@peac/adapter-openclaw 0.10.9 → 0.10.10

package/dist/index.mjs

@@ -0,0 +1,1273 @@
+import { canonicalize, base64urlDecode, sign } from '@peac/crypto';
+import { toInteractionEvidence, createHasher, createCaptureSession } from '@peac/capture-core';
+
+// src/types.ts
+var OPENCLAW_EXTENSION_KEYS = {
+  /** OpenClaw context extension */
+  CONTEXT: "org.openclaw/context",
+  /** Security audit digest */
+  AUDIT_DIGEST: "org.openclaw/audit_digest"
+};
+var OPENCLAW_ERROR_CODES = {
+  /** Missing required field in OpenClaw event */
+  MISSING_FIELD: "E_OPENCLAW_MISSING_FIELD",
+  /** Invalid field value in OpenClaw event */
+  INVALID_FIELD: "E_OPENCLAW_INVALID_FIELD",
+  /** Payload serialization failed */
+  SERIALIZATION_FAILED: "E_OPENCLAW_SERIALIZATION_FAILED",
+  /** Signing failed */
+  SIGNING_FAILED: "E_OPENCLAW_SIGNING_FAILED",
+  /** Emitter not configured */
+  EMITTER_NOT_CONFIGURED: "E_OPENCLAW_EMITTER_NOT_CONFIGURED"
+};
+var OPENCLAW_WARNING_CODES = {
+  /** Payload exceeded size limit and was truncated for hashing */
+  PAYLOAD_TRUNCATED: "W_OPENCLAW_PAYLOAD_TRUNCATED",
+  /** Payload serialization failed (circular refs, BigInt, etc.) */
+  SERIALIZATION_FAILED: "W_OPENCLAW_SERIALIZATION_FAILED",
+  /** Optional field missing (non-critical) */
+  OPTIONAL_FIELD_MISSING: "W_OPENCLAW_OPTIONAL_FIELD_MISSING",
+  /** Unknown tool provider */
+  UNKNOWN_PROVIDER: "W_OPENCLAW_UNKNOWN_PROVIDER",
+  /** Payload dropped due to redaction policy (hash_only mode for non-allowlisted tool) */
+  PAYLOAD_REDACTED: "W_OPENCLAW_PAYLOAD_REDACTED"
+};
+var DEFAULT_PLATFORM = "openclaw";
+var DEFAULT_KIND = "tool.call";
+function mapToolCallEvent(event, config) {
+  const warnings = [];
+  const validationError = validateRequiredFields(event);
+  if (validationError) {
+    return {
+      success: false,
+      error_code: validationError.code,
+      error_message: validationError.message
+    };
+  }
+  const interactionId = buildInteractionId(event);
+  const captureMode = config?.capture?.mode ?? "hash_only";
+  const allowlist = config?.capture?.allowlist ?? [];
+  const maxPayloadSize = config?.capture?.max_payload_size ?? 1024 * 1024;
+  const isAllowlisted = captureMode === "allowlist" && allowlist.includes(event.tool_name);
+  const inputResult = serializePayloadWithPolicy(
+    event.input,
+    maxPayloadSize,
+    isAllowlisted,
+    "input"
+  );
+  const outputResult = event.output !== void 0 ? serializePayloadWithPolicy(event.output, maxPayloadSize, isAllowlisted, "output") : void 0;
+  if (inputResult.warning) {
+    warnings.push(inputResult.warning);
+  }
+  if (outputResult?.warning) {
+    warnings.push(outputResult.warning);
+  }
+  const inputBytes = inputResult.bytes;
+  const outputBytes = outputResult?.bytes;
+  const platform = config?.platform ?? DEFAULT_PLATFORM;
+  const platformVersion = config?.platform_version;
+  const pluginId = config?.plugin_id;
+  const extensions = buildExtensions(event);
+  const action = {
+    id: interactionId,
+    kind: DEFAULT_KIND,
+    platform,
+    started_at: event.started_at,
+    completed_at: event.completed_at,
+    tool_name: event.tool_name,
+    tool_provider: event.tool_provider,
+    input_bytes: inputBytes,
+    output_bytes: outputBytes,
+    status: event.status,
+    error_code: event.error_code,
+    retryable: event.retryable,
+    metadata: {
+      // Platform metadata
+      ...platformVersion && { platform_version: platformVersion },
+      ...pluginId && { plugin_id: pluginId },
+      // Tool version (not a standard field, stored in metadata)
+      ...event.tool_version && { tool_version: event.tool_version },
+      // Policy context
+      ...event.policy && {
+        policy_decision: event.policy.decision,
+        sandbox_enabled: event.policy.sandbox_enabled,
+        elevated: event.policy.elevated,
+        policy_hash: event.policy.policy_hash
+      },
+      // OpenClaw extensions (will be mapped to interaction.extensions)
+      ...extensions
+    }
+  };
+  return {
+    success: true,
+    action,
+    warnings: warnings.length > 0 ? warnings : void 0
+  };
+}
+function mapToolCallEventBatch(events, config) {
+  return events.map((event) => mapToolCallEvent(event, config));
+}
+function validateRequiredFields(event) {
+  if (!event.tool_call_id) {
+    return {
+      code: OPENCLAW_ERROR_CODES.MISSING_FIELD,
+      message: "Missing required field: tool_call_id"
+    };
+  }
+  if (!event.run_id) {
+    return {
+      code: OPENCLAW_ERROR_CODES.MISSING_FIELD,
+      message: "Missing required field: run_id"
+    };
+  }
+  if (!event.tool_name) {
+    return {
+      code: OPENCLAW_ERROR_CODES.MISSING_FIELD,
+      message: "Missing required field: tool_name"
+    };
+  }
+  if (!event.started_at) {
+    return {
+      code: OPENCLAW_ERROR_CODES.MISSING_FIELD,
+      message: "Missing required field: started_at"
+    };
+  }
+  if (!event.status) {
+    return {
+      code: OPENCLAW_ERROR_CODES.MISSING_FIELD,
+      message: "Missing required field: status"
+    };
+  }
+  const validStatuses = ["ok", "error", "timeout", "canceled"];
+  if (!validStatuses.includes(event.status)) {
+    return {
+      code: OPENCLAW_ERROR_CODES.INVALID_FIELD,
+      message: `Invalid status: ${event.status}. Expected one of: ${validStatuses.join(", ")}`
+    };
+  }
+  if (!isValidRfc3339(event.started_at)) {
+    return {
+      code: OPENCLAW_ERROR_CODES.INVALID_FIELD,
+      message: `Invalid started_at timestamp: ${event.started_at}. Expected RFC 3339 format.`
+    };
+  }
+  if (event.completed_at && !isValidRfc3339(event.completed_at)) {
+    return {
+      code: OPENCLAW_ERROR_CODES.INVALID_FIELD,
+      message: `Invalid completed_at timestamp: ${event.completed_at}. Expected RFC 3339 format.`
+    };
+  }
+  return null;
+}
+function buildInteractionId(event) {
+  const runIdEncoded = base64urlEncode(event.run_id);
+  const toolCallIdEncoded = base64urlEncode(event.tool_call_id);
+  return `openclaw/${runIdEncoded}/${toolCallIdEncoded}`;
+}
+function base64urlEncode(str) {
+  const bytes = new TextEncoder().encode(str);
+  const base64 = btoa(String.fromCharCode(...bytes));
+  return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function serializePayloadWithPolicy(payload, maxPayloadSize, isAllowlisted, fieldName) {
+  if (payload === void 0) {
+    return {};
+  }
+  let bytes;
+  try {
+    const json = canonicalize(payload);
+    bytes = new TextEncoder().encode(json);
+  } catch {
+    return {
+      warning: {
+        code: OPENCLAW_WARNING_CODES.SERIALIZATION_FAILED,
+        message: `${fieldName} payload could not be serialized (circular ref, BigInt, etc.)`,
+        field: fieldName
+      }
+    };
+  }
+  let truncated = false;
+  if (bytes.length > maxPayloadSize) {
+    bytes = bytes.slice(0, maxPayloadSize);
+    truncated = true;
+  }
+  const result = { bytes, truncated };
+  if (truncated) {
+    result.warning = {
+      code: OPENCLAW_WARNING_CODES.PAYLOAD_TRUNCATED,
+      message: `${fieldName} payload exceeded ${maxPayloadSize} bytes and was truncated`,
+      field: fieldName
+    };
+  }
+  return result;
+}
+function buildExtensions(event) {
+  const extensions = {};
+  if (event.context) {
+    const contextExt = {
+      ...event.context.channel && { channel: event.context.channel },
+      ...event.context.workspace_digest && { workspace_digest: event.context.workspace_digest },
+      ...event.context.gateway_version && { gateway_version: event.context.gateway_version },
+      tool_call_id: event.tool_call_id
+    };
+    if (Object.keys(contextExt).length > 0) {
+      extensions[OPENCLAW_EXTENSION_KEYS.CONTEXT] = contextExt;
+    }
+  } else {
+    extensions[OPENCLAW_EXTENSION_KEYS.CONTEXT] = {
+      tool_call_id: event.tool_call_id
+    };
+  }
+  if (event.context?.audit_digest) {
+    extensions[OPENCLAW_EXTENSION_KEYS.AUDIT_DIGEST] = event.context.audit_digest;
+  }
+  return extensions;
+}
+function isValidRfc3339(timestamp) {
+  const rfc3339Pattern = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?(Z|[+-]\d{2}:\d{2})$/;
+  if (!rfc3339Pattern.test(timestamp)) {
+    return false;
+  }
+  const date = new Date(timestamp);
+  return !isNaN(date.getTime());
+}
+function extractWorkflowId(event) {
+  return event.session_key;
+}
+function buildWorkflowContext(event) {
+  if (!event.session_key) {
+    return void 0;
+  }
+  return {
+    workflow_id: event.session_key,
+    step_id: event.tool_call_id,
+    tool_name: event.tool_name,
+    framework: "openclaw"
+  };
+}
+
+// src/hooks.ts
+function createHookHandler(handlerConfig) {
+  const { session, config, onCapture, onMappingError } = handlerConfig;
+  return {
+    async afterToolCall(event) {
+      const mappingResult = mapToolCallEvent(event, config);
+      if (!mappingResult.success || !mappingResult.action) {
+        if (onMappingError) {
+          onMappingError(mappingResult, event);
+        }
+        return {
+          success: false,
+          code: mappingResult.error_code ?? "E_OPENCLAW_MAPPING_FAILED",
+          message: mappingResult.error_message ?? "Failed to map OpenClaw event"
+        };
+      }
+      const captureResult = await session.capture(mappingResult.action);
+      const hookResult = captureResult.success ? { success: true, entry: captureResult.entry } : { success: false, code: captureResult.code, message: captureResult.message };
+      if (onCapture) {
+        onCapture(hookResult, event);
+      }
+      return hookResult;
+    },
+    getSession() {
+      return session;
+    },
+    async close() {
+      await session.close();
+    }
+  };
+}
+async function captureBatch(handler, events) {
+  const results = [];
+  for (const event of events) {
+    const result = await handler.afterToolCall(event);
+    results.push(result);
+  }
+  return results;
+}
+async function captureParallel(handler, events) {
+  return Promise.all(events.map((event) => handler.afterToolCall(event)));
+}
+function createSessionHistoryTailer(tailerConfig) {
+  const { handler, sessionId, pollIntervalMs = 1e3, fetchHistory, onError } = tailerConfig;
+  let running = false;
+  let inFlight = false;
+  let lastEventId;
+  let intervalHandle;
+  const poll = async () => {
+    if (inFlight) return;
+    inFlight = true;
+    try {
+      const events = await fetchHistory(sessionId, lastEventId);
+      for (const event of events) {
+        if (!running) break;
+        await handler.afterToolCall(event);
+        lastEventId = event.tool_call_id;
+      }
+    } catch (error) {
+      if (onError) {
+        onError(error instanceof Error ? error : new Error(String(error)));
+      }
+    } finally {
+      inFlight = false;
+    }
+  };
+  return {
+    start() {
+      if (running) return;
+      running = true;
+      intervalHandle = setInterval(poll, pollIntervalMs);
+      poll();
+    },
+    stop() {
+      if (!running) return;
+      running = false;
+      if (intervalHandle) {
+        clearInterval(intervalHandle);
+        intervalHandle = void 0;
+      }
+    },
+    getLastEventId() {
+      return lastEventId;
+    },
+    isRunning() {
+      return running;
+    }
+  };
+}
+function createReceiptEmitter(emitterConfig) {
+  const { signer, writer, onEmit, onError } = emitterConfig;
+  let closed = false;
+  return {
+    async emit(entry) {
+      if (closed) {
+        return {
+          success: false,
+          error_code: "E_EMITTER_CLOSED",
+          error_message: "Emitter has been closed"
+        };
+      }
+      try {
+        const interaction = toInteractionEvidence(entry);
+        const receiptPayload = buildReceiptPayload(interaction, entry, signer);
+        const jws = await signer.sign(receiptPayload);
+        const signedReceipt = {
+          rid: receiptPayload.rid,
+          jws,
+          interaction_id: entry.action.id,
+          entry_digest: entry.entry_digest
+        };
+        const receiptPath = await writer.write(signedReceipt);
+        const result = {
+          success: true,
+          receipt_path: receiptPath,
+          receipt_id: receiptPayload.rid
+        };
+        if (onEmit) {
+          onEmit(result, entry);
+        }
+        return result;
+      } catch (error) {
+        const errorMessage = error instanceof Error ? error.message : String(error);
+        if (onError) {
+          onError(error instanceof Error ? error : new Error(errorMessage), entry);
+        }
+        return {
+          success: false,
+          error_code: OPENCLAW_ERROR_CODES.SIGNING_FAILED,
+          error_message: `Failed to emit receipt: ${errorMessage}`
+        };
+      }
+    },
+    async flush() {
+    },
+    async close() {
+      closed = true;
+      await writer.close();
+    }
+  };
+}
+function buildReceiptPayload(interaction, entry, signer) {
+  const now = Math.floor(Date.now() / 1e3);
+  const rid = generateReceiptId(entry.entry_digest);
+  const payload = {
+    iss: signer.getIssuer(),
+    iat: now,
+    rid,
+    evidence: {
+      extensions: {
+        "org.peacprotocol/interaction@0.1": interaction
+      }
+    }
+  };
+  const audience = signer.getAudience();
+  if (audience) {
+    payload.aud = audience;
+  }
+  return payload;
+}
+function generateReceiptId(entryDigest) {
+  return `r_${entryDigest.slice(0, 32)}`;
+}
+function createBackgroundService(serviceConfig) {
+  const {
+    emitter,
+    getPendingEntries,
+    markEmitted,
+    drainIntervalMs = 1e3,
+    onError
+  } = serviceConfig;
+  let running = false;
+  let stopping = false;
+  let inFlight = false;
+  let intervalHandle;
+  const stats = {
+    emitted: 0,
+    failed: 0
+  };
+  const drainOnce = async () => {
+    if (inFlight) return;
+    inFlight = true;
+    try {
+      const entries = await getPendingEntries();
+      for (const entry of entries) {
+        if (stopping) break;
+        const result = await emitter.emit(entry);
+        if (result.success) {
+          await markEmitted(entry.entry_digest);
+          stats.emitted++;
+          stats.lastEmitTime = /* @__PURE__ */ new Date();
+        } else {
+          stats.failed++;
+          stats.lastError = result.error_message;
+        }
+      }
+    } catch (error) {
+      stats.lastError = error instanceof Error ? error.message : String(error);
+      if (onError) {
+        onError(error instanceof Error ? error : new Error(String(error)));
+      }
+    } finally {
+      inFlight = false;
+    }
+  };
+  return {
+    start() {
+      if (running) return;
+      running = true;
+      intervalHandle = setInterval(drainOnce, drainIntervalMs);
+      drainOnce();
+    },
+    stop() {
+      if (!running) return;
+      stopping = true;
+      running = false;
+      if (intervalHandle) {
+        clearInterval(intervalHandle);
+        intervalHandle = void 0;
+      }
+    },
+    async drain() {
+      await drainOnce();
+    },
+    isRunning() {
+      return running;
+    },
+    getStats() {
+      return { ...stats };
+    }
+  };
+}
+function createJwkSigner(jwk, issuer, audience) {
+  const kid = jwk.kid || generateKeyId(jwk);
+  if (!jwk.d) {
+    throw new Error("JWK must include private key (d parameter)");
+  }
+  const privateKeyBytes = base64urlDecode(jwk.d);
+  return {
+    async sign(payload) {
+      return sign(payload, privateKeyBytes, kid);
+    },
+    getKeyId() {
+      return kid;
+    },
+    getIssuer() {
+      return issuer;
+    },
+    getAudience() {
+      return audience;
+    }
+  };
+}
+async function resolveSigner(keyRef, issuer, audience) {
+  const colonIndex = keyRef.indexOf(":");
+  if (colonIndex === -1) {
+    throw new Error(`Invalid key reference format: ${keyRef}. Expected scheme:value`);
+  }
+  const scheme = keyRef.slice(0, colonIndex);
+  const value = keyRef.slice(colonIndex + 1);
+  switch (scheme) {
+    case "env": {
+      const keyData = process.env[value];
+      if (!keyData) {
+        throw new Error(`Environment variable ${value} not set for signing key`);
+      }
+      const jwk = JSON.parse(keyData);
+      return createJwkSigner(jwk, issuer, audience);
+    }
+    case "file": {
+      const fs = await import('fs');
+      const keyData = await fs.promises.readFile(value, "utf-8");
+      const jwk = JSON.parse(keyData);
+      return createJwkSigner(jwk, issuer, audience);
+    }
+    case "keychain":
+      throw new Error("Keychain signing not yet implemented. Use env: for development.");
+    case "sidecar":
+      throw new Error("Sidecar signing not yet implemented. Use env: for development.");
+    default:
+      throw new Error(`Unknown key reference scheme: ${scheme}. Use env: or file:`);
+  }
+}
+function generateKeyId(jwk) {
+  const publicPart = jwk.x || "";
+  let hash = 0;
+  for (let i = 0; i < publicPart.length; i++) {
+    const char = publicPart.charCodeAt(i);
+    hash = (hash << 5) - hash + char;
+    hash = hash & hash;
+  }
+  return `k_${Math.abs(hash).toString(16).padStart(8, "0")}`;
+}
+async function createFileReceiptWriter(outputDir) {
+  const fs = await import('fs');
+  const pathModule = await import('path');
+  const resolvedOutputDir = pathModule.resolve(outputDir);
+  await fs.promises.mkdir(resolvedOutputDir, { recursive: true });
+  return {
+    async write(receipt) {
+      const filename = `${receipt.rid}.peac.json`;
+      const filepath = pathModule.join(resolvedOutputDir, filename);
+      const tempPath = `${filepath}.tmp`;
+      const content = JSON.stringify(
+        {
+          rid: receipt.rid,
+          interaction_id: receipt.interaction_id,
+          entry_digest: receipt.entry_digest,
+          _jws: receipt.jws
+        },
+        null,
+        2
+      );
+      await fs.promises.writeFile(tempPath, content, "utf-8");
+      const fd = await fs.promises.open(tempPath, "r");
+      await fd.sync();
+      await fd.close();
+      await fs.promises.rename(tempPath, filepath);
+      try {
+        const dirFd = await fs.promises.open(resolvedOutputDir, "r");
+        await dirFd.sync();
+        await dirFd.close();
+      } catch {
+      }
+      return filepath;
+    },
+    async close() {
+    }
+  };
+}
+async function createPluginInstance(options) {
+  const {
+    signer,
+    writer,
+    adapterConfig,
+    store,
+    dedupe,
+    drainIntervalMs = 1e3,
+    batchSize = 100,
+    onError
+  } = options;
+  const hasher = await createHasher();
+  const session = createCaptureSession({
+    store,
+    dedupe,
+    hasher
+  });
+  const stats = {
+    totalCaptured: 0,
+    duplicatesSkipped: 0,
+    pendingCount: 0,
+    totalEmitted: 0,
+    totalErrors: 0,
+    keyId: signer.getKeyId(),
+    isRunning: false
+  };
+  const hookHandler = createHookHandler({
+    session,
+    config: adapterConfig,
+    onCapture: (result) => {
+      if (result.success) {
+        stats.totalCaptured++;
+        stats.pendingCount++;
+      } else {
+        stats.duplicatesSkipped++;
+      }
+    }
+  });
+  const emitter = createReceiptEmitter({
+    signer,
+    writer,
+    onEmit: (result) => {
+      if (result.success) {
+        stats.totalEmitted++;
+        stats.pendingCount = Math.max(0, stats.pendingCount - 1);
+      }
+    },
+    onError: (error) => {
+      stats.totalErrors++;
+      if (onError) onError(error);
+    }
+  });
+  let lastEmittedSequence = 0;
+  let drainInProgress = false;
+  const backgroundService = createBackgroundService({
+    emitter,
+    drainIntervalMs,
+    getPendingEntries: async () => {
+      if (drainInProgress) return [];
+      drainInProgress = true;
+      try {
+        const currentSequence = await store.getSequence();
+        if (currentSequence <= lastEmittedSequence) return [];
+        const entries = await store.read(lastEmittedSequence, batchSize);
+        const pending = [];
+        for (const entry of entries) {
+          if (entry.sequence <= lastEmittedSequence) continue;
+          const dedupeEntry = await dedupe.get(entry.action.id);
+          if (dedupeEntry?.emitted) continue;
+          pending.push(entry);
+        }
+        return pending;
+      } finally {
+        drainInProgress = false;
+      }
+    },
+    markEmitted: async (digest) => {
+      const entries = await store.read(lastEmittedSequence, batchSize);
+      const entry = entries.find((e) => e.entry_digest === digest);
+      if (entry) {
+        if (entry.sequence > lastEmittedSequence) {
+          lastEmittedSequence = entry.sequence;
+        }
+        await dedupe.markEmitted(entry.action.id);
+      }
+    },
+    onError
+  });
+  return {
+    session,
+    hookHandler,
+    backgroundService,
+    start() {
+      stats.isRunning = true;
+      backgroundService.start();
+    },
+    async stop() {
+      backgroundService.stop();
+      await backgroundService.drain();
+      await hookHandler.close();
+      stats.isRunning = false;
+    },
+    getStats() {
+      return { ...stats };
+    }
+  };
+}
+
+// src/tools.ts
+var MAX_STATUS_FILE_SCAN = 1e3;
+var MAX_QUERY_FILE_PARSE = 1e4;
+var MAX_FILE_SIZE_BYTES = 10 * 1024 * 1024;
+var ALLOWED_ALGORITHMS = ["EdDSA", "ES256", "ES384", "ES512", "RS256", "RS384", "RS512"];
+var ALG_KEY_TYPE_MAP = {
+  EdDSA: { kty: "OKP", crv: ["Ed25519", "Ed448"] },
+  ES256: { kty: "EC", crv: ["P-256"] },
+  ES384: { kty: "EC", crv: ["P-384"] },
+  ES512: { kty: "EC", crv: ["P-521"] },
+  RS256: { kty: "RSA" },
+  RS384: { kty: "RSA" },
+  RS512: { kty: "RSA" }
+};
+function createStatusTool(stats, outputDir) {
+  return {
+    name: "peac_receipts.status",
+    description: "Show PEAC receipts status: spool size, last receipt time, config summary",
+    parameters: {},
+    async execute() {
+      const fs = await import('fs');
+      const pathModule = await import('path');
+      const resolvedOutputDir = pathModule.resolve(outputDir);
+      let receiptCount = 0;
+      let lastReceiptTime = null;
+      let oldestReceiptTime = null;
+      let countApproximate = false;
+      try {
+        const files = await fs.promises.readdir(resolvedOutputDir);
+        const receiptFiles = files.filter((f) => f.endsWith(".peac.json"));
+        receiptCount = receiptFiles.length;
+        const filesToScan = receiptFiles.slice(0, MAX_STATUS_FILE_SCAN);
+        countApproximate = receiptFiles.length > MAX_STATUS_FILE_SCAN;
+        if (filesToScan.length > 0) {
+          const fileStats = await Promise.all(
+            filesToScan.map(async (f) => {
+              const stat = await fs.promises.stat(pathModule.join(resolvedOutputDir, f));
+              return { file: f, mtime: stat.mtime };
+            })
+          );
+          fileStats.sort((a, b) => b.mtime.getTime() - a.mtime.getTime());
+          lastReceiptTime = fileStats[0].mtime.toISOString();
+          oldestReceiptTime = fileStats[fileStats.length - 1].mtime.toISOString();
+        }
+      } catch {
+      }
+      return {
+        status: "ok",
+        spool: {
+          pending_entries: stats.pendingCount,
+          total_captured: stats.totalCaptured,
+          duplicates_skipped: stats.duplicatesSkipped
+        },
+        receipts: {
+          count: receiptCount,
+          count_approximate: countApproximate,
+          output_dir: resolvedOutputDir,
+          last_receipt_time: lastReceiptTime,
+          oldest_receipt_time: oldestReceiptTime
+        },
+        emitter: {
+          total_emitted: stats.totalEmitted,
+          total_errors: stats.totalErrors,
+          is_running: stats.isRunning,
+          key_id: stats.keyId
+        }
+      };
+    }
+  };
+}
+function createExportBundleTool(outputDir, logger) {
+  return {
+    name: "peac_receipts.export_bundle",
+    description: "Export receipts as a bundle directory for audit (manifest.json + receipts/)",
+    parameters: {
+      type: "object",
+      properties: {
+        workflow_id: {
+          type: "string",
+          description: "Filter by workflow ID"
+        },
+        since: {
+          type: "string",
+          description: "Include receipts since this RFC 3339 timestamp"
+        },
+        until: {
+          type: "string",
+          description: "Include receipts until this RFC 3339 timestamp"
+        },
+        output_path: {
+          type: "string",
+          description: "Output path for bundle directory (default: peac-bundle-{timestamp})"
+        }
+      }
+    },
+    async execute(params) {
+      const fs = await import('fs');
+      const pathModule = await import('path');
+      const resolvedOutputDir = pathModule.resolve(outputDir);
+      try {
+        const files = await fs.promises.readdir(resolvedOutputDir);
+        const receiptFiles = files.filter((f) => f.endsWith(".peac.json"));
+        if (receiptFiles.length === 0) {
+          return {
+            status: "ok",
+            message: "No receipts to export",
+            receipt_count: 0
+          };
+        }
+        const receipts = [];
+        for (const file of receiptFiles) {
+          const filePath = pathModule.join(resolvedOutputDir, file);
+          let stat;
+          try {
+            stat = await fs.promises.stat(filePath);
+          } catch {
+            continue;
+          }
+          if (params.since && stat.mtime < new Date(params.since)) {
+            continue;
+          }
+          if (params.until && stat.mtime > new Date(params.until)) {
+            continue;
+          }
+          let content;
+          try {
+            content = JSON.parse(await fs.promises.readFile(filePath, "utf-8"));
+          } catch {
+            logger.warn(`Skipping invalid JSON in ${file}`);
+            continue;
+          }
+          if (params.workflow_id) {
+            const workflowExt = content?.auth?.extensions?.["org.peacprotocol/workflow"];
+            if (workflowExt?.workflow_id !== params.workflow_id) {
+              continue;
+            }
+          }
+          receipts.push({ file, content, mtime: stat.mtime });
+        }
+        if (receipts.length === 0) {
+          return {
+            status: "ok",
+            message: "No receipts match the filter criteria",
+            receipt_count: 0
+          };
+        }
+        const manifest = {
+          version: "1.0",
+          format: "peac-bundle-directory",
+          created_at: (/* @__PURE__ */ new Date()).toISOString(),
+          receipt_count: receipts.length,
+          filters: {
+            workflow_id: params.workflow_id || null,
+            since: params.since || null,
+            until: params.until || null
+          },
+          receipts: receipts.map((r) => ({
+            file: r.file,
+            mtime: r.mtime.toISOString()
+          }))
+        };
+        const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+        const bundleDir = params.output_path ? pathModule.resolve(params.output_path) : pathModule.join(resolvedOutputDir, `peac-bundle-${timestamp}`);
+        await fs.promises.mkdir(bundleDir, { recursive: true });
+        await fs.promises.writeFile(
+          pathModule.join(bundleDir, "manifest.json"),
+          JSON.stringify(manifest, null, 2)
+        );
+        const receiptsDir = pathModule.join(bundleDir, "receipts");
+        await fs.promises.mkdir(receiptsDir, { recursive: true });
+        for (const receipt of receipts) {
+          await fs.promises.writeFile(
+            pathModule.join(receiptsDir, receipt.file),
+            JSON.stringify(receipt.content, null, 2)
+          );
+        }
+        logger.info(`Exported ${receipts.length} receipts to ${bundleDir}`);
+        return {
+          status: "ok",
+          message: `Exported ${receipts.length} receipts to directory`,
+          receipt_count: receipts.length,
+          bundle_path: bundleDir
+        };
+      } catch (error) {
+        logger.error("Export bundle failed:", error);
+        return {
+          status: "error",
+          message: error instanceof Error ? error.message : "Unknown error",
+          receipt_count: 0
+        };
+      }
+    }
+  };
+}
+function createVerifyTool(logger) {
+  return {
+    name: "peac_receipts.verify",
+    description: "Verify a receipt or bundle offline",
+    parameters: {
+      type: "object",
+      properties: {
+        path: {
+          type: "string",
+          description: "Path to receipt file or bundle directory"
+        },
+        jwks_path: {
+          type: "string",
+          description: "Path to JWKS file for key verification (optional)"
+        }
+      },
+      required: ["path"]
+    },
+    async execute(params) {
+      const verifyParams = params;
+      const fs = await import('fs');
+      const pathModule = await import('path');
+      try {
+        const stat = await fs.promises.stat(verifyParams.path);
+        if (stat.isDirectory()) {
+          return await verifyBundle(
+            verifyParams.path,
+            verifyParams.jwks_path,
+            fs,
+            pathModule,
+            logger
+          );
+        } else {
+          return await verifySingleReceipt(verifyParams.path, verifyParams.jwks_path, fs, logger);
+        }
+      } catch (error) {
+        logger.error("Verification failed:", error);
+        return {
+          status: "error",
+          valid: false,
+          message: error instanceof Error ? error.message : "Unknown error",
+          errors: [error instanceof Error ? error.message : "Unknown error"]
+        };
+      }
+    }
+  };
+}
+async function verifySingleReceipt(receiptPath, jwksPath, fs, logger) {
+  const stat = await fs.promises.stat(receiptPath);
+  if (stat.size > MAX_FILE_SIZE_BYTES) {
+    return {
+      status: "error",
+      valid: false,
+      message: `File too large: ${stat.size} bytes exceeds limit of ${MAX_FILE_SIZE_BYTES} bytes`,
+      errors: [`File size ${stat.size} bytes exceeds ${MAX_FILE_SIZE_BYTES} byte limit`]
+    };
+  }
+  const content = await fs.promises.readFile(receiptPath, "utf-8");
+  const receipt = JSON.parse(content);
+  const errors = [];
+  const warnings = [];
+  if (!receipt.auth) {
+    errors.push("Missing auth block");
+  }
+  if (!receipt.evidence) {
+    errors.push("Missing evidence block");
+  }
+  const interaction = receipt.evidence?.extensions?.["org.peacprotocol/interaction@0.1"];
+  if (interaction) {
+    if (!interaction.interaction_id) {
+      errors.push("Missing interaction_id");
+    }
+    if (!interaction.kind) {
+      errors.push("Missing kind");
+    }
+    if (!interaction.executor?.platform) {
+      errors.push("Missing executor.platform");
+    }
+    if (!interaction.started_at) {
+      errors.push("Missing started_at");
+    }
+    if (interaction.completed_at && interaction.started_at) {
+      if (new Date(interaction.completed_at) < new Date(interaction.started_at)) {
+        errors.push("completed_at is before started_at");
+      }
+    }
+    if (interaction.output && !interaction.result?.status) {
+      errors.push("output present but result.status missing");
+    }
+  } else {
+    warnings.push("No interaction evidence found");
+  }
+  if (jwksPath && receipt._jws) {
+    try {
+      const { verify, base64urlDecode: base64urlDecode2, base64urlDecodeString } = await import('@peac/crypto');
+      const jwks = JSON.parse(await fs.promises.readFile(jwksPath, "utf-8"));
+      const jwsParts = receipt._jws.split(".");
+      if (jwsParts.length !== 3) {
+        errors.push("Invalid JWS format (expected 3 parts)");
+      } else {
+        const headerJson = base64urlDecodeString(jwsParts[0]);
+        const header = JSON.parse(headerJson);
+        if (header.alg === "none") {
+          errors.push('Algorithm "none" is not allowed');
+        }
+        if (header.alg && !ALLOWED_ALGORITHMS.includes(header.alg)) {
+          errors.push(
+            `Algorithm "${header.alg}" is not in allowed list: ${ALLOWED_ALGORITHMS.join(", ")}`
+          );
+        }
+        if (header.crit && header.crit.length > 0) {
+          const headerObj = header;
+          const missingCrit = header.crit.filter((h) => !(h in headerObj));
+          if (missingCrit.length > 0) {
+            errors.push(`Critical headers declared but missing: ${missingCrit.join(", ")}`);
+          }
+          errors.push(`Unsupported critical headers: ${header.crit.join(", ")}`);
+        }
+        const targetKid = header.kid;
+        let keyJwk;
+        if (!Array.isArray(jwks.keys) || jwks.keys.length === 0) {
+          errors.push("JWKS has no keys");
+        } else if (targetKid) {
+          keyJwk = jwks.keys.find((k) => k.kid === targetKid);
+          if (!keyJwk) {
+            errors.push(`Key with kid "${targetKid}" not found in JWKS`);
+          }
+        } else if (jwks.keys.length === 1) {
+          keyJwk = jwks.keys[0];
+          warnings.push("JWS has no kid - using only key from JWKS");
+        } else {
+          errors.push(`JWS missing kid but JWKS has ${jwks.keys.length} keys - cannot select`);
+        }
+        if (keyJwk && header.alg && errors.length === 0) {
+          const expectedKeyType = ALG_KEY_TYPE_MAP[header.alg];
+          if (expectedKeyType) {
+            if (keyJwk.kty !== expectedKeyType.kty) {
+              errors.push(
+                `Algorithm "${header.alg}" requires key type "${expectedKeyType.kty}" but key has "${keyJwk.kty}"`
+              );
+            } else if (expectedKeyType.crv && keyJwk.crv && !expectedKeyType.crv.includes(keyJwk.crv)) {
+              errors.push(
+                `Algorithm "${header.alg}" requires curve ${expectedKeyType.crv.join(" or ")} but key has "${keyJwk.crv}"`
+              );
+            }
+          }
+          if (keyJwk.use && keyJwk.use !== "sig") {
+            errors.push(
+              `Key use "${keyJwk.use}" is not valid for signature verification (expected "sig")`
+            );
+          }
+          if (keyJwk.key_ops && !keyJwk.key_ops.includes("verify")) {
+            errors.push(`Key operations ${JSON.stringify(keyJwk.key_ops)} do not include "verify"`);
+          }
+        }
+        if (keyJwk && errors.length === 0) {
+          const publicKeyParam = keyJwk.x || keyJwk.n;
+          if (!publicKeyParam) {
+            errors.push("Selected key missing public key (x or n parameter)");
+          } else {
+            const publicKeyBytes = base64urlDecode2(publicKeyParam);
+            await verify(receipt._jws, publicKeyBytes);
+            logger.info(`Signature verified with key ${keyJwk.kid || "anonymous"}`);
+          }
+        }
+      }
+    } catch (error) {
+      errors.push(
+        `Signature verification failed: ${error instanceof Error ? error.message : "Unknown"}`
+      );
+    }
+  } else if (!jwksPath) {
+    warnings.push("No JWKS provided - signature not verified");
+  }
+  return {
+    status: errors.length === 0 ? "ok" : "error",
+    valid: errors.length === 0,
+    message: errors.length === 0 ? "Receipt is valid" : "Receipt has validation errors",
+    errors: errors.length > 0 ? errors : void 0,
+    warnings: warnings.length > 0 ? warnings : void 0,
+    receipt_id: receipt.auth?.rid,
+    interaction_id: interaction?.interaction_id
+  };
+}
+async function verifyBundle(bundlePath, jwksPath, fs, pathModule, logger) {
+  const manifestPath = pathModule.join(bundlePath, "manifest.json");
+  const manifest = JSON.parse(await fs.promises.readFile(manifestPath, "utf-8"));
+  const receiptsDir = pathModule.join(bundlePath, "receipts");
+  const files = await fs.promises.readdir(receiptsDir);
+  let validCount = 0;
+  let invalidCount = 0;
+  const allErrors = [];
+  const allWarnings = [];
+  for (const file of files) {
+    if (!file.endsWith(".peac.json")) continue;
+    const result = await verifySingleReceipt(
+      pathModule.join(receiptsDir, file),
+      jwksPath,
+      fs,
+      logger
+    );
+    if (result.valid) {
+      validCount++;
+    } else {
+      invalidCount++;
+      if (result.errors) {
+        allErrors.push(...result.errors.map((e) => `${file}: ${e}`));
+      }
+    }
+    if (result.warnings) {
+      allWarnings.push(...result.warnings.map((w) => `${file}: ${w}`));
+    }
+  }
+  return {
+    status: invalidCount === 0 ? "ok" : "error",
+    valid: invalidCount === 0,
+    message: `Bundle verification: ${validCount} valid, ${invalidCount} invalid`,
+    errors: allErrors.length > 0 ? allErrors : void 0,
+    warnings: allWarnings.length > 0 ? allWarnings : void 0,
+    bundle_stats: {
+      total: validCount + invalidCount,
+      valid: validCount,
+      invalid: invalidCount,
+      manifest_receipt_count: manifest.receipt_count
+    }
+  };
+}
+function createQueryTool(outputDir, logger) {
+  return {
+    name: "peac_receipts.query",
+    description: "Query receipts by workflow_id, tool name, or time range",
+    parameters: {
+      type: "object",
+      properties: {
+        workflow_id: {
+          type: "string",
+          description: "Filter by workflow ID"
+        },
+        tool_name: {
+          type: "string",
+          description: "Filter by tool name"
+        },
+        since: {
+          type: "string",
+          description: "Include receipts since this RFC 3339 timestamp"
+        },
+        until: {
+          type: "string",
+          description: "Include receipts until this RFC 3339 timestamp"
+        },
+        status: {
+          type: "string",
+          enum: ["ok", "error", "timeout", "canceled"],
+          description: "Filter by result status"
+        },
+        limit: {
+          type: "integer",
+          description: "Maximum number of results (default: 100)"
+        },
+        offset: {
+          type: "integer",
+          description: "Skip this many results (for pagination)"
+        }
+      }
+    },
+    async execute(params) {
+      const fs = await import('fs');
+      const pathModule = await import('path');
+      const resolvedOutputDir = pathModule.resolve(outputDir);
+      try {
+        const files = await fs.promises.readdir(resolvedOutputDir);
+        const receiptFiles = files.filter((f) => f.endsWith(".peac.json"));
+        const limit = Math.min(params.limit || 100, MAX_QUERY_FILE_PARSE);
+        const offset = params.offset || 0;
+        const fileInfos = [];
+        for (const file of receiptFiles.slice(0, MAX_QUERY_FILE_PARSE)) {
+          try {
+            const filePath = pathModule.join(resolvedOutputDir, file);
+            const stat = await fs.promises.stat(filePath);
+            if (params.since && stat.mtime < new Date(params.since)) {
+              continue;
+            }
+            if (params.until && stat.mtime > new Date(params.until)) {
+              continue;
+            }
+            fileInfos.push({ file, mtime: stat.mtime });
+          } catch {
+            continue;
+          }
+        }
+        fileInfos.sort((a, b) => b.mtime.getTime() - a.mtime.getTime());
+        const matches = [];
+        let skippedForFilters = 0;
+        let filesSkippedForSize = 0;
+        let filesSkippedForInvalidJson = 0;
+        for (const { file } of fileInfos) {
+          const filePath = pathModule.join(resolvedOutputDir, file);
+          try {
+            const fileStat = await fs.promises.stat(filePath);
+            if (fileStat.size > MAX_FILE_SIZE_BYTES) {
+              filesSkippedForSize++;
+              continue;
+            }
+          } catch {
+            continue;
+          }
+          let content;
+          try {
+            content = JSON.parse(await fs.promises.readFile(filePath, "utf-8"));
+          } catch {
+            filesSkippedForInvalidJson++;
+            continue;
+          }
+          const interaction = content?.evidence?.extensions?.["org.peacprotocol/interaction@0.1"];
+          const workflow = content?.auth?.extensions?.["org.peacprotocol/workflow"];
+          if (params.workflow_id && workflow?.workflow_id !== params.workflow_id) {
+            skippedForFilters++;
+            continue;
+          }
+          if (params.tool_name && interaction?.tool?.name !== params.tool_name) {
+            skippedForFilters++;
+            continue;
+          }
+          if (params.status && interaction?.result?.status !== params.status) {
+            skippedForFilters++;
+            continue;
+          }
+          matches.push({
+            file,
+            receipt_id: content.auth?.rid,
+            interaction_id: interaction?.interaction_id,
+            workflow_id: workflow?.workflow_id,
+            tool_name: interaction?.tool?.name,
+            status: interaction?.result?.status,
+            started_at: interaction?.started_at,
+            completed_at: interaction?.completed_at
+          });
+          if (matches.length >= offset + limit + 100) {
+            break;
+          }
+        }
+        matches.sort((a, b) => {
+          const aTime = a.started_at ? new Date(a.started_at).getTime() : 0;
+          const bTime = b.started_at ? new Date(b.started_at).getTime() : 0;
+          if (bTime !== aTime) return bTime - aTime;
+          return a.file.localeCompare(b.file);
+        });
+        const paginated = matches.slice(offset, offset + limit);
+        const warnings = [];
+        if (receiptFiles.length > MAX_QUERY_FILE_PARSE) {
+          warnings.push(`Results capped at ${MAX_QUERY_FILE_PARSE} files`);
+        }
+        if (filesSkippedForSize > 0) {
+          warnings.push(
+            `${filesSkippedForSize} files skipped (exceeded ${MAX_FILE_SIZE_BYTES} byte limit)`
+          );
+        }
+        if (filesSkippedForInvalidJson > 0) {
+          warnings.push(`${filesSkippedForInvalidJson} files skipped (invalid JSON)`);
+        }
+        const hasTruncation = receiptFiles.length > MAX_QUERY_FILE_PARSE || filesSkippedForSize > 0 || filesSkippedForInvalidJson > 0;
+        return {
+          status: "ok",
+          total: matches.length,
+          offset,
+          limit,
+          results: paginated,
+          truncated: hasTruncation,
+          skipped: hasTruncation ? {
+            too_large: filesSkippedForSize,
+            invalid_json: filesSkippedForInvalidJson,
+            capped: receiptFiles.length > MAX_QUERY_FILE_PARSE ? receiptFiles.length - MAX_QUERY_FILE_PARSE : 0
+          } : void 0,
+          ...warnings.length > 0 && { warning: warnings.join("; ") }
+        };
+      } catch (error) {
+        logger.error("Query failed:", error);
+        return {
+          status: "error",
+          total: 0,
+          offset: 0,
+          limit: params.limit || 100,
+          results: [],
+          error: error instanceof Error ? error.message : "Unknown error"
+        };
+      }
+    }
+  };
+}
+
+export { OPENCLAW_ERROR_CODES, OPENCLAW_EXTENSION_KEYS, OPENCLAW_WARNING_CODES, buildWorkflowContext, captureBatch, captureParallel, createBackgroundService, createExportBundleTool, createFileReceiptWriter, createHookHandler, createJwkSigner, createPluginInstance, createQueryTool, createReceiptEmitter, createSessionHistoryTailer, createStatusTool, createVerifyTool, extractWorkflowId, generateKeyId, mapToolCallEvent, mapToolCallEventBatch, resolveSigner };
+//# sourceMappingURL=index.mjs.map
+//# sourceMappingURL=index.mjs.map