CAAC;QAAE,OAAO,KAAK,CAAC;IACnG,MAAM,SAAS,GAAG,IAAA,wBAAe,EAAC,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,0BAA0B,EAAE,YAAY,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IACnI,IAAI,CAAC;QACH,OAAO,IAAA,eAAY,EAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAA,4BAAa,EAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;IACpH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAgB,QAAQ,CAAC,KAAa;IACpC,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,SAAS,CAAC,GAAG,SAAS,CAAC;AACnD,CAAC;AAED,SAAS,qBAAqB,CAAC,OAAkB;IAC/C,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,sBAAsB,EAAE,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,GAAG,QAAQ,EAAE,GAAG,OAAO,CAAC;IAC5H,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,yBAAyB,CAAC,WAAiC;IAClE,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC,WAAW,CAAC,UAAU,EAAE,WAAW,CAAC,SAAS,CAAC,CAAC;IACnF,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,sCAAsC,CAAC;IAC/D,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IACtE,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,WAAW,CAAC,IAAgB,EAAE,iBAA8B;IACnE,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,IAAI,CAAC,MAAM,QAAQ,CAAC,CAAC;IAC3G,MAAM,UAAU,GAAG,IAAA,yBAAgB,EAAC,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,yBAAyB,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAC1I,MAAM,YAAY,GAAG,uBAAuB,CAAC,UAAU,CAAC,CAAC;IACzD,IAAI,iBAAiB,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5F,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,QAAQ,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAW;IACrC,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACzB,IAAI,UAAqB,CAAC;IAC1B,IAAI,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACnC,UAAU,GAAG,IAAA,yBAAgB,EAAC,KAAK,CAAC,CAAC;IACvC,CAAC;SAAM,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,UAAU,GAAG,IAAA,yBAAgB,EAAC,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3E,CAAC;SAAM,CAAC;QACN,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACvC,IAAI,KAAa,CAAC;QAClB,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;YAAE,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;;YACzF,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC1C,UAAU,GAAG,KAAK,CAAC,MAAM,KAAK,EAAE;YAC9B,CAAC,CAAC,IAAA,yBAAgB,EAAC,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;YAC5G,CAAC,CAAC,IAAA,yBAAgB,EAAC,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,QAAQ,CAAC,UAAU,EAAE,uBAAuB,CAAC,UAAU,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,uBAAuB,CAAC,UAAqB;IACpD,MAAM,GAAG,GAAG,IAAA,wBAAe,EAAC,UAAU,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAChF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,QAAQ,CAAC,UAAqB,EAAE,YAAoB;IAC3D,OAAO;QACL,UAAU;QACV,YAAY;QACZ,YAAY,EAAE,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC1C,oBAAoB,EAAE,2BAA2B,CAAC,YAAY,CAAC;KAChE,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B,CAAC,YAAoB;IACvD,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,0BAA0B,CAAC,QAAmB;IACrD,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC;IACrC,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC;IACrE,IAAI,UAAU;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IACtD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACxH,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;AACxB,CAAC"}

package/dist/workflow/types.d.ts

@@ -12,6 +12,12 @@ export interface WorkflowConfig {
     user_id?: string;
     api_base_url?: string;
     license_key?: string;
+    signingKeys?: {
+        /** 32-byte Ed25519 secret seed. */
+        privateKey: Uint8Array;
+        /** 32-byte Ed25519 public key. */
+        publicKey: Uint8Array;
+    };
     post_json?: (url: string, body: unknown, headers: Record<string, string>) => Promise<unknown>;
     get_json?: (url: string, headers: Record<string, string>) => Promise<unknown>;
 }
@@ -34,6 +40,7 @@ export interface ReceiptV2 {
     signed_at: string;
     signature: string;
     public_key_fingerprint: string;
+    public_key_hex: string;
     workflow_id: string | null;
     parent_receipt_id: string | null;
     chain_validation_hash: string | null;

package/dist/workflow/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/workflow/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC1D,MAAM,MAAM,aAAa,GACrB,QAAQ,GACR,QAAQ,GACR,WAAW,GACX,WAAW,GACX,eAAe,GACf,iBAAiB,CAAC;AAEtB,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,OAAO,GAAG,QAAQ,GAAG,IAAI,CAAC;AAEpE,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,MAAM,CAAC;IACvB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC;IACrD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9F,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CAC/E;AAED,MAAM,WAAW,uBAAuB;IACtC,SAAS,EAAE,OAAO,CAAC;IACnB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,gBAAgB,EAAE,eAAe,CAAC;IAClC,uBAAuB,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED,MAAM,WAAW,SAAS;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,CAAC,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,uBAAuB,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,gCAAgC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChD,aAAa,EAAE,OAAO,CAAC;IACvB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,gBAAgB,EAAE,uBAAuB,GAAG,IAAI,CAAC;IACjD,YAAY,CAAC,EAAE,SAAS,GAAG,YAAY,GAAG,QAAQ,GAAG,SAAS,GAAG,WAAW,CAAC;IAC7E,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,iBAAkB,SAAQ,SAAS;IAClD,aAAa,EAAE,IAAI,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,aAAa,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,eAAe,EAAE,MAAM,CAAC;IACxB,qBAAqB,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,IAAI,CAAC;CACV;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,KAAK,CAAC;IACV,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,mBAAmB,GAAG,qBAAqB,GAAG,2BAA2B,CAAC;CACnF;AAED,MAAM,MAAM,qBAAqB,GAAG,gBAAgB,GAAG,iBAAiB,CAAC;AAGzE,MAAM,WAAW,SAAU,SAAQ,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC;IAClE,cAAc,EAAE,CAAC,CAAC;IAClB,UAAU,EAAE,eAAe,CAAC;CAC7B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/workflow/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC1D,MAAM,MAAM,aAAa,GACrB,QAAQ,GACR,QAAQ,GACR,WAAW,GACX,WAAW,GACX,eAAe,GACf,iBAAiB,CAAC;AAEtB,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,OAAO,GAAG,QAAQ,GAAG,IAAI,CAAC;AAEpE,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,MAAM,CAAC;IACvB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC;IACrD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE;QACZ,mCAAmC;QACnC,UAAU,EAAE,UAAU,CAAC;QACvB,kCAAkC;QAClC,SAAS,EAAE,UAAU,CAAC;KACvB,CAAC;IACF,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9F,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CAC/E;AAED,MAAM,WAAW,uBAAuB;IACtC,SAAS,EAAE,OAAO,CAAC;IACnB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,gBAAgB,EAAE,eAAe,CAAC;IAClC,uBAAuB,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED,MAAM,WAAW,SAAS;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,CAAC,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,uBAAuB,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,gCAAgC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChD,aAAa,EAAE,OAAO,CAAC;IACvB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,gBAAgB,EAAE,uBAAuB,GAAG,IAAI,CAAC;IACjD,YAAY,CAAC,EAAE,SAAS,GAAG,YAAY,GAAG,QAAQ,GAAG,SAAS,GAAG,WAAW,CAAC;IAC7E,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,iBAAkB,SAAQ,SAAS;IAClD,aAAa,EAAE,IAAI,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,aAAa,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,eAAe,EAAE,MAAM,CAAC;IACxB,qBAAqB,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,IAAI,CAAC;CACV;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,KAAK,CAAC;IACV,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,mBAAmB,GAAG,qBAAqB,GAAG,2BAA2B,CAAC;CACnF;AAED,MAAM,MAAM,qBAAqB,GAAG,gBAAgB,GAAG,iBAAiB,CAAC;AAGzE,MAAM,WAAW,SAAU,SAAQ,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC;IAClE,cAAc,EAAE,CAAC,CAAC;IAClB,UAAU,EAAE,eAAe,CAAC;CAC7B"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentguard-run/spend",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "description": "All terminology and labels used in AgentGuard materials are descriptive of software functionality only, not legal definitions or guarantees of compliance. Terms like receipt, audit log, evidence, audit trail, and attestation refer solely to cryptographically-signed records produced by the software. Full functional-use disclaimer in README.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -109,6 +109,11 @@
       "types": "./dist/frameworks/openrouter.d.ts",
       "require": "./dist/frameworks/openrouter.js",
       "default": "./dist/frameworks/openrouter.js"
+    },
+    "./operating-pack": {
+      "types": "./dist/operating-pack.d.ts",
+      "require": "./dist/operating-pack.js",
+      "default": "./dist/operating-pack.js"
     }
   },
   "bin": {
@@ -142,7 +147,8 @@
     "src/byo",
     "src/cli/byo.ts",
     "docs/patents/CLAIM_MAPPING.md",
-    "src/frameworks"
+    "src/frameworks",
+    "src/operating-pack.ts"
   ],
   "scripts": {
     "build": "tsc",

package/src/operating-pack.ts

@@ -0,0 +1,397 @@
+import { randomUUID } from 'crypto';
+import { canonicalJson, computeSignerFingerprint, sha256Hex } from './decision-log';
+import { signDagNode, verifyReceiptDag, type ReceiptCapabilityLevel, type ReceiptDagEnvelope, type ReceiptDagNode } from './receipts/dag';
+import type { SpendDecision } from './types';
+
+export type OperatingPackVertical = 'law';
+export type OperatingPackActionKind =
+  | 'intake'
+  | 'conflict_check'
+  | 'document_summary'
+  | 'billing_reconciliation'
+  | 'client_update_draft'
+  | 'send_client_email'
+  | 'trust_account_action';
+
+export interface OperatingPackSigningKeys {
+  privateKey: Uint8Array;
+  publicKey: Uint8Array;
+}
+
+export interface OperatingPackReviewerCascadeOptions {
+  enabled?: boolean;
+  drafterModel?: string;
+  reviewerModel?: string;
+  triggerThreshold?: number;
+  drafterMaxCostCents?: number;
+  reviewerMaxCostCents?: number;
+}
+
+export interface OperatingPackOptions {
+  vertical: OperatingPackVertical;
+  workflowId: string;
+  signingKeys: OperatingPackSigningKeys;
+  approvedCapabilities?: ReceiptCapabilityLevel[];
+  reviewerCascade?: OperatingPackReviewerCascadeOptions;
+  maxWorkflowCostCents?: number;
+}
+
+export interface OperatingPackAction {
+  actionId: string;
+  kind: OperatingPackActionKind;
+  capability?: ReceiptCapabilityLevel;
+  highRisk?: boolean;
+  highRiskClassifierScore?: number;
+  keywordRisk?: boolean;
+  modelIds?: string[];
+  tokenCounts?: { inputTokens?: number; outputTokens?: number };
+  totalCostCents?: number;
+  metadata?: Record<string, unknown>;
+  reviewerVerdict?: 'drafter_only' | 'review_required' | 'approved' | 'rejected';
+}
+
+export interface OperatingPackGuardResult {
+  allowed: boolean;
+  reason: string;
+  node: ReceiptDagNode;
+  dag: ReceiptDagEnvelope;
+  reviewerCascadeTriggered: boolean;
+  spentCents: number;
+}
+
+export interface OperatingPackSkillTemplate {
+  slug: string;
+  title: string;
+  capability: ReceiptCapabilityLevel;
+  reviewerCascade: boolean;
+  markdown: string;
+}
+
+export interface OperatingPackDefinition {
+  vertical: OperatingPackVertical;
+  title: string;
+  counselReviewPending: boolean;
+  agentsMd: string;
+  skills: Record<string, OperatingPackSkillTemplate>;
+  sourceOfTruth: string;
+  checklist: string[];
+  capabilityTable: Array<{ capability: ReceiptCapabilityLevel; use: string; blockedExamples: string[] }>;
+}
+
+const CAPABILITY_RANK: Record<ReceiptCapabilityLevel, number> = {
+  READ_ONLY: 0,
+  TRANSACT: 1,
+  ADMIN: 2,
+  ORCHESTRATE: 3,
+};
+
+const DATA_PLANE_KEYS = /^(title|summary|prompt|completion|content|messages|input|output|text|raw|source|notes|draft|body|transcript|document|client_content|clientContent|matter_description|email_body|file_text)$/i;
+const SAFE_METADATA_KEYS = new Set([
+  'action_id',
+  'action_kind',
+  'billing_code',
+  'capability',
+  'cost_cents',
+  'duration_ms',
+  'event',
+  'jurisdiction',
+  'matter_hash',
+  'model',
+  'model_id',
+  'outcome',
+  'practice_area',
+  'review_status',
+  'risk_score',
+  'token_count',
+  'workflow_id',
+]);
+
+export const LAW_OPERATING_PACK: OperatingPackDefinition = {
+  vertical: 'law',
+  title: 'AgentGuard Law Operating Pack',
+  counselReviewPending: true,
+  agentsMd: `# AgentGuard Law Operating Pack\n\nCounsel review pending: this file is operating scaffolding for legal workflows and should be reviewed by your counsel before production use.\n\n## Guardrails\n\n- ABA Model Rule 1.6: protect client information. Do not paste client content into tools that are not approved for the matter.\n- Conflicts: run conflict checks before intake work advances to drafting or client communication.\n- No unauthorized practice of law: agents prepare drafts and metadata. A licensed attorney reviews legal judgment.\n- Draft before send: client-facing emails and filings are drafts until a human approves dispatch.\n- Retention: keep signed AgentGuard receipts and matter metadata according to firm policy. Do not store prompt or completion content in receipts.\n- Trust account actions: trust transfers, disbursement instructions, and ledger changes require ADMIN capability.\n\n## Capability Map\n\n- READ_ONLY: intake classification, conflict pre-checks, document summaries, billing reconciliation previews.\n- TRANSACT: create a client-update draft or prepare a dispatch packet.\n- ADMIN: trust-account actions, retention policy changes, capability changes.\n- ORCHESTRATE: assign or revoke agent work across matters.\n`,
+  skills: {
+    intake: {
+      slug: 'intake',
+      title: 'Intake Skill',
+      capability: 'READ_ONLY',
+      reviewerCascade: false,
+      markdown: `# Intake Skill\n\nPurpose: classify a new inquiry using matter metadata only.\n\nInputs: jurisdiction, practice area, referral source, matter hash, urgency flag.\n\nRules:\n- Do not ask the model to decide representation.\n- Do not place client narrative text in AgentGuard receipts.\n- Output a routing label, missing-information checklist, and conflict-check reminder.\n`,
+    },
+    'conflict-check': {
+      slug: 'conflict-check',
+      title: 'Conflict Check Skill',
+      capability: 'READ_ONLY',
+      reviewerCascade: true,
+      markdown: `# Conflict Check Skill\n\nPurpose: prepare a conflict pre-check packet from firm metadata.\n\nInputs: matter hash, party hashes, jurisdiction, practice area, intake source.\n\nRules:\n- Match on firm-approved metadata systems only.\n- Refuse if party identity data is incomplete.\n- Reviewer Cascade triggers when a possible match, former-client marker, adverse-party marker, or trust-account marker appears.\n`,
+    },
+    'document-summary': {
+      slug: 'document-summary',
+      title: 'Document Summary Skill',
+      capability: 'READ_ONLY',
+      reviewerCascade: true,
+      markdown: `# Document Summary Skill\n\nPurpose: produce a working summary for attorney review.\n\nInputs: document hash, document type, jurisdiction, matter hash, token counts.\n\nRules:\n- Cite document sections or refuse when citations are unavailable.\n- Mark all output as draft work product for attorney review.\n- Reviewer Cascade triggers for settlement, privilege, indemnity, non-compete, waiver, trust, sanctions, or deadline markers.\n`,
+    },
+    'billing-reconciliation': {
+      slug: 'billing-reconciliation',
+      title: 'Billing Reconciliation Skill',
+      capability: 'READ_ONLY',
+      reviewerCascade: false,
+      markdown: `# Billing Reconciliation Skill\n\nPurpose: compare time-entry metadata against matter budgets and billing codes.\n\nInputs: billing code, matter hash, time-entry hashes, amount cents, policy cap.\n\nRules:\n- Do not move money.\n- Do not alter trust ledgers.\n- Escalate to ADMIN before any trust-account action.\n`,
+    },
+    'client-update-draft': {
+      slug: 'client-update-draft',
+      title: 'Client Update Draft Skill',
+      capability: 'TRANSACT',
+      reviewerCascade: true,
+      markdown: `# Client Update Draft Skill\n\nPurpose: draft a client update for attorney review.\n\nInputs: matter hash, milestone label, jurisdiction, practice area, cited record hashes.\n\nRules:\n- Draft before send. Never dispatch directly.\n- Include a review status field before any client-facing use.\n- Reviewer Cascade triggers for deadline, settlement, privilege, fee, trust, or adverse-party markers.\n`,
+    },
+  },
+  sourceOfTruth: `# Source Of Truth Layout\n\nUse this local layout inside the firm environment.\n\n- matters/<matter-hash>/metadata.json\n- matters/<matter-hash>/parties.json\n- matters/<matter-hash>/documents/<document-hash>.json\n- matters/<matter-hash>/receipts/*.json\n- policies/agentguard-policy.yaml\n- logs/agentguard-decisions.ndjson\n\nAgentGuard receipts store metadata, hashes, costs, model identifiers, capability decisions, and signatures. They do not store prompt or completion content.\n`,
+  checklist: [
+    'Review AGENTS.md with firm counsel before production use.',
+    'Define matter hash and party hash conventions.',
+    'Map each skill to a capability tier.',
+    'Enable Reviewer Cascade for client updates, conflicts, and document summaries.',
+    'Set a per-matter and per-day spend cap.',
+    'Store signed receipts with matter metadata only.',
+    'Test trust-account actions with ADMIN capability denied by default.',
+  ],
+  capabilityTable: [
+    { capability: 'READ_ONLY', use: 'Classify, summarize, reconcile, and prepare metadata-only packets.', blockedExamples: ['Sending client email', 'Trust ledger update'] },
+    { capability: 'TRANSACT', use: 'Create dispatch-ready drafts that still require human approval.', blockedExamples: ['Trust transfer', 'Policy change'] },
+    { capability: 'ADMIN', use: 'Trust-account actions, retention changes, and capability grants.', blockedExamples: ['Unreviewed client dispatch'] },
+    { capability: 'ORCHESTRATE', use: 'Assign, revoke, or coordinate multiple matter agents.', blockedExamples: ['Bypassing capability review'] },
+  ],
+};
+
+export function createOperatingPackEnvelope(opts: OperatingPackOptions): OperatingPackEnvelope {
+  return new OperatingPackEnvelope(opts);
+}
+
+export class OperatingPackEnvelope {
+  private readonly nodes: ReceiptDagNode[] = [];
+  private readonly approvedCapabilities: Set<ReceiptCapabilityLevel>;
+  private spentCents = 0;
+
+  constructor(private readonly opts: OperatingPackOptions) {
+    if (opts.vertical !== 'law') throw new Error('Only the law operating pack is bundled in this release');
+    if (!safeLabel(opts.workflowId)) throw new Error('Operating Pack workflowId is required');
+    this.approvedCapabilities = new Set(opts.approvedCapabilities ?? ['READ_ONLY']);
+  }
+
+  getPack(): OperatingPackDefinition {
+    return LAW_OPERATING_PACK;
+  }
+
+  async guardAction(input: OperatingPackAction): Promise<OperatingPackGuardResult> {
+    assertAction(input);
+    assertMetadataOnly(input.metadata ?? {});
+    const capability = input.capability ?? capabilityForAction(input.kind);
+    const cost = safeNonNegativeInteger(input.totalCostCents);
+    const spendExceeded = Number.isSafeInteger(this.opts.maxWorkflowCostCents) && this.opts.maxWorkflowCostCents! >= 0 && this.spentCents + cost > this.opts.maxWorkflowCostCents!;
+    const capabilityAllowed = this.hasCapability(capability);
+    const allowed = capabilityAllowed && !spendExceeded;
+    const reason = !capabilityAllowed ? `Capability ${capability} is required for ${input.kind}` : spendExceeded ? 'Operating Pack workflow spend cap reached' : 'Operating Pack action allowed';
+    if (allowed) this.spentCents += cost;
+    const triggers = allowed ? reviewerCascadeTriggers(input, this.opts) : [];
+    const node = await this.signActionNode(input, capability, allowed, reason, triggers);
+    this.nodes.push(node);
+    return {
+      allowed,
+      reason,
+      node,
+      dag: this.getReceiptDag(),
+      reviewerCascadeTriggered: triggers.length > 0,
+      spentCents: this.spentCents,
+    };
+  }
+
+  getReceiptDag(): ReceiptDagEnvelope {
+    const root = this.nodes[this.nodes.length - 1];
+    return { nodes: [...this.nodes], rootId: root?.entryHash ?? '0'.repeat(64), workflowId: workflowHash(this.opts.workflowId) };
+  }
+
+  async verifyDag(publicKeyHex?: string): Promise<Awaited<ReturnType<typeof verifyReceiptDag>>> {
+    return verifyReceiptDag(this.getReceiptDag(), publicKeyHex ?? Buffer.from(this.opts.signingKeys.publicKey).toString('hex'));
+  }
+
+  outboundPayloads(): Record<string, unknown>[] {
+    return [];
+  }
+
+  signerFingerprint(): string {
+    return computeSignerFingerprint(this.opts.signingKeys.publicKey);
+  }
+
+  private hasCapability(capability: ReceiptCapabilityLevel): boolean {
+    for (const granted of this.approvedCapabilities) {
+      if (CAPABILITY_RANK[granted] >= CAPABILITY_RANK[capability]) return true;
+    }
+    return false;
+  }
+
+  private async signActionNode(input: OperatingPackAction, capability: ReceiptCapabilityLevel, allowed: boolean, reason: string, triggers: string[]): Promise<ReceiptDagNode> {
+    const decision = operatingPackDecision(input, this.opts, capability, allowed, reason, triggers, this.spentCents);
+    return signDagNode({
+      sequence: this.nodes.length,
+      decision,
+      privateKey: this.opts.signingKeys.privateKey,
+      publicKey: this.opts.signingKeys.publicKey,
+      parents: this.nodes.length ? [this.nodes[this.nodes.length - 1] as ReceiptDagNode] : [],
+      workflowId: workflowHash(this.opts.workflowId),
+      trustScore: allowed ? (triggers.length ? 0.9 : 0.94) : 0.2,
+      blocked: !allowed,
+      capability,
+    });
+  }
+}
+
+function operatingPackDecision(input: OperatingPackAction, opts: OperatingPackOptions, capability: ReceiptCapabilityLevel, allowed: boolean, reason: string, triggers: string[], spentCents: number): SpendDecision {
+  const cost = safeNonNegativeInteger(input.totalCostCents);
+  const inputTokens = safeNonNegativeInteger(input.tokenCounts?.inputTokens);
+  const outputTokens = safeNonNegativeInteger(input.tokenCounts?.outputTokens);
+  const receipt: Record<string, unknown> = {
+    type: 'agent_operating_pack_action',
+    vertical: opts.vertical,
+    counselReviewPending: LAW_OPERATING_PACK.counselReviewPending,
+    workflowHash: workflowHash(opts.workflowId),
+    actionId: safeLabel(input.actionId) ?? hashValue(input.actionId).slice(0, 16),
+    actionKind: input.kind,
+    capability,
+    blocked: !allowed,
+    modelIds: safeModelIds(input.modelIds ?? []),
+    inputTokens,
+    outputTokens,
+    totalCostCents: cost,
+    metadata: filterReceiptMetadata({ ...(input.metadata ?? {}), action_kind: input.kind, capability }),
+  };
+  if (triggers.length > 0) receipt.reviewerCascade = buildReviewerCascadeReceipt(input, opts, triggers);
+  return {
+    decisionId: randomUUID(),
+    timestamp: new Date().toISOString(),
+    action: allowed ? 'allow' : 'block',
+    triggeredCap: allowed ? null : { window: 'per_call', amountCents: cost, action: 'block', reason },
+    triggeredScopeKey: null,
+    projectedCents: cost,
+    windowSpendBefore: Math.max(0, spentCents - (allowed ? cost : 0)),
+    windowSpendAfter: spentCents,
+    provider: 'unknown',
+    modelRequested: 'operating-pack',
+    modelResolved: 'operating-pack',
+    policyId: 'agentguard-operating-pack-law',
+    policyVersion: 1,
+    enforcementMode: 'enforce',
+    reasons: [reason],
+    entryType: 'outcome',
+    outcomeReceipt: receipt,
+  };
+}
+
+function buildReviewerCascadeReceipt(input: OperatingPackAction, opts: OperatingPackOptions, triggers: string[]): Record<string, unknown> {
+  const cascade = opts.reviewerCascade ?? {};
+  return {
+    outcome: input.kind,
+    drafter: {
+      model: safeLabel(cascade.drafterModel) ?? 'openai/gpt-4o-mini',
+      maxCostCents: safeNonNegativeInteger(cascade.drafterMaxCostCents ?? 25),
+    },
+    reviewer: {
+      model: safeLabel(cascade.reviewerModel) ?? 'anthropic/claude-sonnet-4-6',
+      maxCostCents: safeNonNegativeInteger(cascade.reviewerMaxCostCents ?? 75),
+    },
+    triggerFired: triggers,
+    reviewerVerdict: safeLabel(input.reviewerVerdict) ?? 'review_required',
+  };
+}
+
+function reviewerCascadeTriggers(input: OperatingPackAction, opts: OperatingPackOptions): string[] {
+  if (opts.reviewerCascade?.enabled === false) return [];
+  const threshold = opts.reviewerCascade?.triggerThreshold ?? 0.55;
+  const triggers: string[] = [];
+  if (input.highRisk === true) triggers.push('high_risk_action');
+  if (input.keywordRisk === true) triggers.push('keyword_prefilter');
+  if (typeof input.highRiskClassifierScore === 'number' && input.highRiskClassifierScore >= threshold) triggers.push(`risk_score_above:${threshold}`);
+  if (['conflict_check', 'document_summary', 'client_update_draft', 'send_client_email', 'trust_account_action'].includes(input.kind)) triggers.push('law_pack_default');
+  return [...new Set(triggers)].sort();
+}
+
+function capabilityForAction(kind: OperatingPackActionKind): ReceiptCapabilityLevel {
+  if (kind === 'trust_account_action') return 'ADMIN';
+  if (kind === 'send_client_email' || kind === 'client_update_draft') return 'TRANSACT';
+  return 'READ_ONLY';
+}
+
+function assertAction(input: OperatingPackAction): void {
+  assertPlainRecord(input, 'action');
+  if (!safeLabel(input.actionId)) throw new Error('Operating Pack actionId is required');
+  const allowedKinds: OperatingPackActionKind[] = ['intake', 'conflict_check', 'document_summary', 'billing_reconciliation', 'client_update_draft', 'send_client_email', 'trust_account_action'];
+  if (!allowedKinds.includes(input.kind)) throw new Error('Operating Pack action kind is not supported');
+  if (input.capability && !(input.capability in CAPABILITY_RANK)) throw new Error('Operating Pack capability is not supported');
+  if (input.tokenCounts) validateTokens(input.tokenCounts.inputTokens ?? 0, input.tokenCounts.outputTokens ?? 0);
+  if (input.totalCostCents != null && (!Number.isSafeInteger(input.totalCostCents) || input.totalCostCents < 0)) throw new Error('Operating Pack totalCostCents must be a non-negative safe integer');
+}
+
+export function assertOperatingPackMetadataOnly(value: unknown, path = 'metadata'): void {
+  assertMetadataOnly(value, path);
+}
+
+function assertMetadataOnly(value: unknown, path = 'metadata'): void {
+  if (value == null) return;
+  if (Array.isArray(value)) {
+    for (let i = 0; i < value.length; i++) assertMetadataOnly(value[i], `${path}[${i}]`);
+    return;
+  }
+  if (typeof value !== 'object') return;
+  for (const [key, child] of Object.entries(value as Record<string, unknown>)) {
+    if (DATA_PLANE_KEYS.test(key)) throw new Error(`Operating Pack metadata cannot include data-plane field: ${path}.${key}`);
+    assertMetadataOnly(child, `${path}.${key}`);
+  }
+}
+
+function filterReceiptMetadata(metadata: Record<string, unknown>): Record<string, unknown> {
+  assertMetadataOnly(metadata);
+  const out: Record<string, unknown> = {};
+  for (const [key, value] of Object.entries(metadata)) {
+    if (!SAFE_METADATA_KEYS.has(key)) continue;
+    if (value == null || typeof value === 'string' || typeof value === 'number' || typeof value === 'boolean') out[key] = value;
+  }
+  return out;
+}
+
+function assertPlainRecord(value: unknown, name: string): void {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) throw new Error(`Operating Pack ${name} must be an object`);
+}
+
+function validateTokens(inputTokens: number, outputTokens: number): void {
+  if (!Number.isSafeInteger(inputTokens) || inputTokens < 0) throw new Error('inputTokens must be a non-negative safe integer');
+  if (!Number.isSafeInteger(outputTokens) || outputTokens < 0) throw new Error('outputTokens must be a non-negative safe integer');
+}
+
+function workflowHash(value: string): string {
+  return hashValue(`workflow:${value}`);
+}
+
+function hashValue(value: string): string {
+  return sha256Hex(canonicalJson({ value }));
+}
+
+function safeLabel(value: unknown): string | undefined {
+  if (typeof value !== 'string') return undefined;
+  const trimmed = value.trim();
+  if (!trimmed || !/^[A-Za-z0-9_.:/-]{1,180}$/.test(trimmed)) return undefined;
+  return trimmed;
+}
+
+function safeModelIds(models: string[]): string[] {
+  return models.map((model) => safeLabel(model)).filter(Boolean) as string[];
+}
+
+function safeNonNegativeInteger(value: unknown): number {
+  return Number.isSafeInteger(value) && (value as number) >= 0 ? value as number : 0;
+}
+
+export function operatingPackSignerFingerprint(opts: OperatingPackOptions): string | null {
+  return opts.signingKeys ? computeSignerFingerprint(opts.signingKeys.publicKey) : null;
+}