settld 0.1.2 → 0.2.0

package/docs/spec/schemas/VerificationReport.v1.schema.json

@@ -0,0 +1,83 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://settld.local/schemas/VerificationReport.v1.schema.json",
+  "title": "VerificationReport.v1",
+  "type": "object",
+  "required": ["schemaVersion", "profile", "tool", "warnings", "subject", "reportHash"],
+  "properties": {
+    "schemaVersion": { "const": "VerificationReport.v1" },
+    "profile": { "const": "strict" },
+    "tool": {
+      "type": "object",
+      "required": ["name", "version"],
+      "properties": {
+        "name": { "const": "settld" },
+        "version": { "type": ["string", "null"] },
+        "commit": { "type": "string", "pattern": "^[0-9a-f]{7,64}$" }
+      }
+    },
+    "warnings": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["code"],
+        "properties": {
+          "code": {
+            "enum": [
+              "LEGACY_KEYS_FORMAT_USED",
+              "NONSERVER_REVOCATION_NOT_ENFORCED",
+              "GOVERNANCE_POLICY_MISSING_LENIENT",
+              "GOVERNANCE_POLICY_V1_ACCEPTED_LENIENT",
+              "BUNDLE_HEAD_ATTESTATION_MISSING_LENIENT",
+              "MISSING_GOVERNANCE_SNAPSHOT_LENIENT",
+              "UNSIGNED_REPORT_LENIENT",
+              "VERIFICATION_REPORT_MISSING_LENIENT",
+              "TOOL_VERSION_UNKNOWN",
+              "TOOL_COMMIT_UNKNOWN"
+            ]
+          },
+          "message": { "type": ["string", "null"] },
+          "detail": {}
+        }
+      }
+    },
+    "signer": {
+      "type": ["object", "null"],
+      "properties": {
+        "keyId": { "type": "string" },
+        "scope": { "enum": ["global", "tenant"] },
+        "governanceEventRef": { "type": ["object", "null"] }
+      }
+    },
+    "bundleHeadAttestation": {
+      "type": ["object", "null"],
+      "properties": {
+        "schemaVersion": { "type": ["string", "null"] },
+        "attestationHash": { "type": ["string", "null"], "pattern": "^[0-9a-f]{64}$" },
+        "signerKeyId": { "type": ["string", "null"] },
+        "signedAt": { "type": ["string", "null"] },
+        "manifestHash": { "type": ["string", "null"], "pattern": "^[0-9a-f]{64}$" }
+      }
+    },
+    "timestampProof": { "$ref": "https://settld.local/schemas/TimestampProof.v1.schema.json" },
+    "policy": { "type": ["object", "null"] },
+    "subject": {
+      "type": "object",
+      "required": ["type", "manifestHash"],
+      "properties": {
+        "type": { "type": "string" },
+        "tenantId": { "type": ["string", "null"] },
+        "period": { "type": ["string", "null"] },
+        "createdAt": { "type": ["string", "null"] },
+        "protocol": { "type": ["string", "null"] },
+        "manifestHash": { "type": "string", "pattern": "^[0-9a-f]{64}$" }
+      }
+    },
+    "inputs": {},
+    "monthProofAttestation": { "type": ["object", "null"] },
+    "reportHash": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
+    "signature": { "type": ["string", "null"] },
+    "signerKeyId": { "type": ["string", "null"] },
+    "signedAt": { "type": ["string", "null"] }
+  }
+}

package/docs/spec/schemas/VerifyAboutOutput.v1.schema.json

@@ -0,0 +1,54 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://settld.local/schemas/VerifyAboutOutput.v1.schema.json",
+  "title": "VerifyAboutOutput.v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schemaVersion", "tool", "protocol", "defaults", "features"],
+  "properties": {
+    "schemaVersion": { "const": "VerifyAboutOutput.v1" },
+    "tool": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["name", "version", "commit"],
+      "properties": {
+        "name": { "const": "settld-verify" },
+        "version": { "type": ["string", "null"] },
+        "commit": { "type": ["string", "null"] }
+      }
+    },
+    "protocol": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["canonicalJson", "objects"],
+      "properties": {
+        "canonicalJson": { "const": "RFC8785" },
+        "objects": { "type": "array", "items": { "type": "string" } }
+      }
+    },
+    "defaults": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["strict", "hashConcurrency"],
+      "properties": {
+        "strict": { "type": "boolean" },
+        "hashConcurrency": { "type": "integer", "minimum": 1 }
+      }
+    },
+    "features": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["format", "failOnWarnings", "hashConcurrency"],
+      "properties": {
+        "format": {
+          "type": "array",
+          "items": { "enum": ["human", "json"] },
+          "minItems": 1
+        },
+        "failOnWarnings": { "type": "boolean" },
+        "hashConcurrency": { "type": "boolean" }
+      }
+    }
+  }
+}
+

package/docs/spec/schemas/VerifyCliOutput.v1.schema.json

@@ -0,0 +1,75 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://settld.local/schemas/VerifyCliOutput.v1.schema.json",
+  "title": "VerifyCliOutput.v1",
+  "type": "object",
+  "required": ["schemaVersion", "tool", "mode", "target", "ok", "verificationOk", "errors", "warnings", "summary"],
+  "properties": {
+    "schemaVersion": { "const": "VerifyCliOutput.v1" },
+    "tool": {
+      "type": "object",
+      "required": ["name", "version"],
+      "properties": {
+        "name": { "type": "string" },
+        "version": { "type": ["string", "null"] },
+        "commit": { "type": ["string", "null"], "pattern": "^[0-9a-f]{7,64}$" }
+      }
+    },
+    "mode": {
+      "type": "object",
+      "required": ["strict", "failOnWarnings"],
+      "properties": {
+        "strict": { "type": "boolean" },
+        "failOnWarnings": { "type": "boolean" }
+      }
+    },
+    "target": {
+      "type": "object",
+      "required": ["kind", "input", "resolved", "dir"],
+      "properties": {
+        "kind": { "type": "string" },
+        "input": { "type": ["string", "null"] },
+        "resolved": { "type": ["string", "null"] },
+        "dir": { "type": ["string", "null"] }
+      }
+    },
+    "ok": { "type": "boolean" },
+    "verificationOk": { "type": "boolean" },
+    "errors": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["code", "path", "message", "detail"],
+        "properties": {
+          "code": { "type": "string" },
+          "path": { "type": ["string", "null"] },
+          "message": { "type": ["string", "null"] },
+          "detail": {}
+        }
+      }
+    },
+    "warnings": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["code", "path", "message", "detail"],
+        "properties": {
+          "code": { "type": "string" },
+          "path": { "type": ["string", "null"] },
+          "message": { "type": ["string", "null"] },
+          "detail": {}
+        }
+      }
+    },
+    "summary": {
+      "type": "object",
+      "required": ["tenantId", "period", "type", "manifestHash"],
+      "properties": {
+        "tenantId": { "type": ["string", "null"] },
+        "period": { "type": ["string", "null"] },
+        "type": { "type": ["string", "null"] },
+        "manifestHash": { "type": ["string", "null"], "pattern": "^[0-9a-f]{64}$" }
+      }
+    }
+  }
+}

package/docs/spec/schemas/VerifyReleaseOutput.v1.schema.json

@@ -0,0 +1,47 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://settld.local/schemas/VerifyReleaseOutput.v1.schema.json",
+  "title": "VerifyReleaseOutput.v1",
+  "type": "object",
+  "required": ["schemaVersion", "ok", "release", "signatureOk", "artifactsOk", "errors", "warnings"],
+  "properties": {
+    "schemaVersion": { "const": "VerifyReleaseOutput.v1" },
+    "ok": { "type": "boolean" },
+    "release": {
+      "type": "object",
+      "required": ["tag", "version", "commit"],
+      "properties": {
+        "tag": { "type": "string" },
+        "version": { "type": "string" },
+        "commit": { "type": ["string", "null"] }
+      }
+    },
+    "signatureOk": { "type": "boolean" },
+    "artifactsOk": { "type": "boolean" },
+    "errors": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["code", "message"],
+        "properties": {
+          "code": { "type": "string" },
+          "message": { "type": "string" },
+          "path": { "type": ["string", "null"] }
+        }
+      }
+    },
+    "warnings": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["code", "message"],
+        "properties": {
+          "code": { "type": "string" },
+          "message": { "type": "string" },
+          "path": { "type": ["string", "null"] }
+        }
+      }
+    }
+  }
+}
+

package/docs/spec/x402-error-codes.v1.txt

@@ -0,0 +1,35 @@
+X402_EXECUTION_INTENT_REQUIRED
+X402_EXECUTION_INTENT_IDEMPOTENCY_MISMATCH
+X402_EXECUTION_INTENT_CONFLICT
+X402_EXECUTION_INTENT_HASH_MISMATCH
+X402_EXECUTION_INTENT_INVALID
+X402_EXECUTION_INTENT_TIME_INVALID
+X402_EXECUTION_INTENT_TENANT_MISMATCH
+X402_EXECUTION_INTENT_AGENT_MISMATCH
+X402_EXECUTION_INTENT_SIDE_EFFECTING_REQUIRED
+X402_EXECUTION_INTENT_REQUEST_BINDING_REQUIRED
+X402_EXECUTION_INTENT_REQUEST_MISMATCH
+X402_EXECUTION_INTENT_SPEND_LIMIT_EXCEEDED
+X402_EXECUTION_INTENT_CURRENCY_MISMATCH
+X402_EXECUTION_INTENT_RUN_MISMATCH
+X402_EXECUTION_INTENT_AGREEMENT_MISMATCH
+X402_EXECUTION_INTENT_QUOTE_MISMATCH
+X402_EXECUTION_INTENT_POLICY_VERSION_MISMATCH
+X402_EXECUTION_INTENT_POLICY_HASH_MISMATCH
+X402_EXECUTION_INTENT_EXPIRES_AT_INVALID
+X402_EXECUTION_INTENT_EXPIRED
+# verify/runtime policy binding
+X402_INVALID_VERIFICATION_KEY_REF
+X402_MISSING_REQUIRED_PROOF
+X402_INVALID_CRYPTOGRAPHIC_PROOF
+X402_SPEND_AUTH_POLICY_FINGERPRINT_MISMATCH
+X402_REQUEST_BINDING_REQUIRED
+X402_REQUEST_BINDING_EVIDENCE_REQUIRED
+X402_REQUEST_BINDING_EVIDENCE_MISMATCH
+# reversal-events read paths
+X402_REVERSAL_EVENTS_LIST_UNSUPPORTED
+X402_REVERSAL_EVENTS_LIST_INVALID
+X402_REVERSAL_EVENT_GET_UNSUPPORTED
+X402_REVERSAL_EVENT_ID_INVALID
+X402_REVERSAL_EVENT_NOT_FOUND
+SCHEMA_INVALID

package/docs/templates/buyer-email.txt

@@ -0,0 +1,18 @@
+Subject: Verified invoice link (evidence-backed)
+
+Hi,
+
+Here is your verified invoice link:
+<PASTE_MAGIC_LINK_HERE>
+
+This link provides:
+- Green/Amber/Red verification status
+- Invoice totals + line item summary
+- Stable error/warning codes when something fails
+- Downloads for audit/offline replay (bundle ZIP + deterministic verification JSON)
+
+If you need to re-verify offline, download the bundle ZIP from the page and run your verifier under your trust policy.
+
+Thanks,
+<YOUR_NAME>
+

package/docs/templates/buyer-one-pager.md

@@ -0,0 +1,24 @@
+# Settld Verified Invoice (Buyer one-pager)
+
+This invoice link is backed by a **cryptographically verifiable bundle** (an `InvoiceBundle.v1`) that can be archived and re-verified later, offline.
+
+## What you see on the page
+
+- **Green**: Verified with no warnings.
+- **Amber**: Verified, but warnings are present (common early: governance trust anchors not configured for strict verification).
+- **Red**: Verification failed.
+
+## What you can download
+
+- **Bundle ZIP**: the exact artifact that was verified (archive this for audit).
+- **Verification JSON** (`VerifyCliOutput.v1`): deterministic, machine-readable result (codes + hashes).
+- **Producer receipt** (if present): `verify/verification_report.json` from inside the bundle (producer-signed).
+- **PDF summary**: non-normative human summary for compatibility (not the source of truth).
+
+## Offline re-verification (recommended for audit)
+
+1. Download the **Bundle ZIP**.
+2. Verify locally using `settld-verify` (or another conforming verifier) under your trust policy.
+
+The verification JSON includes stable codes and hashes to support audit trails and replay.
+

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "settld",
-  "version": "0.1.2",
+  "version": "0.2.0",
   "description": "Settld kernel CLI and local control-plane tooling",
   "private": false,
   "type": "module",
   "engines": {
-    "node": ">=20"
+    "node": "20.x"
   },
   "publishConfig": {
     "access": "public"
@@ -22,14 +22,19 @@
     "bin",
     "conformance",
     "packages/artifact-verify/src",
-    "scripts/closepack",
-    "scripts/init",
+    "scripts",
+    "docs",
     "src",
     "services/finance-sink",
+    "services/x402-gateway",
     "services/receiver"
   ],
   "bin": {
-    "settld": "bin/settld.js"
+    "settld": "bin/settld.js",
+    "settld-mcp": "bin/settld-mcp"
+  },
+  "exports": {
+    "./mcp": "./scripts/mcp/settld-mcp-server.mjs"
   },
   "scripts": {
     "postinstall": "node scripts/init/postinstall-sanity.mjs",
@@ -38,17 +43,27 @@
     "dev:receiver": "node services/receiver/src/server.js",
     "dev:finance-sink": "node services/finance-sink/src/server.js",
     "dev:magic-link": "node services/magic-link/src/server.js",
+    "dev:x402-gateway": "node services/x402-gateway/src/server.js",
+    "quickstart:x402": "node scripts/quickstart/x402.mjs",
+    "setup:onboard": "node scripts/setup/onboard.mjs",
+    "setup:circle": "node scripts/setup/circle-bootstrap.mjs",
+    "setup:openclaw": "node scripts/setup/openclaw-onboard.mjs",
     "start:prod": "NODE_ENV=production node src/api/server.js",
     "start:maintenance": "NODE_ENV=production node src/api/maintenance.js",
     "start:receiver": "NODE_ENV=production node services/receiver/src/server.js",
     "start:finance-sink": "NODE_ENV=production node services/finance-sink/src/server.js",
     "start:magic-link": "NODE_ENV=production node services/magic-link/src/server.js",
+    "start:x402-gateway": "NODE_ENV=production node services/x402-gateway/src/server.js",
     "agent:sim": "node src/agent/agent-sim.js",
     "chaos": "node scripts/chaos.js",
     "load:ingest": "k6 run scripts/load/ingest-burst.k6.js",
     "load:deliveries": "node scripts/load/run-delivery-load.js",
     "acceptance:full-stack": "bash scripts/acceptance/full-stack.sh",
     "demo:delivery": "node scripts/demo/delivery-robot/generate.mjs",
+    "demo:mcp-paid-exa": "node scripts/demo/mcp-paid-exa.mjs",
+    "demo:mcp-paid-weather": "node scripts/demo/mcp-paid-exa.mjs --workload=weather",
+    "demo:mcp-paid-llm": "node scripts/demo/mcp-paid-exa.mjs --workload=llm",
+    "demo:compositional-settlement": "node scripts/demo/compositional-settlement-3hop.mjs",
     "demo:ui:prep": "node scripts/demo/delivery-robot/export-ui-fixture.mjs",
     "demo:ui": "cd dashboard && npm run dev",
     "demo:build": "cd dashboard && npm run build",
@@ -57,6 +72,15 @@
     "proof:job": "node scripts/proof-bundle/job.mjs",
     "proof:month": "node scripts/proof-bundle/month.mjs",
     "trust:wizard": "node scripts/trust-config/wizard.mjs",
+    "keys:rotate": "node scripts/trust-config/rotate-settld-pay.mjs",
+    "scaffold:paid-tool": "node scripts/scaffold/create-settld-paid-tool.mjs",
+    "settlement:x402:batch": "node scripts/settlement/x402-batch-worker.mjs",
+    "mcp:server": "node scripts/mcp/settld-mcp-server.mjs",
+    "mcp:probe": "node scripts/mcp/probe.mjs",
+    "mcp:http": "node scripts/mcp/settld-mcp-http-gateway.mjs",
+    "provider:conformance": "node scripts/provider/conformance-run.mjs",
+    "provider:publish": "node scripts/provider/publish.mjs",
+    "provider:keys:generate": "node scripts/provider/keys-generate.mjs",
     "governance:export": "node scripts/governance/export.mjs",
     "openapi:write": "node scripts/openapi/write.mjs",
     "sdk:smoke": "node scripts/sdk/smoke.mjs",
@@ -79,18 +103,41 @@
     "test:ops:throughput:incident": "node scripts/ci/run-10x-throughput-incident-rehearsal.mjs",
     "test:ops:go-live-gate": "node scripts/ci/run-go-live-gate.mjs",
     "test:ops:kernel-v0-launch-gate": "node scripts/ci/check-kernel-v0-launch-gate.mjs",
+    "test:ops:kernel-v0-ship-gate": "node scripts/ci/run-kernel-v0-ship-gate.mjs",
+    "test:ops:offline-verification-parity-gate": "node scripts/ci/run-offline-verification-parity-gate.mjs",
     "test:ops:self-serve-gate": "node scripts/ci/run-self-serve-launch-gate.mjs",
+    "test:ops:onboarding-policy-slo-gate": "node scripts/ci/run-onboarding-policy-slo-gate.mjs",
+    "test:ops:onboarding-host-success-gate": "node scripts/ci/run-onboarding-host-success-gate.mjs",
     "test:ops:self-serve-benchmark": "node scripts/ci/build-self-serve-benchmark-report.mjs",
     "test:ops:launch-cutover-packet": "node scripts/ci/build-launch-cutover-packet.mjs",
+    "test:ops:production-cutover-gate": "node scripts/ci/run-production-cutover-gate.mjs",
+    "test:ops:release-promotion-guard": "node scripts/ci/run-release-promotion-guard.mjs",
+    "test:ci:mcp-host-smoke": "node scripts/ci/run-mcp-host-smoke.mjs",
+    "test:ci:mcp-host-cert-matrix": "node scripts/ci/run-mcp-host-cert-matrix.mjs",
+    "test:x402:circle:sandbox:batch-e2e": "node --test test/circle-sandbox-batch-settlement-e2e.test.js",
+    "test:x402:circle:sandbox:smoke": "node scripts/ci/run-circle-sandbox-smoke.mjs",
+    "test:ci:runtime-import-smoke": "node scripts/ci/runtime-import-smoke.mjs",
+    "test:ci:secret-hygiene": "node scripts/ci/check-secret-hygiene.mjs",
+    "test:ci:public-openclaw-npx-smoke": "node scripts/ci/run-public-openclaw-npx-smoke.mjs",
     "test:cli:pack-smoke": "node scripts/ci/cli-pack-smoke.mjs",
     "ops:lighthouse:update": "node scripts/ci/update-lighthouse-tracker.mjs",
     "ops:tenant:bootstrap:conformance": "node scripts/ops/bootstrap-tenant-conformance.mjs",
+    "ops:money-rails:reconcile:evidence": "node scripts/ops/money-rails-reconcile-evidence.mjs",
+    "ops:money-rails:chargeback:evidence": "node scripts/ops/money-rails-chargeback-evidence.mjs",
+    "ops:dispute:finance:packet": "node scripts/ops/dispute-finance-reconciliation-packet.mjs",
+    "ops:x402:pilot:weekly-report": "node scripts/ops/build-x402-pilot-reliability-report.mjs",
+    "ops:x402:hitl:smoke": "node scripts/ops/run-x402-hitl-smoke.mjs",
+    "ops:x402:receipt:sample-check": "node scripts/ops/check-x402-receipt-sample.mjs",
+    "ops:hosted-baseline:evidence": "node scripts/ops/hosted-baseline-evidence.mjs",
+    "ops:design-partner:run-packet": "node scripts/ops/design-partner-run-packet.mjs",
     "magic-link:migrate-runs-db": "node scripts/magic-link/migrate-run-records-to-db.mjs",
     "release:artifacts": "node scripts/release/build-artifacts.mjs",
     "audit:packet": "node scripts/audit/build-audit-packet.mjs"
   },
   "dependencies": {
-    "pg": "^8.11.5"
+    "@circle-fin/developer-controlled-wallets": "^10.1.0",
+    "pg": "^8.11.5",
+    "snarkjs": "^0.7.6"
   },
   "devDependencies": {
     "ajv": "^8.17.1"