@peac/cli 0.11.2 → 0.11.3

package/dist/index.mjs

@@ -9,8 +9,9 @@ import { join } from 'path';
 import { loadProfile, serializePolicyJson, serializePolicyYaml, ProfileError, createExamplePolicy, loadPolicy, PolicyValidationError, PolicyLoadError, compilePeacTxt, compileRobotsSnippet, compileAiprefTemplates, renderPolicyMarkdown, explainMatches, evaluate, listProfiles, getProfileSummary } from '@peac/policy-kit';
 import { execSync } from 'child_process';
 import { createHash } from 'crypto';
-import { validateWorkflowContextOrdered, isValidPurposeToken, isCanonicalPurpose, validateObligationsExtension, validateInteractionOrdered, validateDisputeAttestation, validateAttributionAttestation, validateAgentIdentityAttestation, ReceiptClaimsSchema, parseReceiptClaims } from '@peac/schema';
+import { computeReceiptRef, validateWorkflowContextOrdered, isValidPurposeToken, isCanonicalPurpose, validateObligationsExtension, validateInteractionOrdered, validateDisputeAttestation, validateAttributionAttestation, validateAgentIdentityAttestation, ReceiptClaimsSchema, parseReceiptClaims } from '@peac/schema';
 import { parse } from '@peac/disc';
+import { readDisputeBundle } from '@peac/audit';
 
 function getGlobalOptions(cmd) {
   const parent = cmd.parent;
@@ -2179,6 +2180,194 @@ JWKS for verification: ${path6.relative(outputDir, jwksPath)}`);
     process.exitCode = 1;
   }
 });
+var MAX_BUNDLE_SIZE = 16 * 1024 * 1024;
+function getGlobalOptions4(cmd) {
+  const parent = cmd.parent;
+  if (!parent) return {};
+  return parent.opts();
+}
+function outputError4(error, details, opts) {
+  if (opts.json) {
+    console.log(JSON.stringify({ success: false, error, ...details }, null, 2));
+  } else {
+    console.error(`Error: ${error}`);
+  }
+}
+function decodeJwsPayload(jws) {
+  try {
+    const { payload } = decode(jws);
+    return payload;
+  } catch {
+    return null;
+  }
+}
+function extractConflictKey(jws, receiptRef) {
+  const payload = decodeJwsPayload(jws);
+  if (!payload) {
+    return `unknown|${receiptRef}`;
+  }
+  const iss = typeof payload.iss === "string" ? payload.iss : "unknown";
+  if (typeof payload.jti === "string" && payload.jti.length > 0) {
+    return `${iss}|${payload.jti}`;
+  }
+  if (typeof payload.rid === "string" && payload.rid.length > 0) {
+    return `${iss}|${payload.rid}`;
+  }
+  return `${iss}|${receiptRef}`;
+}
+async function extractReceipts(contents, sourceLabel) {
+  const records = [];
+  for (const [_id, jws] of contents.receipts) {
+    const receiptRef = await computeReceiptRef(jws);
+    const key = extractConflictKey(jws, receiptRef);
+    records.push({ key, jws, receipt_ref: receiptRef, source: sourceLabel });
+  }
+  return records;
+}
+function findDiffFields(jwsA, jwsB) {
+  const payloadA = decodeJwsPayload(jwsA);
+  const payloadB = decodeJwsPayload(jwsB);
+  if (!payloadA || !payloadB) return ["payload_decode_failed"];
+  const allKeys = /* @__PURE__ */ new Set([...Object.keys(payloadA), ...Object.keys(payloadB)]);
+  const diffs = [];
+  for (const k of allKeys) {
+    if (JSON.stringify(payloadA[k]) !== JSON.stringify(payloadB[k])) {
+      diffs.push(k);
+    }
+  }
+  return diffs.sort();
+}
+async function readBundle(bundlePath, label) {
+  if (!fs6.existsSync(bundlePath)) {
+    return { ok: false, error: `Bundle file not found: ${bundlePath}` };
+  }
+  const stat = fs6.statSync(bundlePath);
+  if (stat.size > MAX_BUNDLE_SIZE) {
+    return { ok: false, error: `Bundle ${label} exceeds 16 MB size limit (${stat.size} bytes)` };
+  }
+  const resolved = fs6.realpathSync(bundlePath);
+  if (resolved !== bundlePath && !resolved.startsWith(process.cwd())) {
+    if (!fs6.existsSync(resolved)) {
+      return { ok: false, error: `Path traversal detected for ${label}` };
+    }
+  }
+  const zipBuffer = fs6.readFileSync(bundlePath);
+  const result = await readDisputeBundle(zipBuffer);
+  if (!result.ok) {
+    return { ok: false, error: `Failed to read ${label}: ${result.error.message}` };
+  }
+  return { ok: true, value: result.value };
+}
+function formatReportText2(report) {
+  const lines = [
+    "PEAC Reconciliation Report",
+    "==========================",
+    "",
+    `Generated: ${report.generated_at}`,
+    `Bundles: ${report.bundles.join(", ")}`,
+    `Total receipts: ${report.total_receipts}`,
+    `Merged receipts: ${report.merged_receipts}`,
+    `Conflicts: ${report.conflicts.length}`,
+    ""
+  ];
+  if (report.conflicts.length === 0) {
+    lines.push("No conflicts detected. Bundles merge cleanly.");
+  } else {
+    lines.push("Conflicts:");
+    lines.push("---------");
+    for (const conflict of report.conflicts) {
+      lines.push(`  Key: ${conflict.key}`);
+      lines.push(`    Bundle A ref: ${conflict.bundle_a_receipt_ref}`);
+      lines.push(`    Bundle B ref: ${conflict.bundle_b_receipt_ref}`);
+      lines.push(`    Different fields: ${conflict.diff_fields.join(", ")}`);
+      lines.push("");
+    }
+  }
+  return lines.join("\n");
+}
+function reconcileCommand() {
+  const reconcile = new Command("reconcile").description(
+    "Merge evidence bundles and detect conflicts (v0.11.3+)"
+  );
+  reconcile.argument("<bundle1>", "Path to first bundle ZIP file").argument("<bundle2>", "Path to second bundle ZIP file").option("-f, --format <format>", "Output format: json or text", "text").option("--fail-on-conflict", "Exit code 1 when any conflict detected", false).action(
+    async (bundle1Path, bundle2Path, options, cmd) => {
+      const globalOpts = getGlobalOptions4(cmd);
+      const format = options.format || "text";
+      const failOnConflict = !!options.failOnConflict;
+      try {
+        const [result1, result2] = await Promise.all([
+          readBundle(bundle1Path, "bundle1"),
+          readBundle(bundle2Path, "bundle2")
+        ]);
+        if (!result1.ok) {
+          outputError4(result1.error, {}, globalOpts);
+          process.exitCode = 1;
+          return;
+        }
+        if (!result2.ok) {
+          outputError4(result2.error, {}, globalOpts);
+          process.exitCode = 1;
+          return;
+        }
+        const [receipts1, receipts2] = await Promise.all([
+          extractReceipts(result1.value, bundle1Path),
+          extractReceipts(result2.value, bundle2Path)
+        ]);
+        const index = /* @__PURE__ */ new Map();
+        for (const r of [...receipts1, ...receipts2]) {
+          const existing = index.get(r.key) ?? [];
+          existing.push(r);
+          index.set(r.key, existing);
+        }
+        const conflicts = [];
+        let mergedCount = 0;
+        const sortedKeys = [...index.keys()].sort();
+        for (const key of sortedKeys) {
+          const records = index.get(key);
+          const fromA = records.filter((r) => r.source === bundle1Path);
+          const fromB = records.filter((r) => r.source === bundle2Path);
+          if (fromA.length > 0 && fromB.length > 0) {
+            const a = fromA[0];
+            const b = fromB[0];
+            if (a.receipt_ref !== b.receipt_ref) {
+              conflicts.push({
+                key,
+                bundle_a_receipt_ref: a.receipt_ref,
+                bundle_b_receipt_ref: b.receipt_ref,
+                diff_fields: findDiffFields(a.jws, b.jws)
+              });
+            }
+            mergedCount++;
+          } else {
+            mergedCount++;
+          }
+        }
+        const report = {
+          version: "1.0",
+          generated_at: (/* @__PURE__ */ new Date()).toISOString(),
+          bundles: [bundle1Path, bundle2Path],
+          total_receipts: receipts1.length + receipts2.length,
+          merged_receipts: mergedCount,
+          conflicts
+        };
+        if (format === "json" || globalOpts.json) {
+          console.log(JSON.stringify(report, null, 2));
+        } else {
+          console.log(formatReportText2(report));
+        }
+        if (failOnConflict && conflicts.length > 0) {
+          process.exitCode = 1;
+        } else {
+          process.exitCode = 0;
+        }
+      } catch (err) {
+        outputError4(err.message, {}, globalOpts);
+        process.exitCode = 1;
+      }
+    }
+  );
+  return reconcile;
+}
 
 // src/index.ts
 var program = new Command();
@@ -2314,6 +2503,7 @@ program.command("decode").description("Decode a PEAC receipt JWS (without verifi
 program.addCommand(policy);
 program.addCommand(conformance);
 program.addCommand(samples);
+program.addCommand(reconcileCommand());
 try {
   program.parse();
 } catch (err) {