@peac/adapter-openclaw 0.10.11 → 0.10.12

package/dist/keygen-cli.cjs

@@ -0,0 +1,116 @@
+#!/usr/bin/env node
+'use strict';
+
+var path = require('path');
+var fs = require('fs/promises');
+var crypto = require('@peac/crypto');
+require('@peac/capture-core');
+
+function _interopNamespace(e) {
+  if (e && e.__esModule) return e;
+  var n = Object.create(null);
+  if (e) {
+    Object.keys(e).forEach(function (k) {
+      if (k !== 'default') {
+        var d = Object.getOwnPropertyDescriptor(e, k);
+        Object.defineProperty(n, k, d.get ? d : {
+          enumerable: true,
+          get: function () { return e[k]; }
+        });
+      }
+    });
+  }
+  n.default = e;
+  return Object.freeze(n);
+}
+
+var path__namespace = /*#__PURE__*/_interopNamespace(path);
+var fs__namespace = /*#__PURE__*/_interopNamespace(fs);
+
+function generateKeyId(jwk) {
+  const publicPart = jwk.x || "";
+  let hash = 0;
+  for (let i = 0; i < publicPart.length; i++) {
+    const char = publicPart.charCodeAt(i);
+    hash = (hash << 5) - hash + char;
+    hash = hash & hash;
+  }
+  return `k_${Math.abs(hash).toString(16).padStart(8, "0")}`;
+}
+
+// src/keygen.ts
+var DEFAULT_KEY_FILENAME = "signing-key.jwk";
+async function generateSigningKey(options) {
+  const outputDir = options?.outputDir ?? ".";
+  const filename = options?.filename ?? DEFAULT_KEY_FILENAME;
+  const { privateKey: privateKeyBytes, publicKey: publicKeyBytes } = await crypto.generateKeypair();
+  const d = crypto.base64urlEncode(privateKeyBytes);
+  const x = crypto.base64urlEncode(publicKeyBytes);
+  const privateJwk = {
+    kty: "OKP",
+    crv: "Ed25519",
+    x,
+    d,
+    alg: "EdDSA",
+    use: "sig"
+  };
+  const kid = generateKeyId(privateJwk);
+  privateJwk.kid = kid;
+  const publicJwk = {
+    kty: "OKP",
+    crv: "Ed25519",
+    x,
+    kid,
+    alg: "EdDSA",
+    use: "sig"
+  };
+  await fs__namespace.mkdir(outputDir, { recursive: true });
+  const keyPath = path__namespace.join(outputDir, filename);
+  await fs__namespace.writeFile(keyPath, JSON.stringify(privateJwk, null, 2) + "\n", "utf-8");
+  try {
+    await fs__namespace.chmod(keyPath, 384);
+  } catch {
+    process.stderr.write(
+      `Warning: Could not set file permissions on ${keyPath}. Ensure the file is not readable by other users.
+`
+    );
+  }
+  return { kid, keyPath, publicJwk, privateJwk };
+}
+async function keygenCli(args) {
+  let outputDir;
+  for (let i = 0; i < args.length; i++) {
+    if (args[i] === "--output-dir" && i + 1 < args.length) {
+      outputDir = args[i + 1];
+      i++;
+    } else if (args[i] === "--help" || args[i] === "-h") {
+      process.stdout.write(
+        "Usage: peac-keygen [--output-dir <dir>]\n\nGenerate an Ed25519 signing key for PEAC receipt signing.\n\nOptions:\n  --output-dir <dir>  Directory for key file (default: current directory)\n  --help, -h          Show this help message\n"
+      );
+      return;
+    }
+  }
+  const result = await generateSigningKey({ outputDir });
+  process.stdout.write(`Key generated successfully.
+`);
+  process.stdout.write(`  kid:      ${result.kid}
+`);
+  process.stdout.write(`  key file: ${result.keyPath}
+`);
+  process.stdout.write(`  public x: ${result.publicJwk.x}
+`);
+  process.stdout.write(`
+To use with the OpenClaw adapter:
+`);
+  process.stdout.write(`  signing.key_ref: "file:${path__namespace.resolve(result.keyPath)}"
+`);
+}
+
+// src/keygen-cli.ts
+keygenCli(process.argv.slice(2)).catch((err) => {
+  process.stderr.write(`Error: ${err.message}
+`);
+  process.exitCode = 1;
+});
+//# sourceMappingURL=keygen-cli.cjs.map
+//# sourceMappingURL=keygen-cli.cjs.map

package/dist/keygen-cli.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/plugin.ts","../src/keygen.ts","../src/keygen-cli.ts"],"names":["generateKeypair","base64urlEncode","fs","path"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqPO,SAAS,cAAc,GAAA,EAAkB;AAC9C,EAAA,MAAM,UAAA,GAAa,IAAI,CAAA,IAAK,EAAA;AAC5B,EAAA,IAAI,IAAA,GAAO,CAAA;AACX,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,UAAA,CAAW,QAAQ,CAAA,EAAA,EAAK;AAC1C,IAAA,MAAM,IAAA,GAAO,UAAA,CAAW,UAAA,CAAW,CAAC,CAAA;AACpC,IAAA,IAAA,GAAA,CAAQ,IAAA,IAAQ,KAAK,IAAA,GAAO,IAAA;AAC5B,IAAA,IAAA,GAAO,IAAA,GAAO,IAAA;AAAA,EAChB;AACA,EAAA,OAAO,CAAA,EAAA,EAAK,IAAA,CAAK,GAAA,CAAI,IAAI,CAAA,CAAE,QAAA,CAAS,EAAE,CAAA,CAAE,QAAA,CAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CAAA;AAC1D;;;AC1MA,IAAM,oBAAA,GAAuB,iBAAA;AAe7B,eAAsB,mBAAmB,OAAA,EAAgD;AACvF,EAAA,MAAM,SAAA,GAAY,SAAS,SAAA,IAAa,GAAA;AACxC,EAAA,MAAM,QAAA,GAAW,SAAS,QAAA,IAAY,oBAAA;AAGtC,EAAA,MAAM,EAAE,UAAA,EAAY,eAAA,EAAiB,WAAW,cAAA,EAAe,GAAI,MAAMA,sBAAA,EAAgB;AAGzF,EAAA,MAAM,CAAA,GAAIC,uBAAgB,eAAe,CAAA;AACzC,EAAA,MAAM,CAAA,GAAIA,uBAAgB,cAAc,CAAA;AAGxC,EAAA,MAAM,UAAA,GAAkB;AAAA,IACtB,GAAA,EAAK,KAAA;AAAA,IACL,GAAA,EAAK,SAAA;AAAA,IACL,CAAA;AAAA,IACA,CAAA;AAAA,IACA,GAAA,EAAK,OAAA;AAAA,IACL,GAAA,EAAK;AAAA,GACP;AAGA,EAAA,MAAM,GAAA,GAAM,cAAc,UAAU,CAAA;AACpC,EAAA,UAAA,CAAW,GAAA,GAAM,GAAA;AAGjB,EAAA,MAAM,SAAA,GAAiB;AAAA,IACrB,GAAA,EAAK,KAAA;AAAA,IACL,GAAA,EAAK,SAAA;AAAA,IACL,CAAA;AAAA,IACA,GAAA;AAAA,IACA,GAAA,EAAK,OAAA;AAAA,IACL,GAAA,EAAK;AAAA,GACP;AAGA,EAAA,MAASC,aAAA,CAAA,KAAA,CAAM,SAAA,EAAW,EAAE,SAAA,EAAW,MAAM,CAAA;AAC7C,EAAA,MAAM,OAAA,GAAeC,eAAA,CAAA,IAAA,CAAK,SAAA,EAAW,QAAQ,CAAA;AAC7C,EAAA,MAASD,aAAA,CAAA,SAAA,CAAU,SAAS,IAAA,CAAK,SAAA,CAAU,YAAY,IAAA,EAAM,CAAC,CAAA,GAAI,IAAA,EAAM,OAAO,CAAA;AAG/E,EAAA,IAAI;AACF,IAAA,MAASA,aAAA,CAAA,KAAA,CAAM,SAAS,GAAK,CAAA;AAAA,EAC/B,CAAA,CAAA,MAAQ;AAEN,IAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,MACb,8CAA8C,OAAO,CAAA;AAAA;AAAA,KAEvD;AAAA,EACF;AAEA,EAAA,OAAO,EAAE,GAAA,EAAK,OAAA,EAAS,SAAA,EAAW,UAAA,EAAW;AAC/C;AAUA,eAAsB,UAAU,IAAA,EAA+B;AAC7D,EAAA,IAAI,SAAA;AAEJ,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,IAAA,CAAK,QAAQ,CAAA,EAAA,EAAK;AACpC,IAAA,IAAI,KAAK,CAAC,CAAA,KAAM,kBAAkB,CAAA,GAAI,CAAA,GAAI,KAAK,MAAA,EAAQ;AACrD,MAAA,SAAA,GAAY,IAAA,CAAK,IAAI,CAAC,CAAA;AACtB,MAAA,CAAA,EAAA;AAAA,IACF,CAAA,MAAA,IAAW,KAAK,CAAC,CAAA,KAAM,YAAY,IAAA,CAAK,CAAC,MAAM,IAAA,EAAM;AACnD,MAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,QACb;AAAA,OAKF;AACA,MAAA;AAAA,IACF;AAAA,EACF;AAEA,EAAA,MAAM,MAAA,GAAS,MAAM,kBAAA,CAAmB,EAAE,WAAW,CAAA;AAErD,EAAA,OAAA,CAAQ,OAAO,KAAA,CAAM,CAAA;AAAA,CAA+B,CAAA;AACpD,EAAA,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,YAAA,EAAe,MAAA,CAAO,GAAG;AAAA,CAAI,CAAA;AAClD,EAAA,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,YAAA,EAAe,MAAA,CAAO,OAAO;AAAA,CAAI,CAAA;AACtD,EAAA,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,YAAA,EAAe,MAAA,CAAO,UAAU,CAAC;AAAA,CAAI,CAAA;AAC1D,EAAA,OAAA,CAAQ,OAAO,KAAA,CAAM;AAAA;AAAA,CAAuC,CAAA;AAC5D,EAAA,OAAA,CAAQ,OAAO,KAAA,CAAM,CAAA,yBAAA,EAAiCC,eAAA,CAAA,OAAA,CAAQ,MAAA,CAAO,OAAO,CAAC,CAAA;AAAA,CAAK,CAAA;AACpF;;;ACpJA,SAAA,CAAU,OAAA,CAAQ,KAAK,KAAA,CAAM,CAAC,CAAC,CAAA,CAAE,KAAA,CAAM,CAAC,GAAA,KAAe;AACrD,EAAA,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,OAAA,EAAU,GAAA,CAAI,OAAO;AAAA,CAAI,CAAA;AAC9C,EAAA,OAAA,CAAQ,QAAA,GAAW,CAAA;AACrB,CAAC,CAAA","file":"keygen-cli.cjs","sourcesContent":["/**\n * @peac/adapter-openclaw - Plugin Entry Point\n *\n * OpenClaw plugin types and utilities for PEAC receipts.\n * This module provides types and factory functions for OpenClaw integration.\n *\n * Note: Full plugin activation requires OpenClaw's plugin runtime.\n * The types and utilities here allow building custom integrations.\n */\n\nimport type { CaptureSession, SpoolStore, DedupeIndex } from '@peac/capture-core';\nimport { createCaptureSession, createHasher } from '@peac/capture-core';\nimport { sign, base64urlDecode } from '@peac/crypto';\nimport type { OpenClawAdapterConfig } from './types.js';\nimport { createHookHandler, type OpenClawHookHandler } from './hooks.js';\nimport {\n  createReceiptEmitter,\n  createBackgroundService,\n  type Signer,\n  type ReceiptWriter,\n  type BackgroundEmitterService,\n} from './emitter.js';\n\n// =============================================================================\n// JWK Type\n// =============================================================================\n\n/**\n * JSON Web Key structure for signing keys (Ed25519).\n */\nexport interface JWK {\n  kty: string;\n  crv?: string;\n  x?: string;\n  d?: string;\n  kid?: string;\n  alg?: string;\n  use?: string;\n}\n\n// =============================================================================\n// Plugin Configuration Types\n// =============================================================================\n\n/**\n * Plugin configuration from openclaw.plugin.json configSchema.\n *\n * @experimental This interface is experimental and may change.\n */\nexport interface PluginConfig {\n  enabled?: boolean;\n  output_dir?: string;\n  capture?: {\n    mode?: 'hash_only' | 'allowlist';\n    allowlist?: string[];\n    max_payload_size?: number;\n  };\n  signing: {\n    key_ref: string;\n    issuer: string;\n    audience?: string;\n  };\n  correlation?: {\n    include_workflow?: boolean;\n    // Note: include_identity and identity_attestation_ref are reserved for future use\n  };\n  background?: {\n    drain_interval_ms?: number;\n    batch_size?: number;\n  };\n}\n\n/**\n * OpenClaw plugin context provided by the runtime.\n */\nexport interface PluginContext {\n  /** Plugin configuration from gateway config */\n  config: PluginConfig;\n  /** Agent workspace directory */\n  workspaceDir: string;\n  /** Logger instance */\n  logger: PluginLogger;\n  /** Register a tool call hook */\n  onToolCall: (handler: ToolCallHandler) => void;\n  /** Register a tool result hook */\n  onToolResult: (handler: ToolResultHandler) => void;\n  /** Register tools */\n  registerTools: (tools: PluginTool[]) => void;\n}\n\n/**\n * Plugin logger interface.\n */\nexport interface PluginLogger {\n  debug: (message: string, ...args: unknown[]) => void;\n  info: (message: string, ...args: unknown[]) => void;\n  warn: (message: string, ...args: unknown[]) => void;\n  error: (message: string, ...args: unknown[]) => void;\n}\n\n/**\n * Tool call event from OpenClaw.\n */\nexport interface ToolCallEvent {\n  tool_call_id: string;\n  run_id: string;\n  session_key?: string;\n  tool_name: string;\n  tool_provider?: string;\n  input: unknown;\n  started_at: string;\n}\n\n/**\n * Tool result event from OpenClaw.\n */\nexport interface ToolResultEvent {\n  tool_call_id: string;\n  run_id: string;\n  session_key?: string;\n  tool_name: string;\n  output: unknown;\n  completed_at: string;\n  status: 'ok' | 'error' | 'timeout' | 'canceled';\n  error_code?: string;\n}\n\n/**\n * Tool call handler function.\n */\nexport type ToolCallHandler = (event: ToolCallEvent) => void | Promise<void>;\n\n/**\n * Tool result handler function.\n */\nexport type ToolResultHandler = (event: ToolResultEvent) => void | Promise<void>;\n\n/**\n * Plugin tool definition.\n */\nexport interface PluginTool {\n  name: string;\n  description: string;\n  parameters?: Record<string, unknown>;\n  execute: (params: Record<string, unknown>) => Promise<unknown>;\n}\n\n// =============================================================================\n// Signer Creation\n// =============================================================================\n\n/**\n * Create a signer from a JWK private key.\n *\n * @param jwk - Ed25519 private key in JWK format\n * @param issuer - Issuer URI for receipts\n * @param audience - Optional audience URI\n * @returns Signer instance\n */\nexport function createJwkSigner(jwk: JWK, issuer: string, audience?: string): Signer {\n  const kid = jwk.kid || generateKeyId(jwk);\n\n  // Extract the private key bytes from JWK\n  if (!jwk.d) {\n    throw new Error('JWK must include private key (d parameter)');\n  }\n\n  // Decode base64url to get raw key bytes\n  const privateKeyBytes = base64urlDecode(jwk.d);\n\n  return {\n    async sign(payload: unknown): Promise<string> {\n      return sign(payload, privateKeyBytes, kid);\n    },\n\n    getKeyId(): string {\n      return kid;\n    },\n\n    getIssuer(): string {\n      return issuer;\n    },\n\n    getAudience(): string | undefined {\n      return audience;\n    },\n  };\n}\n\n/**\n * Resolve a signer from a key reference string.\n *\n * Supported formats:\n * - env:VAR_NAME - Load key from environment variable\n * - file:/path - Load from file (development only)\n *\n * @param keyRef - Key reference string\n * @param issuer - Issuer URI\n * @param audience - Optional audience URI\n * @returns Promise resolving to Signer\n */\nexport async function resolveSigner(\n  keyRef: string,\n  issuer: string,\n  audience?: string\n): Promise<Signer> {\n  const colonIndex = keyRef.indexOf(':');\n  if (colonIndex === -1) {\n    throw new Error(`Invalid key reference format: ${keyRef}. Expected scheme:value`);\n  }\n\n  const scheme = keyRef.slice(0, colonIndex);\n  const value = keyRef.slice(colonIndex + 1);\n\n  switch (scheme) {\n    case 'env': {\n      const keyData = process.env[value];\n      if (!keyData) {\n        throw new Error(`Environment variable ${value} not set for signing key`);\n      }\n      const jwk = JSON.parse(keyData) as JWK;\n      return createJwkSigner(jwk, issuer, audience);\n    }\n\n    case 'file': {\n      const fs = await import('fs');\n      const keyData = await fs.promises.readFile(value, 'utf-8');\n      const jwk = JSON.parse(keyData) as JWK;\n      return createJwkSigner(jwk, issuer, audience);\n    }\n\n    case 'keychain':\n      throw new Error('Keychain signing not yet implemented. Use env: for development.');\n\n    case 'sidecar':\n      throw new Error('Sidecar signing not yet implemented. Use env: for development.');\n\n    default:\n      throw new Error(`Unknown key reference scheme: ${scheme}. Use env: or file:`);\n  }\n}\n\n/**\n * Generate a key ID from a JWK by hashing its public components.\n */\nexport function generateKeyId(jwk: JWK): string {\n  const publicPart = jwk.x || '';\n  let hash = 0;\n  for (let i = 0; i < publicPart.length; i++) {\n    const char = publicPart.charCodeAt(i);\n    hash = (hash << 5) - hash + char;\n    hash = hash & hash;\n  }\n  return `k_${Math.abs(hash).toString(16).padStart(8, '0')}`;\n}\n\n// =============================================================================\n// Receipt Writer\n// =============================================================================\n\n/**\n * Create a file system receipt writer with atomic writes.\n *\n * Writes are atomic: write to .tmp, fsync, rename. This ensures\n * partially written files are never observable.\n *\n * @param outputDir - Directory for receipt files\n * @returns Promise resolving to ReceiptWriter\n */\nexport async function createFileReceiptWriter(outputDir: string): Promise<ReceiptWriter> {\n  const fs = await import('fs');\n  const pathModule = await import('path');\n\n  // Use path.resolve for portability\n  const resolvedOutputDir = pathModule.resolve(outputDir);\n\n  // Ensure directory exists\n  await fs.promises.mkdir(resolvedOutputDir, { recursive: true });\n\n  return {\n    async write(receipt) {\n      const filename = `${receipt.rid}.peac.json`;\n      const filepath = pathModule.join(resolvedOutputDir, filename);\n      const tempPath = `${filepath}.tmp`;\n\n      // Decode the JWS payload to persist the full receipt structure.\n      // The verify and export tools expect auth + evidence blocks at the top level.\n      // JWS compact serialization: header.payload.signature (base64url)\n      let content: string;\n      const jwsParts = receipt.jws.split('.');\n      if (jwsParts.length !== 3) {\n        // Malformed JWS -- write _jws-only receipt (best effort, still recoverable)\n        content = JSON.stringify({ _jws: receipt.jws }, null, 2);\n      } else {\n        try {\n          const payloadJson = Buffer.from(jwsParts[1], 'base64url').toString('utf-8');\n          const payload = JSON.parse(payloadJson);\n\n          // Split payload into auth (identity fields) and evidence (data fields)\n          const { evidence, ...auth } = payload;\n\n          content = JSON.stringify({ auth, evidence, _jws: receipt.jws }, null, 2);\n        } catch {\n          // Payload decode failed -- write _jws-only receipt (best effort)\n          content = JSON.stringify({ _jws: receipt.jws }, null, 2);\n        }\n      }\n\n      // Atomic write: write to .tmp, fsync, rename, fsync dir\n      await fs.promises.writeFile(tempPath, content, 'utf-8');\n\n      // fsync file for durability (open, sync, close)\n      const fd = await fs.promises.open(tempPath, 'r');\n      await fd.sync();\n      await fd.close();\n\n      // Atomic rename (POSIX guarantees atomicity)\n      await fs.promises.rename(tempPath, filepath);\n\n      // fsync parent directory for full crash durability (POSIX best practice)\n      // This ensures the rename is persisted even on power loss\n      // Best-effort: may fail on some platforms (Windows, network FS)\n      try {\n        const dirFd = await fs.promises.open(resolvedOutputDir, 'r');\n        await dirFd.sync();\n        await dirFd.close();\n      } catch {\n        // Directory fsync not supported on this platform - continue anyway\n        // Receipt is still atomic via rename, just not fully durable on power loss\n      }\n\n      return filepath;\n    },\n\n    async close() {\n      // No-op for file writer\n    },\n  };\n}\n\n// =============================================================================\n// Plugin Instance\n// =============================================================================\n\n/**\n * Plugin instance state.\n */\nexport interface PluginInstance {\n  /** Capture session */\n  session: CaptureSession;\n  /** Hook handler for tool calls */\n  hookHandler: OpenClawHookHandler;\n  /** Background emitter service */\n  backgroundService: BackgroundEmitterService;\n  /** Start the plugin */\n  start(): void;\n  /** Stop the plugin */\n  stop(): Promise<void>;\n  /** Get plugin stats */\n  getStats(): PluginStats;\n}\n\n/**\n * Plugin statistics.\n */\nexport interface PluginStats {\n  totalCaptured: number;\n  duplicatesSkipped: number;\n  pendingCount: number;\n  totalEmitted: number;\n  totalErrors: number;\n  keyId: string;\n  isRunning: boolean;\n}\n\n/**\n * Options for creating a plugin instance.\n */\nexport interface CreatePluginOptions {\n  /** Signer for receipts */\n  signer: Signer;\n  /** Receipt writer */\n  writer: ReceiptWriter;\n  /** Adapter configuration */\n  adapterConfig?: OpenClawAdapterConfig;\n  /** Spool store implementation (required) */\n  store: SpoolStore;\n  /** Dedupe index implementation (required) */\n  dedupe: DedupeIndex;\n  /** Background drain interval in ms (default: 1000) */\n  drainIntervalMs?: number;\n  /** Batch size for draining (default: 100) */\n  batchSize?: number;\n  /** Error callback */\n  onError?: (error: Error) => void;\n}\n\n/**\n * Create a plugin instance.\n *\n * @param options - Plugin options\n * @returns Plugin instance\n */\nexport async function createPluginInstance(options: CreatePluginOptions): Promise<PluginInstance> {\n  const {\n    signer,\n    writer,\n    adapterConfig,\n    store,\n    dedupe,\n    drainIntervalMs = 1000,\n    batchSize = 100,\n    onError,\n  } = options;\n\n  // Create hasher\n  const hasher = await createHasher();\n\n  // Create capture session\n  const session = createCaptureSession({\n    store,\n    dedupe,\n    hasher,\n  });\n\n  // Track stats\n  const stats: PluginStats = {\n    totalCaptured: 0,\n    duplicatesSkipped: 0,\n    pendingCount: 0,\n    totalEmitted: 0,\n    totalErrors: 0,\n    keyId: signer.getKeyId(),\n    isRunning: false,\n  };\n\n  // Create hook handler\n  const hookHandler = createHookHandler({\n    session,\n    config: adapterConfig,\n    onCapture: (result) => {\n      if (result.success) {\n        stats.totalCaptured++;\n        stats.pendingCount++;\n      } else {\n        stats.duplicatesSkipped++;\n      }\n    },\n  });\n\n  // Create receipt emitter\n  const emitter = createReceiptEmitter({\n    signer,\n    writer,\n    onEmit: (result) => {\n      if (result.success) {\n        stats.totalEmitted++;\n        stats.pendingCount = Math.max(0, stats.pendingCount - 1);\n      }\n    },\n    onError: (error) => {\n      stats.totalErrors++;\n      if (onError) onError(error);\n    },\n  });\n\n  // Track last emitted sequence for cursor-based emission\n  // This is the in-memory cursor; on restart, we rebuild from dedupe index\n  let lastEmittedSequence = 0;\n\n  // Mutex to prevent overlapping drain cycles\n  let drainInProgress = false;\n\n  // Create background service with proper cursor tracking\n  // Note: For full restart safety, the dedupe index should be persistent.\n  // The getPendingEntries filters out already-emitted entries using the dedupe index.\n  const backgroundService = createBackgroundService({\n    emitter,\n    drainIntervalMs,\n    getPendingEntries: async () => {\n      // Prevent overlapping drain cycles\n      if (drainInProgress) return [];\n      drainInProgress = true;\n\n      try {\n        // Read entries after the last emitted sequence\n        const currentSequence = await store.getSequence();\n        if (currentSequence <= lastEmittedSequence) return [];\n\n        // Read from cursor position\n        const entries = await store.read(lastEmittedSequence, batchSize);\n\n        // Filter out entries that are already emitted (restart safety)\n        // This uses the persistent dedupe index as source of truth\n        const pending = [];\n        for (const entry of entries) {\n          if (entry.sequence <= lastEmittedSequence) continue;\n          // Check if already emitted in dedupe index\n          const dedupeEntry = await dedupe.get(entry.action.id);\n          if (dedupeEntry?.emitted) continue;\n          pending.push(entry);\n        }\n        return pending;\n      } finally {\n        drainInProgress = false;\n      }\n    },\n    markEmitted: async (digest) => {\n      // Find the entry with this digest and update cursor\n      const entries = await store.read(lastEmittedSequence, batchSize);\n      const entry = entries.find((e) => e.entry_digest === digest);\n      if (entry) {\n        // Update in-memory cursor\n        if (entry.sequence > lastEmittedSequence) {\n          lastEmittedSequence = entry.sequence;\n        }\n        // Mark in persistent dedupe index (restart-safe)\n        await dedupe.markEmitted(entry.action.id);\n      }\n    },\n    onError,\n  });\n\n  return {\n    session,\n    hookHandler,\n    backgroundService,\n\n    start() {\n      stats.isRunning = true;\n      backgroundService.start();\n    },\n\n    async stop() {\n      backgroundService.stop();\n      await backgroundService.drain();\n      await hookHandler.close();\n      stats.isRunning = false;\n    },\n\n    getStats() {\n      return { ...stats };\n    },\n  };\n}\n","/**\n * @peac/adapter-openclaw - Signing Key Generation\n *\n * Generates an Ed25519 keypair for PEAC receipt signing.\n * Reuses generateKeyId() from plugin.ts for kid derivation.\n *\n * Usage (programmatic):\n *   const result = await generateSigningKey({ outputDir: '~/.openclaw/peac' });\n *   console.log(result.kid);\n *\n * Usage (CLI):\n *   npx @peac/adapter-openclaw keygen\n *   npx @peac/adapter-openclaw keygen --output-dir /path/to/dir\n */\n\nimport * as path from 'node:path';\nimport * as fs from 'node:fs/promises';\nimport { generateKeypair, base64urlEncode } from '@peac/crypto';\nimport { generateKeyId, type JWK } from './plugin.js';\n\n// =============================================================================\n// Types\n// =============================================================================\n\n/**\n * Options for key generation.\n */\nexport interface KeygenOptions {\n  /** Directory to write the key file to. Default: current directory. */\n  outputDir?: string;\n  /** Filename for the private key. Default: signing-key.jwk */\n  filename?: string;\n}\n\n/**\n * Result of key generation.\n */\nexport interface KeygenResult {\n  /** Key ID (derived from public key). */\n  kid: string;\n  /** Path where the private key was written. */\n  keyPath: string;\n  /** The public JWK (safe to share). */\n  publicJwk: JWK;\n  /** The private JWK (keep secret). */\n  privateJwk: JWK;\n}\n\n// =============================================================================\n// Defaults\n// =============================================================================\n\nconst DEFAULT_KEY_FILENAME = 'signing-key.jwk';\n\n// =============================================================================\n// Key Generation\n// =============================================================================\n\n/**\n * Generate an Ed25519 signing keypair and write the private key to disk.\n *\n * - Private key file has 0o600 permissions (owner read/write only).\n *   On platforms where chmod fails (Windows), a warning is logged to stderr.\n * - The key ID (kid) is derived from the public key via generateKeyId().\n *\n * @returns KeygenResult with paths and key material\n */\nexport async function generateSigningKey(options?: KeygenOptions): Promise<KeygenResult> {\n  const outputDir = options?.outputDir ?? '.';\n  const filename = options?.filename ?? DEFAULT_KEY_FILENAME;\n\n  // Generate Ed25519 keypair via @peac/crypto\n  const { privateKey: privateKeyBytes, publicKey: publicKeyBytes } = await generateKeypair();\n\n  // Encode as base64url\n  const d = base64urlEncode(privateKeyBytes);\n  const x = base64urlEncode(publicKeyBytes);\n\n  // Build JWK\n  const privateJwk: JWK = {\n    kty: 'OKP',\n    crv: 'Ed25519',\n    x,\n    d,\n    alg: 'EdDSA',\n    use: 'sig',\n  };\n\n  // Derive key ID from public component\n  const kid = generateKeyId(privateJwk);\n  privateJwk.kid = kid;\n\n  // Public JWK (no private component)\n  const publicJwk: JWK = {\n    kty: 'OKP',\n    crv: 'Ed25519',\n    x,\n    kid,\n    alg: 'EdDSA',\n    use: 'sig',\n  };\n\n  // Write to disk\n  await fs.mkdir(outputDir, { recursive: true });\n  const keyPath = path.join(outputDir, filename);\n  await fs.writeFile(keyPath, JSON.stringify(privateJwk, null, 2) + '\\n', 'utf-8');\n\n  // Set restrictive permissions (0o600 = owner read/write only)\n  try {\n    await fs.chmod(keyPath, 0o600);\n  } catch {\n    // chmod may fail on Windows -- log warning but don't fail\n    process.stderr.write(\n      `Warning: Could not set file permissions on ${keyPath}. ` +\n        `Ensure the file is not readable by other users.\\n`\n    );\n  }\n\n  return { kid, keyPath, publicJwk, privateJwk };\n}\n\n// =============================================================================\n// CLI Entry Point\n// =============================================================================\n\n/**\n * CLI handler for `peac-keygen` command.\n * Parses args, generates key, prints results.\n */\nexport async function keygenCli(args: string[]): Promise<void> {\n  let outputDir: string | undefined;\n\n  for (let i = 0; i < args.length; i++) {\n    if (args[i] === '--output-dir' && i + 1 < args.length) {\n      outputDir = args[i + 1];\n      i++;\n    } else if (args[i] === '--help' || args[i] === '-h') {\n      process.stdout.write(\n        'Usage: peac-keygen [--output-dir <dir>]\\n\\n' +\n          'Generate an Ed25519 signing key for PEAC receipt signing.\\n\\n' +\n          'Options:\\n' +\n          '  --output-dir <dir>  Directory for key file (default: current directory)\\n' +\n          '  --help, -h          Show this help message\\n'\n      );\n      return;\n    }\n  }\n\n  const result = await generateSigningKey({ outputDir });\n\n  process.stdout.write(`Key generated successfully.\\n`);\n  process.stdout.write(`  kid:      ${result.kid}\\n`);\n  process.stdout.write(`  key file: ${result.keyPath}\\n`);\n  process.stdout.write(`  public x: ${result.publicJwk.x}\\n`);\n  process.stdout.write(`\\nTo use with the OpenClaw adapter:\\n`);\n  process.stdout.write(`  signing.key_ref: \"file:${path.resolve(result.keyPath)}\"\\n`);\n}\n","#!/usr/bin/env node\n/**\n * CLI entry point for peac-keygen.\n * Invoked via: npx @peac/adapter-openclaw keygen\n */\n\nimport { keygenCli } from './keygen.js';\n\nkeygenCli(process.argv.slice(2)).catch((err: Error) => {\n  process.stderr.write(`Error: ${err.message}\\n`);\n  process.exitCode = 1;\n});\n"]}

package/dist/keygen-cli.d.ts

@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+/**
+ * CLI entry point for peac-keygen.
+ * Invoked via: npx @peac/adapter-openclaw keygen
+ */
+export {};
+//# sourceMappingURL=keygen-cli.d.ts.map

package/dist/keygen-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keygen-cli.d.ts","sourceRoot":"","sources":["../src/keygen-cli.ts"],"names":[],"mappings":";AACA;;;GAGG"}

package/dist/keygen-cli.mjs

@@ -0,0 +1,93 @@
+#!/usr/bin/env node
+import * as path from 'path';
+import * as fs from 'fs/promises';
+import { generateKeypair, base64urlEncode } from '@peac/crypto';
+import '@peac/capture-core';
+
+function generateKeyId(jwk) {
+  const publicPart = jwk.x || "";
+  let hash = 0;
+  for (let i = 0; i < publicPart.length; i++) {
+    const char = publicPart.charCodeAt(i);
+    hash = (hash << 5) - hash + char;
+    hash = hash & hash;
+  }
+  return `k_${Math.abs(hash).toString(16).padStart(8, "0")}`;
+}
+
+// src/keygen.ts
+var DEFAULT_KEY_FILENAME = "signing-key.jwk";
+async function generateSigningKey(options) {
+  const outputDir = options?.outputDir ?? ".";
+  const filename = options?.filename ?? DEFAULT_KEY_FILENAME;
+  const { privateKey: privateKeyBytes, publicKey: publicKeyBytes } = await generateKeypair();
+  const d = base64urlEncode(privateKeyBytes);
+  const x = base64urlEncode(publicKeyBytes);
+  const privateJwk = {
+    kty: "OKP",
+    crv: "Ed25519",
+    x,
+    d,
+    alg: "EdDSA",
+    use: "sig"
+  };
+  const kid = generateKeyId(privateJwk);
+  privateJwk.kid = kid;
+  const publicJwk = {
+    kty: "OKP",
+    crv: "Ed25519",
+    x,
+    kid,
+    alg: "EdDSA",
+    use: "sig"
+  };
+  await fs.mkdir(outputDir, { recursive: true });
+  const keyPath = path.join(outputDir, filename);
+  await fs.writeFile(keyPath, JSON.stringify(privateJwk, null, 2) + "\n", "utf-8");
+  try {
+    await fs.chmod(keyPath, 384);
+  } catch {
+    process.stderr.write(
+      `Warning: Could not set file permissions on ${keyPath}. Ensure the file is not readable by other users.
+`
+    );
+  }
+  return { kid, keyPath, publicJwk, privateJwk };
+}
+async function keygenCli(args) {
+  let outputDir;
+  for (let i = 0; i < args.length; i++) {
+    if (args[i] === "--output-dir" && i + 1 < args.length) {
+      outputDir = args[i + 1];
+      i++;
+    } else if (args[i] === "--help" || args[i] === "-h") {
+      process.stdout.write(
+        "Usage: peac-keygen [--output-dir <dir>]\n\nGenerate an Ed25519 signing key for PEAC receipt signing.\n\nOptions:\n  --output-dir <dir>  Directory for key file (default: current directory)\n  --help, -h          Show this help message\n"
+      );
+      return;
+    }
+  }
+  const result = await generateSigningKey({ outputDir });
+  process.stdout.write(`Key generated successfully.
+`);
+  process.stdout.write(`  kid:      ${result.kid}
+`);
+  process.stdout.write(`  key file: ${result.keyPath}
+`);
+  process.stdout.write(`  public x: ${result.publicJwk.x}
+`);
+  process.stdout.write(`
+To use with the OpenClaw adapter:
+`);
+  process.stdout.write(`  signing.key_ref: "file:${path.resolve(result.keyPath)}"
+`);
+}
+
+// src/keygen-cli.ts
+keygenCli(process.argv.slice(2)).catch((err) => {
+  process.stderr.write(`Error: ${err.message}
+`);
+  process.exitCode = 1;
+});
+//# sourceMappingURL=keygen-cli.mjs.map
+//# sourceMappingURL=keygen-cli.mjs.map

package/dist/keygen-cli.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/plugin.ts","../src/keygen.ts","../src/keygen-cli.ts"],"names":[],"mappings":";;;;;;AAqPO,SAAS,cAAc,GAAA,EAAkB;AAC9C,EAAA,MAAM,UAAA,GAAa,IAAI,CAAA,IAAK,EAAA;AAC5B,EAAA,IAAI,IAAA,GAAO,CAAA;AACX,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,UAAA,CAAW,QAAQ,CAAA,EAAA,EAAK;AAC1C,IAAA,MAAM,IAAA,GAAO,UAAA,CAAW,UAAA,CAAW,CAAC,CAAA;AACpC,IAAA,IAAA,GAAA,CAAQ,IAAA,IAAQ,KAAK,IAAA,GAAO,IAAA;AAC5B,IAAA,IAAA,GAAO,IAAA,GAAO,IAAA;AAAA,EAChB;AACA,EAAA,OAAO,CAAA,EAAA,EAAK,IAAA,CAAK,GAAA,CAAI,IAAI,CAAA,CAAE,QAAA,CAAS,EAAE,CAAA,CAAE,QAAA,CAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CAAA;AAC1D;;;AC1MA,IAAM,oBAAA,GAAuB,iBAAA;AAe7B,eAAsB,mBAAmB,OAAA,EAAgD;AACvF,EAAA,MAAM,SAAA,GAAY,SAAS,SAAA,IAAa,GAAA;AACxC,EAAA,MAAM,QAAA,GAAW,SAAS,QAAA,IAAY,oBAAA;AAGtC,EAAA,MAAM,EAAE,UAAA,EAAY,eAAA,EAAiB,WAAW,cAAA,EAAe,GAAI,MAAM,eAAA,EAAgB;AAGzF,EAAA,MAAM,CAAA,GAAI,gBAAgB,eAAe,CAAA;AACzC,EAAA,MAAM,CAAA,GAAI,gBAAgB,cAAc,CAAA;AAGxC,EAAA,MAAM,UAAA,GAAkB;AAAA,IACtB,GAAA,EAAK,KAAA;AAAA,IACL,GAAA,EAAK,SAAA;AAAA,IACL,CAAA;AAAA,IACA,CAAA;AAAA,IACA,GAAA,EAAK,OAAA;AAAA,IACL,GAAA,EAAK;AAAA,GACP;AAGA,EAAA,MAAM,GAAA,GAAM,cAAc,UAAU,CAAA;AACpC,EAAA,UAAA,CAAW,GAAA,GAAM,GAAA;AAGjB,EAAA,MAAM,SAAA,GAAiB;AAAA,IACrB,GAAA,EAAK,KAAA;AAAA,IACL,GAAA,EAAK,SAAA;AAAA,IACL,CAAA;AAAA,IACA,GAAA;AAAA,IACA,GAAA,EAAK,OAAA;AAAA,IACL,GAAA,EAAK;AAAA,GACP;AAGA,EAAA,MAAS,EAAA,CAAA,KAAA,CAAM,SAAA,EAAW,EAAE,SAAA,EAAW,MAAM,CAAA;AAC7C,EAAA,MAAM,OAAA,GAAe,IAAA,CAAA,IAAA,CAAK,SAAA,EAAW,QAAQ,CAAA;AAC7C,EAAA,MAAS,EAAA,CAAA,SAAA,CAAU,SAAS,IAAA,CAAK,SAAA,CAAU,YAAY,IAAA,EAAM,CAAC,CAAA,GAAI,IAAA,EAAM,OAAO,CAAA;AAG/E,EAAA,IAAI;AACF,IAAA,MAAS,EAAA,CAAA,KAAA,CAAM,SAAS,GAAK,CAAA;AAAA,EAC/B,CAAA,CAAA,MAAQ;AAEN,IAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,MACb,8CAA8C,OAAO,CAAA;AAAA;AAAA,KAEvD;AAAA,EACF;AAEA,EAAA,OAAO,EAAE,GAAA,EAAK,OAAA,EAAS,SAAA,EAAW,UAAA,EAAW;AAC/C;AAUA,eAAsB,UAAU,IAAA,EAA+B;AAC7D,EAAA,IAAI,SAAA;AAEJ,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,IAAA,CAAK,QAAQ,CAAA,EAAA,EAAK;AACpC,IAAA,IAAI,KAAK,CAAC,CAAA,KAAM,kBAAkB,CAAA,GAAI,CAAA,GAAI,KAAK,MAAA,EAAQ;AACrD,MAAA,SAAA,GAAY,IAAA,CAAK,IAAI,CAAC,CAAA;AACtB,MAAA,CAAA,EAAA;AAAA,IACF,CAAA,MAAA,IAAW,KAAK,CAAC,CAAA,KAAM,YAAY,IAAA,CAAK,CAAC,MAAM,IAAA,EAAM;AACnD,MAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,QACb;AAAA,OAKF;AACA,MAAA;AAAA,IACF;AAAA,EACF;AAEA,EAAA,MAAM,MAAA,GAAS,MAAM,kBAAA,CAAmB,EAAE,WAAW,CAAA;AAErD,EAAA,OAAA,CAAQ,OAAO,KAAA,CAAM,CAAA;AAAA,CAA+B,CAAA;AACpD,EAAA,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,YAAA,EAAe,MAAA,CAAO,GAAG;AAAA,CAAI,CAAA;AAClD,EAAA,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,YAAA,EAAe,MAAA,CAAO,OAAO;AAAA,CAAI,CAAA;AACtD,EAAA,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,YAAA,EAAe,MAAA,CAAO,UAAU,CAAC;AAAA,CAAI,CAAA;AAC1D,EAAA,OAAA,CAAQ,OAAO,KAAA,CAAM;AAAA;AAAA,CAAuC,CAAA;AAC5D,EAAA,OAAA,CAAQ,OAAO,KAAA,CAAM,CAAA,yBAAA,EAAiC,IAAA,CAAA,OAAA,CAAQ,MAAA,CAAO,OAAO,CAAC,CAAA;AAAA,CAAK,CAAA;AACpF;;;ACpJA,SAAA,CAAU,OAAA,CAAQ,KAAK,KAAA,CAAM,CAAC,CAAC,CAAA,CAAE,KAAA,CAAM,CAAC,GAAA,KAAe;AACrD,EAAA,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,OAAA,EAAU,GAAA,CAAI,OAAO;AAAA,CAAI,CAAA;AAC9C,EAAA,OAAA,CAAQ,QAAA,GAAW,CAAA;AACrB,CAAC,CAAA","file":"keygen-cli.mjs","sourcesContent":["/**\n * @peac/adapter-openclaw - Plugin Entry Point\n *\n * OpenClaw plugin types and utilities for PEAC receipts.\n * This module provides types and factory functions for OpenClaw integration.\n *\n * Note: Full plugin activation requires OpenClaw's plugin runtime.\n * The types and utilities here allow building custom integrations.\n */\n\nimport type { CaptureSession, SpoolStore, DedupeIndex } from '@peac/capture-core';\nimport { createCaptureSession, createHasher } from '@peac/capture-core';\nimport { sign, base64urlDecode } from '@peac/crypto';\nimport type { OpenClawAdapterConfig } from './types.js';\nimport { createHookHandler, type OpenClawHookHandler } from './hooks.js';\nimport {\n  createReceiptEmitter,\n  createBackgroundService,\n  type Signer,\n  type ReceiptWriter,\n  type BackgroundEmitterService,\n} from './emitter.js';\n\n// =============================================================================\n// JWK Type\n// =============================================================================\n\n/**\n * JSON Web Key structure for signing keys (Ed25519).\n */\nexport interface JWK {\n  kty: string;\n  crv?: string;\n  x?: string;\n  d?: string;\n  kid?: string;\n  alg?: string;\n  use?: string;\n}\n\n// =============================================================================\n// Plugin Configuration Types\n// =============================================================================\n\n/**\n * Plugin configuration from openclaw.plugin.json configSchema.\n *\n * @experimental This interface is experimental and may change.\n */\nexport interface PluginConfig {\n  enabled?: boolean;\n  output_dir?: string;\n  capture?: {\n    mode?: 'hash_only' | 'allowlist';\n    allowlist?: string[];\n    max_payload_size?: number;\n  };\n  signing: {\n    key_ref: string;\n    issuer: string;\n    audience?: string;\n  };\n  correlation?: {\n    include_workflow?: boolean;\n    // Note: include_identity and identity_attestation_ref are reserved for future use\n  };\n  background?: {\n    drain_interval_ms?: number;\n    batch_size?: number;\n  };\n}\n\n/**\n * OpenClaw plugin context provided by the runtime.\n */\nexport interface PluginContext {\n  /** Plugin configuration from gateway config */\n  config: PluginConfig;\n  /** Agent workspace directory */\n  workspaceDir: string;\n  /** Logger instance */\n  logger: PluginLogger;\n  /** Register a tool call hook */\n  onToolCall: (handler: ToolCallHandler) => void;\n  /** Register a tool result hook */\n  onToolResult: (handler: ToolResultHandler) => void;\n  /** Register tools */\n  registerTools: (tools: PluginTool[]) => void;\n}\n\n/**\n * Plugin logger interface.\n */\nexport interface PluginLogger {\n  debug: (message: string, ...args: unknown[]) => void;\n  info: (message: string, ...args: unknown[]) => void;\n  warn: (message: string, ...args: unknown[]) => void;\n  error: (message: string, ...args: unknown[]) => void;\n}\n\n/**\n * Tool call event from OpenClaw.\n */\nexport interface ToolCallEvent {\n  tool_call_id: string;\n  run_id: string;\n  session_key?: string;\n  tool_name: string;\n  tool_provider?: string;\n  input: unknown;\n  started_at: string;\n}\n\n/**\n * Tool result event from OpenClaw.\n */\nexport interface ToolResultEvent {\n  tool_call_id: string;\n  run_id: string;\n  session_key?: string;\n  tool_name: string;\n  output: unknown;\n  completed_at: string;\n  status: 'ok' | 'error' | 'timeout' | 'canceled';\n  error_code?: string;\n}\n\n/**\n * Tool call handler function.\n */\nexport type ToolCallHandler = (event: ToolCallEvent) => void | Promise<void>;\n\n/**\n * Tool result handler function.\n */\nexport type ToolResultHandler = (event: ToolResultEvent) => void | Promise<void>;\n\n/**\n * Plugin tool definition.\n */\nexport interface PluginTool {\n  name: string;\n  description: string;\n  parameters?: Record<string, unknown>;\n  execute: (params: Record<string, unknown>) => Promise<unknown>;\n}\n\n// =============================================================================\n// Signer Creation\n// =============================================================================\n\n/**\n * Create a signer from a JWK private key.\n *\n * @param jwk - Ed25519 private key in JWK format\n * @param issuer - Issuer URI for receipts\n * @param audience - Optional audience URI\n * @returns Signer instance\n */\nexport function createJwkSigner(jwk: JWK, issuer: string, audience?: string): Signer {\n  const kid = jwk.kid || generateKeyId(jwk);\n\n  // Extract the private key bytes from JWK\n  if (!jwk.d) {\n    throw new Error('JWK must include private key (d parameter)');\n  }\n\n  // Decode base64url to get raw key bytes\n  const privateKeyBytes = base64urlDecode(jwk.d);\n\n  return {\n    async sign(payload: unknown): Promise<string> {\n      return sign(payload, privateKeyBytes, kid);\n    },\n\n    getKeyId(): string {\n      return kid;\n    },\n\n    getIssuer(): string {\n      return issuer;\n    },\n\n    getAudience(): string | undefined {\n      return audience;\n    },\n  };\n}\n\n/**\n * Resolve a signer from a key reference string.\n *\n * Supported formats:\n * - env:VAR_NAME - Load key from environment variable\n * - file:/path - Load from file (development only)\n *\n * @param keyRef - Key reference string\n * @param issuer - Issuer URI\n * @param audience - Optional audience URI\n * @returns Promise resolving to Signer\n */\nexport async function resolveSigner(\n  keyRef: string,\n  issuer: string,\n  audience?: string\n): Promise<Signer> {\n  const colonIndex = keyRef.indexOf(':');\n  if (colonIndex === -1) {\n    throw new Error(`Invalid key reference format: ${keyRef}. Expected scheme:value`);\n  }\n\n  const scheme = keyRef.slice(0, colonIndex);\n  const value = keyRef.slice(colonIndex + 1);\n\n  switch (scheme) {\n    case 'env': {\n      const keyData = process.env[value];\n      if (!keyData) {\n        throw new Error(`Environment variable ${value} not set for signing key`);\n      }\n      const jwk = JSON.parse(keyData) as JWK;\n      return createJwkSigner(jwk, issuer, audience);\n    }\n\n    case 'file': {\n      const fs = await import('fs');\n      const keyData = await fs.promises.readFile(value, 'utf-8');\n      const jwk = JSON.parse(keyData) as JWK;\n      return createJwkSigner(jwk, issuer, audience);\n    }\n\n    case 'keychain':\n      throw new Error('Keychain signing not yet implemented. Use env: for development.');\n\n    case 'sidecar':\n      throw new Error('Sidecar signing not yet implemented. Use env: for development.');\n\n    default:\n      throw new Error(`Unknown key reference scheme: ${scheme}. Use env: or file:`);\n  }\n}\n\n/**\n * Generate a key ID from a JWK by hashing its public components.\n */\nexport function generateKeyId(jwk: JWK): string {\n  const publicPart = jwk.x || '';\n  let hash = 0;\n  for (let i = 0; i < publicPart.length; i++) {\n    const char = publicPart.charCodeAt(i);\n    hash = (hash << 5) - hash + char;\n    hash = hash & hash;\n  }\n  return `k_${Math.abs(hash).toString(16).padStart(8, '0')}`;\n}\n\n// =============================================================================\n// Receipt Writer\n// =============================================================================\n\n/**\n * Create a file system receipt writer with atomic writes.\n *\n * Writes are atomic: write to .tmp, fsync, rename. This ensures\n * partially written files are never observable.\n *\n * @param outputDir - Directory for receipt files\n * @returns Promise resolving to ReceiptWriter\n */\nexport async function createFileReceiptWriter(outputDir: string): Promise<ReceiptWriter> {\n  const fs = await import('fs');\n  const pathModule = await import('path');\n\n  // Use path.resolve for portability\n  const resolvedOutputDir = pathModule.resolve(outputDir);\n\n  // Ensure directory exists\n  await fs.promises.mkdir(resolvedOutputDir, { recursive: true });\n\n  return {\n    async write(receipt) {\n      const filename = `${receipt.rid}.peac.json`;\n      const filepath = pathModule.join(resolvedOutputDir, filename);\n      const tempPath = `${filepath}.tmp`;\n\n      // Decode the JWS payload to persist the full receipt structure.\n      // The verify and export tools expect auth + evidence blocks at the top level.\n      // JWS compact serialization: header.payload.signature (base64url)\n      let content: string;\n      const jwsParts = receipt.jws.split('.');\n      if (jwsParts.length !== 3) {\n        // Malformed JWS -- write _jws-only receipt (best effort, still recoverable)\n        content = JSON.stringify({ _jws: receipt.jws }, null, 2);\n      } else {\n        try {\n          const payloadJson = Buffer.from(jwsParts[1], 'base64url').toString('utf-8');\n          const payload = JSON.parse(payloadJson);\n\n          // Split payload into auth (identity fields) and evidence (data fields)\n          const { evidence, ...auth } = payload;\n\n          content = JSON.stringify({ auth, evidence, _jws: receipt.jws }, null, 2);\n        } catch {\n          // Payload decode failed -- write _jws-only receipt (best effort)\n          content = JSON.stringify({ _jws: receipt.jws }, null, 2);\n        }\n      }\n\n      // Atomic write: write to .tmp, fsync, rename, fsync dir\n      await fs.promises.writeFile(tempPath, content, 'utf-8');\n\n      // fsync file for durability (open, sync, close)\n      const fd = await fs.promises.open(tempPath, 'r');\n      await fd.sync();\n      await fd.close();\n\n      // Atomic rename (POSIX guarantees atomicity)\n      await fs.promises.rename(tempPath, filepath);\n\n      // fsync parent directory for full crash durability (POSIX best practice)\n      // This ensures the rename is persisted even on power loss\n      // Best-effort: may fail on some platforms (Windows, network FS)\n      try {\n        const dirFd = await fs.promises.open(resolvedOutputDir, 'r');\n        await dirFd.sync();\n        await dirFd.close();\n      } catch {\n        // Directory fsync not supported on this platform - continue anyway\n        // Receipt is still atomic via rename, just not fully durable on power loss\n      }\n\n      return filepath;\n    },\n\n    async close() {\n      // No-op for file writer\n    },\n  };\n}\n\n// =============================================================================\n// Plugin Instance\n// =============================================================================\n\n/**\n * Plugin instance state.\n */\nexport interface PluginInstance {\n  /** Capture session */\n  session: CaptureSession;\n  /** Hook handler for tool calls */\n  hookHandler: OpenClawHookHandler;\n  /** Background emitter service */\n  backgroundService: BackgroundEmitterService;\n  /** Start the plugin */\n  start(): void;\n  /** Stop the plugin */\n  stop(): Promise<void>;\n  /** Get plugin stats */\n  getStats(): PluginStats;\n}\n\n/**\n * Plugin statistics.\n */\nexport interface PluginStats {\n  totalCaptured: number;\n  duplicatesSkipped: number;\n  pendingCount: number;\n  totalEmitted: number;\n  totalErrors: number;\n  keyId: string;\n  isRunning: boolean;\n}\n\n/**\n * Options for creating a plugin instance.\n */\nexport interface CreatePluginOptions {\n  /** Signer for receipts */\n  signer: Signer;\n  /** Receipt writer */\n  writer: ReceiptWriter;\n  /** Adapter configuration */\n  adapterConfig?: OpenClawAdapterConfig;\n  /** Spool store implementation (required) */\n  store: SpoolStore;\n  /** Dedupe index implementation (required) */\n  dedupe: DedupeIndex;\n  /** Background drain interval in ms (default: 1000) */\n  drainIntervalMs?: number;\n  /** Batch size for draining (default: 100) */\n  batchSize?: number;\n  /** Error callback */\n  onError?: (error: Error) => void;\n}\n\n/**\n * Create a plugin instance.\n *\n * @param options - Plugin options\n * @returns Plugin instance\n */\nexport async function createPluginInstance(options: CreatePluginOptions): Promise<PluginInstance> {\n  const {\n    signer,\n    writer,\n    adapterConfig,\n    store,\n    dedupe,\n    drainIntervalMs = 1000,\n    batchSize = 100,\n    onError,\n  } = options;\n\n  // Create hasher\n  const hasher = await createHasher();\n\n  // Create capture session\n  const session = createCaptureSession({\n    store,\n    dedupe,\n    hasher,\n  });\n\n  // Track stats\n  const stats: PluginStats = {\n    totalCaptured: 0,\n    duplicatesSkipped: 0,\n    pendingCount: 0,\n    totalEmitted: 0,\n    totalErrors: 0,\n    keyId: signer.getKeyId(),\n    isRunning: false,\n  };\n\n  // Create hook handler\n  const hookHandler = createHookHandler({\n    session,\n    config: adapterConfig,\n    onCapture: (result) => {\n      if (result.success) {\n        stats.totalCaptured++;\n        stats.pendingCount++;\n      } else {\n        stats.duplicatesSkipped++;\n      }\n    },\n  });\n\n  // Create receipt emitter\n  const emitter = createReceiptEmitter({\n    signer,\n    writer,\n    onEmit: (result) => {\n      if (result.success) {\n        stats.totalEmitted++;\n        stats.pendingCount = Math.max(0, stats.pendingCount - 1);\n      }\n    },\n    onError: (error) => {\n      stats.totalErrors++;\n      if (onError) onError(error);\n    },\n  });\n\n  // Track last emitted sequence for cursor-based emission\n  // This is the in-memory cursor; on restart, we rebuild from dedupe index\n  let lastEmittedSequence = 0;\n\n  // Mutex to prevent overlapping drain cycles\n  let drainInProgress = false;\n\n  // Create background service with proper cursor tracking\n  // Note: For full restart safety, the dedupe index should be persistent.\n  // The getPendingEntries filters out already-emitted entries using the dedupe index.\n  const backgroundService = createBackgroundService({\n    emitter,\n    drainIntervalMs,\n    getPendingEntries: async () => {\n      // Prevent overlapping drain cycles\n      if (drainInProgress) return [];\n      drainInProgress = true;\n\n      try {\n        // Read entries after the last emitted sequence\n        const currentSequence = await store.getSequence();\n        if (currentSequence <= lastEmittedSequence) return [];\n\n        // Read from cursor position\n        const entries = await store.read(lastEmittedSequence, batchSize);\n\n        // Filter out entries that are already emitted (restart safety)\n        // This uses the persistent dedupe index as source of truth\n        const pending = [];\n        for (const entry of entries) {\n          if (entry.sequence <= lastEmittedSequence) continue;\n          // Check if already emitted in dedupe index\n          const dedupeEntry = await dedupe.get(entry.action.id);\n          if (dedupeEntry?.emitted) continue;\n          pending.push(entry);\n        }\n        return pending;\n      } finally {\n        drainInProgress = false;\n      }\n    },\n    markEmitted: async (digest) => {\n      // Find the entry with this digest and update cursor\n      const entries = await store.read(lastEmittedSequence, batchSize);\n      const entry = entries.find((e) => e.entry_digest === digest);\n      if (entry) {\n        // Update in-memory cursor\n        if (entry.sequence > lastEmittedSequence) {\n          lastEmittedSequence = entry.sequence;\n        }\n        // Mark in persistent dedupe index (restart-safe)\n        await dedupe.markEmitted(entry.action.id);\n      }\n    },\n    onError,\n  });\n\n  return {\n    session,\n    hookHandler,\n    backgroundService,\n\n    start() {\n      stats.isRunning = true;\n      backgroundService.start();\n    },\n\n    async stop() {\n      backgroundService.stop();\n      await backgroundService.drain();\n      await hookHandler.close();\n      stats.isRunning = false;\n    },\n\n    getStats() {\n      return { ...stats };\n    },\n  };\n}\n","/**\n * @peac/adapter-openclaw - Signing Key Generation\n *\n * Generates an Ed25519 keypair for PEAC receipt signing.\n * Reuses generateKeyId() from plugin.ts for kid derivation.\n *\n * Usage (programmatic):\n *   const result = await generateSigningKey({ outputDir: '~/.openclaw/peac' });\n *   console.log(result.kid);\n *\n * Usage (CLI):\n *   npx @peac/adapter-openclaw keygen\n *   npx @peac/adapter-openclaw keygen --output-dir /path/to/dir\n */\n\nimport * as path from 'node:path';\nimport * as fs from 'node:fs/promises';\nimport { generateKeypair, base64urlEncode } from '@peac/crypto';\nimport { generateKeyId, type JWK } from './plugin.js';\n\n// =============================================================================\n// Types\n// =============================================================================\n\n/**\n * Options for key generation.\n */\nexport interface KeygenOptions {\n  /** Directory to write the key file to. Default: current directory. */\n  outputDir?: string;\n  /** Filename for the private key. Default: signing-key.jwk */\n  filename?: string;\n}\n\n/**\n * Result of key generation.\n */\nexport interface KeygenResult {\n  /** Key ID (derived from public key). */\n  kid: string;\n  /** Path where the private key was written. */\n  keyPath: string;\n  /** The public JWK (safe to share). */\n  publicJwk: JWK;\n  /** The private JWK (keep secret). */\n  privateJwk: JWK;\n}\n\n// =============================================================================\n// Defaults\n// =============================================================================\n\nconst DEFAULT_KEY_FILENAME = 'signing-key.jwk';\n\n// =============================================================================\n// Key Generation\n// =============================================================================\n\n/**\n * Generate an Ed25519 signing keypair and write the private key to disk.\n *\n * - Private key file has 0o600 permissions (owner read/write only).\n *   On platforms where chmod fails (Windows), a warning is logged to stderr.\n * - The key ID (kid) is derived from the public key via generateKeyId().\n *\n * @returns KeygenResult with paths and key material\n */\nexport async function generateSigningKey(options?: KeygenOptions): Promise<KeygenResult> {\n  const outputDir = options?.outputDir ?? '.';\n  const filename = options?.filename ?? DEFAULT_KEY_FILENAME;\n\n  // Generate Ed25519 keypair via @peac/crypto\n  const { privateKey: privateKeyBytes, publicKey: publicKeyBytes } = await generateKeypair();\n\n  // Encode as base64url\n  const d = base64urlEncode(privateKeyBytes);\n  const x = base64urlEncode(publicKeyBytes);\n\n  // Build JWK\n  const privateJwk: JWK = {\n    kty: 'OKP',\n    crv: 'Ed25519',\n    x,\n    d,\n    alg: 'EdDSA',\n    use: 'sig',\n  };\n\n  // Derive key ID from public component\n  const kid = generateKeyId(privateJwk);\n  privateJwk.kid = kid;\n\n  // Public JWK (no private component)\n  const publicJwk: JWK = {\n    kty: 'OKP',\n    crv: 'Ed25519',\n    x,\n    kid,\n    alg: 'EdDSA',\n    use: 'sig',\n  };\n\n  // Write to disk\n  await fs.mkdir(outputDir, { recursive: true });\n  const keyPath = path.join(outputDir, filename);\n  await fs.writeFile(keyPath, JSON.stringify(privateJwk, null, 2) + '\\n', 'utf-8');\n\n  // Set restrictive permissions (0o600 = owner read/write only)\n  try {\n    await fs.chmod(keyPath, 0o600);\n  } catch {\n    // chmod may fail on Windows -- log warning but don't fail\n    process.stderr.write(\n      `Warning: Could not set file permissions on ${keyPath}. ` +\n        `Ensure the file is not readable by other users.\\n`\n    );\n  }\n\n  return { kid, keyPath, publicJwk, privateJwk };\n}\n\n// =============================================================================\n// CLI Entry Point\n// =============================================================================\n\n/**\n * CLI handler for `peac-keygen` command.\n * Parses args, generates key, prints results.\n */\nexport async function keygenCli(args: string[]): Promise<void> {\n  let outputDir: string | undefined;\n\n  for (let i = 0; i < args.length; i++) {\n    if (args[i] === '--output-dir' && i + 1 < args.length) {\n      outputDir = args[i + 1];\n      i++;\n    } else if (args[i] === '--help' || args[i] === '-h') {\n      process.stdout.write(\n        'Usage: peac-keygen [--output-dir <dir>]\\n\\n' +\n          'Generate an Ed25519 signing key for PEAC receipt signing.\\n\\n' +\n          'Options:\\n' +\n          '  --output-dir <dir>  Directory for key file (default: current directory)\\n' +\n          '  --help, -h          Show this help message\\n'\n      );\n      return;\n    }\n  }\n\n  const result = await generateSigningKey({ outputDir });\n\n  process.stdout.write(`Key generated successfully.\\n`);\n  process.stdout.write(`  kid:      ${result.kid}\\n`);\n  process.stdout.write(`  key file: ${result.keyPath}\\n`);\n  process.stdout.write(`  public x: ${result.publicJwk.x}\\n`);\n  process.stdout.write(`\\nTo use with the OpenClaw adapter:\\n`);\n  process.stdout.write(`  signing.key_ref: \"file:${path.resolve(result.keyPath)}\"\\n`);\n}\n","#!/usr/bin/env node\n/**\n * CLI entry point for peac-keygen.\n * Invoked via: npx @peac/adapter-openclaw keygen\n */\n\nimport { keygenCli } from './keygen.js';\n\nkeygenCli(process.argv.slice(2)).catch((err: Error) => {\n  process.stderr.write(`Error: ${err.message}\\n`);\n  process.exitCode = 1;\n});\n"]}

package/dist/keygen.d.ts

@@ -0,0 +1,53 @@
+/**
+ * @peac/adapter-openclaw - Signing Key Generation
+ *
+ * Generates an Ed25519 keypair for PEAC receipt signing.
+ * Reuses generateKeyId() from plugin.ts for kid derivation.
+ *
+ * Usage (programmatic):
+ *   const result = await generateSigningKey({ outputDir: '~/.openclaw/peac' });
+ *   console.log(result.kid);
+ *
+ * Usage (CLI):
+ *   npx @peac/adapter-openclaw keygen
+ *   npx @peac/adapter-openclaw keygen --output-dir /path/to/dir
+ */
+import { type JWK } from './plugin.js';
+/**
+ * Options for key generation.
+ */
+export interface KeygenOptions {
+    /** Directory to write the key file to. Default: current directory. */
+    outputDir?: string;
+    /** Filename for the private key. Default: signing-key.jwk */
+    filename?: string;
+}
+/**
+ * Result of key generation.
+ */
+export interface KeygenResult {
+    /** Key ID (derived from public key). */
+    kid: string;
+    /** Path where the private key was written. */
+    keyPath: string;
+    /** The public JWK (safe to share). */
+    publicJwk: JWK;
+    /** The private JWK (keep secret). */
+    privateJwk: JWK;
+}
+/**
+ * Generate an Ed25519 signing keypair and write the private key to disk.
+ *
+ * - Private key file has 0o600 permissions (owner read/write only).
+ *   On platforms where chmod fails (Windows), a warning is logged to stderr.
+ * - The key ID (kid) is derived from the public key via generateKeyId().
+ *
+ * @returns KeygenResult with paths and key material
+ */
+export declare function generateSigningKey(options?: KeygenOptions): Promise<KeygenResult>;
+/**
+ * CLI handler for `peac-keygen` command.
+ * Parses args, generates key, prints results.
+ */
+export declare function keygenCli(args: string[]): Promise<void>;
+//# sourceMappingURL=keygen.d.ts.map

package/dist/keygen.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keygen.d.ts","sourceRoot":"","sources":["../src/keygen.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,OAAO,EAAiB,KAAK,GAAG,EAAE,MAAM,aAAa,CAAC;AAMtD;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,sEAAsE;IACtE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,wCAAwC;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ,8CAA8C;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB,sCAAsC;IACtC,SAAS,EAAE,GAAG,CAAC;IACf,qCAAqC;IACrC,UAAU,EAAE,GAAG,CAAC;CACjB;AAYD;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CAoDvF;AAMD;;;GAGG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA2B7D"}

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAGlF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,EAAqB,KAAK,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACzE,OAAO,EAGL,KAAK,MAAM,EACX,KAAK,aAAa,EAClB,KAAK,wBAAwB,EAC9B,MAAM,cAAc,CAAC;AAMtB;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAMD;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE;QACR,IAAI,CAAC,EAAE,WAAW,GAAG,WAAW,CAAC;QACjC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;QACrB,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;IACF,OAAO,EAAE;QACP,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,WAAW,CAAC,EAAE;QACZ,gBAAgB,CAAC,EAAE,OAAO,CAAC;KAE5B,CAAC;IACF,UAAU,CAAC,EAAE;QACX,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,+CAA+C;IAC/C,MAAM,EAAE,YAAY,CAAC;IACrB,gCAAgC;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,sBAAsB;IACtB,MAAM,EAAE,YAAY,CAAC;IACrB,gCAAgC;IAChC,UAAU,EAAE,CAAC,OAAO,EAAE,eAAe,KAAK,IAAI,CAAC;IAC/C,kCAAkC;IAClC,YAAY,EAAE,CAAC,OAAO,EAAE,iBAAiB,KAAK,IAAI,CAAC;IACnD,qBAAqB;IACrB,aAAa,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,IAAI,CAAC;CAC9C;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;IACrD,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;IACpD,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;IACpD,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;CACtD;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,IAAI,GAAG,OAAO,GAAG,SAAS,GAAG,UAAU,CAAC;IAChD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE7E;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAEjF;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CAChE;AAMD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CA4BnF;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,CAmCjB;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,CAS9C;AAMD;;;;;;;;GAQG;AACH,wBAAsB,uBAAuB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAyDvF;AAMD;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,sBAAsB;IACtB,OAAO,EAAE,cAAc,CAAC;IACxB,kCAAkC;IAClC,WAAW,EAAE,mBAAmB,CAAC;IACjC,iCAAiC;IACjC,iBAAiB,EAAE,wBAAwB,CAAC;IAC5C,uBAAuB;IACvB,KAAK,IAAI,IAAI,CAAC;IACd,sBAAsB;IACtB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,uBAAuB;IACvB,QAAQ,IAAI,WAAW,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,0BAA0B;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,qBAAqB;IACrB,MAAM,EAAE,aAAa,CAAC;IACtB,4BAA4B;IAC5B,aAAa,CAAC,EAAE,qBAAqB,CAAC;IACtC,4CAA4C;IAC5C,KAAK,EAAE,UAAU,CAAC;IAClB,6CAA6C;IAC7C,MAAM,EAAE,WAAW,CAAC;IACpB,sDAAsD;IACtD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,6CAA6C;IAC7C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qBAAqB;IACrB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;CAClC;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,cAAc,CAAC,CA6IhG"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAGlF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,EAAqB,KAAK,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACzE,OAAO,EAGL,KAAK,MAAM,EACX,KAAK,aAAa,EAClB,KAAK,wBAAwB,EAC9B,MAAM,cAAc,CAAC;AAMtB;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAMD;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE;QACR,IAAI,CAAC,EAAE,WAAW,GAAG,WAAW,CAAC;QACjC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;QACrB,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;IACF,OAAO,EAAE;QACP,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,WAAW,CAAC,EAAE;QACZ,gBAAgB,CAAC,EAAE,OAAO,CAAC;KAE5B,CAAC;IACF,UAAU,CAAC,EAAE;QACX,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,+CAA+C;IAC/C,MAAM,EAAE,YAAY,CAAC;IACrB,gCAAgC;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,sBAAsB;IACtB,MAAM,EAAE,YAAY,CAAC;IACrB,gCAAgC;IAChC,UAAU,EAAE,CAAC,OAAO,EAAE,eAAe,KAAK,IAAI,CAAC;IAC/C,kCAAkC;IAClC,YAAY,EAAE,CAAC,OAAO,EAAE,iBAAiB,KAAK,IAAI,CAAC;IACnD,qBAAqB;IACrB,aAAa,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,IAAI,CAAC;CAC9C;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;IACrD,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;IACpD,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;IACpD,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;CACtD;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,IAAI,GAAG,OAAO,GAAG,SAAS,GAAG,UAAU,CAAC;IAChD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE7E;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAEjF;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CAChE;AAMD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CA4BnF;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,CAmCjB;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,CAS9C;AAMD;;;;;;;;GAQG;AACH,wBAAsB,uBAAuB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAqEvF;AAMD;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,sBAAsB;IACtB,OAAO,EAAE,cAAc,CAAC;IACxB,kCAAkC;IAClC,WAAW,EAAE,mBAAmB,CAAC;IACjC,iCAAiC;IACjC,iBAAiB,EAAE,wBAAwB,CAAC;IAC5C,uBAAuB;IACvB,KAAK,IAAI,IAAI,CAAC;IACd,sBAAsB;IACtB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,uBAAuB;IACvB,QAAQ,IAAI,WAAW,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,0BAA0B;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,qBAAqB;IACrB,MAAM,EAAE,aAAa,CAAC;IACtB,4BAA4B;IAC5B,aAAa,CAAC,EAAE,qBAAqB,CAAC;IACtC,4CAA4C;IAC5C,KAAK,EAAE,UAAU,CAAC;IAClB,6CAA6C;IAC7C,MAAM,EAAE,WAAW,CAAC;IACpB,sDAAsD;IACtD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,6CAA6C;IAC7C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qBAAqB;IACrB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;CAClC;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,cAAc,CAAC,CA6IhG"}

package/dist/tools.d.ts

@@ -21,8 +21,12 @@ interface PluginStats {
 /**
  * Create the peac_receipts.status tool.
  * Shows spool size, last receipt time, and config summary.
+ *
+ * @param getStats - Getter function that returns live stats on each invocation.
+ *                   Accepts either a getter or a static PluginStats for backwards compat.
+ * @param outputDir - Directory where receipt files are stored.
  */
-export declare function createStatusTool(stats: PluginStats, outputDir: string): PluginTool;
+export declare function createStatusTool(getStats: (() => PluginStats) | PluginStats, outputDir: string): PluginTool;
 /**
  * Create the peac_receipts.export_bundle tool.
  * Exports receipts as a bundle directory for audit.

package/dist/tools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../src/tools.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAiC5D;;GAEG;AACH,UAAU,WAAW;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,OAAO,CAAC;CACpB;AAMD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,GAAG,UAAU,CAoElF;AA4BD;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,UAAU,CA2J1F;AAoBD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,YAAY,GAAG,UAAU,CAmDjE;AA6RD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,UAAU,CAoNnF"}
+{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../src/tools.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AA0D5D;;GAEG;AACH,UAAU,WAAW;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,OAAO,CAAC;CACpB;AAMD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,CAAC,MAAM,WAAW,CAAC,GAAG,WAAW,EAC3C,SAAS,EAAE,MAAM,GAChB,UAAU,CAqEZ;AA4BD;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,UAAU,CAmM1F;AA8BD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,YAAY,GAAG,UAAU,CAmDjE;AA8UD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,UAAU,CAiPnF"}

package/openclaw.plugin.json

@@ -1,7 +1,7 @@
 {
   "id": "peac-receipts",
   "name": "PEAC Receipts",
-  "version": "0.10.6",
+  "version": "0.10.11",
   "description": "Generate signed, verifiable evidence records for tool calls with PEAC protocol",
   "author": "PEAC Protocol",
   "license": "Apache-2.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@peac/adapter-openclaw",
-  "version": "0.10.11",
+  "version": "0.10.12",
   "description": "OpenClaw adapter for PEAC interaction evidence capture",
   "main": "dist/index.cjs",
   "types": "dist/index.d.ts",
@@ -25,6 +25,9 @@
     "url": "https://github.com/peacprotocol/peac/issues"
   },
   "homepage": "https://github.com/peacprotocol/peac#readme",
+  "bin": {
+    "peac-keygen": "./dist/keygen-cli.cjs"
+  },
   "files": [
     "dist",
     "openclaw.plugin.json",
@@ -36,14 +39,15 @@
     "provenance": true
   },
   "dependencies": {
-    "@peac/capture-core": "0.10.11",
-    "@peac/adapter-core": "0.10.11",
-    "@peac/kernel": "0.10.11",
-    "@peac/schema": "0.10.11",
-    "@peac/crypto": "0.10.11"
+    "@peac/adapter-core": "0.10.12",
+    "@peac/capture-core": "0.10.12",
+    "@peac/capture-node": "0.10.12",
+    "@peac/crypto": "0.10.12",
+    "@peac/schema": "0.10.12",
+    "@peac/kernel": "0.10.12"
   },
   "devDependencies": {
-    "@types/node": "^20.10.0",
+    "@types/node": "^22.0.0",
     "typescript": "^5.3.3",
     "vitest": "^4.0.0",
     "tsup": "^8.0.0"