feat: law-source-bund 0.1.0 (source.bundesrecht)

Fetch one German federal law from gesetze-im-internet.de (BMJ) by its site slug, unpack the BMJ norm XML from the site's xml.zip and return it content-addressed (SHA-256) plus the BMJ builddate, so a flow's audit trail pins the exact Gesetzesstand it processed. - xml.zip unpack picks the largest XML entry (norm body) - lying ZIP size header rejected instead of silently truncated (audit integrity); 64 MB unpack cap, 96 MB download cap - net permission pinned to www.gesetze-im-internet.de; no auth - 11 unit tests (no network), wasm32-wasip2 build green Signed-off-by: flemming-it <sf@flemming.it>
2026-07-17 00:29:06 +02:00 · 2026-07-17 00:29:06 +02:00 · f1652cce62
commit f1652cce62
16 changed files with 1760 additions and 0 deletions
--- a/.forgejo/workflows/ci.yml
+++ b/.forgejo/workflows/ci.yml
@ -0,0 +1,66 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+env:
+  CARGO_TERM_COLOR: always
+  RUSTFLAGS: "-D warnings"
+  RUST_TOOLCHAIN: "1.86"
+  CARGO_NET_GIT_FETCH_WITH_CLI: "true"
+
+jobs:
+  ci:
+    name: Linux x86_64 (Forgejo)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout law-source-bund via external URL
+        run: |
+          set -eu
+          mkdir -p "$GITHUB_WORKSPACE"
+          cd "$GITHUB_WORKSPACE"
+          git init -q
+          git remote add origin \
+            "https://x-access-token:${GITHUB_TOKEN}@git.flemming.ai/${GITHUB_REPOSITORY}.git"
+          git fetch --depth=1 origin "$GITHUB_SHA"
+          git checkout -q FETCH_HEAD
+
+      - name: Configure git URL rewrite for SDK fetch
+        env:
+          SDK_PAT: ${{ secrets.MODULE_SDK_PAT }}
+        run: |
+          git config --global \
+            "url.https://x-access-token:${SDK_PAT}@git.flemming.ai/.insteadOf" \
+            "https://git.flemming.ai/"
+
+      - name: Install system dependencies
+        run: |
+          apt-get update -qq
+          apt-get install -y --no-install-recommends \
+            curl ca-certificates build-essential pkg-config libssl-dev git
+
+      - name: Install Rust toolchain
+        run: |
+          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
+            | sh -s -- -y --profile minimal \
+              --default-toolchain "$RUST_TOOLCHAIN" \
+              --target wasm32-wasip2 --component rustfmt --component clippy
+          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
+
+      - name: Cargo fmt --check
+        run: cargo fmt --all -- --check
+
+      - name: Cargo clippy
+        run: cargo clippy --all-targets -- -D warnings
+
+      - name: Cargo build (host)
+        run: cargo build --all-targets
+
+      - name: Cargo test (host)
+        run: cargo test --all-targets
+
+      - name: Cargo build (wasm32-wasip2)
+        run: cargo build --release --target wasm32-wasip2
--- a/.gitignore
+++ b/.gitignore
@ -0,0 +1,3 @@
+target/
+**/*.rs.bk
+.DS_Store
--- a/Cargo.lock
+++ b/Cargo.lock
@ -0,0 +1,823 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "adler2"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
+
+[[package]]
+name = "ahash"
+version = "0.8.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a15f179cd60c4584b8a8c596927aadc462e27f2ca70c04e0071964a73ba7a75"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+ "version_check",
+ "zerocopy",
+]
+
+[[package]]
+name = "anyhow"
+version = "1.0.103"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2a4385e2e34eb35d6b3efe798b9eb88096925d87726c0798709bf56d9ed84af3"
+
+[[package]]
+name = "arbitrary"
+version = "1.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3d036a3c4ab069c7b410a2ce876bd74808d2d0888a82667669f8e783a898bf1"
+dependencies = [
+ "derive_arbitrary",
+]
+
+[[package]]
+name = "bitflags"
+version = "2.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4388bee8683e3d04af747c73422af53102d2bd24d9eadb6cbc100baef4b43f8"
+
+[[package]]
+name = "block-buffer"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "bumpalo"
+version = "3.20.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
+
+[[package]]
+name = "bytes"
+version = "1.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
+
+[[package]]
+name = "cfg-if"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+
+[[package]]
+name = "chain-module-sdk"
+version = "0.3.0"
+source = "git+https://git.flemming.ai/fai/chain-module-sdk-rust.git?tag=v0.3.0#a4415ada7e76aac5e3aabf3e4c4311ffc348d8d0"
+dependencies = [
+ "chain-module-sdk-macros",
+ "serde",
+ "serde_json",
+ "thiserror",
+ "wit-bindgen 0.36.0",
+]
+
+[[package]]
+name = "chain-module-sdk-macros"
+version = "0.3.0"
+source = "git+https://git.flemming.ai/fai/chain-module-sdk-rust.git?tag=v0.3.0#a4415ada7e76aac5e3aabf3e4c4311ffc348d8d0"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "cpufeatures"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "crc32fast"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9481c1c90cbf2ac953f07c8d4a58aa3945c425b7185c9154d67a65e4230da511"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "crossbeam-utils"
+version = "0.8.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "61803da095bee82a81bb1a452ecc25d3b2f1416d1897eb86430c6159ef717c17"
+
+[[package]]
+name = "crypto-common"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
+dependencies = [
+ "generic-array",
+ "typenum",
+]
+
+[[package]]
+name = "derive_arbitrary"
+version = "1.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e567bd82dcff979e4b03460c307b3cdc9e96fde3d73bed1496d2bc75d9dd62a"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "digest"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
+dependencies = [
+ "block-buffer",
+ "crypto-common",
+]
+
+[[package]]
+name = "displaydoc"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ac70aa55017e108007fbaf5aa0f54b021c98f92ff8af59d42eda9da96e3dd4f"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "equivalent"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
+
+[[package]]
+name = "flate2"
+version = "1.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "843fba2746e448b37e26a819579957415c8cef339bf08564fe8b7ddbd959573c"
+dependencies = [
+ "crc32fast",
+ "miniz_oxide",
+]
+
+[[package]]
+name = "form_urlencoded"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf"
+dependencies = [
+ "percent-encoding",
+]
+
+[[package]]
+name = "generic-array"
+version = "0.14.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
+dependencies = [
+ "typenum",
+ "version_check",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.14.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
+dependencies = [
+ "ahash",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.17.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
+
+[[package]]
+name = "heck"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
+
+[[package]]
+name = "http"
+version = "1.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6970f50e31d6fc17d3fa27329444bfa74e196cf62e95052a3f6fee181dba6425"
+dependencies = [
+ "bytes",
+ "itoa",
+]
+
+[[package]]
+name = "id-arena"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d3067d79b975e8844ca9eb072e16b31c3c1c36928edf9c6789548c524d0d954"
+
+[[package]]
+name = "indexmap"
+version = "2.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
+dependencies = [
+ "equivalent",
+ "hashbrown 0.17.1",
+ "serde",
+ "serde_core",
+]
+
+[[package]]
+name = "itoa"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
+
+[[package]]
+name = "law_source_bund"
+version = "0.1.0"
+dependencies = [
+ "chain-module-sdk",
+ "serde",
+ "serde_json",
+ "sha2",
+ "waki",
+ "zip",
+]
+
+[[package]]
+name = "leb128"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c83bff1d572d6b9aeef67ddfc8448e4a3737909cb28e81f97c791b9018703e52"
+
+[[package]]
+name = "libc"
+version = "0.2.186"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
+
+[[package]]
+name = "log"
+version = "0.4.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ceec5bc11778974d1bcb055b18002eba7f4b3518b6a0081b3af5f21666da9ad"
+
+[[package]]
+name = "memchr"
+version = "2.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
+
+[[package]]
+name = "miniz_oxide"
+version = "0.8.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316"
+dependencies = [
+ "adler2",
+ "simd-adler32",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.21.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
+
+[[package]]
+name = "percent-encoding"
+version = "2.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
+
+[[package]]
+name = "prettyplease"
+version = "0.2.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "479ca8adacdd7ce8f1fb39ce9ecccbfe93a3f1344b3d0d97f20bc0196208f62b"
+dependencies = [
+ "proc-macro2",
+ "syn",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.106"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.46"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dfbc457d0c7a0759a614551b11a6409e5951f6c7537be1f1b7682b9ae9230368"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "semver"
+version = "1.0.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd"
+
+[[package]]
+name = "serde"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.150"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e8014e44b4736ed0538adeecded0fce2a272f22dc9578a7eb6b2d9993c74cfb9"
+dependencies = [
+ "itoa",
+ "memchr",
+ "serde",
+ "serde_core",
+ "zmij",
+]
+
+[[package]]
+name = "sha2"
+version = "0.10.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
+[[package]]
+name = "simd-adler32"
+version = "0.3.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a219298ac11a56ea9a6d2120044824d6f01aeb034955e7af7bc16858527deea"
+
+[[package]]
+name = "smallvec"
+version = "1.15.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ed6a63f02c8539c91a8685a86f4099661ba3da017932f6ebbea6de3f0fa7c90"
+
+[[package]]
+name = "spdx"
+version = "0.10.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3e17e880bafaeb362a7b751ec46bdc5b61445a188f80e0606e68167cd540fa3"
+dependencies = [
+ "smallvec",
+]
+
+[[package]]
+name = "syn"
+version = "2.0.119"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "872831b642d1a07999a962a351ed35b955ea2cfc8f3862091e2a240a84f17297"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "thiserror"
+version = "2.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4288b5bcbc7920c07a1149a35cf9590a2aa808e0bc1eafaade0b80947865fbc4"
+dependencies = [
+ "thiserror-impl",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "2.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebc4ee7f67670e9b64d05fa4253e753e016c6c95ff35b89b7941d6b856dec1d5"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "typenum"
+version = "1.20.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
+
+[[package]]
+name = "unicode-xid"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853"
+
+[[package]]
+name = "version_check"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
+
+[[package]]
+name = "waki"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e2db2daf1dfbadf228fd8b3c22b96a359135fd673b3d2c203274ee6a0df9c77"
+dependencies = [
+ "anyhow",
+ "form_urlencoded",
+ "http",
+ "serde",
+ "waki-macros",
+ "wit-bindgen 0.34.0",
+]
+
+[[package]]
+name = "waki-macros"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a061143f321cc5eeb523f60bdbcd45cfc3ee8851f8cf24f7a4b963bddc5642eb"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "wasm-encoder"
+version = "0.219.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8aa79bcd666a043b58f5fa62b221b0b914dd901e6f620e8ab7371057a797f3e1"
+dependencies = [
+ "leb128",
+ "wasmparser 0.219.2",
+]
+
+[[package]]
+name = "wasm-encoder"
+version = "0.220.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e913f9242315ca39eff82aee0e19ee7a372155717ff0eb082c741e435ce25ed1"
+dependencies = [
+ "leb128",
+ "wasmparser 0.220.1",
+]
+
+[[package]]
+name = "wasm-metadata"
+version = "0.219.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1ef51bd442042a2a7b562dddb6016ead52c4abab254c376dcffc83add2c9c34"
+dependencies = [
+ "anyhow",
+ "indexmap",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "spdx",
+ "wasm-encoder 0.219.2",
+ "wasmparser 0.219.2",
+]
+
+[[package]]
+name = "wasm-metadata"
+version = "0.220.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "185dfcd27fa5db2e6a23906b54c28199935f71d9a27a1a27b3a88d6fee2afae7"
+dependencies = [
+ "anyhow",
+ "indexmap",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "spdx",
+ "wasm-encoder 0.220.1",
+ "wasmparser 0.220.1",
+]
+
+[[package]]
+name = "wasmparser"
+version = "0.219.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5220ee4c6ffcc0cb9d7c47398052203bc902c8ef3985b0c8134118440c0b2921"
+dependencies = [
+ "ahash",
+ "bitflags",
+ "hashbrown 0.14.5",
+ "indexmap",
+ "semver",
+]
+
+[[package]]
+name = "wasmparser"
+version = "0.220.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8d07b6a3b550fefa1a914b6d54fc175dd11c3392da11eee604e6ffc759805d25"
+dependencies = [
+ "ahash",
+ "bitflags",
+ "hashbrown 0.14.5",
+ "indexmap",
+ "semver",
+]
+
+[[package]]
+name = "wit-bindgen"
+version = "0.34.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e11ad55616555605a60a8b2d1d89e006c2076f46c465c892cc2c153b20d4b30"
+dependencies = [
+ "wit-bindgen-rt 0.34.0",
+ "wit-bindgen-rust-macro 0.34.0",
+]
+
+[[package]]
+name = "wit-bindgen"
+version = "0.36.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6a2b3e15cd6068f233926e7d8c7c588b2ec4fb7cc7bf3824115e7c7e2a8485a3"
+dependencies = [
+ "wit-bindgen-rt 0.36.0",
+ "wit-bindgen-rust-macro 0.36.0",
+]
+
+[[package]]
+name = "wit-bindgen-core"
+version = "0.34.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "163cee59d3d5ceec0b256735f3ab0dccac434afb0ec38c406276de9c5a11e906"
+dependencies = [
+ "anyhow",
+ "heck",
+ "wit-parser 0.219.2",
+]
+
+[[package]]
+name = "wit-bindgen-core"
+version = "0.36.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b632a5a0fa2409489bd49c9e6d99fcc61bb3d4ce9d1907d44662e75a28c71172"
+dependencies = [
+ "anyhow",
+ "heck",
+ "wit-parser 0.220.1",
+]
+
+[[package]]
+name = "wit-bindgen-rt"
+version = "0.34.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "744845cde309b8fa32408d6fb67456449278c66ea4dcd96de29797b302721f02"
+dependencies = [
+ "bitflags",
+]
+
+[[package]]
+name = "wit-bindgen-rt"
+version = "0.36.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7947d0131c7c9da3f01dfde0ab8bd4c4cf3c5bd49b6dba0ae640f1fa752572ea"
+dependencies = [
+ "bitflags",
+]
+
+[[package]]
+name = "wit-bindgen-rust"
+version = "0.34.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6919521fc7807f927a739181db93100ca7ed03c29509b84d5f96b27b2e49a9a"
+dependencies = [
+ "anyhow",
+ "heck",
+ "indexmap",
+ "prettyplease",
+ "syn",
+ "wasm-metadata 0.219.2",
+ "wit-bindgen-core 0.34.0",
+ "wit-component 0.219.2",
+]
+
+[[package]]
+name = "wit-bindgen-rust"
+version = "0.36.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4329de4186ee30e2ef30a0533f9b3c123c019a237a7c82d692807bf1b3ee2697"
+dependencies = [
+ "anyhow",
+ "heck",
+ "indexmap",
+ "prettyplease",
+ "syn",
+ "wasm-metadata 0.220.1",
+ "wit-bindgen-core 0.36.0",
+ "wit-component 0.220.1",
+]
+
+[[package]]
+name = "wit-bindgen-rust-macro"
+version = "0.34.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c967731fc5d50244d7241ecfc9302a8929db508eea3c601fbc5371b196ba38a5"
+dependencies = [
+ "anyhow",
+ "prettyplease",
+ "proc-macro2",
+ "quote",
+ "syn",
+ "wit-bindgen-core 0.34.0",
+ "wit-bindgen-rust 0.34.0",
+]
+
+[[package]]
+name = "wit-bindgen-rust-macro"
+version = "0.36.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "177fb7ee1484d113b4792cc480b1ba57664bbc951b42a4beebe573502135b1fc"
+dependencies = [
+ "anyhow",
+ "prettyplease",
+ "proc-macro2",
+ "quote",
+ "syn",
+ "wit-bindgen-core 0.36.0",
+ "wit-bindgen-rust 0.36.0",
+]
+
+[[package]]
+name = "wit-component"
+version = "0.219.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4b8479a29d81c063264c3ab89d496787ef78f8345317a2dcf6dece0f129e5fcd"
+dependencies = [
+ "anyhow",
+ "bitflags",
+ "indexmap",
+ "log",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "wasm-encoder 0.219.2",
+ "wasm-metadata 0.219.2",
+ "wasmparser 0.219.2",
+ "wit-parser 0.219.2",
+]
+
+[[package]]
+name = "wit-component"
+version = "0.220.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b505603761ed400c90ed30261f44a768317348e49f1864e82ecdc3b2744e5627"
+dependencies = [
+ "anyhow",
+ "bitflags",
+ "indexmap",
+ "log",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "wasm-encoder 0.220.1",
+ "wasm-metadata 0.220.1",
+ "wasmparser 0.220.1",
+ "wit-parser 0.220.1",
+]
+
+[[package]]
+name = "wit-parser"
+version = "0.219.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca004bb251010fe956f4a5b9d4bf86b4e415064160dd6669569939e8cbf2504f"
+dependencies = [
+ "anyhow",
+ "id-arena",
+ "indexmap",
+ "log",
+ "semver",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "unicode-xid",
+ "wasmparser 0.219.2",
+]
+
+[[package]]
+name = "wit-parser"
+version = "0.220.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae2a7999ed18efe59be8de2db9cb2b7f84d88b27818c79353dfc53131840fe1a"
+dependencies = [
+ "anyhow",
+ "id-arena",
+ "indexmap",
+ "log",
+ "semver",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "unicode-xid",
+ "wasmparser 0.220.1",
+]
+
+[[package]]
+name = "zerocopy"
+version = "0.8.54"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7cbbc0a705a0fd05cc3676525980d2bf5a9bc4adac6d6475209a7887cf59d19"
+dependencies = [
+ "zerocopy-derive",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.8.54"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2e817b7b52d0c7358d3246da9d69935ebb18116b2b102b4230dac079b4862f5"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "zip"
+version = "2.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fabe6324e908f85a1c52063ce7aa26b68dcb7eb6dbc83a2d148403c9bc3eba50"
+dependencies = [
+ "arbitrary",
+ "crc32fast",
+ "crossbeam-utils",
+ "displaydoc",
+ "flate2",
+ "indexmap",
+ "memchr",
+ "thiserror",
+ "zopfli",
+]
+
+[[package]]
+name = "zmij"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
+
+[[package]]
+name = "zopfli"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f05cd8797d63865425ff89b5c4a48804f35ba0ce8d125800027ad6017d2b5249"
+dependencies = [
+ "bumpalo",
+ "crc32fast",
+ "log",
+ "simd-adler32",
+]
--- a/Cargo.toml
+++ b/Cargo.toml
@ -0,0 +1,52 @@
+# Standalone Cargo.toml — targets wasm32-wasip2.
+#
+# Build with:
+#   cargo build --release --target wasm32-wasip2
+
+[package]
+name = "law_source_bund"
+version = "0.1.0"
+edition = "2024"
+authors = ["Dr. Stefan Flemming <chain@flemming.ai>"]
+license = "Apache-2.0"
+publish = false
+description = "F∆I module — fetch German federal law from gesetze-im-internet.de by slug (BMJ XML, content-addressed)"
+repository = "https://git.flemming.ai/chain-modules/law-source-bund"
+rust-version = "1.85"
+
+[lib]
+crate-type = ["cdylib", "rlib"]
+
+[dependencies]
+chain-module-sdk = { git = "https://git.flemming.ai/fai/chain-module-sdk-rust.git", tag = "v0.3.0" }
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+sha2 = "0.10"
+# gesetze-im-internet serves each norm as an xml.zip archive.
+# Pure-Rust deflate only — same restricted feature set text-extract
+# uses (deflate64/bzip2/zstd stay out of the WASM build).
+zip = { version = "2", default-features = false, features = ["deflate"] }
+
+# WASI-0.2 HTTP client — same one http-request / law-source-eurlex use.
+# Only compiled into the wasm32-wasip2 build.
+[target.'cfg(target_arch = "wasm32")'.dependencies]
+waki = "0.5"
+
+[profile.release]
+opt-level = "s"
+lto = true
+codegen-units = 1
+strip = "symbols"
+
+[lints.rust]
+unsafe_op_in_unsafe_fn = "warn"
+
+[lints.clippy]
+unwrap_used = "deny"
+expect_used = "deny"
+panic = "deny"
+print_stdout = "deny"
+print_stderr = "deny"
+
+[workspace]
+# Empty workspace table so this package is NOT picked up by a parent.
--- a/73
+++ b/73
@ -0,0 +1,73 @@
+Apache License
+Version 2.0, January 2004
+http://www.apache.org/licenses/
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1. Definitions.
+
+"License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document.
+
+"Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License.
+
+"Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity.
+
+"You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License.
+
+"Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files.
+
+"Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types.
+
+"Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below).
+
+"Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof.
+
+"Contribution" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to the Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as "Not a Contribution."
+
+"Contributor" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by Licensor and subsequently incorporated within the Work.
+
+2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form.
+
+3. Grant of Patent License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed.
+
+4. Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions:
+
+     (a) You must give any other recipients of the Work or Derivative Works a copy of this License; and
+
+     (b) You must cause any modified files to carry prominent notices stating that You changed the files; and
+
+     (c) You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and
+
+     (d) If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding those notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License.
+
+     You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License.
+
+5. Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions.
+
+6. Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file.
+
+7. Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License.
+
+8. Limitation of Liability. In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of this License or out of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of such damages.
+
+9. Accepting Warranty or Additional Liability. While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support, warranty, indemnity, or other liability obligations and/or rights consistent with this License. However, in accepting such obligations, You may act only on Your own behalf and on Your sole responsibility, not on behalf of any other Contributor, and only if You agree to indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability.
+
+END OF TERMS AND CONDITIONS
+
+APPENDIX: How to apply the Apache License to your work.
+
+To apply the Apache License to your work, attach the following boilerplate notice, with the fields enclosed by brackets "[]" replaced with your own identifying information. (Don't include the brackets!)  The text should be enclosed in the appropriate comment syntax for the file format. We also recommend that a file or class name and description of purpose be included on the same "printed page" as the copyright notice for easier identification within third-party archives.
+
+Copyright 2026 Flemming.AI
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
--- a/MODULE.de.md
+++ b/MODULE.de.md
@ -0,0 +1,60 @@
+# source.bundesrecht
+
+<!-- chain:io-card:start -->
+<!-- Generated by `chain doc` from module.yaml — do not edit by hand. -->
+![law-source-bund inputs and outputs](law-source-bund.io.de.svg)
+<!-- chain:io-card:end -->
+
+Deutsches Bundesrecht von gesetze-im-internet.de per Kürzel holen
+
+## Was es tut
+
+Löst ein gesetze-im-internet.de-Kürzel (z. B. `bgb`, `estg`, `gg`,
+`stromnzv`) gegen die öffentliche BMJ-Publikationsseite auf, lädt das
+`xml.zip` des Gesetzes, entpackt das BMJ-Normen-XML (gii-norm-DTD)
+und liefert es samt Metadaten. Die entpackten Bytes sind
+inhaltsadressiert (SHA-256) — das Prüfprotokoll des Flows hält den
+exakt verarbeiteten Gesetzesstand fest.
+
+Anders als EUR-Lex liefert gesetze-im-internet nur den AKTUELLEN
+konsolidierten Stand — es gibt keine URL für ältere Fassungen. Der
+SHA-256 (plus das BMJ-`builddate` aus dem XML-Kopf) macht einen
+späteren Re-Fetch vergleichbar: Eine Änderung upstream wird sichtbar
+statt still.
+
+Nur öffentliche BMJ-Daten; die Netzwerk-Berechtigung ist auf
+`www.gesetze-im-internet.de` festgelegt.
+
+## Verwendung
+
+```yaml
+steps:
+  - id: fetch
+    use: source.bundesrecht@^0
+    with:
+      gesetz: stromnzv
+
+  - id: normalize
+    use: text.akoma-normalize@^0
+    with:
+      content: $fetch.xml
+```
+
+Das Kürzel ist das Pfadsegment der Gesetzes-Seite auf
+gesetze-im-internet.de: `https://www.gesetze-im-internet.de/<slug>/`.
+
+## Ausgaben
+
+- `xml` — das BMJ-Normen-XML wie aus dem Archiv der Seite entpackt.
+  Für die strukturierte Akoma-Ntoso-Darstellung an
+  `text.akoma-normalize` weiterreichen (dessen BMJ-Adapter aus v0.1
+  versteht dieses Format nativ).
+- `meta` — JSON-SourceMeta: `gesetz`, `url`, `source_sha256`,
+  `byte_len` und `builddate`, sofern der XML-Kopf eines trägt.
+
+## Fehler
+
+- Unbekanntes Kürzel → klare Eingabefehler-Meldung mit der geprüften
+  URL.
+- Kein ZIP, kein XML im Archiv, HTML-Fehlerseiten → interner Fehler
+  mit Ursache; HTML wird nie an nachgelagerte Schritte durchgereicht.
--- a/MODULE.md
+++ b/MODULE.md
@ -0,0 +1,59 @@
+# source.bundesrecht
+
+<!-- chain:io-card:start -->
+<!-- Generated by `chain doc` from module.yaml — do not edit by hand. -->
+![law-source-bund inputs and outputs](law-source-bund.io.svg)
+<!-- chain:io-card:end -->
+
+Fetch German federal law from gesetze-im-internet.de by slug
+
+## What it does
+
+Resolves a gesetze-im-internet.de slug (e.g. `bgb`, `estg`, `gg`,
+`stromnzv`) against the public BMJ publication site, downloads the
+law's `xml.zip`, unpacks the BMJ norm XML (gii-norm DTD) and returns
+it plus a metadata record. The unpacked bytes are content-addressed
+(SHA-256), so the flow's audit trail pins the exact Gesetzesstand
+that was processed.
+
+Unlike EUR-Lex, gesetze-im-internet serves only the CURRENT
+consolidated state — there is no URL for an older version. The
+SHA-256 (plus the BMJ `builddate` from the XML header) is what makes
+a later re-fetch comparable: a change upstream becomes visible
+instead of silent.
+
+Public BMJ data only; network permission is pinned to
+`www.gesetze-im-internet.de`.
+
+## How to use
+
+```yaml
+steps:
+  - id: fetch
+    use: source.bundesrecht@^0
+    with:
+      gesetz: stromnzv
+
+  - id: normalize
+    use: text.akoma-normalize@^0
+    with:
+      content: $fetch.xml
+```
+
+The slug is the path segment of the law's page on
+gesetze-im-internet.de: `https://www.gesetze-im-internet.de/<slug>/`.
+
+## Outputs
+
+- `xml` — the BMJ norm XML as unpacked from the site's archive.
+  Feed into `text.akoma-normalize` for the structured
+  Akoma-Ntoso-aligned representation (its v0.1 BMJ adapter handles
+  this format natively).
+- `meta` — JSON SourceMeta: `gesetz`, `url`, `source_sha256`,
+  `byte_len`, and `builddate` when the XML header carries one.
+
+## Errors
+
+- Unknown slug → clear invalid-input error naming the checked URL.
+- Non-ZIP or XML-less download, HTML error pages → internal error
+  with the reason; nothing HTML-shaped is ever passed downstream.
--- a/25
+++ b/25
@ -0,0 +1,25 @@
+law-source-bund
+Copyright 2026 Flemming.AI
+
+This product includes software developed by Dr. Stefan Flemming
+and contributors (https://flemming.ai/).
+
+------------------------------------------------------------------
+Third-party acknowledgments
+
+ZIP unpacking uses the `zip` crate
+(https://github.com/zip-rs/zip2), MIT licensed.
+
+SHA-256 hashing uses the `sha2` crate
+(https://github.com/RustCrypto/hashes), Apache-2.0 / MIT licensed.
+
+Module SDK glue is provided by `chain-module-sdk`
+(https://git.flemming.ai/fai/chain-module-sdk-rust), Apache-2.0.
+
+------------------------------------------------------------------
+Data source
+
+Fetches public legal texts from gesetze-im-internet.de, the joint
+publication site of the Federal Ministry of Justice (BMJ) and
+juris GmbH. The texts themselves are official works exempt from
+copyright protection under § 5 UrhG.
--- a/STORE.yaml
+++ b/STORE.yaml
@ -0,0 +1,28 @@
+schema_version: 1
+
+author:
+  name: "Flemming.AI"
+  email: chain@flemming.ai
+  url: https://flemming.ai
+
+license: Apache-2.0
+
+tagline:
+  en: "Fetch German federal law from gesetze-im-internet.de"
+  de: "Deutsches Bundesrecht von gesetze-im-internet.de holen"
+
+description:
+  en: "Resolves a gesetze-im-internet.de slug against the public BMJ site, unpacks the law's BMJ norm XML and returns it content-addressed (SHA-256) so the audit trail pins the exact legal state processed."
+  de: "Löst ein gesetze-im-internet.de-Kürzel gegen die öffentliche BMJ-Seite auf, entpackt das BMJ-Normen-XML des Gesetzes und liefert es inhaltsadressiert (SHA-256) — das Prüfprotokoll hält den exakten Gesetzesstand fest."
+
+category: data
+tags: [legal, bundesrecht, gesetze-im-internet, bmj, source]
+
+assets:
+  icon: assets/icon.svg
+
+documentation:
+  long_description: MODULE.md
+
+links:
+  repository: https://git.flemming.ai/chain-modules/law-source-bund
--- a/assets/icon.svg
+++ b/assets/icon.svg
@ -0,0 +1,18 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" width="64" height="64">
+  <rect width="64" height="64" rx="12" fill="#08090A"/>
+  <circle cx="32" cy="32" r="17" fill="none" stroke="#E9E7E2" stroke-width="3"/>
+  <g fill="#2E8F9E">
+    <circle cx="32" cy="18.5" r="2"/>
+    <circle cx="38.75" cy="20.3" r="2"/>
+    <circle cx="43.7" cy="25.25" r="2"/>
+    <circle cx="45.5" cy="32" r="2"/>
+    <circle cx="43.7" cy="38.75" r="2"/>
+    <circle cx="38.75" cy="43.7" r="2"/>
+    <circle cx="32" cy="45.5" r="2"/>
+    <circle cx="25.25" cy="43.7" r="2"/>
+    <circle cx="20.3" cy="38.75" r="2"/>
+    <circle cx="18.5" cy="32" r="2"/>
+    <circle cx="20.3" cy="25.25" r="2"/>
+    <circle cx="25.25" cy="20.3" r="2"/>
+  </g>
+</svg>
--- a/law-source-bund.io.de.svg
+++ b/law-source-bund.io.de.svg
@ -0,0 +1,36 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1012 300" width="1012" height="300" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif" role="img" aria-label="Module I/O card for law-source-bund"><style>
+  .bg{fill:#fafbfb;stroke:#e4e7e9;stroke-width:1}
+  .title{fill:#12171a;font-size:24px;font-weight:700}
+  .ver{fill:#6b7580;font-size:16px;font-weight:500}
+  .cap{fill:#2e8f9e;font-size:14px;font-weight:600;letter-spacing:.02em}
+  .section{fill:#8a939b;font-size:11px;font-weight:700;letter-spacing:.14em}
+  .body{fill:#ffffff;stroke:#2e8f9e;stroke-width:2}
+  .bodyname{fill:#12171a;font-size:18px;font-weight:700}
+  .wire{stroke:#c2cace;stroke-width:2}
+  .port{stroke:#fafbfb;stroke-width:2}
+  .port.in{fill:#2e8f9e}
+  .port.out{fill:#b4703a}
+  .fname{fill:#12171a;font-size:15px;font-weight:600}
+  .ftype{fill:#6b7580;font-size:13px;font-weight:500}
+  .fdesc{fill:#5b656d;font-size:12.5px}
+  .rule{stroke:#e4e7e9;stroke-width:1}
+  .footer{fill:#6b7580;font-size:12.5px}
+  @media (prefers-color-scheme: dark){
+    .bg{fill:#12161a;stroke:#252b31}
+    .title{fill:#eef1f2}
+    .ver{fill:#9aa3ab}
+    .cap{fill:#4fb3c2}
+    .section{fill:#7c868e}
+    .body{fill:#1a2025;stroke:#4fb3c2}
+    .bodyname{fill:#eef1f2}
+    .wire{stroke:#39424a}
+    .port{stroke:#12161a}
+    .port.in{fill:#4fb3c2}
+    .port.out{fill:#d08a52}
+    .fname{fill:#eef1f2}
+    .ftype{fill:#7c868e}
+    .fdesc{fill:#a7b0b7}
+    .rule{stroke:#252b31}
+    .footer{fill:#9aa3ab}
+  }
+</style><rect class="bg" x="0" y="0" width="1012" height="300" rx="16"/><text class="title" x="32" y="44">law-source-bund<tspan class="ver" dx="10">v0.1.0</tspan></text><text class="cap" x="32" y="70">source.bundesrecht@0.1.0</text><text class="section" x="32" y="80">EINGÄNGE</text><text class="section" text-anchor="end" x="980" y="80">AUSGÄNGE</text><rect class="body" x="396" y="100" width="220" height="136" rx="14"/><text class="bodyname" text-anchor="middle" x="506" y="173">law-source-bund</text><line class="wire" x1="352" y1="130" x2="396" y2="130"/><circle class="port in" cx="396" cy="130" r="6"/><text class="fname" text-anchor="end" x="340" y="122">gesetz<tspan class="ftype"> · text</tspan></text><text class="fdesc" text-anchor="end" x="340" y="142">Kürzel (Slug) des Gesetzes auf</text><text class="fdesc" text-anchor="end" x="340" y="157">gesetze-im-internet.de, z. B. bgb, estg,</text><text class="fdesc" text-anchor="end" x="340" y="172">gg oder stromnzv. Der Slug ist das</text><line class="wire" x1="616" y1="130" x2="660" y2="130"/><circle class="port out" cx="616" cy="130" r="6"/><text class="fname" text-anchor="start" x="672" y="122">meta<tspan class="ftype"> · json</tspan></text><text class="fdesc" text-anchor="start" x="672" y="142">JSON-codiertes SourceMeta (Felder s.</text><text class="fdesc" text-anchor="start" x="672" y="157">EN). source_sha256 ist der</text><text class="fdesc" text-anchor="start" x="672" y="172">Versionsanker: gesetze-im-internet</text><line class="wire" x1="616" y1="206" x2="660" y2="206"/><circle class="port out" cx="616" cy="206" r="6"/><text class="fname" text-anchor="start" x="672" y="198">xml<tspan class="ftype"> · bytes</tspan></text><text class="fdesc" text-anchor="start" x="672" y="218">BMJ-Normen-XML (gii-norm-DTD) aus dem</text><text class="fdesc" text-anchor="start" x="672" y="233">xml.zip der Seite. Für die</text><text class="fdesc" text-anchor="start" x="672" y="248">strukturierte Akoma-Ntoso-Darstellung an</text><line class="rule" x1="32" y1="252" x2="980" y2="252"/><text class="footer" x="32" y="278">Berechtigungen: net: www.gesetze-im-internet.de</text></svg>
--- a/law-source-bund.io.svg
+++ b/law-source-bund.io.svg
@ -0,0 +1,36 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1012 300" width="1012" height="300" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif" role="img" aria-label="Module I/O card for law-source-bund"><style>
+  .bg{fill:#fafbfb;stroke:#e4e7e9;stroke-width:1}
+  .title{fill:#12171a;font-size:24px;font-weight:700}
+  .ver{fill:#6b7580;font-size:16px;font-weight:500}
+  .cap{fill:#2e8f9e;font-size:14px;font-weight:600;letter-spacing:.02em}
+  .section{fill:#8a939b;font-size:11px;font-weight:700;letter-spacing:.14em}
+  .body{fill:#ffffff;stroke:#2e8f9e;stroke-width:2}
+  .bodyname{fill:#12171a;font-size:18px;font-weight:700}
+  .wire{stroke:#c2cace;stroke-width:2}
+  .port{stroke:#fafbfb;stroke-width:2}
+  .port.in{fill:#2e8f9e}
+  .port.out{fill:#b4703a}
+  .fname{fill:#12171a;font-size:15px;font-weight:600}
+  .ftype{fill:#6b7580;font-size:13px;font-weight:500}
+  .fdesc{fill:#5b656d;font-size:12.5px}
+  .rule{stroke:#e4e7e9;stroke-width:1}
+  .footer{fill:#6b7580;font-size:12.5px}
+  @media (prefers-color-scheme: dark){
+    .bg{fill:#12161a;stroke:#252b31}
+    .title{fill:#eef1f2}
+    .ver{fill:#9aa3ab}
+    .cap{fill:#4fb3c2}
+    .section{fill:#7c868e}
+    .body{fill:#1a2025;stroke:#4fb3c2}
+    .bodyname{fill:#eef1f2}
+    .wire{stroke:#39424a}
+    .port{stroke:#12161a}
+    .port.in{fill:#4fb3c2}
+    .port.out{fill:#d08a52}
+    .fname{fill:#eef1f2}
+    .ftype{fill:#7c868e}
+    .fdesc{fill:#a7b0b7}
+    .rule{stroke:#252b31}
+    .footer{fill:#9aa3ab}
+  }
+</style><rect class="bg" x="0" y="0" width="1012" height="300" rx="16"/><text class="title" x="32" y="44">law-source-bund<tspan class="ver" dx="10">v0.1.0</tspan></text><text class="cap" x="32" y="70">source.bundesrecht@0.1.0</text><text class="section" x="32" y="80">INPUTS</text><text class="section" text-anchor="end" x="980" y="80">OUTPUTS</text><rect class="body" x="396" y="100" width="220" height="136" rx="14"/><text class="bodyname" text-anchor="middle" x="506" y="173">law-source-bund</text><line class="wire" x1="352" y1="130" x2="396" y2="130"/><circle class="port in" cx="396" cy="130" r="6"/><text class="fname" text-anchor="end" x="340" y="122">gesetz<tspan class="ftype"> · text</tspan></text><text class="fdesc" text-anchor="end" x="340" y="142">gesetze-im-internet.de slug of the law,</text><text class="fdesc" text-anchor="end" x="340" y="157">e.g. bgb, estg, gg, or stromnzv. The</text><text class="fdesc" text-anchor="end" x="340" y="172">slug is the path segment of the law's</text><line class="wire" x1="616" y1="130" x2="660" y2="130"/><circle class="port out" cx="616" cy="130" r="6"/><text class="fname" text-anchor="start" x="672" y="122">meta<tspan class="ftype"> · json</tspan></text><text class="fdesc" text-anchor="start" x="672" y="142">JSON-encoded SourceMeta: {</text><text class="fdesc" text-anchor="start" x="672" y="157">schema_version: "0.1", gesetz: "bgb",</text><text class="fdesc" text-anchor="start" x="672" y="172">url:</text><line class="wire" x1="616" y1="206" x2="660" y2="206"/><circle class="port out" cx="616" cy="206" r="6"/><text class="fname" text-anchor="start" x="672" y="198">xml<tspan class="ftype"> · bytes</tspan></text><text class="fdesc" text-anchor="start" x="672" y="218">BMJ norm XML (gii-norm DTD) as unpacked</text><text class="fdesc" text-anchor="start" x="672" y="233">from the site's xml.zip. Feed into</text><text class="fdesc" text-anchor="start" x="672" y="248">text.akoma-normalize for the structured</text><line class="rule" x1="32" y1="252" x2="980" y2="252"/><text class="footer" x="32" y="278">Permissions: net: www.gesetze-im-internet.de</text></svg>
--- a/module.wasm
+++ b/module.wasm
--- a/module.yaml
+++ b/module.yaml
@ -0,0 +1,70 @@
+schema_version: 3
+provider: chain
+name: law-source-bund
+version: 0.1.0
+
+# Capability provided by this module.
+#
+# Fetches one German federal law from gesetze-im-internet.de (BMJ)
+# by its site slug and returns the BMJ XML content-addressed
+# (SHA-256), so a flow's audit trail pins the exact Gesetzesstand
+# it processed. Public BMJ data only — no authentication, no
+# personal data.
+provides:
+  - capability: source.bundesrecht
+    version: 0.1.0
+
+inputs:
+  gesetz:
+    type: text
+    description:
+      en: |
+        gesetze-im-internet.de slug of the law, e.g. bgb, estg,
+        gg, or stromnzv. The slug is the path segment of the law's
+        page (https://www.gesetze-im-internet.de/<slug>/).
+      de: |
+        Kürzel (Slug) des Gesetzes auf gesetze-im-internet.de,
+        z. B. bgb, estg, gg oder stromnzv. Der Slug ist das
+        Pfadsegment der Gesetzes-Seite
+        (https://www.gesetze-im-internet.de/<slug>/).
+
+outputs:
+  xml:
+    type: bytes
+    description:
+      en: |
+        BMJ norm XML (gii-norm DTD) as unpacked from the site's
+        xml.zip. Feed into text.akoma-normalize for the structured
+        Akoma-Ntoso-aligned representation.
+      de: |
+        BMJ-Normen-XML (gii-norm-DTD) aus dem xml.zip der Seite.
+        Für die strukturierte Akoma-Ntoso-Darstellung an
+        text.akoma-normalize weiterreichen.
+  meta:
+    type: json
+    description:
+      en: |
+        JSON-encoded SourceMeta:
+          {
+            schema_version: "0.1",
+            gesetz: "bgb",
+            url: "https://www.gesetze-im-internet.de/bgb/xml.zip",
+            source_sha256: "…",     // hash of the unpacked XML bytes
+            byte_len: 123456,
+            builddate: "20260701120000"   // from the XML header, if present
+          }
+        source_sha256 is the versioning anchor: gesetze-im-internet
+        serves only the current consolidated state, so the hash (plus
+        the BMJ builddate) is what makes a later re-fetch comparable.
+      de: |
+        JSON-codiertes SourceMeta (Felder s. EN). source_sha256 ist
+        der Versionsanker: gesetze-im-internet liefert nur den
+        aktuellen konsolidierten Stand — Hash + BMJ-builddate machen
+        einen späteren Re-Fetch vergleichbar.
+
+# Permissions required.
+#
+# One pinned host: the module talks to gesetze-im-internet.de
+# (BMJ / juris publication site) and nothing else.
+permissions:
+  - "net: www.gesetze-im-internet.de"
--- a/rust-toolchain.toml
+++ b/rust-toolchain.toml
@ -0,0 +1,4 @@
+[toolchain]
+channel = "1.86"
+targets = ["wasm32-wasip2"]
+components = ["rustfmt", "clippy"]
--- a/src/lib.rs
+++ b/src/lib.rs
@ -0,0 +1,407 @@
+//! `source.bundesrecht` module — fetch one German federal law from
+//! gesetze-im-internet.de (BMJ) by its site slug and hand its BMJ
+//! norm XML downstream, content-addressed so a flow's audit trail
+//! pins the exact Gesetzesstand.
+//!
+//! # Capability
+//!
+//! - **Input:**
+//!   * `gesetz` — `text`, the gesetze-im-internet.de slug (e.g.
+//!     `bgb`, `estg`, `gg`, `stromnzv`) — the path segment of the
+//!     law's page.
+//! - **Output:**
+//!   * `xml` — `bytes` (`application/xml`), the BMJ norm XML
+//!     (gii-norm DTD) unpacked from the site's `xml.zip`. Feed it
+//!     to `text.akoma-normalize` for the structured representation.
+//!   * `meta` — `json` SourceMeta (see below): slug, the resolved
+//!     URL, SHA-256 of the unpacked XML, and the BMJ `builddate`
+//!     from the XML header when present.
+//!
+//! # Versioning ("Gesetzesstand")
+//!
+//! Unlike EUR-Lex, gesetze-im-internet serves only the CURRENT
+//! consolidated state — there is no URL for an older version. The
+//! module therefore returns `source_sha256` (and the BMJ
+//! `builddate`) so downstream steps and the audit log can prove
+//! which bytes the flow saw; a later re-fetch that differs becomes
+//! visible instead of silent.
+//!
+//! # Scope
+//!
+//! Public BMJ data only; no authentication, no personal data.
+//! Network permission is pinned to `www.gesetze-im-internet.de`.
+
+#![allow(clippy::result_large_err)]
+
+use std::io::Read;
+
+use chain_module_sdk::prelude::*;
+use serde::Serialize;
+use sha2::{Digest, Sha256};
+
+/// Cap on the unpacked XML size (the BGB, the largest law on the
+/// site, unpacks to ~9 MB — 64 MB leaves an order of magnitude of
+/// headroom while a zip bomb stays contained).
+const MAX_XML_BYTES: u64 = 64 * 1024 * 1024;
+
+/// Cap on the downloaded archive itself. waki buffers the response
+/// in memory before we see it, so this cannot stop the transfer —
+/// but it turns an absurd body into a clean module error instead of
+/// feeding it to the unzipper (the WASM memory ceiling backstops
+/// the transfer itself).
+const MAX_DOWNLOAD_BYTES: usize = 96 * 1024 * 1024;
+
+#[derive(Debug, Serialize)]
+struct SourceMeta {
+    schema_version: &'static str,
+    gesetz: String,
+    url: String,
+    source_sha256: String,
+    byte_len: usize,
+    /// BMJ `builddate` attribute from the `<dokumente>` root, e.g.
+    /// `20260701120000`; absent when the header does not carry one.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    builddate: Option<String>,
+}
+
+#[chain_module]
+pub fn invoke(_ctx: Context, inputs: Inputs) -> Result<Outputs, ModuleError> {
+    let slug_raw = inputs.require_text("gesetz")?;
+    let slug = normalize_slug(slug_raw)?;
+    let url = gii_url(&slug);
+
+    let (status, body) = fetch(&url)?;
+    if status == 404 {
+        return Err(ModuleError::invalid_input(format!(
+            "gesetze-im-internet.de knows no law '{slug}' \
+             (checked {url}) — the slug is the path segment of the \
+             law's page, e.g. bgb, estg, gg"
+        )));
+    }
+    if status != 200 {
+        return Err(ModuleError::internal(format!(
+            "gesetze-im-internet.de answered HTTP {status} for {url}"
+        )));
+    }
+    if body.len() > MAX_DOWNLOAD_BYTES {
+        return Err(ModuleError::internal(format!(
+            "the download for '{slug}' is {} bytes — over the \
+             {MAX_DOWNLOAD_BYTES}-byte safety cap",
+            body.len()
+        )));
+    }
+
+    let xml = unzip_norm_xml(&body, &slug)?;
+    if !looks_like_bmj_xml(&xml) {
+        return Err(ModuleError::internal(format!(
+            "the archive for '{slug}' did not contain BMJ norm XML \
+             (gii-norm DTD expected)"
+        )));
+    }
+
+    let meta = SourceMeta {
+        schema_version: "0.1",
+        gesetz: slug,
+        url,
+        source_sha256: hex_sha256(&xml),
+        byte_len: xml.len(),
+        builddate: builddate(&xml),
+    };
+
+    Outputs::new()
+        .with_bytes("xml", "application/xml", xml)
+        .with_json("meta", &meta)
+}
+
+/// Validate + canonicalise a gesetze-im-internet slug. Lower-cases
+/// and refuses anything that is not a plain path segment, so a URL
+/// or a stray path can never smuggle a different host or directory
+/// into the request.
+fn normalize_slug(raw: &str) -> Result<String, ModuleError> {
+    let s = raw.trim().to_ascii_lowercase();
+    let valid_len = (1..=64).contains(&s.len());
+    let valid_chars = s
+        .chars()
+        .all(|c| c.is_ascii_lowercase() || c.is_ascii_digit() || c == '_' || c == '-');
+    if !(valid_len && valid_chars) {
+        return Err(ModuleError::invalid_input(format!(
+            "'{raw}' is not a gesetze-im-internet slug \
+             (expected the path segment of the law's page, e.g. bgb, \
+             estg, gg, stromnzv)"
+        )));
+    }
+    Ok(s)
+}
+
+/// Download URL for a slug. Every law's machine-readable form lives
+/// at `<slug>/xml.zip` next to its HTML page.
+fn gii_url(slug: &str) -> String {
+    format!("https://www.gesetze-im-internet.de/{slug}/xml.zip")
+}
+
+/// Unpack the norm XML out of the site's `xml.zip`. The archive
+/// carries one `*.xml` (plus image attachments for some laws); when
+/// several XML entries exist the largest one is the norm body.
+fn unzip_norm_xml(archive_bytes: &[u8], slug: &str) -> Result<Vec<u8>, ModuleError> {
+    let cursor = std::io::Cursor::new(archive_bytes);
+    let mut archive = zip::ZipArchive::new(cursor).map_err(|e| {
+        ModuleError::internal(format!(
+            "the download for '{slug}' is not a readable ZIP archive: {e}"
+        ))
+    })?;
+
+    let mut best: Option<(usize, u64)> = None;
+    for i in 0..archive.len() {
+        let entry = archive.by_index(i).map_err(|e| {
+            ModuleError::internal(format!("ZIP entry {i} for '{slug}' is unreadable: {e}"))
+        })?;
+        let name = entry.name().to_ascii_lowercase();
+        if name.ends_with(".xml") && best.is_none_or(|(_, size)| entry.size() > size) {
+            best = Some((i, entry.size()));
+        }
+    }
+
+    let Some((index, size)) = best else {
+        return Err(ModuleError::internal(format!(
+            "the archive for '{slug}' contains no XML entry"
+        )));
+    };
+    if size > MAX_XML_BYTES {
+        return Err(ModuleError::internal(format!(
+            "the norm XML for '{slug}' declares {size} bytes — over the \
+             {MAX_XML_BYTES}-byte safety cap"
+        )));
+    }
+
+    let entry = archive
+        .by_index(index)
+        .map_err(|e| ModuleError::internal(format!("ZIP entry for '{slug}' is unreadable: {e}")))?;
+    let mut xml = Vec::with_capacity(size as usize);
+    // Read one byte past the DECLARED size: the header is attacker
+    // input, and silently truncating a lying entry would ship (and
+    // SHA-256-anchor) partial law text as if it were authoritative.
+    // Any mismatch — more data than declared or less — is an error.
+    let read = entry.take(size + 1).read_to_end(&mut xml).map_err(|e| {
+        ModuleError::internal(format!("unpacking the XML for '{slug}' failed: {e}"))
+    })?;
+    if read as u64 != size {
+        return Err(ModuleError::internal(format!(
+            "the norm XML for '{slug}' decompresses to a different size \
+             than its ZIP header declares ({size} bytes declared) — \
+             refusing the archive as corrupt or manipulated"
+        )));
+    }
+    Ok(xml)
+}
+
+/// Cheap shape check: XML declaration or root tag, and the gii-norm
+/// vocabulary (`<dokumente>` root or `<norm>` records). Error pages
+/// are HTML.
+fn looks_like_bmj_xml(body: &[u8]) -> bool {
+    let head = body.get(..4096.min(body.len())).unwrap_or_default();
+    let head = String::from_utf8_lossy(head);
+    let head_trim = head.trim_start();
+    if !head_trim.starts_with("<?xml") && !head_trim.starts_with('<') {
+        return false;
+    }
+    if head_trim.to_ascii_lowercase().contains("<html") {
+        return false;
+    }
+    head.contains("<dokumente") || head.contains("<norm")
+}
+
+/// BMJ `builddate` attribute out of the `<dokumente>` root tag,
+/// e.g. `<dokumente builddate="20260701120000" doknr="…">`. Plain
+/// string scan — the value sits in the first few hundred bytes and
+/// an XML parser would be dead weight here.
+fn builddate(xml: &[u8]) -> Option<String> {
+    let head = xml.get(..4096.min(xml.len()))?;
+    let head = String::from_utf8_lossy(head);
+    let after = head.split("builddate=\"").nth(1)?;
+    let value: String = after.chars().take_while(|c| *c != '"').collect();
+    let plausible = (8..=20).contains(&value.len()) && value.chars().all(|c| c.is_ascii_digit());
+    plausible.then_some(value)
+}
+
+fn hex_sha256(data: &[u8]) -> String {
+    let mut hasher = Sha256::new();
+    hasher.update(data);
+    let digest = hasher.finalize();
+    let mut s = String::with_capacity(64);
+    for byte in digest {
+        s.push(nibble_to_hex(byte >> 4));
+        s.push(nibble_to_hex(byte & 0x0f));
+    }
+    s
+}
+
+fn nibble_to_hex(n: u8) -> char {
+    match n {
+        0..=9 => (b'0' + n) as char,
+        10..=15 => (b'a' + n - 10) as char,
+        _ => '?',
+    }
+}
+
+/// WASM path: one GET. The hub's sandbox enforces the
+/// `net: www.gesetze-im-internet.de` permission.
+#[cfg(target_arch = "wasm32")]
+fn fetch(url: &str) -> Result<(u16, Vec<u8>), ModuleError> {
+    let response = waki::Client::new()
+        .get(url)
+        .header(
+            waki::header::HeaderName::from_static("accept"),
+            waki::header::HeaderValue::from_static("application/zip"),
+        )
+        .send()
+        .map_err(|e| ModuleError::internal(format!("gesetze-im-internet request failed: {e}")))?;
+    let status = response.status_code();
+    let body = response
+        .body()
+        .map_err(|e| ModuleError::internal(format!("gesetze-im-internet body read failed: {e}")))?;
+    Ok((status, body))
+}
+
+/// Host-side stub. Lets `cargo test` (no wasm target) link the rlib
+/// without pulling waki; the real path is the wasm32 variant above.
+#[cfg(not(target_arch = "wasm32"))]
+fn fetch(_url: &str) -> Result<(u16, Vec<u8>), ModuleError> {
+    Err(ModuleError::internal(
+        "source.bundesrecht can only fetch under the WASM runtime",
+    ))
+}
+
+#[cfg(test)]
+mod tests {
+    #![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+    use super::*;
+    use std::io::Write;
+    use zip::write::SimpleFileOptions;
+
+    fn zip_of(entries: &[(&str, &[u8])]) -> Vec<u8> {
+        let mut buf = std::io::Cursor::new(Vec::new());
+        let mut writer = zip::ZipWriter::new(&mut buf);
+        for (name, bytes) in entries {
+            writer
+                .start_file(*name, SimpleFileOptions::default())
+                .unwrap();
+            writer.write_all(bytes).unwrap();
+        }
+        writer.finish().unwrap();
+        buf.into_inner()
+    }
+
+    const SAMPLE_XML: &[u8] = br#"<?xml version="1.0" encoding="UTF-8"?>
+<dokumente builddate="20260701120000" doknr="BJNR001950896">
+<norm doknr="BJNR001950896"><metadaten><jurabk>BGB</jurabk></metadaten></norm>
+</dokumente>"#;
+
+    #[test]
+    fn lying_zip_size_header_is_rejected() {
+        // Highly compressible payload so deflate actually shrinks it,
+        // then patch the central directory's uncompressed-size field
+        // (offset 24 in the PK\x01\x02 record) to declare fewer bytes
+        // than the entry inflates to — the attacker-controlled header
+        // lies. Truncating silently would anchor partial law text.
+        let mut payload = SAMPLE_XML.to_vec();
+        payload.extend(std::iter::repeat_n(b'a', 64 * 1024));
+        let mut bytes = zip_of(&[("BJNR001950896.xml", payload.as_slice())]);
+        let cd = bytes
+            .windows(4)
+            .rposition(|w| w == [0x50, 0x4b, 0x01, 0x02])
+            .expect("central directory record");
+        bytes[cd + 24..cd + 28].copy_from_slice(&1000u32.to_le_bytes());
+        let err = unzip_norm_xml(&bytes, "bgb").unwrap_err();
+        assert!(
+            format!("{err:?}").contains("different size"),
+            "expected the size-mismatch rejection, got: {err:?}"
+        );
+    }
+
+    #[test]
+    fn accepts_plain_slugs() {
+        assert_eq!(normalize_slug("bgb").unwrap(), "bgb");
+        assert_eq!(normalize_slug(" BGB ").unwrap(), "bgb");
+        assert_eq!(normalize_slug("stromnzv").unwrap(), "stromnzv");
+        assert_eq!(normalize_slug("bgb-1").unwrap(), "bgb-1");
+        assert_eq!(normalize_slug("estg_2009").unwrap(), "estg_2009");
+    }
+
+    #[test]
+    fn rejects_paths_urls_and_garbage() {
+        assert!(normalize_slug("").is_err());
+        assert!(normalize_slug("bgb/xml.zip").is_err());
+        assert!(normalize_slug("https://www.gesetze-im-internet.de/bgb/").is_err());
+        assert!(normalize_slug("../etc").is_err());
+        assert!(normalize_slug("a b").is_err());
+    }
+
+    #[test]
+    fn builds_the_download_url() {
+        assert_eq!(
+            gii_url("bgb"),
+            "https://www.gesetze-im-internet.de/bgb/xml.zip"
+        );
+    }
+
+    #[test]
+    fn unzips_the_single_xml_entry() {
+        let archive = zip_of(&[("BJNR001950896.xml", SAMPLE_XML)]);
+        let xml = unzip_norm_xml(&archive, "bgb").unwrap();
+        assert_eq!(xml, SAMPLE_XML);
+    }
+
+    #[test]
+    fn picks_the_largest_xml_when_several_exist() {
+        let small = b"<?xml version=\"1.0\"?><dokumente/>" as &[u8];
+        let archive = zip_of(&[
+            ("toc.xml", small),
+            ("BJNR001950896.xml", SAMPLE_XML),
+            ("bild.gif", b"GIF89a..."),
+        ]);
+        let xml = unzip_norm_xml(&archive, "bgb").unwrap();
+        assert_eq!(xml, SAMPLE_XML);
+    }
+
+    #[test]
+    fn refuses_archive_without_xml() {
+        let archive = zip_of(&[("bild.gif", b"GIF89a...")]);
+        let err = unzip_norm_xml(&archive, "bgb").unwrap_err();
+        assert!(format!("{err:?}").contains("no XML entry"));
+    }
+
+    #[test]
+    fn refuses_non_zip_bytes() {
+        assert!(unzip_norm_xml(b"<!DOCTYPE html><html>404</html>", "nope").is_err());
+    }
+
+    #[test]
+    fn bmj_shape_check_accepts_norm_xml_rejects_html() {
+        assert!(looks_like_bmj_xml(SAMPLE_XML));
+        assert!(!looks_like_bmj_xml(
+            b"<!DOCTYPE html><html><body>Not found</body></html>"
+        ));
+        assert!(!looks_like_bmj_xml(b"plain text"));
+        assert!(!looks_like_bmj_xml(b""));
+        // XML, but not the gii-norm vocabulary.
+        assert!(!looks_like_bmj_xml(b"<?xml version=\"1.0\"?><ACT/>"));
+    }
+
+    #[test]
+    fn extracts_builddate_from_the_root_tag() {
+        assert_eq!(builddate(SAMPLE_XML).as_deref(), Some("20260701120000"));
+        assert_eq!(builddate(b"<?xml version=\"1.0\"?><dokumente/>"), None);
+        // Non-numeric builddate is refused rather than passed through.
+        assert_eq!(
+            builddate(b"<dokumente builddate=\"gestern\"><norm/></dokumente>"),
+            None
+        );
+    }
+
+    #[test]
+    fn hashes_are_hex_and_deterministic() {
+        let a = hex_sha256(b"abc");
+        assert_eq!(a.len(), 64);
+        assert_eq!(a, hex_sha256(b"abc"));
+    }
+}