@supercuts-walrus/backend 0.0.0-stage → 0.1.1

package/dist/seller-catalog-generate.js

@@ -0,0 +1,68 @@
+#!/usr/bin/env node
+import { createHash } from "node:crypto";
+import { readFileSync, statSync, writeFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { createCapabilityManifest } from "./capability.js";
+import { fail } from "./errors.js";
+import { parseArgs } from "./phase3.js";
+const args = parseArgs(process.argv.slice(2));
+const required = (name) => typeof args[name] === "string" ? args[name] : fail("ARGUMENT_REQUIRED", `--${name} is required`);
+const report = (name) => {
+    const path = resolve(required(name));
+    if ((statSync(path).mode & 0o077) !== 0)
+        fail("ARTIFACT_PERMISSIONS", `${name} report must be owner-only`);
+    const body = readFileSync(path);
+    if (!body.length || body.length > 10 * 1024 * 1024)
+        fail("ARTIFACT_INVALID", `${name} report size is invalid`);
+    let data;
+    try {
+        data = JSON.parse(body.toString());
+    }
+    catch (error) {
+        return fail("ARTIFACT_INVALID", `${name} report must be JSON`, error);
+    }
+    return { path, body, data, hash: createHash("sha256").update(body).digest("hex") };
+};
+const price = (name) => { const value = required(name); if (!/^[1-9][0-9]*$/.test(value))
+    fail("PRICE_INVALID", `${name} must be positive MIST`); return value; };
+try {
+    const run = JSON.parse(readFileSync(resolve(required("run-json")), "utf8"));
+    const origin = new URL(required("seller-url"));
+    if (origin.protocol !== "https:" && !(origin.protocol === "http:" && ["localhost", "127.0.0.1", "::1"].includes(origin.hostname)))
+        fail("SELLER_ORIGIN_INVALID", "seller URL must use HTTPS except on loopback");
+    const briefA = report("brief-a"), briefB = report("brief-b"), analysisA = report("analysis-a"), analysisB = report("analysis-b");
+    for (const item of [briefA, briefB, analysisA, analysisB])
+        if (item.data.reviewStatus !== "approved")
+            fail("ARTIFACT_REVIEW_REQUIRED", `${item.path} must be owner-reviewed before live provisioning`);
+    for (const brief of [briefA, briefB]) {
+        if (typeof brief.data.title !== "string" || typeof brief.data.body !== "string" || !Array.isArray(brief.data.citations) || brief.data.citations.length < 2 || typeof brief.data.preview !== "object")
+            fail("BRIEF_INVALID", "brief reports need title, body, two citations, and preview metadata");
+        for (const key of ["relevance", "sourceQuality"])
+            if (typeof brief.data.preview[key] !== "number" || brief.data.preview[key] < 0 || brief.data.preview[key] > 1)
+                fail("BRIEF_INVALID", `preview ${key} must be in [0,1]`);
+        if (!Number.isFinite(brief.data.preview.freshnessDays) || brief.data.preview.freshnessDays < 0 || brief.data.preview.freshnessDays > 365)
+            fail("BRIEF_INVALID", "preview freshnessDays is invalid");
+    }
+    for (const analysis of [analysisA, analysisB])
+        if (typeof analysis.data.title !== "string" || typeof analysis.data.body !== "string")
+            fail("ANALYSIS_INVALID", "analysis reports need a title and body");
+    const expiresAt = Date.now() + 7 * 24 * 60 * 60 * 1000;
+    const capability = (id, sellerId, description, rails, amount) => createCapabilityManifest({ capabilityId: id, sellerId, capability: id === "competitor-analysis" ? "sui.competitor-analysis" : "sui.market-brief", description, inputSchema: { type: "object", properties: { topic: { type: "string" } } }, outputSchema: { type: "object", properties: { title: { type: "string" }, body: { type: "string" }, citations: { type: "array" } } }, supportedRails: rails, priceBand: { minimum: amount, maximum: amount }, asset: "0x2::sui::SUI", endpoint: new URL(`/resource/${id}`, origin).toString(), expiresAt });
+    const publicA = run.addresses.publicSeller ?? fail("SELLER_CONFIG_INVALID", "first brief seller is missing"), publicB = run.addresses.secondPublicSeller ?? fail("SELLER_CONFIG_INVALID", "second brief seller is missing"), analysisSeller = run.addresses.confidentialSeller ?? fail("SELLER_CONFIG_INVALID", "analysis seller is missing");
+    const manifestA = capability("market-brief-a", publicA, String(briefA.data.title), ["x402"], price("brief-a-price"));
+    const manifestB = capability("market-brief-b", publicB, String(briefB.data.title), ["x402"], price("brief-b-price"));
+    const manifestAnalysis = capability("competitor-analysis", analysisSeller, String(analysisA.data.title), ["x402", "shielded"], price("analysis-price"));
+    const config = { sellers: [
+            { sellerId: run.addresses.publicSeller, home: run.homes.publicSeller, capabilities: [{ manifest: manifestA, preview: { title: briefA.data.title, summary: briefA.data.preview.summary, citations: briefA.data.citations, relevance: briefA.data.preview.relevance, sourceQuality: briefA.data.preview.sourceQuality, freshnessDays: briefA.data.preview.freshnessDays }, artifact: briefA.path }] },
+            { sellerId: run.addresses.secondPublicSeller, home: run.homes.secondPublicSeller, capabilities: [{ manifest: manifestB, preview: { title: briefB.data.title, summary: briefB.data.preview.summary, citations: briefB.data.citations, relevance: briefB.data.preview.relevance, sourceQuality: briefB.data.preview.sourceQuality, freshnessDays: briefB.data.preview.freshnessDays }, artifact: briefB.path }] },
+            { sellerId: run.addresses.confidentialSeller, home: run.homes.confidentialSeller, capabilities: [{ manifest: manifestAnalysis, preview: { title: analysisA.data.title, summary: "Prepared competitor analysis matched to the purchased brief" }, variants: { [briefA.hash]: analysisA.path, [briefB.hash]: analysisB.path } }] },
+        ] };
+    const output = resolve(required("output")), workflow = resolve(required("workflow-output"));
+    writeFileSync(output, `${JSON.stringify(config, null, 2)}\n`, { mode: 0o600, flag: "wx" });
+    writeFileSync(workflow, `${JSON.stringify({ capabilities: [manifestA, manifestB, manifestAnalysis] }, null, 2)}\n`, { mode: 0o600, flag: "wx" });
+    process.stdout.write(`${JSON.stringify({ config: output, workflow, briefHashes: [briefA.hash, briefB.hash], capabilityIds: [manifestA.capabilityId, manifestB.capabilityId, manifestAnalysis.capabilityId] })}\n`);
+}
+catch (error) {
+    process.stderr.write(`${error instanceof Error ? error.message : "catalog generation failed"}\n`);
+    process.exitCode = 1;
+}

package/dist/seller-database.d.ts

@@ -0,0 +1,41 @@
+import type { EncryptedSellerSnapshot } from "./seller-state.js";
+import type { SignedCapabilityRegistration } from "./capability.js";
+/** Server-only PostgREST access. The service-role key must never reach a buyer tool. */
+export declare class SellerDatabase {
+    private readonly origin;
+    private readonly serviceKey;
+    private readonly http;
+    constructor(origin: string, serviceKey: string, http?: typeof fetch);
+    private request;
+    getSnapshot(sellerId: string): Promise<{
+        payload: EncryptedSellerSnapshot;
+        revision: number;
+    } | undefined>;
+    putSnapshot(snapshot: EncryptedSellerSnapshot, expectedRevision?: number): Promise<number>;
+    listCatalog(): Promise<Array<Record<string, unknown>>>;
+    listDirectory(now?: number, offset?: number): Promise<SignedCapabilityRegistration[]>;
+    putDirectory(registration: SignedCapabilityRegistration): Promise<void>;
+    putCatalog(row: {
+        seller_id: string;
+        capability_id: string;
+        manifest: unknown;
+        blob_id: string;
+        signature: string;
+        transport_public_key: string;
+        preview: unknown;
+    }): Promise<void>;
+    addEvent(row: {
+        run_id: string;
+        seller_id: string;
+        stage: string;
+        status: string;
+        details: Record<string, unknown>;
+    }): Promise<void>;
+    listEvents(runId: string): Promise<Array<Record<string, unknown>>>;
+    listPaymentClaims(): Promise<Array<{
+        digest: string;
+        request_id: string;
+        seller_id: string;
+    }>>;
+    claimPayment(digest: string, requestId: string, sellerId: string): Promise<void>;
+}

package/dist/seller-database.js

@@ -0,0 +1,80 @@
+import { fail } from "./errors.js";
+/** Server-only PostgREST access. The service-role key must never reach a buyer tool. */
+export class SellerDatabase {
+    origin;
+    serviceKey;
+    http;
+    constructor(origin, serviceKey, http = fetch) {
+        this.origin = origin;
+        this.serviceKey = serviceKey;
+        this.http = http;
+        const url = new URL(origin);
+        if (url.protocol !== "https:")
+            fail("SELLER_DB_INVALID", "Supabase URL must use HTTPS");
+        if (!serviceKey)
+            fail("SELLER_DB_INVALID", "Supabase service key is required");
+    }
+    async request(path, init = {}) {
+        const response = await this.http(new URL(`/rest/v1/${path}`, this.origin), {
+            ...init,
+            headers: { apikey: this.serviceKey, Authorization: `Bearer ${this.serviceKey}`, ...(init.body ? { "content-type": "application/json" } : {}), ...(init.headers ?? {}) },
+            signal: init.signal ?? AbortSignal.timeout(30_000),
+        });
+        if (!response.ok) {
+            await response.arrayBuffer();
+            fail("SELLER_DB_UNAVAILABLE", `Supabase returned ${response.status}`);
+        }
+        const body = await response.text();
+        return body ? JSON.parse(body) : undefined;
+    }
+    async getSnapshot(sellerId) {
+        const rows = await this.request(`seller_state?seller_id=eq.${encodeURIComponent(sellerId)}&select=payload,revision`);
+        return rows[0];
+    }
+    async putSnapshot(snapshot, expectedRevision) {
+        if (expectedRevision === undefined) {
+            await this.request("seller_state?on_conflict=seller_id", { method: "POST", headers: { Prefer: "resolution=merge-duplicates,return=minimal" }, body: JSON.stringify({ seller_id: snapshot.sellerId, payload: snapshot, revision: 0, updated_at: new Date().toISOString() }) });
+            return 0;
+        }
+        const rows = await this.request(`seller_state?seller_id=eq.${encodeURIComponent(snapshot.sellerId)}&revision=eq.${expectedRevision}&select=revision`, { method: "PATCH", headers: { Prefer: "return=representation" }, body: JSON.stringify({ payload: snapshot, revision: expectedRevision + 1, updated_at: new Date().toISOString() }) });
+        if (!Array.isArray(rows) || rows.length !== 1 || rows[0]?.revision !== expectedRevision + 1)
+            fail("SELLER_STATE_CONFLICT", "another seller instance updated the durable snapshot");
+        return expectedRevision + 1;
+    }
+    async listCatalog() {
+        return await this.request("seller_catalog?select=seller_id,capability_id,manifest,blob_id,signature,transport_public_key,preview,updated_at&order=capability_id.asc");
+    }
+    async listDirectory(now = Date.now(), offset = 0) {
+        if (!Number.isSafeInteger(offset) || offset < 0 || offset > 100_000)
+            fail("SELLER_DIRECTORY_INVALID", "directory offset is invalid");
+        const rows = await this.request(`seller_directory?expires_at=gt.${now}&select=registration&order=capability_id.asc&limit=100&offset=${offset}`);
+        return rows.map((row) => row.registration);
+    }
+    async putDirectory(registration) {
+        const manifest = registration.manifest;
+        const existing = await this.request(`seller_directory?capability_id=eq.${encodeURIComponent(manifest.capabilityId)}&select=seller_id,registration`);
+        if (existing[0] && existing[0].seller_id !== manifest.sellerId)
+            fail("SELLER_DIRECTORY_CONFLICT", "capability ID belongs to another seller");
+        await this.request("seller_directory?on_conflict=capability_id", { method: "POST", headers: { Prefer: "resolution=merge-duplicates,return=minimal" }, body: JSON.stringify({ capability_id: manifest.capabilityId, seller_id: manifest.sellerId, registration, endpoint_origin: new URL(manifest.endpoint).origin, expires_at: manifest.expiresAt, updated_at: new Date().toISOString() }) });
+    }
+    async putCatalog(row) {
+        await this.request("seller_catalog?on_conflict=capability_id", { method: "POST", headers: { Prefer: "resolution=merge-duplicates,return=minimal" }, body: JSON.stringify({ ...row, updated_at: new Date().toISOString() }) });
+    }
+    async addEvent(row) {
+        await this.request("seller_events", { method: "POST", headers: { Prefer: "return=minimal" }, body: JSON.stringify({ ...row, created_at: new Date().toISOString() }) });
+    }
+    async listEvents(runId) {
+        return await this.request(`seller_events?run_id=eq.${encodeURIComponent(runId)}&select=seller_id,stage,status,details,created_at&order=id.asc`);
+    }
+    async listPaymentClaims() {
+        return await this.request("seller_payment_claims?select=digest,request_id,seller_id&order=digest.asc");
+    }
+    async claimPayment(digest, requestId, sellerId) {
+        const inserted = await this.request("seller_payment_claims?on_conflict=digest&select=digest,request_id,seller_id", { method: "POST", headers: { Prefer: "resolution=ignore-duplicates,return=representation" }, body: JSON.stringify({ digest, request_id: requestId, seller_id: sellerId }) });
+        if (Array.isArray(inserted) && inserted.length === 1)
+            return;
+        const existing = await this.request(`seller_payment_claims?digest=eq.${encodeURIComponent(digest)}&select=request_id,seller_id`);
+        if (existing[0]?.request_id !== requestId || existing[0]?.seller_id !== sellerId)
+            fail("PAYMENT_CONSUMED", "payment digest is already claimed by another resource");
+    }
+}

package/dist/seller-directory-cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/seller-directory-cli.js

@@ -0,0 +1,24 @@
+#!/usr/bin/env node
+import { readFileSync, statSync } from "node:fs";
+import { resolve } from "node:path";
+import { verifySignedCapability } from "./capability.js";
+import { fail } from "./errors.js";
+async function main() {
+    const [command, file, directory] = process.argv.slice(2);
+    if (command !== "publish" || !file || !directory)
+        fail("ARGUMENT_REQUIRED", "usage: supercuts-seller-directory publish <owner-only-registration.json> <directory-origin>");
+    const path = resolve(file);
+    if ((statSync(path).mode & 0o077) !== 0)
+        fail("SELLER_CONFIG_PERMISSIONS", "registration file must be owner-only");
+    const registration = JSON.parse(readFileSync(path, "utf8"));
+    await verifySignedCapability(registration);
+    const url = new URL(directory);
+    if (url.protocol !== "https:" && !(url.protocol === "http:" && ["localhost", "127.0.0.1", "::1"].includes(url.hostname)) || url.username || url.password || url.pathname !== "/" || url.search || url.hash)
+        fail("SELLER_DIRECTORY_INVALID", "directory origin must be HTTPS or loopback HTTP without path or credentials");
+    const response = await fetch(new URL("/v2/directory/register", url), { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ registration }), redirect: "error", signal: AbortSignal.timeout(90_000) });
+    const result = await response.json();
+    if (!response.ok || result.ok !== true)
+        fail("SELLER_DIRECTORY_UNAVAILABLE", String(result.message ?? `directory returned HTTP ${response.status}`));
+    process.stdout.write(`${JSON.stringify(result)}\n`);
+}
+main().catch((error) => { process.stderr.write(`${error instanceof Error ? error.message : "directory publication failed"}\n`); process.exitCode = 1; });

package/dist/seller-directory.d.ts

@@ -0,0 +1,5 @@
+import { type SignedCapabilityRegistration } from "./capability.js";
+import type { SellerDatabase } from "./seller-database.js";
+export declare function validateDirectoryOrigin(endpoint: string, allowLoopback?: boolean): Promise<URL>;
+/** The directory stores signed public metadata, never a seller role home. */
+export declare function registerDirectoryCapability(db: Pick<SellerDatabase, "putDirectory">, registration: SignedCapabilityRegistration, aggregator: string, http?: typeof fetch, allowLoopback?: boolean): Promise<void>;

package/dist/seller-directory.js

@@ -0,0 +1,50 @@
+import { lookup } from "node:dns/promises";
+import { isIP } from "node:net";
+import { verifySignedCapability } from "./capability.js";
+import { fail } from "./errors.js";
+import { canonicalJson } from "./settlement.js";
+function publicAddress(address) {
+    if (address.includes(":"))
+        return !/^(::|::1$|fc|fd|fe80:|2001:db8:)/i.test(address) && !address.startsWith("::ffff:");
+    const octets = address.split(".").map(Number);
+    return octets.length === 4 && octets.every((part) => Number.isInteger(part) && part >= 0 && part <= 255)
+        && octets[0] !== 0 && octets[0] !== 10 && octets[0] !== 127 && octets[0] < 224
+        && !(octets[0] === 169 && octets[1] === 254) && !(octets[0] === 172 && octets[1] >= 16 && octets[1] <= 31)
+        && !(octets[0] === 192 && octets[1] === 168) && !(octets[0] === 100 && octets[1] >= 64 && octets[1] <= 127);
+}
+export async function validateDirectoryOrigin(endpoint, allowLoopback = false) {
+    const url = new URL(endpoint);
+    if (url.username || url.password || url.hash || url.search || url.port && url.port !== "443" && !allowLoopback)
+        fail("SELLER_ENDPOINT_UNSAFE", "directory endpoint has credentials, query, fragment, or nonstandard port");
+    if (allowLoopback && url.protocol === "http:" && ["localhost", "127.0.0.1", "::1"].includes(url.hostname))
+        return url;
+    if (url.protocol !== "https:" || url.hostname === "localhost" || url.hostname.endsWith(".localhost"))
+        fail("SELLER_ENDPOINT_UNSAFE", "directory endpoint must use a public HTTPS origin");
+    const addresses = isIP(url.hostname) ? [{ address: url.hostname }] : await lookup(url.hostname, { all: true });
+    if (!addresses.length || addresses.some(({ address }) => !publicAddress(address)))
+        fail("SELLER_ENDPOINT_UNSAFE", "directory endpoint resolves to a nonpublic address");
+    return url;
+}
+/** The directory stores signed public metadata, never a seller role home. */
+export async function registerDirectoryCapability(db, registration, aggregator, http = fetch, allowLoopback = false) {
+    await verifySignedCapability(registration);
+    if (!/^[A-Za-z0-9_-]{1,256}$/.test(registration.manifestBlobId))
+        fail("WALRUS_BLOB_INVALID", "directory registration has an invalid Walrus blob ID");
+    const endpoint = await validateDirectoryOrigin(registration.manifest.endpoint, allowLoopback);
+    const read = async (url, limit) => {
+        const response = await http(url, { redirect: "error", signal: AbortSignal.timeout(15_000) });
+        if (!response.ok)
+            fail("SELLER_DIRECTORY_UNAVAILABLE", `registration verification returned HTTP ${response.status}`);
+        const bytes = Buffer.from(await response.arrayBuffer());
+        if (!bytes.length || bytes.length > limit)
+            fail("SELLER_DIRECTORY_INVALID", "registration verification response is too large");
+        return JSON.parse(bytes.toString());
+    };
+    const blob = await read(new URL(`/v1/blobs/${encodeURIComponent(registration.manifestBlobId)}`, aggregator), 128 * 1024);
+    if (canonicalJson(blob) !== canonicalJson(registration.manifest))
+        fail("CAPABILITY_BLOB_MISMATCH", "Walrus manifest differs from the signed registration");
+    const catalog = await read(new URL("/v2/catalog", endpoint.origin), 512 * 1024);
+    if (!Array.isArray(catalog.capabilities) || catalog.capabilities.length > 100 || !catalog.capabilities.some((item) => canonicalJson(item) === canonicalJson(registration)))
+        fail("SELLER_DIRECTORY_UNAVAILABLE", "seller endpoint does not serve the exact signed registration");
+    await db.putDirectory(registration);
+}

package/dist/seller-live-cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/seller-live-cli.js

@@ -0,0 +1,53 @@
+#!/usr/bin/env node
+import { readFileSync, statSync } from "node:fs";
+import { resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+import { fail } from "./errors.js";
+import { Phase3App, errorOutput } from "./phase3.js";
+import { LiveSellerTransport } from "./live-seller-transport.js";
+async function main() {
+    const home = process.argv[2], configPath = process.argv[3];
+    if (!home || !configPath)
+        return fail("ARGUMENT_REQUIRED", "usage: supercuts-seller-live <seller-home> <owner-only-config.json>");
+    if ((statSync(configPath).mode & 0o077) !== 0)
+        fail("SELLER_CONFIG_PERMISSIONS", "seller config must be owner-only");
+    const config = JSON.parse(readFileSync(configPath, "utf8"));
+    if (!Array.isArray(config.capabilities) || !config.capabilities.length)
+        fail("SELLER_CONFIG_INVALID", "seller config must name registered capabilities and handlers");
+    const app = new Phase3App(home), transport = new LiveSellerTransport(app, config);
+    try {
+        for (const item of config.capabilities) {
+            let registration = item.registration;
+            if (item.registrationFile) {
+                const registrationPath = resolve(item.registrationFile);
+                if ((statSync(registrationPath).mode & 0o077) !== 0)
+                    fail("SELLER_CONFIG_PERMISSIONS", "registration file must be owner-only");
+                registration = JSON.parse(readFileSync(registrationPath, "utf8"));
+            }
+            if (!registration)
+                return fail("SELLER_CONFIG_INVALID", "capability requires registration or registrationFile");
+            const path = resolve(item.handler);
+            if ((statSync(path).mode & 0o077) !== 0)
+                fail("SELLER_HANDLER_PERMISSIONS", "seller handler module must be owner-only");
+            const loaded = await import(pathToFileURL(path).href);
+            const handler = loaded.default ?? loaded.handle;
+            if (typeof handler !== "function")
+                return fail("SELLER_HANDLER_INVALID", "seller handler must export default or handle(request)");
+            await transport.register(registration, handler);
+        }
+        const origin = new URL(config.origin), server = transport.createServer();
+        const host = config.listenHost ?? "127.0.0.1", port = config.listenPort ?? (origin.protocol === "http:" && ["127.0.0.1", "localhost", "::1"].includes(origin.hostname) ? Number(origin.port || 80) : 8788);
+        if (!Number.isInteger(port) || port < 1 || port > 65535)
+            fail("SELLER_CONFIG_INVALID", "seller listenPort must be a valid TCP port");
+        await new Promise((done) => server.listen(port, host, done));
+        process.stdout.write(`${JSON.stringify({ ok: true, service: "supercuts-seller-live", origin: config.origin, capabilities: transport.runtime.catalog().map((item) => item.manifest.capabilityId) })}\n`);
+        const stop = () => server.close(() => { app.close(); process.exit(0); });
+        process.on("SIGINT", stop);
+        process.on("SIGTERM", stop);
+    }
+    catch (error) {
+        app.close();
+        throw error;
+    }
+}
+main().catch((error) => { process.stdout.write(`${JSON.stringify(errorOutput(error))}\n`); process.exitCode = 1; });

package/dist/seller-package.d.ts

@@ -0,0 +1,9 @@
+export declare function packageHostedSeller(input: {
+    home: string;
+    spec: string;
+    artifact: string;
+    metadata: string;
+    registration: string;
+    bundle: string;
+    contentType?: string;
+}): Promise<Record<string, unknown>>;

package/dist/seller-package.js

@@ -0,0 +1,50 @@
+import { readFileSync, statSync, writeFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { decodeSuiPrivateKey } from "@mysten/sui/cryptography";
+import { Ed25519Keypair } from "@mysten/sui/keypairs/ed25519";
+import { createCapabilityManifest, validateCapabilityPayload } from "./capability.js";
+import { fail } from "./errors.js";
+import { executeMandated, loadMandate } from "./mandate.js";
+import { Phase3App } from "./phase3.js";
+const ownerFile = (path) => {
+    const value = resolve(path);
+    if ((statSync(value).mode & 0o077) !== 0)
+        fail("SELLER_CONFIG_PERMISSIONS", `${value} must be owner-only`);
+    return value;
+};
+export async function packageHostedSeller(input) {
+    if (![input.home, input.spec, input.artifact, input.metadata, input.registration, input.bundle].every((value) => typeof value === "string" && value.length > 0))
+        fail("ARGUMENT_REQUIRED", "seller package requires --home, --spec, --artifact, --metadata, --registration, and --bundle");
+    const specPath = ownerFile(input.spec), artifactPath = ownerFile(input.artifact), metadataPath = ownerFile(input.metadata);
+    const artifact = readFileSync(artifactPath);
+    if (!artifact.length || artifact.length > 10 * 1024 * 1024)
+        fail("SELLER_ARTIFACT_INVALID", "hosted artifact must contain 1 byte to 10 MiB");
+    const spec = JSON.parse(readFileSync(specPath, "utf8"));
+    const metadata = JSON.parse(readFileSync(metadataPath, "utf8"));
+    const home = resolve(input.home), app = new Phase3App(home);
+    try {
+        if (app.profile.role !== "seller" || app.profile.mock || app.profile.verifierVersion !== 2)
+            fail("SELLER_POOL_VERSION_MISMATCH", "hosted packaging requires a separate live v2 seller role home");
+        const encoded = app.store.getSecret("live:sui-private-key")?.toString() ?? fail("LIVE_CREDENTIAL_MISSING", "seller signer is missing");
+        const decoded = decodeSuiPrivateKey(encoded);
+        if (decoded.scheme !== "ED25519")
+            fail("SIGNER_UNSUPPORTED", "seller requires an ED25519 signer");
+        const signer = Ed25519Keypair.fromSecretKey(decoded.secretKey), manifest = createCapabilityManifest({ ...spec, sellerId: signer.toSuiAddress() });
+        validateCapabilityPayload(manifest, "output", metadata);
+        const published = await executeMandated(app, loadMandate(home), "capability.publish", { "operation-id": `publish-${manifest.manifestHash}`, manifest });
+        const manifestBlobId = String(published.blobId ?? "");
+        if (!manifestBlobId)
+            fail("WALRUS_PUBLISH_FAILED", "capability publication omitted a Walrus blob ID");
+        const transportPublicKey = app.store.getSecret("identity:x25519-public")?.toString("base64url") ?? fail("IDENTITY_MISSING", "seller transport key is missing");
+        const sellerSignature = (await signer.signPersonalMessage(Buffer.from(`${manifest.manifestHash}:${transportPublicKey}`))).signature;
+        const registration = { manifest, manifestBlobId, transportPublicKey, sellerSignature };
+        const registrationPath = resolve(input.registration), bundlePath = resolve(input.bundle);
+        writeFileSync(registrationPath, `${JSON.stringify(registration, null, 2)}\n`, { mode: 0o600, flag: "wx" });
+        const bundle = { sellers: [{ sellerId: manifest.sellerId, home, capabilities: [{ registrationFile: registrationPath, artifactFile: artifactPath, outputMetadata: metadata, contentType: input.contentType ?? "application/octet-stream" }] }] };
+        writeFileSync(bundlePath, `${JSON.stringify(bundle, null, 2)}\n`, { mode: 0o600, flag: "wx" });
+        return { sellerId: manifest.sellerId, capabilityId: manifest.capabilityId, manifestHash: manifest.manifestHash, manifestBlobId, registrationFile: registrationPath, provisioningBundle: bundlePath, nextCommand: `supercuts-seller-v2-provision ${JSON.stringify(bundlePath)}` };
+    }
+    finally {
+        app.close();
+    }
+}

package/dist/seller-provision.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/seller-provision.js

@@ -0,0 +1,84 @@
+#!/usr/bin/env node
+import { readFileSync, statSync } from "node:fs";
+import { resolve } from "node:path";
+import { decodeSuiPrivateKey } from "@mysten/sui/cryptography";
+import { Ed25519Keypair } from "@mysten/sui/keypairs/ed25519";
+import { createHash } from "node:crypto";
+import { validateCapabilityManifest } from "./capability.js";
+import { fail } from "./errors.js";
+import { executeMandated, loadMandate } from "./mandate.js";
+import { Phase3App } from "./phase3.js";
+import { SellerDatabase } from "./seller-database.js";
+import { captureSellerHome, encryptSellerSnapshot } from "./seller-state.js";
+async function main() {
+    const path = process.argv[2] ? resolve(process.argv[2]) : fail("ARGUMENT_REQUIRED", "usage: supercuts-seller-provision <owner-only-config.json>");
+    if ((statSync(path).mode & 0o077) !== 0)
+        fail("CREDENTIAL_PERMISSIONS", "seller provision config must be owner-only");
+    const config = JSON.parse(readFileSync(path, "utf8"));
+    if (!Array.isArray(config.sellers) || config.sellers.length !== 3 || new Set(config.sellers.map((seller) => seller.sellerId)).size !== 3)
+        fail("SELLER_CONFIG_INVALID", "exactly three distinct sellers are required");
+    const required = (key) => process.env[key] ?? fail("SELLER_CONFIG_MISSING", `${key} is required`);
+    const db = new SellerDatabase(required("SUPABASE_URL"), required("SUPABASE_SERVICE_ROLE_KEY"));
+    const key = required("SELLER_STATE_KEY");
+    for (const seller of config.sellers) {
+        const app = new Phase3App(resolve(seller.home));
+        try {
+            if (app.profile.mock || app.profile.role !== "seller")
+                fail("LIVE_PROFILE_REQUIRED", "provision only live seller role homes");
+            const encoded = app.store.getSecret("live:sui-private-key")?.toString() ?? fail("LIVE_CREDENTIAL_MISSING", "seller Sui key is missing");
+            const decoded = decodeSuiPrivateKey(encoded);
+            if (decoded.scheme !== "ED25519")
+                fail("SELLER_IDENTITY_MISMATCH", "seller requires an ED25519 signer");
+            const signer = Ed25519Keypair.fromSecretKey(decoded.secretKey);
+            if (signer.toSuiAddress() !== seller.sellerId)
+                fail("SELLER_IDENTITY_MISMATCH", "seller ID must equal its Sui signer address");
+            const artifacts = {};
+            for (const capability of seller.capabilities) {
+                const manifest = capability.manifest;
+                validateCapabilityManifest(manifest);
+                if (manifest.sellerId !== seller.sellerId)
+                    fail("SELLER_IDENTITY_MISMATCH", "manifest seller ID differs from its role home");
+                if (capability.artifact) {
+                    const body = readFileSync(resolve(capability.artifact));
+                    if (manifest.capability === "sui.market-brief") {
+                        let report;
+                        try {
+                            report = JSON.parse(body.toString());
+                        }
+                        catch (error) {
+                            return fail("BRIEF_INVALID", "market brief must be JSON", error);
+                        }
+                        if (typeof report.title !== "string" || typeof report.body !== "string" || !Array.isArray(report.citations) || report.citations.length < 2 || report.citations.some((value) => typeof value !== "string" || !/^https:\/\//.test(value)))
+                            fail("BRIEF_INVALID", "market brief needs a title, body, and at least two HTTPS citations");
+                    }
+                    artifacts[manifest.capabilityId] = body.toString("base64url");
+                }
+                for (const [briefHash, artifactPath] of Object.entries(capability.variants ?? {})) {
+                    if (!/^[0-9a-f]{64}$/.test(briefHash))
+                        fail("SELLER_CONFIG_INVALID", "variant brief hash is invalid");
+                    artifacts[`${manifest.capabilityId}:${briefHash}`] = readFileSync(resolve(artifactPath)).toString("base64url");
+                }
+                if (!capability.artifact && !Object.keys(capability.variants ?? {}).length)
+                    fail("SELLER_ARTIFACT_MISSING", "capability needs a prepared artifact or brief variants");
+                const published = await executeMandated(app, loadMandate(seller.home), "capability.publish", { "operation-id": `publish-${manifest.manifestHash}`, manifest });
+                const blobId = String(published.blobId ?? "");
+                if (!blobId)
+                    fail("WALRUS_PUBLISH_FAILED", "capability publish returned no blob ID");
+                const hashes = {};
+                for (const [artifactKey, value] of Object.entries(artifacts))
+                    if (artifactKey === manifest.capabilityId || artifactKey.startsWith(`${manifest.capabilityId}:`))
+                        hashes[artifactKey.slice(manifest.capabilityId.length).replace(/^:/, "") || "default"] = createHash("sha256").update(Buffer.from(value, "base64url")).digest("hex");
+                const preview = { ...capability.preview, artifactHashes: hashes };
+                const transportPublicKey = app.store.getSecret("identity:x25519-public")?.toString("base64url") ?? fail("IDENTITY_MISSING", "seller transport key is missing");
+                const signature = (await signer.signPersonalMessage(Buffer.from(`${manifest.manifestHash}:${transportPublicKey}`))).signature;
+                await db.putCatalog({ seller_id: seller.sellerId, capability_id: manifest.capabilityId, manifest, blob_id: blobId, signature, transport_public_key: transportPublicKey, preview });
+            }
+            await db.putSnapshot(encryptSellerSnapshot(await captureSellerHome(seller.home, seller.sellerId, artifacts), key));
+            process.stdout.write(`${JSON.stringify({ sellerId: seller.sellerId, capabilities: seller.capabilities.map((item) => item.manifest.capabilityId), status: "provisioned" })}\n`);
+        }
+        finally {
+            app.close();
+        }
+    }
+}
+main().catch((error) => { process.stderr.write(`${error instanceof Error ? error.message : "provision failed"}\n`); process.exitCode = 1; });

package/dist/seller-register-cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/seller-register-cli.js

@@ -0,0 +1,40 @@
+#!/usr/bin/env node
+import { readFileSync, statSync, writeFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { decodeSuiPrivateKey } from "@mysten/sui/cryptography";
+import { Ed25519Keypair } from "@mysten/sui/keypairs/ed25519";
+import { createCapabilityManifest } from "./capability.js";
+import { fail } from "./errors.js";
+import { Phase3App, errorOutput } from "./phase3.js";
+import { executeMandated, loadMandate } from "./mandate.js";
+async function main() {
+    const home = process.argv[2], specPath = process.argv[3], outputPath = process.argv[4];
+    if (!home || !specPath || !outputPath)
+        return fail("ARGUMENT_REQUIRED", "usage: supercuts-seller-register <seller-home> <capability-spec.json> <registration.json>");
+    if ((statSync(specPath).mode & 0o077) !== 0)
+        fail("SELLER_CONFIG_PERMISSIONS", "capability spec must be owner-only");
+    const spec = JSON.parse(readFileSync(specPath, "utf8"));
+    const app = new Phase3App(home);
+    try {
+        if (app.profile.role !== "seller" || app.profile.mock)
+            fail("SELLER_LIVE_REQUIRED", "registration requires a live seller role home");
+        const encoded = app.store.getSecret("live:sui-private-key")?.toString() ?? fail("LIVE_CREDENTIAL_MISSING", "seller signer is missing");
+        const decoded = decodeSuiPrivateKey(encoded);
+        if (decoded.scheme !== "ED25519")
+            fail("SIGNER_UNSUPPORTED", "seller requires an ED25519 signer");
+        const signer = Ed25519Keypair.fromSecretKey(decoded.secretKey), manifest = createCapabilityManifest({ ...spec, sellerId: signer.toSuiAddress() });
+        const published = await executeMandated(app, loadMandate(home), "capability.publish", { "operation-id": `publish-${manifest.manifestHash}`, manifest });
+        const blobId = String(published.blobId ?? "");
+        if (!blobId)
+            fail("WALRUS_PUBLISH_FAILED", "capability publication omitted a Walrus blob ID");
+        const transportPublicKey = app.store.getSecret("identity:x25519-public")?.toString("base64url") ?? fail("IDENTITY_MISSING", "seller transport key is missing");
+        const sellerSignature = (await signer.signPersonalMessage(Buffer.from(`${manifest.manifestHash}:${transportPublicKey}`))).signature;
+        const registration = { manifest, manifestBlobId: blobId, transportPublicKey, sellerSignature };
+        writeFileSync(resolve(outputPath), `${JSON.stringify(registration, null, 2)}\n`, { mode: 0o600, flag: "wx" });
+        process.stdout.write(`${JSON.stringify({ ok: true, capabilityId: manifest.capabilityId, manifestBlobId: blobId, registrationFile: resolve(outputPath) })}\n`);
+    }
+    finally {
+        app.close();
+    }
+}
+main().catch((error) => { process.stdout.write(`${JSON.stringify(errorOutput(error))}\n`); process.exitCode = 1; });

package/dist/seller-runtime.d.ts

@@ -0,0 +1,60 @@
+import { type SignedCapabilityRegistration } from "./capability.js";
+import type { RoleStore } from "./store.js";
+export interface ServiceRequest {
+    dealId: string;
+    capabilityId: string;
+    input: Record<string, unknown>;
+    requestId: string;
+    paymentDigest: string;
+    agreementHash: string;
+    agreedAmount: string;
+    rail: "shielded" | "x402";
+}
+export interface ServiceResult {
+    artifact: Uint8Array;
+    contentType: string;
+    metadata: Record<string, unknown>;
+}
+export type ServiceHandler = (request: ServiceRequest) => Promise<ServiceResult>;
+export interface VerifiedSellerPayment {
+    finalized: true;
+    tatumVerified: true;
+    digest: string;
+    agreementHash: string;
+    sellerId: string;
+    asset: string;
+    amount: string;
+    rail: "shielded" | "x402";
+}
+export interface SellerRuntimePorts {
+    readBlob(blobId: string): Promise<Uint8Array>;
+    verifyPayment(request: ServiceRequest): Promise<VerifiedSellerPayment>;
+    encryptAndPublish(request: ServiceRequest, result: ServiceResult): Promise<{
+        blobId: string;
+        ciphertext: Uint8Array;
+    }>;
+    serve(runtime: SellerRuntime): Promise<void>;
+}
+export interface SellerDelivery {
+    dealId: string;
+    requestId: string;
+    blobId: string;
+    ciphertextHash: string;
+    artifactSha256: string;
+    contentType: string;
+    metadata: Record<string, unknown>;
+}
+/** Framework-neutral seller execution boundary. The trusted payment verifier
+ * must use chain finality and exact agreement binding, never a buyer's digest
+ * alone. The transport must decrypt/authenticate task input before calling
+ * fulfill and encrypt the artifact before Walrus publication. */
+export declare class SellerRuntime {
+    #private;
+    private readonly store;
+    private readonly ports;
+    constructor(store: RoleStore, ports: SellerRuntimePorts);
+    registerCapability(registration: SignedCapabilityRegistration, handler: ServiceHandler): Promise<void>;
+    catalog(): Array<SignedCapabilityRegistration>;
+    fulfill(request: ServiceRequest): Promise<SellerDelivery>;
+    serve(): Promise<void>;
+}