@peac/cli 0.11.1 → 0.11.3

package/dist/index.mjs

@@ -9,8 +9,9 @@ import { join } from 'path';
 import { loadProfile, serializePolicyJson, serializePolicyYaml, ProfileError, createExamplePolicy, loadPolicy, PolicyValidationError, PolicyLoadError, compilePeacTxt, compileRobotsSnippet, compileAiprefTemplates, renderPolicyMarkdown, explainMatches, evaluate, listProfiles, getProfileSummary } from '@peac/policy-kit';
 import { execSync } from 'child_process';
 import { createHash } from 'crypto';
-import { validateWorkflowContextOrdered, isValidPurposeToken, isCanonicalPurpose, validateObligationsExtension, validateInteractionOrdered, validateDisputeAttestation, validateAttributionAttestation, validateAgentIdentityAttestation, ReceiptClaimsSchema, parseReceiptClaims } from '@peac/schema';
+import { computeReceiptRef, validateWorkflowContextOrdered, isValidPurposeToken, isCanonicalPurpose, validateObligationsExtension, validateInteractionOrdered, validateDisputeAttestation, validateAttributionAttestation, validateAgentIdentityAttestation, ReceiptClaimsSchema, parseReceiptClaims } from '@peac/schema';
 import { parse } from '@peac/disc';
+import { readDisputeBundle } from '@peac/audit';
 
 function getGlobalOptions(cmd) {
   const parent = cmd.parent;
@@ -576,7 +577,8 @@ function computeCanonicalDigest(input) {
     const canonical = canonicalize(input);
     return { alg: "sha-256+jcs", value: sha256(canonical) };
   } catch {
-    return { alg: "sha-256+json", value: sha256(JSON.stringify(input)) };
+    const serialized = JSON.stringify(input) ?? "null";
+    return { alg: "sha-256+json", value: sha256(serialized) };
   }
 }
 var VECTORS_FILE_EXTENSIONS = /* @__PURE__ */ new Set([".json", ".txt", ".jwks", ".pem", ".zip"]);
@@ -727,6 +729,18 @@ var PROFILE_CAPABILITIES = {
     level: "shape",
     validator: "structural-check",
     notes: "Structure-only; no offer/receipt verification or term matching"
+  },
+  errors: {
+    profile: "errors.hints",
+    level: "semantic",
+    validator: "validateErrorHintsInput",
+    notes: "Validates next_action hint table shape and vocabulary (DD-132, DD-133)"
+  },
+  "content-usage": {
+    profile: "content-usage.parse",
+    level: "shape",
+    validator: "validateContentUsageInput",
+    notes: "Validates Content-Usage fixture input type; full parsing tested in dedicated suite"
   }
 };
 function getCategoryCapability(category) {
@@ -1013,6 +1027,68 @@ function validateIssueInput(input) {
   }
   return { valid: true };
 }
+var VALID_NEXT_ACTIONS = /* @__PURE__ */ new Set([
+  "retry_after_delay",
+  "retry_with_different_key",
+  "retry_with_different_input",
+  "refresh_attestation",
+  "contact_issuer",
+  "abort",
+  "none"
+]);
+function validateErrorHintsInput(input) {
+  if (typeof input !== "object" || input === null) {
+    return {
+      valid: false,
+      error_code: "E_INVALID_ERROR_HINTS",
+      error_message: "Error hints input must be an object"
+    };
+  }
+  const obj = input;
+  if (!obj.hints || typeof obj.hints !== "object") {
+    return {
+      valid: false,
+      error_code: "E_MISSING_HINTS",
+      error_message: "Error hints missing required hints object"
+    };
+  }
+  const hints = obj.hints;
+  for (const [code, hint] of Object.entries(hints)) {
+    if (typeof hint !== "object" || hint === null) {
+      return {
+        valid: false,
+        error_code: "E_INVALID_HINT",
+        error_message: `Hint for ${code} must be an object`
+      };
+    }
+    const h = hint;
+    if (!VALID_NEXT_ACTIONS.has(h.next_action)) {
+      return {
+        valid: false,
+        error_code: "E_INVALID_NEXT_ACTION",
+        error_message: `Hint for ${code} has invalid next_action: ${String(h.next_action)}`
+      };
+    }
+    if (typeof h.retryable !== "boolean") {
+      return {
+        valid: false,
+        error_code: "E_INVALID_RETRYABLE",
+        error_message: `Hint for ${code} has non-boolean retryable: ${String(h.retryable)}`
+      };
+    }
+  }
+  return { valid: true };
+}
+function validateContentUsageInput(input) {
+  if (typeof input === "string") {
+    return { valid: true };
+  }
+  return {
+    valid: false,
+    error_code: "E_INVALID_CONTENT_USAGE",
+    error_message: "Content-Usage input must be a string (HTTP header value)"
+  };
+}
 var CATEGORY_VALIDATORS = {
   // Receipt claim validation
   valid: (input) => {
@@ -1049,7 +1125,9 @@ var CATEGORY_VALIDATORS = {
     return validateReceiptPayload(obj.payload ?? obj.claims ?? input);
   },
   workflow: validateWorkflowInput,
-  x402: validateX402Input
+  x402: validateX402Input,
+  errors: validateErrorHintsInput,
+  "content-usage": validateContentUsageInput
 };
 function getValidator(category) {
   return CATEGORY_VALIDATORS[category] ?? ((input) => {
@@ -1148,8 +1226,22 @@ function runConformance(options, callbacks) {
           const f = pack.fixtures[i];
           const fixtureName = f.name ?? `fixture_${i}`;
           const testId = `${baseTestId}.${fixtureName.replace(/\s+/g, "_")}`;
-          const inputDigest = computeCanonicalDigest(f.input);
           callbacks?.onTestStart?.(testId);
+          if (!f.expected || typeof f.expected.valid !== "boolean") {
+            skipped++;
+            const result2 = {
+              id: testId,
+              category: profile,
+              status: "skip",
+              diagnostics: {
+                skip_reason: "Non-standard fixture format (domain-specific test suite)"
+              }
+            };
+            results.push(result2);
+            callbacks?.onTestComplete?.(result2);
+            continue;
+          }
+          const inputDigest = computeCanonicalDigest(f.input);
           if (typeof f.input === "object" && f.input !== null) {
             const inputObj = f.input;
             if (inputObj.claims !== void 0 && inputObj.payload !== void 0) {
@@ -2088,6 +2180,194 @@ JWKS for verification: ${path6.relative(outputDir, jwksPath)}`);
     process.exitCode = 1;
   }
 });
+var MAX_BUNDLE_SIZE = 16 * 1024 * 1024;
+function getGlobalOptions4(cmd) {
+  const parent = cmd.parent;
+  if (!parent) return {};
+  return parent.opts();
+}
+function outputError4(error, details, opts) {
+  if (opts.json) {
+    console.log(JSON.stringify({ success: false, error, ...details }, null, 2));
+  } else {
+    console.error(`Error: ${error}`);
+  }
+}
+function decodeJwsPayload(jws) {
+  try {
+    const { payload } = decode(jws);
+    return payload;
+  } catch {
+    return null;
+  }
+}
+function extractConflictKey(jws, receiptRef) {
+  const payload = decodeJwsPayload(jws);
+  if (!payload) {
+    return `unknown|${receiptRef}`;
+  }
+  const iss = typeof payload.iss === "string" ? payload.iss : "unknown";
+  if (typeof payload.jti === "string" && payload.jti.length > 0) {
+    return `${iss}|${payload.jti}`;
+  }
+  if (typeof payload.rid === "string" && payload.rid.length > 0) {
+    return `${iss}|${payload.rid}`;
+  }
+  return `${iss}|${receiptRef}`;
+}
+async function extractReceipts(contents, sourceLabel) {
+  const records = [];
+  for (const [_id, jws] of contents.receipts) {
+    const receiptRef = await computeReceiptRef(jws);
+    const key = extractConflictKey(jws, receiptRef);
+    records.push({ key, jws, receipt_ref: receiptRef, source: sourceLabel });
+  }
+  return records;
+}
+function findDiffFields(jwsA, jwsB) {
+  const payloadA = decodeJwsPayload(jwsA);
+  const payloadB = decodeJwsPayload(jwsB);
+  if (!payloadA || !payloadB) return ["payload_decode_failed"];
+  const allKeys = /* @__PURE__ */ new Set([...Object.keys(payloadA), ...Object.keys(payloadB)]);
+  const diffs = [];
+  for (const k of allKeys) {
+    if (JSON.stringify(payloadA[k]) !== JSON.stringify(payloadB[k])) {
+      diffs.push(k);
+    }
+  }
+  return diffs.sort();
+}
+async function readBundle(bundlePath, label) {
+  if (!fs6.existsSync(bundlePath)) {
+    return { ok: false, error: `Bundle file not found: ${bundlePath}` };
+  }
+  const stat = fs6.statSync(bundlePath);
+  if (stat.size > MAX_BUNDLE_SIZE) {
+    return { ok: false, error: `Bundle ${label} exceeds 16 MB size limit (${stat.size} bytes)` };
+  }
+  const resolved = fs6.realpathSync(bundlePath);
+  if (resolved !== bundlePath && !resolved.startsWith(process.cwd())) {
+    if (!fs6.existsSync(resolved)) {
+      return { ok: false, error: `Path traversal detected for ${label}` };
+    }
+  }
+  const zipBuffer = fs6.readFileSync(bundlePath);
+  const result = await readDisputeBundle(zipBuffer);
+  if (!result.ok) {
+    return { ok: false, error: `Failed to read ${label}: ${result.error.message}` };
+  }
+  return { ok: true, value: result.value };
+}
+function formatReportText2(report) {
+  const lines = [
+    "PEAC Reconciliation Report",
+    "==========================",
+    "",
+    `Generated: ${report.generated_at}`,
+    `Bundles: ${report.bundles.join(", ")}`,
+    `Total receipts: ${report.total_receipts}`,
+    `Merged receipts: ${report.merged_receipts}`,
+    `Conflicts: ${report.conflicts.length}`,
+    ""
+  ];
+  if (report.conflicts.length === 0) {
+    lines.push("No conflicts detected. Bundles merge cleanly.");
+  } else {
+    lines.push("Conflicts:");
+    lines.push("---------");
+    for (const conflict of report.conflicts) {
+      lines.push(`  Key: ${conflict.key}`);
+      lines.push(`    Bundle A ref: ${conflict.bundle_a_receipt_ref}`);
+      lines.push(`    Bundle B ref: ${conflict.bundle_b_receipt_ref}`);
+      lines.push(`    Different fields: ${conflict.diff_fields.join(", ")}`);
+      lines.push("");
+    }
+  }
+  return lines.join("\n");
+}
+function reconcileCommand() {
+  const reconcile = new Command("reconcile").description(
+    "Merge evidence bundles and detect conflicts (v0.11.3+)"
+  );
+  reconcile.argument("<bundle1>", "Path to first bundle ZIP file").argument("<bundle2>", "Path to second bundle ZIP file").option("-f, --format <format>", "Output format: json or text", "text").option("--fail-on-conflict", "Exit code 1 when any conflict detected", false).action(
+    async (bundle1Path, bundle2Path, options, cmd) => {
+      const globalOpts = getGlobalOptions4(cmd);
+      const format = options.format || "text";
+      const failOnConflict = !!options.failOnConflict;
+      try {
+        const [result1, result2] = await Promise.all([
+          readBundle(bundle1Path, "bundle1"),
+          readBundle(bundle2Path, "bundle2")
+        ]);
+        if (!result1.ok) {
+          outputError4(result1.error, {}, globalOpts);
+          process.exitCode = 1;
+          return;
+        }
+        if (!result2.ok) {
+          outputError4(result2.error, {}, globalOpts);
+          process.exitCode = 1;
+          return;
+        }
+        const [receipts1, receipts2] = await Promise.all([
+          extractReceipts(result1.value, bundle1Path),
+          extractReceipts(result2.value, bundle2Path)
+        ]);
+        const index = /* @__PURE__ */ new Map();
+        for (const r of [...receipts1, ...receipts2]) {
+          const existing = index.get(r.key) ?? [];
+          existing.push(r);
+          index.set(r.key, existing);
+        }
+        const conflicts = [];
+        let mergedCount = 0;
+        const sortedKeys = [...index.keys()].sort();
+        for (const key of sortedKeys) {
+          const records = index.get(key);
+          const fromA = records.filter((r) => r.source === bundle1Path);
+          const fromB = records.filter((r) => r.source === bundle2Path);
+          if (fromA.length > 0 && fromB.length > 0) {
+            const a = fromA[0];
+            const b = fromB[0];
+            if (a.receipt_ref !== b.receipt_ref) {
+              conflicts.push({
+                key,
+                bundle_a_receipt_ref: a.receipt_ref,
+                bundle_b_receipt_ref: b.receipt_ref,
+                diff_fields: findDiffFields(a.jws, b.jws)
+              });
+            }
+            mergedCount++;
+          } else {
+            mergedCount++;
+          }
+        }
+        const report = {
+          version: "1.0",
+          generated_at: (/* @__PURE__ */ new Date()).toISOString(),
+          bundles: [bundle1Path, bundle2Path],
+          total_receipts: receipts1.length + receipts2.length,
+          merged_receipts: mergedCount,
+          conflicts
+        };
+        if (format === "json" || globalOpts.json) {
+          console.log(JSON.stringify(report, null, 2));
+        } else {
+          console.log(formatReportText2(report));
+        }
+        if (failOnConflict && conflicts.length > 0) {
+          process.exitCode = 1;
+        } else {
+          process.exitCode = 0;
+        }
+      } catch (err) {
+        outputError4(err.message, {}, globalOpts);
+        process.exitCode = 1;
+      }
+    }
+  );
+  return reconcile;
+}
 
 // src/index.ts
 var program = new Command();
@@ -2223,6 +2503,7 @@ program.command("decode").description("Decode a PEAC receipt JWS (without verifi
 program.addCommand(policy);
 program.addCommand(conformance);
 program.addCommand(samples);
+program.addCommand(reconcileCommand());
 try {
   program.parse();
 } catch (err) {