{"owner":"genesiscode2026","slug":"verifiable-delivery-packager","channel":"genesiscode2026/verifiable-delivery-packager","version":"1.0.0","artifact_sha256":"e7e58228b0b1a2633d5cc2b5e018180f020a894cd451a6658a25a7a3b61c4232","published_at":"2026-09-16T21:22:01.988Z","price_micro":"79000000","update_price_micro":"15000000","resource_endpoint":"https://x402git.com/api/r/genesiscode2026/verifiable-delivery-packager","version_url":"https://x402git.com/api/v/genesiscode2026/verifiable-delivery-packager","computed":{"artifact_class":"Pack","component_inventory":[{"kind":"source","count":3},{"kind":"tests","count":2},{"kind":"examples","count":1},{"kind":"docs","count":14},{"kind":"config","count":3},{"kind":"other","count":1}],"file_count":24,"dir_depth":1,"bytes_text":35120,"bytes_binary":0,"languages":{"JavaScript":13299},"tree":[{"path":".gitignore","size":30,"binary":false},{"path":"AGENT_EVAL.md","size":1188,"binary":false},{"path":"ARCHITECTURE.md","size":602,"binary":false},{"path":"CHANGELOG.md","size":328,"binary":false},{"path":"DEPENDENCIES.md","size":407,"binary":false},{"path":"LICENSE.md","size":1660,"binary":false},{"path":"LIMITATIONS.md","size":319,"binary":false},{"path":"PREVIEW.md","size":1715,"binary":false},{"path":"QUICKSTART.md","size":996,"binary":false},{"path":"README.md","size":3002,"binary":false},{"path":"SECURITY.md","size":556,"binary":false},{"path":"SUPPORT.md","size":701,"binary":false},{"path":"TEST_REPORT.md","size":885,"binary":false},{"path":"THIRD_PARTY_NOTICES.md","size":216,"binary":false},{"path":"THREAT_MODEL.md","size":838,"binary":false},{"path":"VERIFICATION.md","size":154,"binary":false},{"path":"commercial-manifest.json","size":1194,"binary":false},{"path":"examples/package-demo.mjs","size":2431,"binary":false},{"path":"package.json","size":663,"binary":false},{"path":"release-manifest.json","size":2264,"binary":false},{"path":"src/index.d.ts","size":1672,"binary":false},{"path":"src/index.mjs","size":230,"binary":false},{"path":"src/packager.mjs","size":7819,"binary":false},{"path":"tests/delivery.test.mjs","size":5250,"binary":false}],"readme_html":"<h2>Verifiable Delivery Packager</h2>\n<blockquote><p><strong>Cryptographic delivery packaging, tamper-evident manifest generation, and verifiable review receipts for AI agent and CI/CD deliverables.</strong></p></blockquote>\n<p><img src=\"https://img.shields.io/badge/tests-7%20passed-brightgreen.svg\" alt=\"Tests\" loading=\"lazy\" decoding=\"async\" /> <img src=\"https://img.shields.io/badge/dependencies-0%20runtime-brightgreen.svg\" alt=\"Dependencies\" loading=\"lazy\" decoding=\"async\" /> <img src=\"https://img.shields.io/badge/license-Commercial%20Source-blue.svg\" alt=\"License\" loading=\"lazy\" decoding=\"async\" /></p>\n<hr />\n<h3>1. WHAT IS THIS?</h3>\n<p>The <strong>Verifiable Delivery Packager</strong> is a zero-dependency Node.js library for engineering teams, autonomous AI agent pipelines, and automated review platforms. It bundles software deliverables into deterministic, tamper-evident packages backed by canonical JSON manifests and cryptographically signs review decisions via verification receipts.</p>\n<h3>2. WHO IS IT FOR?</h3>\n<ul><li><strong>AI Agent Framework Developers:</strong> Requiring strict boundaries, canonical manifests, and cryptographic certainty before committing agent changes.</li><li><strong>Security &amp; Compliance Teams:</strong> Enforcing verifiable audit trails for automated code generation.</li><li><strong>CI/CD Pipeline Engineers:</strong> Ensuring artifact integrity between build, test, review, and deployment stages.</li></ul>\n<h3>3. WHAT PROBLEM DOES IT SOLVE?</h3>\n<p>Autonomous agents produce files dynamically. Traditional tarballs or git commits do not provide deterministic canonicalization, leave vulnerabilities open to permission escalation (executable bits), and lack decoupled cryptographic review receipts that can prove an auditor approved the exact byte-for-byte deliverable without re-running the entire repository history.</p>\n<h3>4. WHY PAY FOR IT INSTEAD OF BUILDING IT?</h3>\n<ul><li><strong>Deterministic Canonical Serialization:</strong> Recursively sorts object keys to guarantee identical JSON manifests produce identical SHA-256 digests across platforms.</li><li><strong>Strict Executable Bit Auditing:</strong> Verifies that no deliverable file possesses executable permissions (<code>mode &amp; 0o111 === 0</code>), eliminating surprise script execution vectors.</li><li><strong>Path Traversal &amp; Symlink Immunity:</strong> Automatically detects and rejects symlinks, absolute paths, null bytes, and traversal sequences (<code>..</code>).</li><li><strong>Decoupled Verification Receipts:</strong> Generates cryptographic review approval records (<code>DELIVERY_RECEIPT.json</code>) bound to package digests.</li><li><strong>Zero External Dependencies:</strong> Built entirely on Node.js built-in modules (<code>node:crypto</code>, <code>node:fs</code>, <code>node:path</code>).</li></ul>\n<h3>5. WHAT IS VERIFIED?</h3>\n<ul><li><strong>7 / 7 Automated Unit Tests Passed:</strong> Canonical JSON sorting, end-to-end package generation and verification, unauthorized mutation detection, path traversal rejection, rogue extra file detection, executable bit set rejection, and symlink rejection.</li><li><strong>100% Clean-Room Isolation:</strong> Verified passing inside clean temporary directory with zero network access and zero external npm packages.</li></ul>\n<h3>6. HOW DO I RUN IT?</h3>\n<pre><code class=\"language-bash\"># 1. Run unit test suite\nnode --test tests/delivery.test.mjs\n\n# 2. Run interactive delivery &amp; receipt demo\nnode examples/package-demo.mjs\n</code></pre>","dependencies":[],"licence":{"verdict":"manual"},"scan":{"verdict":"pass","scanner_version":"2026.09.1","at":"2026-09-16T21:22:05.955Z","checks":[{"id":"secrets","tool":"x402git/secrets","tool_version":"2026.09.1","status":"pass","at":"2026-09-16T21:22:05.955Z","findings":0},{"id":"limits","tool":"x402git/limits","tool_version":"2026.09.1","status":"pass","at":"2026-09-16T21:22:05.955Z","findings":0},{"id":"known_vulns","tool":"osv.dev","tool_version":"2026-09-16","status":"pass","at":"2026-09-16T21:22:05.955Z","findings":0,"packages":0},{"id":"known_malware","tool":"osv.dev/MAL","tool_version":"2026-09-16","status":"pass","at":"2026-09-16T21:22:05.955Z","findings":0,"packages":0},{"id":"dep_behaviour","tool":"socket.dev","tool_version":"2026-09-16","status":"findings","at":"2026-09-16T21:22:05.955Z","findings":1,"packages":1},{"id":"capabilities","tool":"x402git/caps","tool_version":"2026.09.1","status":"pass","at":"2026-09-16T21:22:05.955Z","findings":0},{"id":"injection","tool":"x402git/inject","tool_version":"2026.09.1","status":"pass","at":"2026-09-16T21:22:05.955Z","findings":0}],"findings":[{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"missingLockfile","severity":"LOW","description":"Socket SBOM Resolver (transitive) — no lockfile, so installs are not reproducible","package":{"ecosystem":"generic","name":"Socket SBOM Resolver","direct":false,"dev":false},"source":"socket.dev"}],"capabilities":{"tools":[],"runs":[],"hosts":[{"host":"img.shields.io","local":false,"from":"docs","paths":["README.md"]}],"env":[],"install_runs":false,"summary":"links to 1 host in its docs · nothing runs at install"},"counts":{"blocking":0,"disclosed":1,"review":0}},"originality":{"blob_overlap_ratio":0.043,"blobs_seen_elsewhere":1,"blobs_total":23,"nearest_listing":"genesiscode2026/agent-workspace-guard-sdk","derivative_of":null},"engineering":{"unique_5gram_ratio":0.59,"type_token_ratio":0.391,"effective_code_lines":279,"effective_doc_words":1286,"code_files":5,"test_files":2,"padding_suspected":true,"class_note":"Capped at Pack: unique 5-gram ratio 0.59 is below the 0.6 guard."},"cadence":{"releases":0,"median_days_between_releases":null,"on_time_fraction":null,"days_since_last":null,"score":null,"finished":false},"inventory_sentence":"3 source files · 2 test files · 1 example · 14 docs","extensions":{"md":15,"ts":1,"mjs":4,"json":3,"(none)":1},"lines_of_code":473,"warnings":["sbom_unavailable"],"repo_meta":{"repo_id":1372978956,"name":"verifiable-delivery-packager","full_name":"genesiscode2026/verifiable-delivery-packager","description":"Deterministic software-delivery packaging with integrity manifests, executable-bit auditing and cryptographic review receipts.","homepage":null,"topics":["developer-tools","devops","integrity","nodejs","software-supply-chain","verification"],"language":"JavaScript","default_branch":"main","size_kb":16,"created_at":"2026-09-16T12:09:24Z","pushed_at":"2026-09-16T12:09:28Z","licence_spdx":null,"open_issues":null,"stars":null,"forks":null,"watchers":null,"archived":false,"private":true,"html_url":null},"owner":{"login":"genesiscode2026","name":null,"avatar_url":"https://avatars.githubusercontent.com/u/329895054?v=4","bio":null,"blog":null,"company":null,"location":null,"twitter_username":null,"followers":null,"public_repos":1,"created_at":"2026-09-16T08:01:39Z","html_url":"https://github.com/genesiscode2026"},"computed_at":"2026-09-16T21:22:14.746Z","analyzer_version":"0.1.0"},"self_reported":{"description":"Deterministic software-delivery packaging with integrity manifests, executable-bit auditing and cryptographic review receipts.","trigger_hint":"When requiring verified Developer Workflow functionality in autonomous workflows"}}