@peac/cli 0.11.1 → 0.11.3

package/dist/commands/reconcile.d.ts

@@ -0,0 +1,17 @@
+/**
+ * PEAC Reconcile CLI Command (v0.11.3+)
+ *
+ * Merge two evidence bundles and detect conflicts.
+ * Conflict key: composite (iss, jti) with 3-step fallback:
+ * 1. (iss, jti) from JWT claims
+ * 2. (iss, rid) for Wire 0.1
+ * 3. (iss, receipt_ref) where receipt_ref = sha256(receipt_jws)
+ *
+ * NO auto-resolution: conflicts are surfaced for human decision.
+ * Deterministic output: receipts and conflicts sorted by (iss, jti) lexicographically.
+ *
+ * Security: 16 MB bundle size limit, path traversal prevention.
+ */
+import { Command } from 'commander';
+export declare function reconcileCommand(): Command;
+//# sourceMappingURL=reconcile.d.ts.map

package/dist/commands/reconcile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reconcile.d.ts","sourceRoot":"","sources":["../../src/commands/reconcile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAqNpC,wBAAgB,gBAAgB,IAAI,OAAO,CAuH1C"}

package/dist/index.cjs

@@ -11,6 +11,7 @@ var child_process = require('child_process');
 var crypto$1 = require('crypto');
 var schema = require('@peac/schema');
 var disc = require('@peac/disc');
+var audit = require('@peac/audit');
 
 function _interopNamespace(e) {
   if (e && e.__esModule) return e;
@@ -597,7 +598,8 @@ function computeCanonicalDigest(input) {
     const canonical = crypto.canonicalize(input);
     return { alg: "sha-256+jcs", value: sha256(canonical) };
   } catch {
-    return { alg: "sha-256+json", value: sha256(JSON.stringify(input)) };
+    const serialized = JSON.stringify(input) ?? "null";
+    return { alg: "sha-256+json", value: sha256(serialized) };
   }
 }
 var VECTORS_FILE_EXTENSIONS = /* @__PURE__ */ new Set([".json", ".txt", ".jwks", ".pem", ".zip"]);
@@ -748,6 +750,18 @@ var PROFILE_CAPABILITIES = {
     level: "shape",
     validator: "structural-check",
     notes: "Structure-only; no offer/receipt verification or term matching"
+  },
+  errors: {
+    profile: "errors.hints",
+    level: "semantic",
+    validator: "validateErrorHintsInput",
+    notes: "Validates next_action hint table shape and vocabulary (DD-132, DD-133)"
+  },
+  "content-usage": {
+    profile: "content-usage.parse",
+    level: "shape",
+    validator: "validateContentUsageInput",
+    notes: "Validates Content-Usage fixture input type; full parsing tested in dedicated suite"
   }
 };
 function getCategoryCapability(category) {
@@ -1034,6 +1048,68 @@ function validateIssueInput(input) {
   }
   return { valid: true };
 }
+var VALID_NEXT_ACTIONS = /* @__PURE__ */ new Set([
+  "retry_after_delay",
+  "retry_with_different_key",
+  "retry_with_different_input",
+  "refresh_attestation",
+  "contact_issuer",
+  "abort",
+  "none"
+]);
+function validateErrorHintsInput(input) {
+  if (typeof input !== "object" || input === null) {
+    return {
+      valid: false,
+      error_code: "E_INVALID_ERROR_HINTS",
+      error_message: "Error hints input must be an object"
+    };
+  }
+  const obj = input;
+  if (!obj.hints || typeof obj.hints !== "object") {
+    return {
+      valid: false,
+      error_code: "E_MISSING_HINTS",
+      error_message: "Error hints missing required hints object"
+    };
+  }
+  const hints = obj.hints;
+  for (const [code, hint] of Object.entries(hints)) {
+    if (typeof hint !== "object" || hint === null) {
+      return {
+        valid: false,
+        error_code: "E_INVALID_HINT",
+        error_message: `Hint for ${code} must be an object`
+      };
+    }
+    const h = hint;
+    if (!VALID_NEXT_ACTIONS.has(h.next_action)) {
+      return {
+        valid: false,
+        error_code: "E_INVALID_NEXT_ACTION",
+        error_message: `Hint for ${code} has invalid next_action: ${String(h.next_action)}`
+      };
+    }
+    if (typeof h.retryable !== "boolean") {
+      return {
+        valid: false,
+        error_code: "E_INVALID_RETRYABLE",
+        error_message: `Hint for ${code} has non-boolean retryable: ${String(h.retryable)}`
+      };
+    }
+  }
+  return { valid: true };
+}
+function validateContentUsageInput(input) {
+  if (typeof input === "string") {
+    return { valid: true };
+  }
+  return {
+    valid: false,
+    error_code: "E_INVALID_CONTENT_USAGE",
+    error_message: "Content-Usage input must be a string (HTTP header value)"
+  };
+}
 var CATEGORY_VALIDATORS = {
   // Receipt claim validation
   valid: (input) => {
@@ -1070,7 +1146,9 @@ var CATEGORY_VALIDATORS = {
     return validateReceiptPayload(obj.payload ?? obj.claims ?? input);
   },
   workflow: validateWorkflowInput,
-  x402: validateX402Input
+  x402: validateX402Input,
+  errors: validateErrorHintsInput,
+  "content-usage": validateContentUsageInput
 };
 function getValidator(category) {
   return CATEGORY_VALIDATORS[category] ?? ((input) => {
@@ -1169,8 +1247,22 @@ function runConformance(options, callbacks) {
           const f = pack.fixtures[i];
           const fixtureName = f.name ?? `fixture_${i}`;
           const testId = `${baseTestId}.${fixtureName.replace(/\s+/g, "_")}`;
-          const inputDigest = computeCanonicalDigest(f.input);
           callbacks?.onTestStart?.(testId);
+          if (!f.expected || typeof f.expected.valid !== "boolean") {
+            skipped++;
+            const result2 = {
+              id: testId,
+              category: profile,
+              status: "skip",
+              diagnostics: {
+                skip_reason: "Non-standard fixture format (domain-specific test suite)"
+              }
+            };
+            results.push(result2);
+            callbacks?.onTestComplete?.(result2);
+            continue;
+          }
+          const inputDigest = computeCanonicalDigest(f.input);
           if (typeof f.input === "object" && f.input !== null) {
             const inputObj = f.input;
             if (inputObj.claims !== void 0 && inputObj.payload !== void 0) {
@@ -2109,6 +2201,194 @@ JWKS for verification: ${path6__namespace.relative(outputDir, jwksPath)}`);
     process.exitCode = 1;
   }
 });
+var MAX_BUNDLE_SIZE = 16 * 1024 * 1024;
+function getGlobalOptions4(cmd) {
+  const parent = cmd.parent;
+  if (!parent) return {};
+  return parent.opts();
+}
+function outputError4(error, details, opts) {
+  if (opts.json) {
+    console.log(JSON.stringify({ success: false, error, ...details }, null, 2));
+  } else {
+    console.error(`Error: ${error}`);
+  }
+}
+function decodeJwsPayload(jws) {
+  try {
+    const { payload } = crypto.decode(jws);
+    return payload;
+  } catch {
+    return null;
+  }
+}
+function extractConflictKey(jws, receiptRef) {
+  const payload = decodeJwsPayload(jws);
+  if (!payload) {
+    return `unknown|${receiptRef}`;
+  }
+  const iss = typeof payload.iss === "string" ? payload.iss : "unknown";
+  if (typeof payload.jti === "string" && payload.jti.length > 0) {
+    return `${iss}|${payload.jti}`;
+  }
+  if (typeof payload.rid === "string" && payload.rid.length > 0) {
+    return `${iss}|${payload.rid}`;
+  }
+  return `${iss}|${receiptRef}`;
+}
+async function extractReceipts(contents, sourceLabel) {
+  const records = [];
+  for (const [_id, jws] of contents.receipts) {
+    const receiptRef = await schema.computeReceiptRef(jws);
+    const key = extractConflictKey(jws, receiptRef);
+    records.push({ key, jws, receipt_ref: receiptRef, source: sourceLabel });
+  }
+  return records;
+}
+function findDiffFields(jwsA, jwsB) {
+  const payloadA = decodeJwsPayload(jwsA);
+  const payloadB = decodeJwsPayload(jwsB);
+  if (!payloadA || !payloadB) return ["payload_decode_failed"];
+  const allKeys = /* @__PURE__ */ new Set([...Object.keys(payloadA), ...Object.keys(payloadB)]);
+  const diffs = [];
+  for (const k of allKeys) {
+    if (JSON.stringify(payloadA[k]) !== JSON.stringify(payloadB[k])) {
+      diffs.push(k);
+    }
+  }
+  return diffs.sort();
+}
+async function readBundle(bundlePath, label) {
+  if (!fs6__namespace.existsSync(bundlePath)) {
+    return { ok: false, error: `Bundle file not found: ${bundlePath}` };
+  }
+  const stat = fs6__namespace.statSync(bundlePath);
+  if (stat.size > MAX_BUNDLE_SIZE) {
+    return { ok: false, error: `Bundle ${label} exceeds 16 MB size limit (${stat.size} bytes)` };
+  }
+  const resolved = fs6__namespace.realpathSync(bundlePath);
+  if (resolved !== bundlePath && !resolved.startsWith(process.cwd())) {
+    if (!fs6__namespace.existsSync(resolved)) {
+      return { ok: false, error: `Path traversal detected for ${label}` };
+    }
+  }
+  const zipBuffer = fs6__namespace.readFileSync(bundlePath);
+  const result = await audit.readDisputeBundle(zipBuffer);
+  if (!result.ok) {
+    return { ok: false, error: `Failed to read ${label}: ${result.error.message}` };
+  }
+  return { ok: true, value: result.value };
+}
+function formatReportText2(report) {
+  const lines = [
+    "PEAC Reconciliation Report",
+    "==========================",
+    "",
+    `Generated: ${report.generated_at}`,
+    `Bundles: ${report.bundles.join(", ")}`,
+    `Total receipts: ${report.total_receipts}`,
+    `Merged receipts: ${report.merged_receipts}`,
+    `Conflicts: ${report.conflicts.length}`,
+    ""
+  ];
+  if (report.conflicts.length === 0) {
+    lines.push("No conflicts detected. Bundles merge cleanly.");
+  } else {
+    lines.push("Conflicts:");
+    lines.push("---------");
+    for (const conflict of report.conflicts) {
+      lines.push(`  Key: ${conflict.key}`);
+      lines.push(`    Bundle A ref: ${conflict.bundle_a_receipt_ref}`);
+      lines.push(`    Bundle B ref: ${conflict.bundle_b_receipt_ref}`);
+      lines.push(`    Different fields: ${conflict.diff_fields.join(", ")}`);
+      lines.push("");
+    }
+  }
+  return lines.join("\n");
+}
+function reconcileCommand() {
+  const reconcile = new commander.Command("reconcile").description(
+    "Merge evidence bundles and detect conflicts (v0.11.3+)"
+  );
+  reconcile.argument("<bundle1>", "Path to first bundle ZIP file").argument("<bundle2>", "Path to second bundle ZIP file").option("-f, --format <format>", "Output format: json or text", "text").option("--fail-on-conflict", "Exit code 1 when any conflict detected", false).action(
+    async (bundle1Path, bundle2Path, options, cmd) => {
+      const globalOpts = getGlobalOptions4(cmd);
+      const format = options.format || "text";
+      const failOnConflict = !!options.failOnConflict;
+      try {
+        const [result1, result2] = await Promise.all([
+          readBundle(bundle1Path, "bundle1"),
+          readBundle(bundle2Path, "bundle2")
+        ]);
+        if (!result1.ok) {
+          outputError4(result1.error, {}, globalOpts);
+          process.exitCode = 1;
+          return;
+        }
+        if (!result2.ok) {
+          outputError4(result2.error, {}, globalOpts);
+          process.exitCode = 1;
+          return;
+        }
+        const [receipts1, receipts2] = await Promise.all([
+          extractReceipts(result1.value, bundle1Path),
+          extractReceipts(result2.value, bundle2Path)
+        ]);
+        const index = /* @__PURE__ */ new Map();
+        for (const r of [...receipts1, ...receipts2]) {
+          const existing = index.get(r.key) ?? [];
+          existing.push(r);
+          index.set(r.key, existing);
+        }
+        const conflicts = [];
+        let mergedCount = 0;
+        const sortedKeys = [...index.keys()].sort();
+        for (const key of sortedKeys) {
+          const records = index.get(key);
+          const fromA = records.filter((r) => r.source === bundle1Path);
+          const fromB = records.filter((r) => r.source === bundle2Path);
+          if (fromA.length > 0 && fromB.length > 0) {
+            const a = fromA[0];
+            const b = fromB[0];
+            if (a.receipt_ref !== b.receipt_ref) {
+              conflicts.push({
+                key,
+                bundle_a_receipt_ref: a.receipt_ref,
+                bundle_b_receipt_ref: b.receipt_ref,
+                diff_fields: findDiffFields(a.jws, b.jws)
+              });
+            }
+            mergedCount++;
+          } else {
+            mergedCount++;
+          }
+        }
+        const report = {
+          version: "1.0",
+          generated_at: (/* @__PURE__ */ new Date()).toISOString(),
+          bundles: [bundle1Path, bundle2Path],
+          total_receipts: receipts1.length + receipts2.length,
+          merged_receipts: mergedCount,
+          conflicts
+        };
+        if (format === "json" || globalOpts.json) {
+          console.log(JSON.stringify(report, null, 2));
+        } else {
+          console.log(formatReportText2(report));
+        }
+        if (failOnConflict && conflicts.length > 0) {
+          process.exitCode = 1;
+        } else {
+          process.exitCode = 0;
+        }
+      } catch (err) {
+        outputError4(err.message, {}, globalOpts);
+        process.exitCode = 1;
+      }
+    }
+  );
+  return reconcile;
+}
 
 // src/index.ts
 var program = new commander.Command();
@@ -2244,6 +2524,7 @@ program.command("decode").description("Decode a PEAC receipt JWS (without verifi
 program.addCommand(policy);
 program.addCommand(conformance);
 program.addCommand(samples);
+program.addCommand(reconcileCommand());
 try {
   program.parse();
 } catch (err) {