@peac/adapter-openclaw 0.10.11 → 0.10.12

package/dist/index.cjs

@@ -2,6 +2,30 @@
 
 var crypto = require('@peac/crypto');
 var captureCore = require('@peac/capture-core');
+var path = require('path');
+var fs2 = require('fs/promises');
+var captureNode = require('@peac/capture-node');
+
+function _interopNamespace(e) {
+  if (e && e.__esModule) return e;
+  var n = Object.create(null);
+  if (e) {
+    Object.keys(e).forEach(function (k) {
+      if (k !== 'default') {
+        var d = Object.getOwnPropertyDescriptor(e, k);
+        Object.defineProperty(n, k, d.get ? d : {
+          enumerable: true,
+          get: function () { return e[k]; }
+        });
+      }
+    });
+  }
+  n.default = e;
+  return Object.freeze(n);
+}
+
+var path__namespace = /*#__PURE__*/_interopNamespace(path);
+var fs2__namespace = /*#__PURE__*/_interopNamespace(fs2);
 
 // src/types.ts
 var OPENCLAW_EXTENSION_KEYS = {
@@ -518,8 +542,8 @@ async function resolveSigner(keyRef, issuer, audience) {
       return createJwkSigner(jwk, issuer, audience);
     }
     case "file": {
-      const fs = await import('fs');
-      const keyData = await fs.promises.readFile(value, "utf-8");
+      const fs3 = await import('fs');
+      const keyData = await fs3.promises.readFile(value, "utf-8");
       const jwk = JSON.parse(keyData);
       return createJwkSigner(jwk, issuer, audience);
     }
@@ -542,32 +566,36 @@ function generateKeyId(jwk) {
   return `k_${Math.abs(hash).toString(16).padStart(8, "0")}`;
 }
 async function createFileReceiptWriter(outputDir) {
-  const fs = await import('fs');
+  const fs3 = await import('fs');
   const pathModule = await import('path');
   const resolvedOutputDir = pathModule.resolve(outputDir);
-  await fs.promises.mkdir(resolvedOutputDir, { recursive: true });
+  await fs3.promises.mkdir(resolvedOutputDir, { recursive: true });
   return {
     async write(receipt) {
       const filename = `${receipt.rid}.peac.json`;
       const filepath = pathModule.join(resolvedOutputDir, filename);
       const tempPath = `${filepath}.tmp`;
-      const content = JSON.stringify(
-        {
-          rid: receipt.rid,
-          interaction_id: receipt.interaction_id,
-          entry_digest: receipt.entry_digest,
-          _jws: receipt.jws
-        },
-        null,
-        2
-      );
-      await fs.promises.writeFile(tempPath, content, "utf-8");
-      const fd = await fs.promises.open(tempPath, "r");
+      let content;
+      const jwsParts = receipt.jws.split(".");
+      if (jwsParts.length !== 3) {
+        content = JSON.stringify({ _jws: receipt.jws }, null, 2);
+      } else {
+        try {
+          const payloadJson = Buffer.from(jwsParts[1], "base64url").toString("utf-8");
+          const payload = JSON.parse(payloadJson);
+          const { evidence, ...auth } = payload;
+          content = JSON.stringify({ auth, evidence, _jws: receipt.jws }, null, 2);
+        } catch {
+          content = JSON.stringify({ _jws: receipt.jws }, null, 2);
+        }
+      }
+      await fs3.promises.writeFile(tempPath, content, "utf-8");
+      const fd = await fs3.promises.open(tempPath, "r");
       await fd.sync();
       await fd.close();
-      await fs.promises.rename(tempPath, filepath);
+      await fs3.promises.rename(tempPath, filepath);
       try {
-        const dirFd = await fs.promises.open(resolvedOutputDir, "r");
+        const dirFd = await fs3.promises.open(resolvedOutputDir, "r");
         await dirFd.sync();
         await dirFd.close();
       } catch {
@@ -691,6 +719,20 @@ var MAX_STATUS_FILE_SCAN = 1e3;
 var MAX_QUERY_FILE_PARSE = 1e4;
 var MAX_FILE_SIZE_BYTES = 10 * 1024 * 1024;
 var ALLOWED_ALGORITHMS = ["EdDSA", "ES256", "ES384", "ES512", "RS256", "RS384", "RS512"];
+function decodeReceiptPayload(receipt) {
+  const jws = receipt._jws;
+  if (typeof jws !== "string") return null;
+  const parts = jws.split(".");
+  if (parts.length !== 3) return null;
+  try {
+    const payloadJson = Buffer.from(parts[1], "base64url").toString("utf-8");
+    const payload = JSON.parse(payloadJson);
+    const { evidence, ...auth } = payload;
+    return { auth: auth ?? {}, evidence: evidence ?? {} };
+  } catch {
+    return null;
+  }
+}
 var ALG_KEY_TYPE_MAP = {
   EdDSA: { kty: "OKP", crv: ["Ed25519", "Ed448"] },
   ES256: { kty: "EC", crv: ["P-256"] },
@@ -700,13 +742,14 @@ var ALG_KEY_TYPE_MAP = {
   RS384: { kty: "RSA" },
   RS512: { kty: "RSA" }
 };
-function createStatusTool(stats, outputDir) {
+function createStatusTool(getStats, outputDir) {
   return {
     name: "peac_receipts.status",
     description: "Show PEAC receipts status: spool size, last receipt time, config summary",
     parameters: {},
     async execute() {
-      const fs = await import('fs');
+      const stats = typeof getStats === "function" ? getStats() : getStats;
+      const fs3 = await import('fs');
       const pathModule = await import('path');
       const resolvedOutputDir = pathModule.resolve(outputDir);
       let receiptCount = 0;
@@ -714,7 +757,7 @@ function createStatusTool(stats, outputDir) {
       let oldestReceiptTime = null;
       let countApproximate = false;
       try {
-        const files = await fs.promises.readdir(resolvedOutputDir);
+        const files = await fs3.promises.readdir(resolvedOutputDir);
         const receiptFiles = files.filter((f) => f.endsWith(".peac.json"));
         receiptCount = receiptFiles.length;
         const filesToScan = receiptFiles.slice(0, MAX_STATUS_FILE_SCAN);
@@ -722,7 +765,7 @@ function createStatusTool(stats, outputDir) {
         if (filesToScan.length > 0) {
           const fileStats = await Promise.all(
             filesToScan.map(async (f) => {
-              const stat = await fs.promises.stat(pathModule.join(resolvedOutputDir, f));
+              const stat = await fs3.promises.stat(pathModule.join(resolvedOutputDir, f));
               return { file: f, mtime: stat.mtime };
             })
           );
@@ -782,11 +825,11 @@ function createExportBundleTool(outputDir, logger) {
       }
     },
     async execute(params) {
-      const fs = await import('fs');
+      const fs3 = await import('fs');
       const pathModule = await import('path');
       const resolvedOutputDir = pathModule.resolve(outputDir);
       try {
-        const files = await fs.promises.readdir(resolvedOutputDir);
+        const files = await fs3.promises.readdir(resolvedOutputDir);
         const receiptFiles = files.filter((f) => f.endsWith(".peac.json"));
         if (receiptFiles.length === 0) {
           return {
@@ -796,30 +839,48 @@ function createExportBundleTool(outputDir, logger) {
           };
         }
         const receipts = [];
+        const skippedReasons = { stat_error: 0, invalid_json: 0, malformed_jws: 0, filtered: 0 };
+        const skippedFiles = [];
         for (const file of receiptFiles) {
           const filePath = pathModule.join(resolvedOutputDir, file);
           let stat;
           try {
-            stat = await fs.promises.stat(filePath);
+            stat = await fs3.promises.stat(filePath);
           } catch {
+            skippedReasons.stat_error++;
+            skippedFiles.push(file);
             continue;
           }
           if (params.since && stat.mtime < new Date(params.since)) {
+            skippedReasons.filtered++;
             continue;
           }
           if (params.until && stat.mtime > new Date(params.until)) {
+            skippedReasons.filtered++;
             continue;
           }
           let content;
           try {
-            content = JSON.parse(await fs.promises.readFile(filePath, "utf-8"));
+            content = JSON.parse(await fs3.promises.readFile(filePath, "utf-8"));
           } catch {
             logger.warn(`Skipping invalid JSON in ${file}`);
+            skippedReasons.invalid_json++;
+            skippedFiles.push(file);
             continue;
           }
           if (params.workflow_id) {
-            const workflowExt = content?.auth?.extensions?.["org.peacprotocol/workflow"];
+            const decoded = content._jws ? decodeReceiptPayload(content) : null;
+            if (content._jws && !decoded) {
+              logger.warn(`Skipping ${file}: _jws present but malformed`);
+              skippedReasons.malformed_jws++;
+              skippedFiles.push(file);
+              continue;
+            }
+            const authBlock = decoded?.auth ?? content?.auth;
+            const extensions = authBlock?.extensions;
+            const workflowExt = extensions?.["org.peacprotocol/workflow"];
             if (workflowExt?.workflow_id !== params.workflow_id) {
+              skippedReasons.filtered++;
               continue;
             }
           }
@@ -829,7 +890,12 @@ function createExportBundleTool(outputDir, logger) {
           return {
             status: "ok",
             message: "No receipts match the filter criteria",
-            receipt_count: 0
+            receipt_count: 0,
+            scanned_count: receiptFiles.length,
+            exported_count: 0,
+            skipped_count: skippedReasons.stat_error + skippedReasons.invalid_json + skippedReasons.malformed_jws + skippedReasons.filtered,
+            skipped_reasons: skippedReasons,
+            skipped_files: skippedFiles.length > 0 ? skippedFiles.slice(0, 100) : void 0
           };
         }
         const manifest = {
@@ -849,15 +915,15 @@ function createExportBundleTool(outputDir, logger) {
         };
         const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
         const bundleDir = params.output_path ? pathModule.resolve(params.output_path) : pathModule.join(resolvedOutputDir, `peac-bundle-${timestamp}`);
-        await fs.promises.mkdir(bundleDir, { recursive: true });
-        await fs.promises.writeFile(
+        await fs3.promises.mkdir(bundleDir, { recursive: true });
+        await fs3.promises.writeFile(
           pathModule.join(bundleDir, "manifest.json"),
           JSON.stringify(manifest, null, 2)
         );
         const receiptsDir = pathModule.join(bundleDir, "receipts");
-        await fs.promises.mkdir(receiptsDir, { recursive: true });
+        await fs3.promises.mkdir(receiptsDir, { recursive: true });
         for (const receipt of receipts) {
-          await fs.promises.writeFile(
+          await fs3.promises.writeFile(
             pathModule.join(receiptsDir, receipt.file),
             JSON.stringify(receipt.content, null, 2)
           );
@@ -867,7 +933,12 @@ function createExportBundleTool(outputDir, logger) {
           status: "ok",
           message: `Exported ${receipts.length} receipts to directory`,
           receipt_count: receipts.length,
-          bundle_path: bundleDir
+          bundle_path: bundleDir,
+          scanned_count: receiptFiles.length,
+          exported_count: receipts.length,
+          skipped_count: skippedReasons.stat_error + skippedReasons.invalid_json + skippedReasons.malformed_jws + skippedReasons.filtered,
+          skipped_reasons: skippedReasons,
+          skipped_files: skippedFiles.length > 0 ? skippedFiles.slice(0, 100) : void 0
         };
       } catch (error) {
         logger.error("Export bundle failed:", error);
@@ -900,20 +971,20 @@ function createVerifyTool(logger) {
     },
     async execute(params) {
       const verifyParams = params;
-      const fs = await import('fs');
+      const fs3 = await import('fs');
       const pathModule = await import('path');
       try {
-        const stat = await fs.promises.stat(verifyParams.path);
+        const stat = await fs3.promises.stat(verifyParams.path);
         if (stat.isDirectory()) {
           return await verifyBundle(
             verifyParams.path,
             verifyParams.jwks_path,
-            fs,
+            fs3,
             pathModule,
             logger
           );
         } else {
-          return await verifySingleReceipt(verifyParams.path, verifyParams.jwks_path, fs, logger);
+          return await verifySingleReceipt(verifyParams.path, verifyParams.jwks_path, fs3, logger);
         }
       } catch (error) {
         logger.error("Verification failed:", error);
@@ -927,8 +998,8 @@ function createVerifyTool(logger) {
     }
   };
 }
-async function verifySingleReceipt(receiptPath, jwksPath, fs, logger) {
-  const stat = await fs.promises.stat(receiptPath);
+async function verifySingleReceipt(receiptPath, jwksPath, fs3, logger) {
+  const stat = await fs3.promises.stat(receiptPath);
   if (stat.size > MAX_FILE_SIZE_BYTES) {
     return {
       status: "error",
@@ -937,17 +1008,47 @@ async function verifySingleReceipt(receiptPath, jwksPath, fs, logger) {
       errors: [`File size ${stat.size} bytes exceeds ${MAX_FILE_SIZE_BYTES} byte limit`]
     };
   }
-  const content = await fs.promises.readFile(receiptPath, "utf-8");
+  const content = await fs3.promises.readFile(receiptPath, "utf-8");
   const receipt = JSON.parse(content);
   const errors = [];
   const warnings = [];
-  if (!receipt.auth) {
+  let auth;
+  let evidence;
+  if (!receipt._jws) {
+    auth = receipt.auth;
+    evidence = receipt.evidence;
+    warnings.push("Missing _jws field -- using unsigned top-level fields");
+  } else {
+    const decoded = decodeReceiptPayload(receipt);
+    if (!decoded) {
+      errors.push("_jws field present but payload could not be decoded (malformed JWS)");
+      auth = void 0;
+      evidence = void 0;
+    } else {
+      auth = decoded.auth;
+      evidence = decoded.evidence;
+      if (receipt.auth !== void 0 || receipt.evidence !== void 0) {
+        const topAuth = receipt.auth;
+        const topEvidence = receipt.evidence;
+        const authMatch = topAuth === void 0 || JSON.stringify(topAuth) === JSON.stringify(decoded.auth);
+        const evidenceMatch = topEvidence === void 0 || JSON.stringify(topEvidence) === JSON.stringify(decoded.evidence);
+        if (!authMatch || !evidenceMatch) {
+          errors.push(
+            "Dual-representation mismatch: top-level auth/evidence differs from _jws payload"
+          );
+        }
+      }
+    }
+  }
+  if (!auth) {
     errors.push("Missing auth block");
   }
-  if (!receipt.evidence) {
+  if (!evidence) {
     errors.push("Missing evidence block");
   }
-  const interaction = receipt.evidence?.extensions?.["org.peacprotocol/interaction@0.1"];
+  const evidenceObj = evidence;
+  const extensions = evidenceObj?.extensions;
+  const interaction = extensions?.["org.peacprotocol/interaction@0.1"];
   if (interaction) {
     if (!interaction.interaction_id) {
       errors.push("Missing interaction_id");
@@ -955,7 +1056,8 @@ async function verifySingleReceipt(receiptPath, jwksPath, fs, logger) {
     if (!interaction.kind) {
       errors.push("Missing kind");
     }
-    if (!interaction.executor?.platform) {
+    const executor = interaction.executor;
+    if (!executor?.platform) {
       errors.push("Missing executor.platform");
     }
     if (!interaction.started_at) {
@@ -966,7 +1068,8 @@ async function verifySingleReceipt(receiptPath, jwksPath, fs, logger) {
         errors.push("completed_at is before started_at");
       }
     }
-    if (interaction.output && !interaction.result?.status) {
+    const result = interaction.result;
+    if (interaction.output && !result?.status) {
       errors.push("output present but result.status missing");
     }
   } else {
@@ -975,7 +1078,7 @@ async function verifySingleReceipt(receiptPath, jwksPath, fs, logger) {
   if (jwksPath && receipt._jws) {
     try {
       const { verify, base64urlDecode: base64urlDecode2, base64urlDecodeString } = await import('@peac/crypto');
-      const jwks = JSON.parse(await fs.promises.readFile(jwksPath, "utf-8"));
+      const jwks = JSON.parse(await fs3.promises.readFile(jwksPath, "utf-8"));
       const jwsParts = receipt._jws.split(".");
       if (jwsParts.length !== 3) {
         errors.push("Invalid JWS format (expected 3 parts)");
@@ -1060,15 +1163,15 @@ async function verifySingleReceipt(receiptPath, jwksPath, fs, logger) {
     message: errors.length === 0 ? "Receipt is valid" : "Receipt has validation errors",
     errors: errors.length > 0 ? errors : void 0,
     warnings: warnings.length > 0 ? warnings : void 0,
-    receipt_id: receipt.auth?.rid,
+    receipt_id: auth?.rid,
     interaction_id: interaction?.interaction_id
   };
 }
-async function verifyBundle(bundlePath, jwksPath, fs, pathModule, logger) {
+async function verifyBundle(bundlePath, jwksPath, fs3, pathModule, logger) {
   const manifestPath = pathModule.join(bundlePath, "manifest.json");
-  const manifest = JSON.parse(await fs.promises.readFile(manifestPath, "utf-8"));
+  const manifest = JSON.parse(await fs3.promises.readFile(manifestPath, "utf-8"));
   const receiptsDir = pathModule.join(bundlePath, "receipts");
-  const files = await fs.promises.readdir(receiptsDir);
+  const files = await fs3.promises.readdir(receiptsDir);
   let validCount = 0;
   let invalidCount = 0;
   const allErrors = [];
@@ -1078,7 +1181,7 @@ async function verifyBundle(bundlePath, jwksPath, fs, pathModule, logger) {
     const result = await verifySingleReceipt(
       pathModule.join(receiptsDir, file),
       jwksPath,
-      fs,
+      fs3,
       logger
     );
     if (result.valid) {
@@ -1146,11 +1249,11 @@ function createQueryTool(outputDir, logger) {
       }
     },
     async execute(params) {
-      const fs = await import('fs');
+      const fs3 = await import('fs');
       const pathModule = await import('path');
       const resolvedOutputDir = pathModule.resolve(outputDir);
       try {
-        const files = await fs.promises.readdir(resolvedOutputDir);
+        const files = await fs3.promises.readdir(resolvedOutputDir);
         const receiptFiles = files.filter((f) => f.endsWith(".peac.json"));
         const limit = Math.min(params.limit || 100, MAX_QUERY_FILE_PARSE);
         const offset = params.offset || 0;
@@ -1158,7 +1261,7 @@ function createQueryTool(outputDir, logger) {
         for (const file of receiptFiles.slice(0, MAX_QUERY_FILE_PARSE)) {
           try {
             const filePath = pathModule.join(resolvedOutputDir, file);
-            const stat = await fs.promises.stat(filePath);
+            const stat = await fs3.promises.stat(filePath);
             if (params.since && stat.mtime < new Date(params.since)) {
               continue;
             }
@@ -1175,10 +1278,11 @@ function createQueryTool(outputDir, logger) {
         let skippedForFilters = 0;
         let filesSkippedForSize = 0;
         let filesSkippedForInvalidJson = 0;
+        let filesSkippedForMalformedJws = 0;
         for (const { file } of fileInfos) {
           const filePath = pathModule.join(resolvedOutputDir, file);
           try {
-            const fileStat = await fs.promises.stat(filePath);
+            const fileStat = await fs3.promises.stat(filePath);
             if (fileStat.size > MAX_FILE_SIZE_BYTES) {
               filesSkippedForSize++;
               continue;
@@ -1188,32 +1292,43 @@ function createQueryTool(outputDir, logger) {
           }
           let content;
           try {
-            content = JSON.parse(await fs.promises.readFile(filePath, "utf-8"));
+            content = JSON.parse(await fs3.promises.readFile(filePath, "utf-8"));
           } catch {
             filesSkippedForInvalidJson++;
             continue;
           }
-          const interaction = content?.evidence?.extensions?.["org.peacprotocol/interaction@0.1"];
-          const workflow = content?.auth?.extensions?.["org.peacprotocol/workflow"];
+          const decoded = content._jws ? decodeReceiptPayload(content) : null;
+          if (content._jws && !decoded) {
+            filesSkippedForMalformedJws++;
+            continue;
+          }
+          const authBlock = decoded?.auth ?? content?.auth;
+          const evidenceBlock = decoded?.evidence ?? content?.evidence;
+          const evidenceExtensions = evidenceBlock?.extensions;
+          const interaction = evidenceExtensions?.["org.peacprotocol/interaction@0.1"];
+          const authExtensions = authBlock?.extensions;
+          const workflow = authExtensions?.["org.peacprotocol/workflow"];
           if (params.workflow_id && workflow?.workflow_id !== params.workflow_id) {
             skippedForFilters++;
             continue;
           }
-          if (params.tool_name && interaction?.tool?.name !== params.tool_name) {
+          const tool = interaction?.tool;
+          if (params.tool_name && tool?.name !== params.tool_name) {
             skippedForFilters++;
             continue;
           }
-          if (params.status && interaction?.result?.status !== params.status) {
+          const result = interaction?.result;
+          if (params.status && result?.status !== params.status) {
             skippedForFilters++;
             continue;
           }
           matches.push({
             file,
-            receipt_id: content.auth?.rid,
+            receipt_id: authBlock?.rid,
             interaction_id: interaction?.interaction_id,
             workflow_id: workflow?.workflow_id,
-            tool_name: interaction?.tool?.name,
-            status: interaction?.result?.status,
+            tool_name: tool?.name,
+            status: result?.status,
             started_at: interaction?.started_at,
             completed_at: interaction?.completed_at
           });
@@ -1240,17 +1355,25 @@ function createQueryTool(outputDir, logger) {
         if (filesSkippedForInvalidJson > 0) {
           warnings.push(`${filesSkippedForInvalidJson} files skipped (invalid JSON)`);
         }
-        const hasTruncation = receiptFiles.length > MAX_QUERY_FILE_PARSE || filesSkippedForSize > 0 || filesSkippedForInvalidJson > 0;
+        if (filesSkippedForMalformedJws > 0) {
+          warnings.push(`${filesSkippedForMalformedJws} files skipped (malformed JWS)`);
+        }
+        const totalSkipped = filesSkippedForSize + filesSkippedForInvalidJson + filesSkippedForMalformedJws;
+        const hasTruncation = receiptFiles.length > MAX_QUERY_FILE_PARSE || totalSkipped > 0;
         return {
           status: "ok",
           total: matches.length,
           offset,
           limit,
           results: paginated,
+          scanned_count: fileInfos.length,
+          matched_count: matches.length,
           truncated: hasTruncation,
-          skipped: hasTruncation ? {
+          skipped: hasTruncation || skippedForFilters > 0 ? {
             too_large: filesSkippedForSize,
             invalid_json: filesSkippedForInvalidJson,
+            malformed_jws: filesSkippedForMalformedJws,
+            filtered: skippedForFilters,
             capped: receiptFiles.length > MAX_QUERY_FILE_PARSE ? receiptFiles.length - MAX_QUERY_FILE_PARSE : 0
           } : void 0,
           ...warnings.length > 0 && { warning: warnings.join("; ") }
@@ -1269,10 +1392,161 @@ function createQueryTool(outputDir, logger) {
     }
   };
 }
+var DEFAULT_DATA_DIR_NAME = ".openclaw/peac";
+var SPOOL_FILENAME = "spool.jsonl";
+var DEDUPE_FILENAME = "dedupe.idx";
+function defaultDataDir() {
+  const home = process.env.HOME || process.env.USERPROFILE || ".";
+  return path__namespace.join(home, DEFAULT_DATA_DIR_NAME);
+}
+function noopLogger() {
+  const noop = () => {
+  };
+  return { debug: noop, info: noop, warn: noop, error: noop };
+}
+async function activate(options) {
+  const { config, spoolOptions } = options;
+  const logger = options.logger ?? noopLogger();
+  const dataDir = options.dataDir ?? defaultDataDir();
+  await fs2__namespace.mkdir(dataDir, { recursive: true });
+  try {
+    await fs2__namespace.access(dataDir, (await import('constants')).W_OK);
+  } catch {
+    throw new Error(`Data directory is not writable: ${dataDir}`);
+  }
+  logger.info(`Resolving signing key from: ${config.signing.key_ref.split(":")[0]}:***`);
+  const signer = await resolveSigner(
+    config.signing.key_ref,
+    config.signing.issuer,
+    config.signing.audience
+  );
+  logger.info(`Signing key resolved. kid: ${signer.getKeyId()}`);
+  const spoolPath = path__namespace.join(dataDir, SPOOL_FILENAME);
+  const dedupePath = path__namespace.join(dataDir, DEDUPE_FILENAME);
+  const store = await captureNode.createFsSpoolStore({
+    filePath: spoolPath,
+    maxEntries: spoolOptions?.maxEntries,
+    maxFileBytes: spoolOptions?.maxFileBytes,
+    autoCommitIntervalMs: spoolOptions?.autoCommitIntervalMs,
+    lockOptions: spoolOptions?.lockOptions,
+    onWarning: (msg) => logger.warn(`spool: ${msg}`)
+  });
+  const dedupe = await captureNode.createFsDedupeIndex({
+    filePath: dedupePath
+  });
+  const outputDir = config.output_dir ?? path__namespace.join(dataDir, "receipts");
+  const writer = await createFileReceiptWriter(outputDir);
+  const instance = await createPluginInstance({
+    signer,
+    writer,
+    adapterConfig: config,
+    store,
+    dedupe,
+    drainIntervalMs: config.background?.drain_interval_ms,
+    batchSize: config.background?.batch_size,
+    onError: (err) => logger.error(`plugin error: ${err.message}`)
+  });
+  const tools = [
+    createStatusTool(() => instance.getStats(), outputDir),
+    createExportBundleTool(outputDir, logger),
+    createVerifyTool(logger),
+    createQueryTool(outputDir, logger)
+  ];
+  const diag = captureNode.getFsSpoolDiagnostics(store);
+  if (diag) {
+    logger.info(
+      `PEAC evidence export active. Spool: ${diag.entryCount} entries, ${diag.fileBytes} bytes. Receipts: ${outputDir}`
+    );
+  } else {
+    logger.info(`PEAC evidence export active. Receipts: ${outputDir}`);
+  }
+  async function shutdown() {
+    logger.info("Shutting down PEAC evidence export...");
+    await instance.stop();
+    await store.close();
+    await dedupe.close();
+    logger.info("PEAC evidence export stopped.");
+  }
+  return {
+    instance,
+    tools,
+    hookHandler: instance.hookHandler,
+    dataDir,
+    flush: () => instance.backgroundService.drain(),
+    shutdown
+  };
+}
+var DEFAULT_KEY_FILENAME = "signing-key.jwk";
+async function generateSigningKey(options) {
+  const outputDir = options?.outputDir ?? ".";
+  const filename = options?.filename ?? DEFAULT_KEY_FILENAME;
+  const { privateKey: privateKeyBytes, publicKey: publicKeyBytes } = await crypto.generateKeypair();
+  const d = crypto.base64urlEncode(privateKeyBytes);
+  const x = crypto.base64urlEncode(publicKeyBytes);
+  const privateJwk = {
+    kty: "OKP",
+    crv: "Ed25519",
+    x,
+    d,
+    alg: "EdDSA",
+    use: "sig"
+  };
+  const kid = generateKeyId(privateJwk);
+  privateJwk.kid = kid;
+  const publicJwk = {
+    kty: "OKP",
+    crv: "Ed25519",
+    x,
+    kid,
+    alg: "EdDSA",
+    use: "sig"
+  };
+  await fs2__namespace.mkdir(outputDir, { recursive: true });
+  const keyPath = path__namespace.join(outputDir, filename);
+  await fs2__namespace.writeFile(keyPath, JSON.stringify(privateJwk, null, 2) + "\n", "utf-8");
+  try {
+    await fs2__namespace.chmod(keyPath, 384);
+  } catch {
+    process.stderr.write(
+      `Warning: Could not set file permissions on ${keyPath}. Ensure the file is not readable by other users.
+`
+    );
+  }
+  return { kid, keyPath, publicJwk, privateJwk };
+}
+async function keygenCli(args) {
+  let outputDir;
+  for (let i = 0; i < args.length; i++) {
+    if (args[i] === "--output-dir" && i + 1 < args.length) {
+      outputDir = args[i + 1];
+      i++;
+    } else if (args[i] === "--help" || args[i] === "-h") {
+      process.stdout.write(
+        "Usage: peac-keygen [--output-dir <dir>]\n\nGenerate an Ed25519 signing key for PEAC receipt signing.\n\nOptions:\n  --output-dir <dir>  Directory for key file (default: current directory)\n  --help, -h          Show this help message\n"
+      );
+      return;
+    }
+  }
+  const result = await generateSigningKey({ outputDir });
+  process.stdout.write(`Key generated successfully.
+`);
+  process.stdout.write(`  kid:      ${result.kid}
+`);
+  process.stdout.write(`  key file: ${result.keyPath}
+`);
+  process.stdout.write(`  public x: ${result.publicJwk.x}
+`);
+  process.stdout.write(`
+To use with the OpenClaw adapter:
+`);
+  process.stdout.write(`  signing.key_ref: "file:${path__namespace.resolve(result.keyPath)}"
+`);
+}
 
 exports.OPENCLAW_ERROR_CODES = OPENCLAW_ERROR_CODES;
 exports.OPENCLAW_EXTENSION_KEYS = OPENCLAW_EXTENSION_KEYS;
 exports.OPENCLAW_WARNING_CODES = OPENCLAW_WARNING_CODES;
+exports.activate = activate;
 exports.buildWorkflowContext = buildWorkflowContext;
 exports.captureBatch = captureBatch;
 exports.captureParallel = captureParallel;
@@ -1289,6 +1563,8 @@ exports.createStatusTool = createStatusTool;
 exports.createVerifyTool = createVerifyTool;
 exports.extractWorkflowId = extractWorkflowId;
 exports.generateKeyId = generateKeyId;
+exports.generateSigningKey = generateSigningKey;
+exports.keygenCli = keygenCli;
 exports.mapToolCallEvent = mapToolCallEvent;
 exports.mapToolCallEventBatch = mapToolCallEventBatch;
 exports.resolveSigner = resolveSigner;