@vellumai/assistant 0.4.26 → 0.4.29

package/src/bundler/app-bundler.ts

@@ -5,26 +5,26 @@
  * zip archive written to a temp file.
  */
 
-import { createHash,randomUUID } from 'node:crypto';
-import { createWriteStream } from 'node:fs';
-import { readFile, stat,writeFile } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import { extname,join } from 'node:path';
-
-import archiver from 'archiver';
-import JSZip from 'jszip';
-
-import { getApp } from '../memory/app-store.js';
-import { computeContentId } from '../util/content-id.js';
-import { getLogger } from '../util/logger.js';
-import type { SigningCallback } from './bundle-signer.js';
-import { signBundle } from './bundle-signer.js';
-import type { AppManifest } from './manifest.js';
-import { serializeManifest } from './manifest.js';
-
-const bundlerLog = getLogger('app-bundler');
-
-import { APP_VERSION } from '../version.js';
+import { createHash, randomUUID } from "node:crypto";
+import { createWriteStream } from "node:fs";
+import { readFile, stat, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { extname, join } from "node:path";
+
+import archiver from "archiver";
+import JSZip from "jszip";
+
+import { getApp } from "../memory/app-store.js";
+import { computeContentId } from "../util/content-id.js";
+import { getLogger } from "../util/logger.js";
+import type { SigningCallback } from "./bundle-signer.js";
+import { signBundle } from "./bundle-signer.js";
+import type { AppManifest } from "./manifest.js";
+import { serializeManifest } from "./manifest.js";
+
+const bundlerLog = getLogger("app-bundler");
+
+import { APP_VERSION } from "../version.js";
 const PACKAGE_VERSION = APP_VERSION;
 
 const SHORT_HASH_LENGTH = 8;
@@ -56,10 +56,11 @@ export function extractRemoteUrls(html: string): string[] {
 
   // Match href="..." on any element except navigation/resolution tags (not assets).
   // Captures the tag name and href value so we can skip them.
-  const hrefRe = /<(\w+)\b[^>]*?\bhref\s*=\s*(?:"([^"]*?)"|'([^']*?)'|([^\s>]+))[^>]*?\/?>/gi;
+  const hrefRe =
+    /<(\w+)\b[^>]*?\bhref\s*=\s*(?:"([^"]*?)"|'([^']*?)'|([^\s>]+))[^>]*?\/?>/gi;
   while ((m = hrefRe.exec(html)) != null) {
     const tagName = m[1];
-    if (['a', 'base', 'area'].includes(tagName.toLowerCase())) continue;
+    if (["a", "base", "area"].includes(tagName.toLowerCase())) continue;
     const url = m[2] ?? m[3] ?? m[4];
     if (url && /^https?:\/\//i.test(url)) {
       urls.add(url);
@@ -83,8 +84,11 @@ export function extractRemoteUrls(html: string): string[] {
  * Uses a hash of the URL to avoid collisions, preserving the original extension.
  */
 function assetFilename(url: string): string {
-  const hash = createHash('sha256').update(url).digest('hex').slice(0, HASH_DISPLAY_LENGTH);
-  let ext = '';
+  const hash = createHash("sha256")
+    .update(url)
+    .digest("hex")
+    .slice(0, HASH_DISPLAY_LENGTH);
+  let ext = "";
   try {
     const parsed = new URL(url);
     ext = extname(parsed.pathname);
@@ -93,7 +97,7 @@ function assetFilename(url: string): string {
   }
   // Fallback: if no extension or it's too long/weird, drop it
   if (!ext || ext.length > 10 || !/^\.\w+$/.test(ext)) {
-    ext = '';
+    ext = "";
   }
   return `${hash}${ext}`;
 }
@@ -119,12 +123,18 @@ export async function materializeAssets(
     urls.map(async (url) => {
       try {
         const controller = new AbortController();
-        const timeout = setTimeout(() => controller.abort(), ASSET_FETCH_TIMEOUT_MS);
+        const timeout = setTimeout(
+          () => controller.abort(),
+          ASSET_FETCH_TIMEOUT_MS,
+        );
         let buf: Buffer;
         try {
           const resp = await fetch(url, { signal: controller.signal });
           if (!resp.ok) {
-            bundlerLog.warn({ url, status: resp.status }, 'Failed to fetch asset, keeping original URL');
+            bundlerLog.warn(
+              { url, status: resp.status },
+              "Failed to fetch asset, keeping original URL",
+            );
             return;
           }
           buf = Buffer.from(await resp.arrayBuffer());
@@ -136,7 +146,10 @@ export async function materializeAssets(
         assets.push({ archivePath, data: buf });
         urlMap.set(url, archivePath);
       } catch (err) {
-        bundlerLog.warn({ url, err }, 'Failed to fetch asset, keeping original URL');
+        bundlerLog.warn(
+          { url, err },
+          "Failed to fetch asset, keeping original URL",
+        );
       }
     }),
   );
@@ -144,12 +157,14 @@ export async function materializeAssets(
   // Rewrite URLs in HTML — replace each occurrence of the original URL with the local path.
   // Sort by length descending so longer URLs are replaced first, preventing prefix collisions
   // (e.g. "https://cdn/x" replacing part of "https://cdn/x/y.png").
-  const sortedEntries = [...urlMap.entries()].sort((a, b) => b[0].length - a[0].length);
+  const sortedEntries = [...urlMap.entries()].sort(
+    (a, b) => b[0].length - a[0].length,
+  );
   let rewrittenHtml = html;
   for (const [originalUrl, localPath] of sortedEntries) {
     // Escape regex special chars in the URL
-    const escaped = originalUrl.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-    rewrittenHtml = rewrittenHtml.replace(new RegExp(escaped, 'g'), localPath);
+    const escaped = originalUrl.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    rewrittenHtml = rewrittenHtml.replace(new RegExp(escaped, "g"), localPath);
   }
 
   return { rewrittenHtml, assets };
@@ -180,7 +195,7 @@ export async function packageApp(
 
   // Build manifest
   const createdBy = `vellum-assistant/${PACKAGE_VERSION}`;
-  const version = app.version ?? '1.0.0';
+  const version = app.version ?? "1.0.0";
   const contentId = computeContentId(app.name);
 
   const manifest: AppManifest = {
@@ -191,14 +206,16 @@ export async function packageApp(
     ...(app.preview ? { preview: app.preview } : {}),
     created_at: new Date().toISOString(),
     created_by: createdBy,
-    entry: 'index.html',
+    entry: "index.html",
     capabilities: [],
     version,
     content_id: contentId,
   };
 
   // Fetch remote assets and rewrite HTML to reference local copies
-  const { rewrittenHtml, assets: fetchedAssets } = await materializeAssets(app.htmlDefinition);
+  const { rewrittenHtml, assets: fetchedAssets } = await materializeAssets(
+    app.htmlDefinition,
+  );
 
   // Also materialize assets in additional pages
   const rewrittenPages: Record<string, string> = {};
@@ -219,19 +236,22 @@ export async function packageApp(
   const allAssets = [...allAssetsMap.values()];
 
   // Create the zip archive
-  const bundleFilename = `${app.name.replace(/[^a-zA-Z0-9_-]/g, '_')}-${randomUUID().slice(0, SHORT_HASH_LENGTH)}.vellumapp`;
+  const bundleFilename = `${app.name.replace(
+    /[^a-zA-Z0-9_-]/g,
+    "_",
+  )}-${randomUUID().slice(0, SHORT_HASH_LENGTH)}.vellumapp`;
   const bundlePath = join(tmpdir(), bundleFilename);
 
   await new Promise<void>((resolve, reject) => {
     const output = createWriteStream(bundlePath);
-    const archive = archiver('zip', { zlib: { level: 9 } });
+    const archive = archiver("zip", { zlib: { level: 9 } });
 
-    output.on('close', () => resolve());
-    output.on('error', (err: Error) => reject(err));
-    archive.on('error', (err: Error) => reject(err));
-    archive.on('warning', (err: Error) => {
+    output.on("close", () => resolve());
+    output.on("error", (err: Error) => reject(err));
+    archive.on("error", (err: Error) => reject(err));
+    archive.on("warning", (err: Error) => {
       // Only reject on fatal warnings
-      if ((err as NodeJS.ErrnoException).code !== 'ENOENT') {
+      if ((err as NodeJS.ErrnoException).code !== "ENOENT") {
         reject(err);
       }
     });
@@ -239,10 +259,10 @@ export async function packageApp(
     archive.pipe(output);
 
     // Add manifest.json at root level
-    archive.append(serializeManifest(manifest), { name: 'manifest.json' });
+    archive.append(serializeManifest(manifest), { name: "manifest.json" });
 
     // Add index.html at root level
-    archive.append(rewrittenHtml, { name: 'index.html' });
+    archive.append(rewrittenHtml, { name: "index.html" });
 
     // Add additional pages alongside index.html (with rewritten asset URLs)
     if (app.pages) {
@@ -268,17 +288,20 @@ export async function packageApp(
       // Re-open the zip and add signature.json
       const zipBuffer = await readFile(bundlePath);
       const zip = await JSZip.loadAsync(zipBuffer);
-      zip.file('signature.json', JSON.stringify(signatureJson, null, 2));
+      zip.file("signature.json", JSON.stringify(signatureJson, null, 2));
       const signedBuffer = await zip.generateAsync({
-        type: 'nodebuffer',
-        compression: 'DEFLATE',
+        type: "nodebuffer",
+        compression: "DEFLATE",
         compressionOptions: { level: 9 },
       });
       await writeFile(bundlePath, signedBuffer);
 
-      bundlerLog.info({ appId }, 'Bundle signed successfully');
+      bundlerLog.info({ appId }, "Bundle signed successfully");
     } catch (err) {
-      bundlerLog.warn({ err, appId }, 'Failed to sign bundle, proceeding unsigned');
+      bundlerLog.warn(
+        { err, appId },
+        "Failed to sign bundle, proceeding unsigned",
+      );
     }
   }
 
@@ -286,10 +309,12 @@ export async function packageApp(
   const stats = await stat(bundlePath);
   if (stats.size > MAX_BUNDLE_SIZE_BYTES) {
     // Clean up the oversized file
-    const { unlink } = await import('node:fs/promises');
+    const { unlink } = await import("node:fs/promises");
     await unlink(bundlePath);
     throw new Error(
-      `Bundle size ${(stats.size / 1024 / 1024).toFixed(1)} MB exceeds the maximum allowed size of 25 MB`,
+      `Bundle size ${(stats.size / 1024 / 1024).toFixed(
+        1,
+      )} MB exceeds the maximum allowed size of 25 MB`,
     );
   }
 

package/src/bundler/bundle-scanner.ts

@@ -52,16 +52,17 @@ const REQUIRED_MANIFEST_FIELDS = [
 ] as const;
 
 // Magic byte signatures for image validation
-const IMAGE_SIGNATURES: Record<string, { bytes: number[]; offset?: number }[]> = {
-  ".png": [{ bytes: [0x89, 0x50, 0x4e, 0x47] }], // \x89PNG
-  ".jpg": [{ bytes: [0xff, 0xd8, 0xff] }],
-  ".jpeg": [{ bytes: [0xff, 0xd8, 0xff] }],
-  ".gif": [{ bytes: [0x47, 0x49, 0x46, 0x38] }], // GIF8
-  ".webp": [
-    { bytes: [0x52, 0x49, 0x46, 0x46] }, // RIFF at offset 0
-    // bytes 8-11 should be WEBP — checked separately
-  ],
-};
+const IMAGE_SIGNATURES: Record<string, { bytes: number[]; offset?: number }[]> =
+  {
+    ".png": [{ bytes: [0x89, 0x50, 0x4e, 0x47] }], // \x89PNG
+    ".jpg": [{ bytes: [0xff, 0xd8, 0xff] }],
+    ".jpeg": [{ bytes: [0xff, 0xd8, 0xff] }],
+    ".gif": [{ bytes: [0x47, 0x49, 0x46, 0x38] }], // GIF8
+    ".webp": [
+      { bytes: [0x52, 0x49, 0x46, 0x46] }, // RIFF at offset 0
+      // bytes 8-11 should be WEBP — checked separately
+    ],
+  };
 
 // ---------------------------------------------------------------------------
 // Main entry point
@@ -85,11 +86,17 @@ export async function scanBundle(zipPath: string): Promise<ScanResult> {
   }
 
   // Run all scan phases
-  const manifest = await scanArchiveStructure(zip, fileData.byteLength, findings);
+  const manifest = await scanArchiveStructure(
+    zip,
+    fileData.byteLength,
+    findings,
+  );
   if (manifest) {
     await scanHtmlEntry(zip, manifest.entry as string, findings);
   }
-  const entryName = manifest ? (manifest.entry as string | undefined) : undefined;
+  const entryName = manifest
+    ? (manifest.entry as string | undefined)
+    : undefined;
   await scanAssets(zip, findings, entryName);
 
   const passed = !findings.some((f) => f.level === "block");
@@ -151,23 +158,36 @@ async function scanArchiveStructure(
     const data = await entry.async("uint8array");
     totalDecompressed += data.byteLength;
     if (totalDecompressed > MAX_DECOMPRESSED_SIZE) break;
-    if (compressedSize > 0 && totalDecompressed / compressedSize > MAX_COMPRESSION_RATIO) break;
+    if (
+      compressedSize > 0 &&
+      totalDecompressed / compressedSize > MAX_COMPRESSION_RATIO
+    )
+      break;
   }
 
   if (totalDecompressed > MAX_DECOMPRESSED_SIZE) {
     findings.push({
       category: "archive",
       code: "too_large",
-      message: `Total decompressed size ${(totalDecompressed / 1024 / 1024).toFixed(1)} MB exceeds ${MAX_DECOMPRESSED_SIZE / 1024 / 1024} MB limit`,
+      message: `Total decompressed size ${(
+        totalDecompressed /
+        1024 /
+        1024
+      ).toFixed(1)} MB exceeds ${MAX_DECOMPRESSED_SIZE / 1024 / 1024} MB limit`,
       level: "block",
     });
   }
 
-  if (compressedSize > 0 && totalDecompressed / compressedSize > MAX_COMPRESSION_RATIO) {
+  if (
+    compressedSize > 0 &&
+    totalDecompressed / compressedSize > MAX_COMPRESSION_RATIO
+  ) {
     findings.push({
       category: "archive",
       code: "zip_bomb",
-      message: `Compression ratio ${(totalDecompressed / compressedSize).toFixed(0)}:1 exceeds ${MAX_COMPRESSION_RATIO}:1 limit`,
+      message: `Compression ratio ${(
+        totalDecompressed / compressedSize
+      ).toFixed(0)}:1 exceeds ${MAX_COMPRESSION_RATIO}:1 limit`,
       level: "block",
     });
   }
@@ -282,7 +302,8 @@ async function scanHtmlEntry(
   }
 
   // <meta http-equiv="refresh"> with external URL
-  const metaRefreshRe = /<meta[^>]+http-equiv\s*=\s*["']refresh["'][^>]+content\s*=\s*["'][^"']*url\s*=\s*([^"'\s;]+)/gi;
+  const metaRefreshRe =
+    /<meta[^>]+http-equiv\s*=\s*["']refresh["'][^>]+content\s*=\s*["'][^"']*url\s*=\s*([^"'\s;]+)/gi;
   for (const m of html.matchAll(metaRefreshRe)) {
     if (isExternalUrl(m[1])) {
       findings.push({
@@ -309,7 +330,8 @@ async function scanHtmlEntry(
     findings.push({
       category: "html",
       code: "formaction_external",
-      message: "formaction attribute with external URL bypasses form restrictions",
+      message:
+        "formaction attribute with external URL bypasses form restrictions",
       level: "block",
     });
   }
@@ -317,43 +339,88 @@ async function scanHtmlEntry(
   // --- Warn-level: suspicious JS patterns ---
 
   const warnPatterns: { pattern: RegExp; code: string; message: string }[] = [
-    { pattern: /\bfetch\s*\(/g, code: "network_fetch", message: "Uses fetch() for network requests \u2014 could send or receive data from external servers" },
-    { pattern: /\bXMLHttpRequest\b/g, code: "network_xhr", message: "Uses XMLHttpRequest for network requests \u2014 could send or receive data from external servers" },
-    { pattern: /\bnew\s+WebSocket\b/g, code: "network_websocket", message: "Uses WebSocket connections \u2014 could maintain persistent communication with a server" },
-    { pattern: /\bEventSource\b/g, code: "network_eventsource", message: "Uses server-sent events \u2014 could receive live data from a server" },
-    { pattern: /\bdocument\.cookie\b/g, code: "cookie_access", message: "Accesses browser cookies \u2014 could read or store tracking data" },
-    { pattern: /\beval\s*\(/g, code: "eval_usage", message: "Uses eval() for dynamic code execution \u2014 could run code not visible in the source" },
-    { pattern: /\bFunction\s*\(/g, code: "function_constructor", message: "Uses Function() constructor for dynamic code execution \u2014 could run code not visible in the source" },
+    {
+      pattern: /\bfetch\s*\(/g,
+      code: "network_fetch",
+      message:
+        "Uses fetch() for network requests \u2014 could send or receive data from external servers",
+    },
+    {
+      pattern: /\bXMLHttpRequest\b/g,
+      code: "network_xhr",
+      message:
+        "Uses XMLHttpRequest for network requests \u2014 could send or receive data from external servers",
+    },
+    {
+      pattern: /\bnew\s+WebSocket\b/g,
+      code: "network_websocket",
+      message:
+        "Uses WebSocket connections \u2014 could maintain persistent communication with a server",
+    },
+    {
+      pattern: /\bEventSource\b/g,
+      code: "network_eventsource",
+      message:
+        "Uses server-sent events \u2014 could receive live data from a server",
+    },
+    {
+      pattern: /\bdocument\.cookie\b/g,
+      code: "cookie_access",
+      message:
+        "Accesses browser cookies \u2014 could read or store tracking data",
+    },
+    {
+      pattern: /\beval\s*\(/g,
+      code: "eval_usage",
+      message:
+        "Uses eval() for dynamic code execution \u2014 could run code not visible in the source",
+    },
+    {
+      pattern: /\bFunction\s*\(/g,
+      code: "function_constructor",
+      message:
+        "Uses Function() constructor for dynamic code execution \u2014 could run code not visible in the source",
+    },
     {
       pattern: /\bsetTimeout\s*\(\s*["'`]/g,
       code: "settimeout_string",
-      message: "Uses setTimeout() with string for code execution \u2014 could run code not visible in the source",
+      message:
+        "Uses setTimeout() with string for code execution \u2014 could run code not visible in the source",
     },
     {
       pattern: /\bsetInterval\s*\(\s*["'`]/g,
       code: "setinterval_string",
-      message: "Uses setInterval() with string for code execution \u2014 could run code not visible in the source",
+      message:
+        "Uses setInterval() with string for code execution \u2014 could run code not visible in the source",
+    },
+    {
+      pattern: /\bwindow\.open\s*\(/g,
+      code: "window_open",
+      message: "Opens new windows \u2014 could navigate to external sites",
     },
-    { pattern: /\bwindow\.open\s*\(/g, code: "window_open", message: "Opens new windows \u2014 could navigate to external sites" },
     {
       pattern: /\bwindow\.location\s*=/g,
       code: "window_location_assign",
       message: "Redirects the page \u2014 could navigate away from the app",
     },
     {
-      pattern: /\bon(?:error|load|focus|blur|mouseover|mouseout|click|dblclick|submit|input|change|keydown|keyup|keypress)\s*=/g,
+      pattern:
+        /\bon(?:error|load|focus|blur|mouseover|mouseout|click|dblclick|submit|input|change|keydown|keyup|keypress)\s*=/g,
       code: "html_event_handler",
-      message: "Uses inline event handlers \u2014 standard for interactive apps",
+      message:
+        "Uses inline event handlers \u2014 standard for interactive apps",
     },
     {
       pattern: /@import\s+(?:url\s*\(|['"]https?:\/\/)/g,
       code: "css_import",
-      message: "Loads external stylesheet \u2014 could connect to an external server",
+      message:
+        "Loads external stylesheet \u2014 could connect to an external server",
     },
     {
       pattern: /url\s*\(\s*['"]?https?:\/\//g,
       code: "css_external_url",
-      message: "References external URL in CSS \u2014 could load resources from an external server",
+      message:
+        "References external URL in CSS \u2014 could load resources from an external server",
     },
     {
       pattern: /(?:src|href)\s*=\s*["']data:/g,
@@ -381,7 +448,9 @@ async function scanHtmlEntry(
       findings.push({
         category: "html",
         code: "obfuscated_js",
-        message: `Possible obfuscated JS: line ${i + 1} is ${(line.length / 1024).toFixed(1)} KB`,
+        message: `Possible obfuscated JS: line ${i + 1} is ${(
+          line.length / 1024
+        ).toFixed(1)} KB`,
         level: "warn",
       });
       break; // one finding is enough
@@ -389,7 +458,9 @@ async function scanHtmlEntry(
   }
 
   // High density of hex/unicode escapes
-  const escapeMatches = html.match(/\\x[0-9a-fA-F]{2}|\\u[0-9a-fA-F]{4}|\\u\{[0-9a-fA-F]+\}/g);
+  const escapeMatches = html.match(
+    /\\x[0-9a-fA-F]{2}|\\u[0-9a-fA-F]{4}|\\u\{[0-9a-fA-F]+\}/g,
+  );
   if (escapeMatches && escapeMatches.length > 50) {
     findings.push({
       category: "html",
@@ -402,15 +473,27 @@ async function scanHtmlEntry(
 
 function isExternalUrl(url: string): boolean {
   const lower = url.toLowerCase();
-  return lower.startsWith("http://") || lower.startsWith("https://") || url.startsWith("//");
+  return (
+    lower.startsWith("http://") ||
+    lower.startsWith("https://") ||
+    url.startsWith("//")
+  );
 }
 
 // ---------------------------------------------------------------------------
 // Phase 3: Asset scan
 // ---------------------------------------------------------------------------
 
-async function scanAssets(zip: JSZip, findings: ScanFinding[], manifestEntry?: string): Promise<void> {
-  const allowedRootFiles = new Set(["index.html", "manifest.json", "signature.json"]);
+async function scanAssets(
+  zip: JSZip,
+  findings: ScanFinding[],
+  manifestEntry?: string,
+): Promise<void> {
+  const allowedRootFiles = new Set([
+    "index.html",
+    "manifest.json",
+    "signature.json",
+  ]);
   if (manifestEntry) {
     allowedRootFiles.add(manifestEntry);
   }
@@ -426,13 +509,34 @@ async function scanAssets(zip: JSZip, findings: ScanFinding[], manifestEntry?: s
     const dotParts = basename.split(".");
     if (dotParts.length > 2) {
       const suspiciousInnerExts = new Set([
-        "jpg", "jpeg", "png", "gif", "webp", "svg", "bmp", "ico",
-        "pdf", "doc", "docx", "xls", "xlsx", "ppt", "pptx",
-        "html", "htm", "txt", "rtf", "zip", "tar", "gz",
+        "jpg",
+        "jpeg",
+        "png",
+        "gif",
+        "webp",
+        "svg",
+        "bmp",
+        "ico",
+        "pdf",
+        "doc",
+        "docx",
+        "xls",
+        "xlsx",
+        "ppt",
+        "pptx",
+        "html",
+        "htm",
+        "txt",
+        "rtf",
+        "zip",
+        "tar",
+        "gz",
       ]);
       // Check if any non-final extension segment is a known content type
       const innerParts = dotParts.slice(1, -1); // extensions between first dot and last dot
-      const hasSuspiciousInner = innerParts.some((p) => suspiciousInnerExts.has(p.toLowerCase()));
+      const hasSuspiciousInner = innerParts.some((p) =>
+        suspiciousInnerExts.has(p.toLowerCase()),
+      );
       if (hasSuspiciousInner) {
         findings.push({
           category: "asset",

package/src/bundler/bundle-signer.ts

@@ -5,13 +5,13 @@
  * and requests an Ed25519 signature from the Swift client via IPC.
  */
 
-import { createHash } from 'node:crypto';
-import { readFile } from 'node:fs/promises';
+import { createHash } from "node:crypto";
+import { readFile } from "node:fs/promises";
 
-import JSZip from 'jszip';
+import JSZip from "jszip";
 
 export interface SignatureJson {
-  algorithm: 'ed25519';
+  algorithm: "ed25519";
   signer: {
     key_id: string;
     display_name: string;
@@ -35,7 +35,7 @@ export type SigningCallback = (payload: string) => Promise<{
  * Recursively sort object keys alphabetically for canonical JSON.
  */
 function sortKeysDeep(obj: unknown): unknown {
-  if (obj == null || typeof obj !== 'object') {
+  if (obj == null || typeof obj !== "object") {
     return obj;
   }
   if (Array.isArray(obj)) {
@@ -51,12 +51,14 @@ function sortKeysDeep(obj: unknown): unknown {
 /**
  * Compute SHA-256 hashes of all files in a zip archive, excluding signature.json.
  */
-async function computeContentHashes(zip: JSZip): Promise<Record<string, string>> {
+async function computeContentHashes(
+  zip: JSZip,
+): Promise<Record<string, string>> {
   const hashes: Record<string, string> = {};
   const entries: string[] = [];
 
   zip.forEach((relativePath, _file) => {
-    if (relativePath !== 'signature.json') {
+    if (relativePath !== "signature.json") {
       entries.push(relativePath);
     }
   });
@@ -67,8 +69,8 @@ async function computeContentHashes(zip: JSZip): Promise<Record<string, string>>
   for (const entryPath of entries) {
     const file = zip.file(entryPath);
     if (!file || file.dir) continue;
-    const content = await file.async('nodebuffer');
-    const hash = createHash('sha256').update(content).digest('hex');
+    const content = await file.async("nodebuffer");
+    const hash = createHash("sha256").update(content).digest("hex");
     hashes[entryPath] = hash;
   }
 
@@ -93,11 +95,11 @@ export async function signBundle(
   const contentHashes = await computeContentHashes(zip);
 
   // 2. Read manifest
-  const manifestFile = zip.file('manifest.json');
+  const manifestFile = zip.file("manifest.json");
   if (!manifestFile) {
-    throw new Error('Bundle is missing manifest.json');
+    throw new Error("Bundle is missing manifest.json");
   }
-  const manifestText = await manifestFile.async('text');
+  const manifestText = await manifestFile.async("text");
   const manifest = JSON.parse(manifestText) as Record<string, unknown>;
 
   // 3. Construct canonical signing payload with sorted keys
@@ -112,10 +114,10 @@ export async function signBundle(
 
   // 5. Build SignatureJson
   const signatureJson: SignatureJson = {
-    algorithm: 'ed25519',
+    algorithm: "ed25519",
     signer: {
       key_id: keyId,
-      display_name: 'Local Signer',
+      display_name: "Local Signer",
     },
     content_hashes: contentHashes,
     signature,