settld 0.1.2 → 0.2.0

package/scripts/proof-bundle/job.mjs

@@ -0,0 +1,109 @@
+import path from "node:path";
+
+import { createPgStore } from "../../src/db/store-pg.js";
+import { normalizeTenantId, DEFAULT_TENANT_ID } from "../../src/core/tenancy.js";
+import { GOVERNANCE_STREAM_ID } from "../../src/core/governance.js";
+import { buildJobProofBundleV1 } from "../../src/core/proof-bundle.js";
+
+import { ensureDir, writeFilesToDir, writeZipFromDir } from "./lib.mjs";
+
+function readArg(name) {
+  const idx = process.argv.indexOf(name);
+  if (idx === -1) return null;
+  return process.argv[idx + 1] ?? null;
+}
+
+const DATABASE_URL = process.env.DATABASE_URL ?? null;
+if (!DATABASE_URL) throw new Error("DATABASE_URL is required");
+
+const tenantId = normalizeTenantId(process.env.TENANT_ID ?? readArg("--tenant") ?? DEFAULT_TENANT_ID);
+const jobId = readArg("--job") ?? readArg("--jobId") ?? null;
+if (!jobId) throw new Error("usage: DATABASE_URL=... node scripts/proof-bundle/job.mjs --job <jobId> [--out <dir>] [--zip]");
+
+const outBase = readArg("--out") ?? path.join("demo", "proof-bundles");
+const zipFlag = process.argv.includes("--zip");
+
+const store = await createPgStore({ databaseUrl: DATABASE_URL, schema: process.env.PROXY_PG_SCHEMA ?? "public", migrateOnStartup: true });
+try {
+  const jobEvents = await store.listAggregateEvents({ tenantId, aggregateType: "job", aggregateId: String(jobId) });
+  if (!jobEvents.length) throw new Error("job not found");
+  const jobSnapshot = await store.getJob({ tenantId, jobId: String(jobId) });
+  if (!jobSnapshot) throw new Error("job snapshot not found");
+
+  const artifacts = await store.listArtifacts({ tenantId, jobId: String(jobId) });
+  const tenantGovernanceEvents = await store.listAggregateEvents({ tenantId, aggregateType: "month", aggregateId: GOVERNANCE_STREAM_ID });
+  const tenantGovernanceSnapshot = {
+    streamId: GOVERNANCE_STREAM_ID,
+    lastChainHash: tenantGovernanceEvents.length ? tenantGovernanceEvents[tenantGovernanceEvents.length - 1]?.chainHash ?? null : null,
+    lastEventId: tenantGovernanceEvents.length ? tenantGovernanceEvents[tenantGovernanceEvents.length - 1]?.id ?? null : null
+  };
+  const governanceEvents = await store.listAggregateEvents({ tenantId: DEFAULT_TENANT_ID, aggregateType: "month", aggregateId: GOVERNANCE_STREAM_ID });
+  const governanceSnapshot = {
+    streamId: GOVERNANCE_STREAM_ID,
+    lastChainHash: governanceEvents.length ? governanceEvents[governanceEvents.length - 1]?.chainHash ?? null : null,
+    lastEventId: governanceEvents.length ? governanceEvents[governanceEvents.length - 1]?.id ?? null : null
+  };
+
+  const contractDocsByHash = new Map();
+  const customerContractHash = jobSnapshot?.booking?.customerContractHash ?? null;
+  const operatorContractHash = jobSnapshot?.operatorContractHash ?? null;
+  for (const h of [customerContractHash, operatorContractHash]) {
+    if (typeof h !== "string" || !h.trim()) continue;
+    if (typeof store.getContractV2ByHash === "function") {
+      // eslint-disable-next-line no-await-in-loop
+      const rec = await store.getContractV2ByHash({ tenantId, contractHash: String(h) });
+      if (rec?.doc) contractDocsByHash.set(String(h), rec.doc);
+    }
+  }
+
+  const publicKeyByKeyId = store.publicKeyByKeyId instanceof Map ? store.publicKeyByKeyId : new Map();
+  const resolvedSignerKeys = (() => {
+    if (typeof store.listSignerKeys !== "function") return Promise.resolve([]);
+    return (async () => {
+      const tenantKeys = await store.listSignerKeys({ tenantId });
+      const defaultKeys = await store.listSignerKeys({ tenantId: DEFAULT_TENANT_ID });
+      const all = [...(tenantKeys ?? []), ...(defaultKeys ?? [])];
+      const byKeyId = new Map();
+      for (const r of all) {
+        const keyId = r?.keyId ? String(r.keyId) : null;
+        if (!keyId) continue;
+        byKeyId.set(keyId, r);
+      }
+      return Array.from(byKeyId.values());
+    })();
+  })();
+  const signerKeys = await resolvedSignerKeys;
+  const generatedAt = store.nowIso ? store.nowIso() : new Date().toISOString();
+  const manifestSigner = store?.serverSigner ? { keyId: store.serverSigner.keyId, privateKeyPem: store.serverSigner.privateKeyPem } : null;
+
+  const { files, bundle } = buildJobProofBundleV1({
+    tenantId,
+    jobId: String(jobId),
+    jobEvents,
+    jobSnapshot,
+    governanceEvents,
+    governanceSnapshot,
+    tenantGovernanceEvents,
+    tenantGovernanceSnapshot,
+    artifacts,
+    contractDocsByHash,
+    publicKeyByKeyId,
+    signerKeys,
+    manifestSigner,
+    generatedAt
+  });
+
+  const outDir = path.join(outBase, `job_${tenantId}_${String(jobId)}_${bundle.manifestHash.slice(0, 12)}`);
+  ensureDir(outDir);
+  writeFilesToDir({ files, outDir });
+
+  if (zipFlag) {
+    const zipPath = `${outDir}.zip`;
+    await writeZipFromDir({ dir: outDir, outPath: zipPath });
+    process.stdout.write(`${zipPath}\n`);
+  } else {
+    process.stdout.write(`${outDir}\n`);
+  }
+} finally {
+  await store.close?.();
+}

package/scripts/proof-bundle/lib.mjs

@@ -0,0 +1,92 @@
+import fs from "node:fs";
+import path from "node:path";
+import { spawn } from "node:child_process";
+
+export function ensureDir(dir) {
+  fs.mkdirSync(dir, { recursive: true });
+}
+
+export function writeFilesToDir({ files, outDir }) {
+  if (!(files instanceof Map)) throw new TypeError("files must be a Map");
+  if (!outDir) throw new TypeError("outDir is required");
+  ensureDir(outDir);
+
+  // Deterministic: do not depend on Map insertion order.
+  const entries = Array.from(files.entries()).sort(([a], [b]) => a.localeCompare(b));
+  for (const [name, bytes] of entries) {
+    const full = path.join(outDir, name);
+    ensureDir(path.dirname(full));
+    fs.writeFileSync(full, Buffer.from(bytes));
+  }
+}
+
+export async function writeZipFromDir({ dir, outPath, mtime = new Date("2000-01-01T00:00:00.000Z") } = {}) {
+  if (!dir) throw new Error("dir is required");
+  if (!outPath) throw new Error("outPath is required");
+
+  // Avoid npm dependencies: use Python's stdlib zipfile for deterministic zips.
+  // We set a constant timestamp for all entries to keep bytes stable across reruns.
+  const mtimeUtc = new Date(mtime);
+  if (!Number.isFinite(mtimeUtc.getTime())) throw new Error("mtime must be a valid Date");
+  const dt = [
+    mtimeUtc.getUTCFullYear(),
+    mtimeUtc.getUTCMonth() + 1,
+    mtimeUtc.getUTCDate(),
+    mtimeUtc.getUTCHours(),
+    mtimeUtc.getUTCMinutes(),
+    mtimeUtc.getUTCSeconds()
+  ];
+
+  const compression = arguments[0]?.compression ?? "deflated";
+  const compressionMode = String(compression).toLowerCase();
+  if (compressionMode !== "deflated" && compressionMode !== "stored") {
+    throw new Error('compression must be "deflated" or "stored"');
+  }
+  const zipCompression = compressionMode === "stored" ? "ZIP_STORED" : "ZIP_DEFLATED";
+
+  const pyCode = `
+import os, sys, zipfile
+
+src = sys.argv[1]
+out = sys.argv[2]
+dt = tuple(int(x) for x in sys.argv[3].split(","))
+mode = sys.argv[4]
+compression = zipfile.ZIP_STORED if mode == "ZIP_STORED" else zipfile.ZIP_DEFLATED
+
+files = []
+for root, dirs, filenames in os.walk(src):
+    dirs.sort()
+    for fn in sorted(filenames):
+        full = os.path.join(root, fn)
+        rel = os.path.relpath(full, src).replace(os.sep, "/")
+        files.append((full, rel))
+
+zf = zipfile.ZipFile(out, "w", compression=compression)
+try:
+    for full, rel in files:
+        zi = zipfile.ZipInfo(rel, date_time=dt)
+        zi.compress_type = compression
+        with open(full, "rb") as f:
+            zf.writestr(zi, f.read())
+finally:
+    zf.close()
+  `.trim();
+
+  const py = spawn(
+    "python3",
+    [
+      "-c",
+      pyCode,
+      dir,
+      outPath,
+      dt.join(","),
+      zipCompression
+    ],
+    { stdio: "inherit" }
+  );
+
+  await new Promise((resolve, reject) => {
+    py.on("error", reject);
+    py.on("exit", (code) => (code === 0 ? resolve() : reject(new Error(`python3 zip failed with exit code ${code}`))));
+  });
+}

package/scripts/proof-bundle/month.mjs

@@ -0,0 +1,103 @@
+import path from "node:path";
+
+import { createPgStore } from "../../src/db/store-pg.js";
+import { normalizeTenantId, DEFAULT_TENANT_ID } from "../../src/core/tenancy.js";
+import { GOVERNANCE_STREAM_ID } from "../../src/core/governance.js";
+import { MONTH_CLOSE_BASIS, makeMonthCloseStreamId } from "../../src/core/month-close.js";
+import { buildMonthProofBundleV1 } from "../../src/core/proof-bundle.js";
+
+import { ensureDir, writeFilesToDir, writeZipFromDir } from "./lib.mjs";
+
+function readArg(name) {
+  const idx = process.argv.indexOf(name);
+  if (idx === -1) return null;
+  return process.argv[idx + 1] ?? null;
+}
+
+const DATABASE_URL = process.env.DATABASE_URL ?? null;
+if (!DATABASE_URL) throw new Error("DATABASE_URL is required");
+
+const tenantId = normalizeTenantId(process.env.TENANT_ID ?? readArg("--tenant") ?? DEFAULT_TENANT_ID);
+const period = readArg("--period") ?? readArg("--month") ?? null;
+if (!period) throw new Error("usage: DATABASE_URL=... node scripts/proof-bundle/month.mjs --period YYYY-MM [--out <dir>] [--zip]");
+
+const basis = String(readArg("--basis") ?? MONTH_CLOSE_BASIS.SETTLED_AT);
+const outBase = readArg("--out") ?? path.join("demo", "proof-bundles");
+const zipFlag = process.argv.includes("--zip");
+
+const store = await createPgStore({ databaseUrl: DATABASE_URL, schema: process.env.PROXY_PG_SCHEMA ?? "public", migrateOnStartup: true });
+try {
+  const monthId = makeMonthCloseStreamId({ month: String(period), basis });
+  const monthEvents = await store.listAggregateEvents({ tenantId, aggregateType: "month", aggregateId: monthId });
+  if (!monthEvents.length) throw new Error("month close stream not found");
+
+  const artifacts = await store.listArtifacts({ tenantId });
+  const monthArtifacts = artifacts.filter((a) => {
+    if (!a || typeof a !== "object") return false;
+    if (a.period && String(a.period) === String(period)) return true; // GLBatch.v1
+    if (a.month && String(a.month) === String(period)) return true; // MonthlyStatement.v1
+    if (a.period && String(a.period) === String(period)) return true; // PartyStatement/PayoutInstruction include period
+    return false;
+  });
+
+  const publicKeyByKeyId = store.publicKeyByKeyId instanceof Map ? store.publicKeyByKeyId : new Map();
+  let signerKeys = [];
+  if (typeof store.listSignerKeys === "function") {
+    const tenantKeys = await store.listSignerKeys({ tenantId });
+    const defaultKeys = await store.listSignerKeys({ tenantId: DEFAULT_TENANT_ID });
+    const all = [...(tenantKeys ?? []), ...(defaultKeys ?? [])];
+    const byKeyId = new Map();
+    for (const r of all) {
+      const keyId = r?.keyId ? String(r.keyId) : null;
+      if (!keyId) continue;
+      byKeyId.set(keyId, r);
+    }
+    signerKeys = Array.from(byKeyId.values());
+  }
+  const generatedAt = store.nowIso ? store.nowIso() : new Date().toISOString();
+  const manifestSigner = store?.serverSigner ? { keyId: store.serverSigner.keyId, privateKeyPem: store.serverSigner.privateKeyPem } : null;
+  const tenantGovernanceEvents = await store.listAggregateEvents({ tenantId, aggregateType: "month", aggregateId: GOVERNANCE_STREAM_ID });
+  const tenantGovernanceSnapshot = {
+    streamId: GOVERNANCE_STREAM_ID,
+    lastChainHash: tenantGovernanceEvents.length ? tenantGovernanceEvents[tenantGovernanceEvents.length - 1]?.chainHash ?? null : null,
+    lastEventId: tenantGovernanceEvents.length ? tenantGovernanceEvents[tenantGovernanceEvents.length - 1]?.id ?? null : null
+  };
+  const governanceEvents = await store.listAggregateEvents({ tenantId: DEFAULT_TENANT_ID, aggregateType: "month", aggregateId: GOVERNANCE_STREAM_ID });
+  const governanceSnapshot = {
+    streamId: GOVERNANCE_STREAM_ID,
+    lastChainHash: governanceEvents.length ? governanceEvents[governanceEvents.length - 1]?.chainHash ?? null : null,
+    lastEventId: governanceEvents.length ? governanceEvents[governanceEvents.length - 1]?.id ?? null : null
+  };
+
+  const { files, bundle } = buildMonthProofBundleV1({
+    tenantId,
+    period: String(period),
+    basis,
+    monthEvents,
+    governanceEvents,
+    governanceSnapshot,
+    tenantGovernanceEvents,
+    tenantGovernanceSnapshot,
+    artifacts: monthArtifacts,
+    contractDocsByHash: new Map(),
+    publicKeyByKeyId,
+    signerKeys,
+    manifestSigner,
+    requireHeadAttestation: true,
+    generatedAt
+  });
+
+  const outDir = path.join(outBase, `month_${tenantId}_${String(period)}_${bundle.manifestHash.slice(0, 12)}`);
+  ensureDir(outDir);
+  writeFilesToDir({ files, outDir });
+
+  if (zipFlag) {
+    const zipPath = `${outDir}.zip`;
+    await writeZipFromDir({ dir: outDir, outPath: zipPath });
+    process.stdout.write(`${zipPath}\n`);
+  } else {
+    process.stdout.write(`${outDir}\n`);
+  }
+} finally {
+  await store.close?.();
+}

package/scripts/provider/conformance-run.mjs

@@ -0,0 +1,159 @@
+#!/usr/bin/env node
+import fs from "node:fs";
+import path from "node:path";
+
+function usage() {
+  return [
+    "Usage:",
+    "  node scripts/provider/conformance-run.mjs --manifest <file> --base-url <providerBaseUrl> [options]",
+    "",
+    "Options:",
+    "  --api-url <url>              Settld API base URL (default: SETTLD_API_URL or http://127.0.0.1:3000)",
+    "  --api-key <token>            Settld API key (default: SETTLD_API_KEY)",
+    "  --tenant-id <id>             Tenant id header (default: SETTLD_TENANT_ID or tenant_default)",
+    "  --tool-id <toolId>           Run conformance against a specific tool id",
+    "  --provider-id <providerId>   Override provider id (must match manifest.providerId)",
+    "  --provider-key-file <path>   Provider signing public key PEM file",
+    "  --provider-key-pem <pem>     Provider signing public key PEM inline",
+    "  --json-out <file>            Write report JSON to file",
+    "  --allow-fail                 Exit 0 even when conformance fails",
+    "  --help                       Show this help"
+  ].join("\n");
+}
+
+function parseArgs(argv) {
+  const out = {
+    apiUrl: process.env.SETTLD_API_URL || "http://127.0.0.1:3000",
+    apiKey: process.env.SETTLD_API_KEY || null,
+    tenantId: process.env.SETTLD_TENANT_ID || "tenant_default",
+    manifestPath: null,
+    baseUrl: null,
+    toolId: null,
+    providerId: null,
+    providerKeyFile: null,
+    providerKeyPem: null,
+    jsonOut: null,
+    allowFail: false,
+    help: false
+  };
+  for (let i = 0; i < argv.length; i += 1) {
+    const arg = String(argv[i] ?? "");
+    if (arg === "--help" || arg === "-h") out.help = true;
+    else if (arg === "--allow-fail") out.allowFail = true;
+    else if (arg === "--manifest") out.manifestPath = String(argv[++i] ?? "").trim();
+    else if (arg === "--base-url") out.baseUrl = String(argv[++i] ?? "").trim();
+    else if (arg === "--api-url") out.apiUrl = String(argv[++i] ?? "").trim();
+    else if (arg === "--api-key") out.apiKey = String(argv[++i] ?? "").trim();
+    else if (arg === "--tenant-id") out.tenantId = String(argv[++i] ?? "").trim();
+    else if (arg === "--tool-id") out.toolId = String(argv[++i] ?? "").trim();
+    else if (arg === "--provider-id") out.providerId = String(argv[++i] ?? "").trim();
+    else if (arg === "--provider-key-file") out.providerKeyFile = String(argv[++i] ?? "").trim();
+    else if (arg === "--provider-key-pem") out.providerKeyPem = String(argv[++i] ?? "").trim();
+    else if (arg === "--json-out") out.jsonOut = String(argv[++i] ?? "").trim();
+    else throw new Error(`unknown argument: ${arg}`);
+  }
+  if (!out.help) {
+    if (!out.manifestPath) throw new Error("--manifest is required");
+    if (!out.baseUrl) throw new Error("--base-url is required");
+  }
+  return out;
+}
+
+function readJson(filePath) {
+  const resolved = path.resolve(process.cwd(), filePath);
+  const raw = fs.readFileSync(resolved, "utf8");
+  return JSON.parse(raw);
+}
+
+function resolveProviderKeyPem({ inlinePem, filePath }) {
+  if (typeof inlinePem === "string" && inlinePem.trim() !== "") return inlinePem;
+  if (typeof filePath === "string" && filePath.trim() !== "") {
+    const resolved = path.resolve(process.cwd(), filePath);
+    return fs.readFileSync(resolved, "utf8");
+  }
+  return null;
+}
+
+function makeCliError(code, message, details = null) {
+  const err = new Error(message);
+  err.code = code;
+  err.details = details;
+  return err;
+}
+
+function printJson(value) {
+  process.stdout.write(`${JSON.stringify(value, null, 2)}\n`);
+}
+
+async function main() {
+  const args = parseArgs(process.argv.slice(2));
+  if (args.help) {
+    process.stdout.write(`${usage()}\n`);
+    return;
+  }
+  if (!args.apiKey) throw makeCliError("PROVIDER_CONFORMANCE_MISSING_API_KEY", "SETTLD_API_KEY or --api-key is required");
+
+  const manifest = readJson(args.manifestPath);
+  const providerSigningPublicKeyPem = resolveProviderKeyPem({ inlinePem: args.providerKeyPem, filePath: args.providerKeyFile });
+  const response = await fetch(new URL("/marketplace/providers/conformance/run", args.apiUrl), {
+    method: "POST",
+    headers: {
+      authorization: `Bearer ${args.apiKey}`,
+      "x-proxy-tenant-id": args.tenantId,
+      "content-type": "application/json; charset=utf-8"
+    },
+    body: JSON.stringify({
+      providerId: args.providerId || null,
+      baseUrl: args.baseUrl,
+      toolId: args.toolId || null,
+      providerSigningPublicKeyPem,
+      manifest
+    })
+  });
+
+  const text = await response.text();
+  let json = null;
+  try {
+    json = text ? JSON.parse(text) : null;
+  } catch {
+    json = null;
+  }
+  if (!response.ok) {
+    throw makeCliError("PROVIDER_CONFORMANCE_REQUEST_FAILED", "conformance run failed", {
+      statusCode: response.status,
+      response: json ?? text ?? null
+    });
+  }
+  const report = json?.report ?? null;
+  if (!report || typeof report !== "object") {
+    throw makeCliError("PROVIDER_CONFORMANCE_INVALID_RESPONSE", "conformance response missing report");
+  }
+
+  if (args.jsonOut) {
+    const outPath = path.resolve(process.cwd(), args.jsonOut);
+    fs.mkdirSync(path.dirname(outPath), { recursive: true });
+    fs.writeFileSync(outPath, `${JSON.stringify(report, null, 2)}\n`, "utf8");
+  }
+
+  const verdictOk = report?.verdict?.ok === true;
+  const payload = {
+    ok: verdictOk,
+    ...(verdictOk ? {} : { code: "PROVIDER_CONFORMANCE_FAILED", message: "provider conformance failed" }),
+    allowFailApplied: !verdictOk && args.allowFail === true,
+    providerId: report?.providerId ?? null,
+    toolId: report?.tool?.toolId ?? null,
+    verdict: report?.verdict ?? null
+  };
+  printJson(payload);
+  if (!verdictOk && !args.allowFail) process.exitCode = 1;
+}
+
+main().catch((err) => {
+  printJson({
+    ok: false,
+    code: typeof err?.code === "string" && err.code.trim() !== "" ? err.code : "PROVIDER_CONFORMANCE_CLI_ERROR",
+    message: err?.message ?? String(err ?? ""),
+    details: err?.details ?? null
+  });
+  process.exit(1);
+});

package/scripts/provider/keys-generate.mjs

@@ -0,0 +1,135 @@
+#!/usr/bin/env node
+import fs from "node:fs";
+import path from "node:path";
+
+import { createEd25519Keypair, keyIdFromPublicKeyPem } from "../../src/core/crypto.js";
+import { buildSettldPayKeysetV1 } from "../../src/core/settld-keys.js";
+import { computeProviderRefFromPublishProofJwk } from "../../src/core/provider-publish-proof.js";
+
+function usage() {
+  return [
+    "Usage:",
+    "  node scripts/provider/keys-generate.mjs --out-dir <dir> [options]",
+    "",
+    "Options:",
+    "  --out-dir <dir>        Output directory (required)",
+    "  --prefix <name>        File prefix (default: identity)",
+    "  --overwrite            Allow overwriting existing files",
+    "  --help                 Show this help"
+  ].join("\n");
+}
+
+function parseArgs(argv) {
+  const out = {
+    outDir: null,
+    prefix: "identity",
+    overwrite: false,
+    help: false
+  };
+  for (let i = 0; i < argv.length; i += 1) {
+    const arg = String(argv[i] ?? "");
+    if (arg === "--help" || arg === "-h") out.help = true;
+    else if (arg === "--out-dir") out.outDir = String(argv[++i] ?? "").trim();
+    else if (arg === "--prefix") out.prefix = String(argv[++i] ?? "").trim();
+    else if (arg === "--overwrite") out.overwrite = true;
+    else throw new Error(`unknown argument: ${arg}`);
+  }
+  if (!out.help) {
+    if (!out.outDir) throw new Error("--out-dir is required");
+    if (!out.prefix) throw new Error("--prefix must be non-empty");
+  }
+  return out;
+}
+
+function assertWritablePath(filePath, { overwrite }) {
+  if (!fs.existsSync(filePath)) return;
+  if (overwrite) return;
+  throw new Error(`file exists (use --overwrite): ${filePath}`);
+}
+
+function writeFileSafely(filePath, value, { overwrite, mode = null } = {}) {
+  assertWritablePath(filePath, { overwrite });
+  fs.writeFileSync(filePath, value, { encoding: "utf8", ...(mode ? { mode } : {}) });
+}
+
+function main() {
+  const args = parseArgs(process.argv.slice(2));
+  if (args.help) {
+    process.stdout.write(`${usage()}\n`);
+    return;
+  }
+
+  const outDir = path.resolve(process.cwd(), args.outDir);
+  fs.mkdirSync(outDir, { recursive: true });
+
+  const { publicKeyPem, privateKeyPem } = createEd25519Keypair();
+  const keyId = keyIdFromPublicKeyPem(publicKeyPem);
+  const jwks = buildSettldPayKeysetV1({
+    activeKey: {
+      keyId,
+      publicKeyPem
+    },
+    refreshedAt: new Date().toISOString()
+  });
+  const providerRef = computeProviderRefFromPublishProofJwk(jwks.keys[0]);
+
+  const privateKeyPath = path.join(outDir, `${args.prefix}.ed25519.private.pem`);
+  const publicKeyPath = path.join(outDir, `${args.prefix}.ed25519.public.pem`);
+  const jwksPath = path.join(outDir, `${args.prefix}.jwks.json`);
+  const metadataPath = path.join(outDir, `${args.prefix}.meta.json`);
+
+  writeFileSafely(privateKeyPath, privateKeyPem, { overwrite: args.overwrite, mode: 0o600 });
+  writeFileSafely(publicKeyPath, publicKeyPem, { overwrite: args.overwrite });
+  writeFileSafely(jwksPath, `${JSON.stringify(jwks, null, 2)}\n`, { overwrite: args.overwrite });
+  writeFileSafely(
+    metadataPath,
+    `${JSON.stringify(
+      {
+        schemaVersion: "ProviderIdentityMaterial.v1",
+        generatedAt: new Date().toISOString(),
+        keyId,
+        providerRef,
+        files: {
+          privateKeyPath,
+          publicKeyPath,
+          jwksPath
+        }
+      },
+      null,
+      2
+    )}\n`,
+    { overwrite: args.overwrite }
+  );
+
+  process.stdout.write(
+    `${JSON.stringify(
+      {
+        ok: true,
+        keyId,
+        providerRef,
+        privateKeyPath,
+        publicKeyPath,
+        jwksPath,
+        metadataPath
+      },
+      null,
+      2
+    )}\n`
+  );
+}
+
+try {
+  main();
+} catch (err) {
+  process.stdout.write(
+    `${JSON.stringify(
+      {
+        ok: false,
+        message: err?.message ?? String(err ?? "")
+      },
+      null,
+      2
+    )}\n`
+  );
+  process.exit(1);
+}