@peac/cli 0.11.2 → 0.11.3

package/dist/commands/reconcile.d.ts

@@ -0,0 +1,17 @@
+/**
+ * PEAC Reconcile CLI Command (v0.11.3+)
+ *
+ * Merge two evidence bundles and detect conflicts.
+ * Conflict key: composite (iss, jti) with 3-step fallback:
+ * 1. (iss, jti) from JWT claims
+ * 2. (iss, rid) for Wire 0.1
+ * 3. (iss, receipt_ref) where receipt_ref = sha256(receipt_jws)
+ *
+ * NO auto-resolution: conflicts are surfaced for human decision.
+ * Deterministic output: receipts and conflicts sorted by (iss, jti) lexicographically.
+ *
+ * Security: 16 MB bundle size limit, path traversal prevention.
+ */
+import { Command } from 'commander';
+export declare function reconcileCommand(): Command;
+//# sourceMappingURL=reconcile.d.ts.map

package/dist/commands/reconcile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reconcile.d.ts","sourceRoot":"","sources":["../../src/commands/reconcile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAqNpC,wBAAgB,gBAAgB,IAAI,OAAO,CAuH1C"}

package/dist/index.cjs

@@ -11,6 +11,7 @@ var child_process = require('child_process');
 var crypto$1 = require('crypto');
 var schema = require('@peac/schema');
 var disc = require('@peac/disc');
+var audit = require('@peac/audit');
 
 function _interopNamespace(e) {
   if (e && e.__esModule) return e;
@@ -2200,6 +2201,194 @@ JWKS for verification: ${path6__namespace.relative(outputDir, jwksPath)}`);
     process.exitCode = 1;
   }
 });
+var MAX_BUNDLE_SIZE = 16 * 1024 * 1024;
+function getGlobalOptions4(cmd) {
+  const parent = cmd.parent;
+  if (!parent) return {};
+  return parent.opts();
+}
+function outputError4(error, details, opts) {
+  if (opts.json) {
+    console.log(JSON.stringify({ success: false, error, ...details }, null, 2));
+  } else {
+    console.error(`Error: ${error}`);
+  }
+}
+function decodeJwsPayload(jws) {
+  try {
+    const { payload } = crypto.decode(jws);
+    return payload;
+  } catch {
+    return null;
+  }
+}
+function extractConflictKey(jws, receiptRef) {
+  const payload = decodeJwsPayload(jws);
+  if (!payload) {
+    return `unknown|${receiptRef}`;
+  }
+  const iss = typeof payload.iss === "string" ? payload.iss : "unknown";
+  if (typeof payload.jti === "string" && payload.jti.length > 0) {
+    return `${iss}|${payload.jti}`;
+  }
+  if (typeof payload.rid === "string" && payload.rid.length > 0) {
+    return `${iss}|${payload.rid}`;
+  }
+  return `${iss}|${receiptRef}`;
+}
+async function extractReceipts(contents, sourceLabel) {
+  const records = [];
+  for (const [_id, jws] of contents.receipts) {
+    const receiptRef = await schema.computeReceiptRef(jws);
+    const key = extractConflictKey(jws, receiptRef);
+    records.push({ key, jws, receipt_ref: receiptRef, source: sourceLabel });
+  }
+  return records;
+}
+function findDiffFields(jwsA, jwsB) {
+  const payloadA = decodeJwsPayload(jwsA);
+  const payloadB = decodeJwsPayload(jwsB);
+  if (!payloadA || !payloadB) return ["payload_decode_failed"];
+  const allKeys = /* @__PURE__ */ new Set([...Object.keys(payloadA), ...Object.keys(payloadB)]);
+  const diffs = [];
+  for (const k of allKeys) {
+    if (JSON.stringify(payloadA[k]) !== JSON.stringify(payloadB[k])) {
+      diffs.push(k);
+    }
+  }
+  return diffs.sort();
+}
+async function readBundle(bundlePath, label) {
+  if (!fs6__namespace.existsSync(bundlePath)) {
+    return { ok: false, error: `Bundle file not found: ${bundlePath}` };
+  }
+  const stat = fs6__namespace.statSync(bundlePath);
+  if (stat.size > MAX_BUNDLE_SIZE) {
+    return { ok: false, error: `Bundle ${label} exceeds 16 MB size limit (${stat.size} bytes)` };
+  }
+  const resolved = fs6__namespace.realpathSync(bundlePath);
+  if (resolved !== bundlePath && !resolved.startsWith(process.cwd())) {
+    if (!fs6__namespace.existsSync(resolved)) {
+      return { ok: false, error: `Path traversal detected for ${label}` };
+    }
+  }
+  const zipBuffer = fs6__namespace.readFileSync(bundlePath);
+  const result = await audit.readDisputeBundle(zipBuffer);
+  if (!result.ok) {
+    return { ok: false, error: `Failed to read ${label}: ${result.error.message}` };
+  }
+  return { ok: true, value: result.value };
+}
+function formatReportText2(report) {
+  const lines = [
+    "PEAC Reconciliation Report",
+    "==========================",
+    "",
+    `Generated: ${report.generated_at}`,
+    `Bundles: ${report.bundles.join(", ")}`,
+    `Total receipts: ${report.total_receipts}`,
+    `Merged receipts: ${report.merged_receipts}`,
+    `Conflicts: ${report.conflicts.length}`,
+    ""
+  ];
+  if (report.conflicts.length === 0) {
+    lines.push("No conflicts detected. Bundles merge cleanly.");
+  } else {
+    lines.push("Conflicts:");
+    lines.push("---------");
+    for (const conflict of report.conflicts) {
+      lines.push(`  Key: ${conflict.key}`);
+      lines.push(`    Bundle A ref: ${conflict.bundle_a_receipt_ref}`);
+      lines.push(`    Bundle B ref: ${conflict.bundle_b_receipt_ref}`);
+      lines.push(`    Different fields: ${conflict.diff_fields.join(", ")}`);
+      lines.push("");
+    }
+  }
+  return lines.join("\n");
+}
+function reconcileCommand() {
+  const reconcile = new commander.Command("reconcile").description(
+    "Merge evidence bundles and detect conflicts (v0.11.3+)"
+  );
+  reconcile.argument("<bundle1>", "Path to first bundle ZIP file").argument("<bundle2>", "Path to second bundle ZIP file").option("-f, --format <format>", "Output format: json or text", "text").option("--fail-on-conflict", "Exit code 1 when any conflict detected", false).action(
+    async (bundle1Path, bundle2Path, options, cmd) => {
+      const globalOpts = getGlobalOptions4(cmd);
+      const format = options.format || "text";
+      const failOnConflict = !!options.failOnConflict;
+      try {
+        const [result1, result2] = await Promise.all([
+          readBundle(bundle1Path, "bundle1"),
+          readBundle(bundle2Path, "bundle2")
+        ]);
+        if (!result1.ok) {
+          outputError4(result1.error, {}, globalOpts);
+          process.exitCode = 1;
+          return;
+        }
+        if (!result2.ok) {
+          outputError4(result2.error, {}, globalOpts);
+          process.exitCode = 1;
+          return;
+        }
+        const [receipts1, receipts2] = await Promise.all([
+          extractReceipts(result1.value, bundle1Path),
+          extractReceipts(result2.value, bundle2Path)
+        ]);
+        const index = /* @__PURE__ */ new Map();
+        for (const r of [...receipts1, ...receipts2]) {
+          const existing = index.get(r.key) ?? [];
+          existing.push(r);
+          index.set(r.key, existing);
+        }
+        const conflicts = [];
+        let mergedCount = 0;
+        const sortedKeys = [...index.keys()].sort();
+        for (const key of sortedKeys) {
+          const records = index.get(key);
+          const fromA = records.filter((r) => r.source === bundle1Path);
+          const fromB = records.filter((r) => r.source === bundle2Path);
+          if (fromA.length > 0 && fromB.length > 0) {
+            const a = fromA[0];
+            const b = fromB[0];
+            if (a.receipt_ref !== b.receipt_ref) {
+              conflicts.push({
+                key,
+                bundle_a_receipt_ref: a.receipt_ref,
+                bundle_b_receipt_ref: b.receipt_ref,
+                diff_fields: findDiffFields(a.jws, b.jws)
+              });
+            }
+            mergedCount++;
+          } else {
+            mergedCount++;
+          }
+        }
+        const report = {
+          version: "1.0",
+          generated_at: (/* @__PURE__ */ new Date()).toISOString(),
+          bundles: [bundle1Path, bundle2Path],
+          total_receipts: receipts1.length + receipts2.length,
+          merged_receipts: mergedCount,
+          conflicts
+        };
+        if (format === "json" || globalOpts.json) {
+          console.log(JSON.stringify(report, null, 2));
+        } else {
+          console.log(formatReportText2(report));
+        }
+        if (failOnConflict && conflicts.length > 0) {
+          process.exitCode = 1;
+        } else {
+          process.exitCode = 0;
+        }
+      } catch (err) {
+        outputError4(err.message, {}, globalOpts);
+        process.exitCode = 1;
+      }
+    }
+  );
+  return reconcile;
+}
 
 // src/index.ts
 var program = new commander.Command();
@@ -2335,6 +2524,7 @@ program.command("decode").description("Decode a PEAC receipt JWS (without verifi
 program.addCommand(policy);
 program.addCommand(conformance);
 program.addCommand(samples);
+program.addCommand(reconcileCommand());
 try {
   program.parse();
 } catch (err) {