settld 0.1.0

package/conformance/v1/run.mjs

@@ -0,0 +1,229 @@
+#!/usr/bin/env node
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+import { codesFromCliOutput, diffSets, readJsonFile, spawnCapture, stableStringSet } from "./lib/harness.mjs";
+import { applyMutations } from "./lib/mutations.mjs";
+
+function parseArgs(argv) {
+  const out = {
+    bin: "settld-verify",
+    nodeBin: null,
+    caseId: null,
+    list: false,
+    keepTemp: false
+  };
+  for (let i = 0; i < argv.length; i += 1) {
+    const a = argv[i];
+    if (a === "--bin") {
+      out.bin = String(argv[i + 1] ?? "");
+      i += 1;
+      continue;
+    }
+    if (a === "--node-bin") {
+      out.nodeBin = String(argv[i + 1] ?? "");
+      i += 1;
+      continue;
+    }
+    if (a === "--case") {
+      out.caseId = String(argv[i + 1] ?? "");
+      i += 1;
+      continue;
+    }
+    if (a === "--list") {
+      out.list = true;
+      continue;
+    }
+    if (a === "--keep-temp") {
+      out.keepTemp = true;
+      continue;
+    }
+    if (a === "--help" || a === "-h") {
+      return { ...out, help: true };
+    }
+    throw new Error(`unknown argument: ${a}`);
+  }
+  return out;
+}
+
+function usage() {
+  // eslint-disable-next-line no-console
+  console.error("usage:");
+  console.error("  node conformance/v1/run.mjs [--bin settld-verify] [--node-bin <path/to/settld-verify.js>] [--case <id>] [--list] [--keep-temp]");
+}
+
+async function runVerify({ cli, env, kind, strict, failOnWarnings, hashConcurrency, bundleDir }) {
+  const args = [];
+  if (strict) args.push("--strict");
+  if (failOnWarnings) args.push("--fail-on-warnings");
+  args.push("--format", "json");
+  if (hashConcurrency) args.push("--hash-concurrency", String(hashConcurrency));
+
+  if (kind === "job-proof") args.push("--job-proof", bundleDir);
+  else if (kind === "month-proof") args.push("--month-proof", bundleDir);
+  else if (kind === "finance-pack") args.push("--finance-pack", bundleDir);
+  else if (kind === "invoice-bundle") args.push("--invoice-bundle", bundleDir);
+  else if (kind === "close-pack") args.push("--close-pack", bundleDir);
+  else throw new Error(`unsupported kind: ${kind}`);
+
+  return spawnCapture({ cmd: cli.cmd, args: [...cli.args, ...args], env, stdinText: null });
+}
+
+async function main() {
+  const opts = parseArgs(process.argv.slice(2));
+  if (opts.help) {
+    usage();
+    process.exit(0);
+  }
+
+  const packDir = path.dirname(fileURLToPath(import.meta.url));
+  const casesPath = path.join(packDir, "cases.json");
+  const casesDoc = await readJsonFile(casesPath);
+  if (casesDoc?.schemaVersion !== "ConformanceCases.v1") throw new Error(`unsupported cases schemaVersion: ${casesDoc?.schemaVersion ?? "null"}`);
+  const cases = Array.isArray(casesDoc.cases) ? casesDoc.cases : [];
+
+  if (opts.list) {
+    for (const c of cases) {
+      // eslint-disable-next-line no-console
+      console.log(String(c?.id ?? ""));
+    }
+    process.exit(0);
+  }
+
+  const selectedCases = opts.caseId ? cases.filter((c) => String(c?.id ?? "") === opts.caseId) : cases;
+  if (opts.caseId && selectedCases.length === 0) throw new Error(`case not found: ${opts.caseId}`);
+
+  const trustFp = path.join(packDir, String(casesDoc.trustFile ?? "trust.json"));
+  const trust = await readJsonFile(trustFp);
+  const baseTrustEnv = {
+    SETTLD_TRUSTED_GOVERNANCE_ROOT_KEYS_JSON: JSON.stringify(trust?.governanceRoots ?? {}),
+    SETTLD_TRUSTED_PRICING_SIGNER_KEYS_JSON: JSON.stringify(trust?.pricingSigners ?? {}),
+    SETTLD_TRUSTED_TIME_AUTHORITY_KEYS_JSON: JSON.stringify(trust?.timeAuthorities ?? {})
+  };
+
+  const cli = opts.nodeBin
+    ? { cmd: process.execPath, args: [path.resolve(opts.nodeBin)] }
+    : { cmd: opts.bin, args: [] };
+
+  let pass = 0;
+  let fail = 0;
+  let skip = 0;
+
+  for (const c of selectedCases) {
+    const id = String(c?.id ?? "");
+    const allowSkip = Boolean(c?.allowSkip);
+    const expectedFp = path.join(packDir, String(c?.expectedFile ?? ""));
+    const expected = await readJsonFile(expectedFp);
+    if (expected?.schemaVersion !== "ConformanceExpected.v1") throw new Error(`case ${id}: unsupported expected schemaVersion: ${expected?.schemaVersion ?? "null"}`);
+
+    const tmpRoot = await fs.mkdtemp(path.join(os.tmpdir(), `settld-conformance-v1-${id}-`));
+    const bundleDir = path.join(tmpRoot, "bundle");
+    try {
+      const srcBundle = path.join(packDir, String(c?.bundlePath ?? ""));
+      await fs.cp(srcBundle, bundleDir, { recursive: true, force: true });
+
+      const mut = await applyMutations({ bundleDir, tmpRoot, mutations: c?.mutations ?? null, allowSkip });
+      if (mut.skipped) {
+        skip += 1;
+        // eslint-disable-next-line no-console
+        console.log(`SKIP ${id}: ${mut.reason}`);
+        continue;
+      }
+
+      const env = {
+        ...process.env,
+        ...baseTrustEnv,
+        ...(c?.envOverrides && typeof c.envOverrides === "object" && !Array.isArray(c.envOverrides) ? c.envOverrides : {})
+      };
+
+      const run = await runVerify({
+        cli,
+        env,
+        kind: String(c?.kind ?? ""),
+        strict: Boolean(c?.strict),
+        failOnWarnings: Boolean(c?.failOnWarnings),
+        hashConcurrency: c?.hashConcurrency ?? null,
+        bundleDir
+      });
+
+      let cliJson = null;
+      try {
+        cliJson = JSON.parse(run.stdout);
+      } catch (err) {
+        fail += 1;
+        // eslint-disable-next-line no-console
+        console.error(`FAIL ${id}: stdout is not valid JSON (${err?.message ?? String(err ?? "")})`);
+        // eslint-disable-next-line no-console
+        console.error(run.stderr.trim());
+        continue;
+      }
+
+      if (cliJson?.schemaVersion !== "VerifyCliOutput.v1") {
+        fail += 1;
+        // eslint-disable-next-line no-console
+        console.error(`FAIL ${id}: unexpected VerifyCliOutput schemaVersion: ${cliJson?.schemaVersion ?? "null"}`);
+        continue;
+      }
+
+      const actual = {
+        exitCode: run.exitCode,
+        ok: Boolean(cliJson.ok),
+        verificationOk: Boolean(cliJson.verificationOk),
+        errorCodes: codesFromCliOutput(cliJson, "errors"),
+        warningCodes: codesFromCliOutput(cliJson, "warnings")
+      };
+
+      const expectedSlice = {
+        exitCode: expected.exitCode,
+        ok: Boolean(expected.ok),
+        verificationOk: Boolean(expected.verificationOk),
+        errorCodes: stableStringSet(expected.errorCodes),
+        warningCodes: stableStringSet(expected.warningCodes)
+      };
+
+      const diffs = {
+        errors: diffSets({ expected: expectedSlice.errorCodes, actual: actual.errorCodes }),
+        warnings: diffSets({ expected: expectedSlice.warningCodes, actual: actual.warningCodes })
+      };
+
+      const mismatches = [];
+      if (actual.exitCode !== expectedSlice.exitCode) mismatches.push(`exitCode expected ${expectedSlice.exitCode} got ${actual.exitCode}`);
+      if (actual.ok !== expectedSlice.ok) mismatches.push(`ok expected ${expectedSlice.ok} got ${actual.ok}`);
+      if (actual.verificationOk !== expectedSlice.verificationOk) mismatches.push(`verificationOk expected ${expectedSlice.verificationOk} got ${actual.verificationOk}`);
+      if (!diffs.errors.equal) mismatches.push(`errors missing=[${diffs.errors.missing.join(", ")}] extra=[${diffs.errors.extra.join(", ")}]`);
+      if (!diffs.warnings.equal) mismatches.push(`warnings missing=[${diffs.warnings.missing.join(", ")}] extra=[${diffs.warnings.extra.join(", ")}]`);
+
+      if (mismatches.length) {
+        fail += 1;
+        // eslint-disable-next-line no-console
+        console.error(`FAIL ${id}: ${mismatches.join("; ")}`);
+        if (run.stderr.trim()) {
+          // eslint-disable-next-line no-console
+          console.error(run.stderr.trim());
+        }
+      } else {
+        pass += 1;
+        // eslint-disable-next-line no-console
+        console.log(`PASS ${id}`);
+      }
+    } finally {
+      if (!opts.keepTemp) await fs.rm(tmpRoot, { recursive: true, force: true });
+      else {
+        // eslint-disable-next-line no-console
+        console.log(`TEMP ${id}: ${tmpRoot}`);
+      }
+    }
+  }
+
+  // eslint-disable-next-line no-console
+  console.log(`\nSummary: pass=${pass} fail=${fail} skip=${skip}`);
+  process.exit(fail === 0 ? 0 : 1);
+}
+
+main().catch((err) => {
+  // eslint-disable-next-line no-console
+  console.error(err?.stack ?? String(err ?? ""));
+  process.exit(2);
+});

package/conformance/v1/trust.json

@@ -0,0 +1,11 @@
+{
+  "governanceRoots": {
+    "key_4bd1ee0813b265cb6670a1cc": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAFzw7qxt31VJOSAJCw7zy267twYhbJzf9H0dwm3ZmCDM=\n-----END PUBLIC KEY-----\n"
+  },
+  "pricingSigners": {
+    "key_4bd1ee0813b265cb6670a1cc": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAFzw7qxt31VJOSAJCw7zy267twYhbJzf9H0dwm3ZmCDM=\n-----END PUBLIC KEY-----\n"
+  },
+  "timeAuthorities": {
+    "key_0c6b00150d3433d8d612eef2": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEA9CRBU82m4eS1uHNL6PtKBKPLN0YdtubYFP/f9flGVd0=\n-----END PUBLIC KEY-----\n"
+  }
+}

package/docker-compose.yml

@@ -0,0 +1,154 @@
+services:
+  postgres:
+    image: postgres:16
+    environment:
+      POSTGRES_USER: proxy
+      POSTGRES_PASSWORD: proxy
+      POSTGRES_DB: proxy
+    volumes:
+      - proxy_pgdata:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U proxy -d proxy"]
+      interval: 2s
+      timeout: 2s
+      retries: 30
+
+  api:
+    profiles: ["app"]
+    build: .
+    depends_on:
+      postgres:
+        condition: service_healthy
+      minio:
+        condition: service_started
+    environment:
+      NODE_ENV: development
+      STORE: pg
+      DATABASE_URL: postgres://proxy:proxy@postgres:5432/proxy
+      PROXY_PG_SCHEMA: ${PROXY_PG_SCHEMA:-public}
+      PROXY_AUTOTICK: "1"
+      PROXY_AUTOTICK_INTERVAL_MS: "250"
+      PROXY_AUTOTICK_MAX_MESSAGES: "100"
+      # Local bootstrap ops token for dev compose.
+      PROXY_OPS_TOKENS: "tok_ops:ops_read,ops_write,finance_read,finance_write,audit_read"
+      PROXY_ALLOW_INLINE_SECRETS: "1"
+      PROXY_EVIDENCE_STORE: "s3"
+      PROXY_EVIDENCE_S3_ENDPOINT: "http://minio:9000"
+      PROXY_EVIDENCE_S3_REGION: "us-east-1"
+      PROXY_EVIDENCE_S3_BUCKET: "proxy-evidence"
+      PROXY_EVIDENCE_S3_FORCE_PATH_STYLE: "1"
+      PROXY_EVIDENCE_S3_ACCESS_KEY_ID: "proxy"
+      PROXY_EVIDENCE_S3_SECRET_ACCESS_KEY: "proxysecret"
+      PROXY_EXPORT_DESTINATIONS: >
+        {"tenant_default":[{"destinationId":"receiver_v1","kind":"webhook","url":"http://receiver:4000/deliveries/settld","secret":"receiversecret"},{"destinationId":"finance_sink_v1","kind":"webhook","url":"http://finance-sink:4100/deliveries/settld","secret":"financesinksecret","artifactTypes":["JournalCsv.v1","FinancePackBundle.v1"]}]}
+    ports:
+      - "${PROXY_API_PORT:-3000}:3000"
+
+  maintenance:
+    profiles: ["app"]
+    build: .
+    depends_on:
+      postgres:
+        condition: service_healthy
+    command: ["src/api/maintenance.js"]
+    environment:
+      NODE_ENV: development
+      DATABASE_URL: postgres://proxy:proxy@postgres:5432/proxy
+      PROXY_PG_SCHEMA: ${PROXY_PG_SCHEMA:-public}
+      PROXY_MAINTENANCE_INTERVAL_SECONDS: "300"
+
+  receiver:
+    profiles: ["app"]
+    build: .
+    depends_on:
+      api:
+        condition: service_started
+      minio:
+        condition: service_started
+    command: ["services/receiver/src/server.js"]
+    environment:
+      NODE_ENV: development
+      RECEIVER_PORT: "4000"
+      RECEIVER_TENANT_ID: "tenant_default"
+      RECEIVER_DESTINATION_ID: "receiver_v1"
+      RECEIVER_ACK_URL: "http://api:3000/exports/ack"
+      RECEIVER_ALLOW_INLINE_SECRETS: "1"
+      RECEIVER_HMAC_SECRET: "receiversecret"
+      RECEIVER_S3_ENDPOINT: "http://minio:9000"
+      RECEIVER_S3_REGION: "us-east-1"
+      RECEIVER_S3_BUCKET: "proxy-artifacts"
+      RECEIVER_S3_PREFIX: "settld/"
+      RECEIVER_S3_FORCE_PATH_STYLE: "1"
+      RECEIVER_S3_ACCESS_KEY_ID: "proxy"
+      RECEIVER_S3_SECRET_ACCESS_KEY: "proxysecret"
+      RECEIVER_DEDUPE_DB_PATH: "/data/receiver-dedupe.jsonl"
+    ports:
+      - "${PROXY_RECEIVER_PORT:-4000}:4000"
+    volumes:
+      - proxy_receiver_data:/data
+
+  finance-sink:
+    profiles: ["app"]
+    build: .
+    depends_on:
+      api:
+        condition: service_started
+      minio:
+        condition: service_started
+    command: ["services/finance-sink/src/server.js"]
+    environment:
+      NODE_ENV: development
+      FINANCE_SINK_PORT: "4100"
+      FINANCE_SINK_TENANT_ID: "tenant_default"
+      FINANCE_SINK_DESTINATION_ID: "finance_sink_v1"
+      FINANCE_SINK_ACK_URL: "http://api:3000/exports/ack"
+      FINANCE_SINK_ALLOW_INLINE_SECRETS: "1"
+      FINANCE_SINK_HMAC_SECRET: "financesinksecret"
+      FINANCE_SINK_S3_ENDPOINT: "http://minio:9000"
+      FINANCE_SINK_S3_REGION: "us-east-1"
+      FINANCE_SINK_S3_BUCKET: "proxy-finance"
+      FINANCE_SINK_S3_PREFIX: "finance/"
+      FINANCE_SINK_S3_FORCE_PATH_STYLE: "1"
+      FINANCE_SINK_S3_ACCESS_KEY_ID: "proxy"
+      FINANCE_SINK_S3_SECRET_ACCESS_KEY: "proxysecret"
+      FINANCE_SINK_DEDUPE_DB_PATH: "/data/finance-sink-dedupe.jsonl"
+    ports:
+      - "${PROXY_FINANCE_SINK_PORT:-4100}:4100"
+    volumes:
+      - proxy_finance_sink_data:/data
+
+  minio:
+    image: minio/minio:latest
+    environment:
+      MINIO_ROOT_USER: proxy
+      MINIO_ROOT_PASSWORD: proxysecret
+    command: server /data --console-address ":9001"
+    ports:
+      - "${PROXY_MINIO_PORT:-9000}:9000"
+      - "${PROXY_MINIO_CONSOLE_PORT:-9001}:9001"
+    volumes:
+      - proxy_minio_data:/data
+
+  minio-init:
+    profiles: ["init"]
+    image: minio/mc:latest
+    depends_on:
+      minio:
+        condition: service_started
+    entrypoint: ["sh", "-ec"]
+    # NOTE: Compose will split a plain-string `command` on whitespace when converting
+    # to Docker's JSON-array `Cmd`. Use a single-arg list so the shell receives one script.
+    command:
+      - |
+        # MinIO can be "started" before it is ready to accept connections.
+        # Retry quietly until the alias can be initialized.
+        until mc alias set local http://minio:9000 proxy proxysecret >/dev/null 2>&1; do sleep 1; done
+        mc mb -p local/proxy-evidence || true
+        mc mb -p local/proxy-artifacts || true
+        mc mb -p local/proxy-finance || true
+
+volumes:
+  proxy_pgdata:
+  proxy_minio_data:
+  proxy_receiver_data:
+  proxy_finance_sink_data:

package/package.json

@@ -0,0 +1,98 @@
+{
+  "name": "settld",
+  "version": "0.1.0",
+  "description": "Settld kernel CLI and local control-plane tooling",
+  "private": false,
+  "type": "module",
+  "engines": {
+    "node": ">=20"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/aidenlippert/settld"
+  },
+  "files": [
+    "SETTLD_VERSION",
+    "README.md",
+    "Dockerfile",
+    "docker-compose.yml",
+    "bin",
+    "conformance",
+    "packages/artifact-verify/src",
+    "scripts/closepack",
+    "scripts/init",
+    "src",
+    "services/finance-sink",
+    "services/receiver"
+  ],
+  "bin": {
+    "settld": "bin/settld.js"
+  },
+  "scripts": {
+    "postinstall": "node scripts/init/postinstall-sanity.mjs",
+    "dev:api": "node src/api/server.js",
+    "dev:maintenance": "node src/api/maintenance.js",
+    "dev:receiver": "node services/receiver/src/server.js",
+    "dev:finance-sink": "node services/finance-sink/src/server.js",
+    "dev:magic-link": "node services/magic-link/src/server.js",
+    "start:prod": "NODE_ENV=production node src/api/server.js",
+    "start:maintenance": "NODE_ENV=production node src/api/maintenance.js",
+    "start:receiver": "NODE_ENV=production node services/receiver/src/server.js",
+    "start:finance-sink": "NODE_ENV=production node services/finance-sink/src/server.js",
+    "start:magic-link": "NODE_ENV=production node services/magic-link/src/server.js",
+    "agent:sim": "node src/agent/agent-sim.js",
+    "chaos": "node scripts/chaos.js",
+    "load:ingest": "k6 run scripts/load/ingest-burst.k6.js",
+    "load:deliveries": "node scripts/load/run-delivery-load.js",
+    "acceptance:full-stack": "bash scripts/acceptance/full-stack.sh",
+    "demo:delivery": "node scripts/demo/delivery-robot/generate.mjs",
+    "demo:ui:prep": "node scripts/demo/delivery-robot/export-ui-fixture.mjs",
+    "demo:ui": "cd dashboard && npm run dev",
+    "demo:build": "cd dashboard && npm run build",
+    "pilot:finance-pack": "PROXY_DETERMINISTIC_IDS=1 node scripts/pilot/finance-pack.mjs",
+    "finance:bundle": "node scripts/finance-pack/bundle.mjs",
+    "proof:job": "node scripts/proof-bundle/job.mjs",
+    "proof:month": "node scripts/proof-bundle/month.mjs",
+    "trust:wizard": "node scripts/trust-config/wizard.mjs",
+    "governance:export": "node scripts/governance/export.mjs",
+    "openapi:write": "node scripts/openapi/write.mjs",
+    "sdk:smoke": "node scripts/sdk/smoke.mjs",
+    "sdk:smoke:py": "PYTHONDONTWRITEBYTECODE=1 python3 scripts/sdk/smoke-python.py",
+    "sdk:first-run": "node scripts/examples/sdk-first-verified-run.mjs",
+    "sdk:first-run:py": "PYTHONDONTWRITEBYTECODE=1 python3 scripts/examples/sdk-first-verified-run.py",
+    "sdk:first-rfq:py": "PYTHONDONTWRITEBYTECODE=1 python3 scripts/examples/sdk-first-paid-rfq.py",
+    "sdk:analytics": "node scripts/examples/sdk-tenant-analytics.mjs",
+    "sdk:analytics:py": "PYTHONDONTWRITEBYTECODE=1 python3 scripts/examples/sdk-tenant-analytics.py",
+    "dev:env:init": "bash -lc 'if [ ! -f .env.dev ]; then cp scripts/dev/env.dev.example .env.dev; fi; echo \"Created .env.dev (or kept existing)\"'",
+    "dev:start": "bash scripts/dev/start-api.sh",
+    "dev:sdk:key": "bash scripts/dev/new-sdk-key.sh",
+    "dev:sdk:first-run": "bash scripts/dev/sdk-first-run.sh",
+    "dev:billing:doctor": "bash scripts/dev/billing-doctor.sh",
+    "dev:billing:webhook:replay": "bash scripts/dev/billing-webhook-replay.sh",
+    "dev:billing:smoke:prod": "bash scripts/dev/billing-smoke-prod.sh",
+    "test": "bash scripts/test/run.sh",
+    "test:ops:arbitration:browser": "bash scripts/ci/run-arbitration-workspace-browser-e2e.sh",
+    "test:ops:throughput:10x": "node scripts/ci/run-10x-throughput-drill.mjs",
+    "test:ops:throughput:incident": "node scripts/ci/run-10x-throughput-incident-rehearsal.mjs",
+    "test:ops:go-live-gate": "node scripts/ci/run-go-live-gate.mjs",
+    "test:ops:kernel-v0-launch-gate": "node scripts/ci/check-kernel-v0-launch-gate.mjs",
+    "test:ops:self-serve-gate": "node scripts/ci/run-self-serve-launch-gate.mjs",
+    "test:ops:self-serve-benchmark": "node scripts/ci/build-self-serve-benchmark-report.mjs",
+    "test:ops:launch-cutover-packet": "node scripts/ci/build-launch-cutover-packet.mjs",
+    "test:cli:pack-smoke": "node scripts/ci/cli-pack-smoke.mjs",
+    "ops:lighthouse:update": "node scripts/ci/update-lighthouse-tracker.mjs",
+    "ops:tenant:bootstrap:conformance": "node scripts/ops/bootstrap-tenant-conformance.mjs",
+    "magic-link:migrate-runs-db": "node scripts/magic-link/migrate-run-records-to-db.mjs",
+    "release:artifacts": "node scripts/release/build-artifacts.mjs",
+    "audit:packet": "node scripts/audit/build-audit-packet.mjs"
+  },
+  "dependencies": {
+    "pg": "^8.11.5"
+  },
+  "devDependencies": {
+    "ajv": "^8.17.1"
+  }
+}

package/packages/artifact-verify/src/bundle-path.js

@@ -0,0 +1,60 @@
+import path from "node:path";
+
+function isValidSegment(seg) {
+  if (typeof seg !== "string") return false;
+  if (!seg) return false;
+  if (seg === "." || seg === "..") return false;
+  if (seg.includes("\\")) return false;
+  if (seg.includes("\u0000")) return false;
+  if (seg.includes(":")) return false;
+  return true;
+}
+
+export function validateBundleRelativePath(name) {
+  if (typeof name !== "string" || !name.trim()) return { ok: false, reason: "empty" };
+  if (name.startsWith("/")) return { ok: false, reason: "absolute" };
+  if (name.includes("\\")) return { ok: false, reason: "backslash" };
+  if (name.includes("\u0000")) return { ok: false, reason: "nul" };
+  if (name.includes(":")) return { ok: false, reason: "colon" };
+  if (name.endsWith("/")) return { ok: false, reason: "trailing_slash" };
+  const parts = name.split("/");
+  if (!parts.length) return { ok: false, reason: "empty" };
+  for (const seg of parts) {
+    if (!isValidSegment(seg)) return { ok: false, reason: seg === "." || seg === ".." ? "traversal" : "segment" };
+  }
+  return { ok: true };
+}
+
+export function resolveBundlePath({ bundleDir, name }) {
+  if (typeof bundleDir !== "string" || !bundleDir.trim()) throw new TypeError("bundleDir must be a non-empty string");
+  const v = validateBundleRelativePath(name);
+  if (!v.ok) return { ok: false, error: "MANIFEST_PATH_INVALID", name, reason: v.reason };
+
+  const base = path.resolve(bundleDir);
+  const fp = path.resolve(bundleDir, ...String(name).split("/"));
+  const prefix = base.endsWith(path.sep) ? base : base + path.sep;
+  if (fp !== base && !fp.startsWith(prefix)) return { ok: false, error: "MANIFEST_PATH_INVALID", name, reason: "escape" };
+  return { ok: true, path: fp };
+}
+
+export function prevalidateManifestFileEntries({ bundleDir, manifestFiles }) {
+  const files = Array.isArray(manifestFiles) ? manifestFiles : [];
+  const seen = new Set();
+  const seenLower = new Map(); // lower(name) -> original
+  for (const f of files) {
+    const name = typeof f?.name === "string" ? f.name : null;
+    const v = validateBundleRelativePath(name);
+    if (!v.ok) return { ok: false, error: "MANIFEST_PATH_INVALID", name: name ?? null, reason: v.reason };
+    if (seen.has(name)) return { ok: false, error: "MANIFEST_DUPLICATE_PATH", name };
+    {
+      const folded = name.toLowerCase();
+      const prior = seenLower.get(folded);
+      if (prior && prior !== name) return { ok: false, error: "MANIFEST_PATH_CASE_COLLISION", name, conflict: prior };
+      seenLower.set(folded, name);
+    }
+    seen.add(name);
+    const r = resolveBundlePath({ bundleDir, name });
+    if (!r.ok) return r;
+  }
+  return { ok: true };
+}

package/packages/artifact-verify/src/canonical-json.js

@@ -0,0 +1,48 @@
+function canonicalize(value) {
+  if (value === null) return null;
+
+  const valueType = typeof value;
+  if (valueType === "string" || valueType === "boolean") return value;
+  if (valueType === "number") {
+    if (!Number.isFinite(value)) {
+      throw new TypeError("Unsupported number for canonical JSON: non-finite");
+    }
+    if (Object.is(value, -0)) {
+      throw new TypeError("Unsupported number for canonical JSON: -0");
+    }
+    return value;
+  }
+
+  if (valueType === "undefined") {
+    throw new TypeError("Unsupported value for canonical JSON: undefined");
+  }
+
+  if (valueType === "bigint" || valueType === "function" || valueType === "symbol") {
+    throw new TypeError(`Unsupported type for canonical JSON: ${valueType}`);
+  }
+
+  if (Array.isArray(value)) {
+    return value.map(canonicalize);
+  }
+
+  if (valueType === "object") {
+    if (Object.getPrototypeOf(value) !== Object.prototype && Object.getPrototypeOf(value) !== null) {
+      throw new TypeError("Unsupported object for canonical JSON: non-plain object");
+    }
+    const symbols = Object.getOwnPropertySymbols(value);
+    if (symbols.length) {
+      throw new TypeError("Unsupported object for canonical JSON: symbol keys");
+    }
+    const keys = Object.keys(value).sort();
+    const out = {};
+    for (const key of keys) out[key] = canonicalize(value[key]);
+    return out;
+  }
+
+  throw new TypeError(`Unsupported value for canonical JSON: ${String(value)}`);
+}
+
+export function canonicalJsonStringify(value) {
+  return JSON.stringify(canonicalize(value));
+}
+