@peac/cli 0.12.14 → 0.13.1

package/README.md

@@ -100,8 +100,8 @@ peac samples generate --output ./out    # Generate sample files
 - `@peac/crypto` (Layer 2): JWS decoding and signature operations
 - `@peac/schema` (Layer 1): Receipt schema validation
 - `@peac/audit`: Evidence bundle reading for reconciliation
-- `@peac/disc`: Issuer discovery
 - `@peac/policy-kit`: Policy loading, validation, and compilation
+- `@peac/net-node`: SSRF-aware HTTP client used by `peac discover`
 
 ## For Agent Developers
 

package/dist/commands/discover.d.ts

@@ -1,13 +1,16 @@
 /**
  * peac discover <url> command
- * Thin wrapper around @peac/disc for peac.txt policy-document discovery.
  *
- * peac.txt is a policy-document surface per docs/specs/PEAC-TXT.md.
- * For cryptographic key discovery, callers should use
+ * Performs SSRF-aware retrieval of /.well-known/peac.txt and parses it as a
+ * peac-policy/0.1 policy document. Implementation lives in the CLI-internal
+ * helper at ../lib/policy-document-discovery.ts (not a public surface).
+ *
+ * peac.txt is a policy-document surface per docs/specs/PEAC-TXT.md. For
+ * cryptographic key discovery, callers should use
  * /.well-known/peac-issuer.json (see docs/specs/PEAC-ISSUER.md).
  */
 import type { CLIOptions, CommandResult } from '../types.js';
 export declare class DiscoverCommand {
-    execute(url: string, options?: CLIOptions): Promise<CommandResult>;
+    execute(url: string, _options?: CLIOptions): Promise<CommandResult>;
 }
 //# sourceMappingURL=discover.d.ts.map

package/dist/commands/discover.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"discover.d.ts","sourceRoot":"","sources":["../../src/commands/discover.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAG7D,qBAAa,eAAe;IACpB,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,UAAe,GAAG,OAAO,CAAC,aAAa,CAAC;CA+B7E"}
+{"version":3,"file":"discover.d.ts","sourceRoot":"","sources":["../../src/commands/discover.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAOH,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAO7D,qBAAa,eAAe;IACpB,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,GAAE,UAAe,GAAG,OAAO,CAAC,aAAa,CAAC;CA0C9E"}

package/dist/index.cjs

@@ -10,9 +10,12 @@ var policyKit = require('@peac/policy-kit');
 var child_process = require('child_process');
 var crypto$1 = require('crypto');
 var schema = require('@peac/schema');
-var disc = require('@peac/disc');
+var kernel = require('@peac/kernel');
 var audit = require('@peac/audit');
 var module$1 = require('module');
+var chalk = require('chalk');
+
+function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
 
 function _interopNamespace(e) {
   if (e && e.__esModule) return e;
@@ -34,6 +37,7 @@ function _interopNamespace(e) {
 
 var fs6__namespace = /*#__PURE__*/_interopNamespace(fs6);
 var path6__namespace = /*#__PURE__*/_interopNamespace(path6);
+var chalk__default = /*#__PURE__*/_interopDefault(chalk);
 
 function getGlobalOptions(cmd) {
   const parent = cmd.parent;
@@ -703,7 +707,7 @@ var PROFILE_CAPABILITIES = {
   discovery: {
     profile: "discovery.config",
     level: "semantic",
-    validator: "@peac/disc:parse"
+    validator: "@peac/policy-kit:parsePolicyDocument (via cli compat helper)"
   },
   dispute: {
     profile: "receipt.verify.dispute",
@@ -783,6 +787,124 @@ function shouldRunAtLevel(fixtureVersion, level) {
   const levelOrder = ["basic", "standard", "full"];
   return levelOrder.indexOf(fixtureLevel) <= levelOrder.indexOf(level);
 }
+var DISCOVER_TIMEOUT_MS = 5e3;
+var DISCOVER_MAX_BYTES = kernel.POLICY.maxBytes;
+var PEAC_TXT_PATH = kernel.POLICY.manifestPath;
+var DEFAULT_USER_AGENT = "peac-cli";
+var LEGACY_KEY_LINE = /^\s*(verify|public_keys|jwks)\s*:/m;
+var LEGACY_KEY_FULL_LINE_GLOBAL = /^\s*(verify|public_keys|jwks)\s*:.*\r?\n?/gm;
+var legacyWarningFired = false;
+function fireLegacyWarning(field) {
+  if (legacyWarningFired) return;
+  legacyWarningFired = true;
+  if (typeof process !== "undefined" && typeof process.emitWarning === "function") {
+    process.emitWarning(
+      `peac.txt legacy key-discovery field "${field}" is deprecated and ignored. peac.txt is a policy-document surface (docs/specs/PEAC-TXT.md). Key resolution uses iss -> /.well-known/peac-issuer.json -> jwks_uri -> JWKS.`,
+      { code: "PEAC_LEGACY_PEAC_TXT_KEY_FIELD", type: "DeprecationWarning" }
+    );
+  }
+}
+function collectLegacyWarnings(text, warnings) {
+  const lines = text.split(/\r?\n/);
+  let firstField = null;
+  lines.forEach((line, idx) => {
+    const m = line.match(/^\s*(verify|public_keys|jwks)\s*:/);
+    if (m) {
+      if (firstField === null) firstField = m[1];
+      warnings.push(
+        `Line ${idx + 1}: legacy key-discovery field "${m[1]}" ignored (peac.txt is policy-only; use peac-issuer.json for keys)`
+      );
+    }
+  });
+  if (firstField) fireLegacyWarning(firstField);
+}
+function failureFrom(err, warnings) {
+  const errors = [];
+  if (err instanceof policyKit.PolicyValidationError) {
+    const issues = err.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ");
+    errors.push(`Policy validation failed: ${issues}`);
+  } else if (err instanceof policyKit.PolicyLoadError) {
+    errors.push(err.message);
+  } else {
+    errors.push(`Unexpected parse error: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  return {
+    valid: false,
+    errors,
+    warnings: warnings.length > 0 ? warnings : void 0
+  };
+}
+function parsePolicyDocumentCompat(text) {
+  if (text.trim().length === 0) {
+    return {
+      valid: false,
+      errors: ["Empty policy document. Expected peac-policy/0.1 YAML or JSON."]
+    };
+  }
+  const hasLegacyLines = LEGACY_KEY_LINE.test(text);
+  const warnings = [];
+  try {
+    const data = policyKit.parsePolicyDocument(text);
+    if (hasLegacyLines) collectLegacyWarnings(text, warnings);
+    return {
+      valid: true,
+      data,
+      warnings: warnings.length > 0 ? warnings : void 0
+    };
+  } catch (firstErr) {
+    if (!hasLegacyLines) return failureFrom(firstErr, warnings);
+    collectLegacyWarnings(text, warnings);
+    const stripped = text.replace(LEGACY_KEY_FULL_LINE_GLOBAL, "");
+    try {
+      const data = policyKit.parsePolicyDocument(stripped);
+      return { valid: true, data, warnings };
+    } catch (secondErr) {
+      return failureFrom(secondErr, warnings);
+    }
+  }
+}
+async function fetchPolicyDocumentText(origin, options = {}) {
+  let target;
+  try {
+    target = new URL(PEAC_TXT_PATH, origin);
+  } catch (err) {
+    return {
+      ok: false,
+      code: "INVALID_URL",
+      error: `Invalid origin: ${err instanceof Error ? err.message : String(err)}`
+    };
+  }
+  const fetchOptions = {
+    timeoutMs: options.timeoutMs ?? DISCOVER_TIMEOUT_MS,
+    maxResponseBytes: options.maxBytes ?? DISCOVER_MAX_BYTES,
+    headers: { "user-agent": options.userAgent ?? DEFAULT_USER_AGENT },
+    allowedMethods: ["GET"]
+  };
+  const { safeFetchRaw } = await import('@peac/net-node');
+  const raw = await safeFetchRaw(target.toString(), fetchOptions);
+  if (!raw.ok) {
+    return {
+      ok: false,
+      code: raw.code,
+      error: `${raw.code}: ${raw.error}`
+    };
+  }
+  try {
+    if (!raw.response.ok) {
+      return {
+        ok: false,
+        code: `HTTP_${raw.response.status}`,
+        error: `HTTP ${raw.response.status}: ${raw.response.statusText}`
+      };
+    }
+    const text = await raw.response.text();
+    return { ok: true, text, warnings: raw.warnings };
+  } finally {
+    await raw.close();
+  }
+}
+
+// src/lib/conformance/validators.ts
 function zodCodeToKeyword(code) {
   const mapping = {
     invalid_type: "type",
@@ -837,7 +959,7 @@ function validateParseReceiptClaims(payload) {
 }
 function validateDiscoveryInput(input) {
   if (typeof input === "string") {
-    const result = disc.parse(input);
+    const result = parsePolicyDocumentCompat(input);
     if (result.valid) {
       return { valid: true };
     }
@@ -2593,6 +2715,118 @@ function doctor(program2) {
     process.exit(exitCode);
   });
 }
+function formatOutput(result, json = false) {
+  if (json) {
+    return JSON.stringify(result, null, 2);
+  }
+  if (!result.success) {
+    return chalk__default.default.red(`Error: ${result.error}`);
+  }
+  if (result.data && typeof result.data === "object") {
+    if (result.data.sources) {
+      return formatDiscoveryResult(result.data);
+    } else if (result.data.digest) {
+      return formatHashResult(result.data);
+    } else if (result.data.valid !== void 0) {
+      return formatVerifyResult(result.data);
+    }
+  }
+  return JSON.stringify(result.data, null, 2);
+}
+function formatDiscoveryResult(data) {
+  const lines = [`Discovery for: ${chalk__default.default.blue(data.url)}`, ""];
+  for (const source of data.sources) {
+    const status = source.status === "found" ? chalk__default.default.green("[found]") : source.status === "not_found" ? chalk__default.default.yellow("[not found]") : chalk__default.default.red("[error]");
+    lines.push(`${status} ${source.type}: ${source.url}`);
+    if (source.etag) {
+      lines.push(`  ETag: ${source.etag}`);
+    }
+  }
+  return lines.join("\\n");
+}
+function formatHashResult(data) {
+  return [
+    `Algorithm: ${data.algorithm}`,
+    `Format: ${data.format}`,
+    `Digest: ${chalk__default.default.green(data.digest)}`,
+    `Input size: ${data.input_size} bytes`
+  ].join("\\n");
+}
+function formatVerifyResult(data) {
+  if (data.valid) {
+    const lines = [chalk__default.default.green("Receipt verified successfully"), ""];
+    if (data.policy_hash) {
+      lines.push(`Policy hash: ${data.policy_hash}`);
+    }
+    if (data.resource) {
+      lines.push(`Resource: ${data.resource}`);
+    }
+    return lines.join("\\n");
+  } else {
+    return chalk__default.default.red(`Verification failed: ${data.error || "Unknown error"}`);
+  }
+}
+function handleError(error) {
+  return {
+    success: false,
+    error: error.message
+  };
+}
+function timing() {
+  const started = Date.now();
+  return {
+    started,
+    end: () => {
+      const completed = Date.now();
+      return {
+        started,
+        completed,
+        duration: completed - started
+      };
+    }
+  };
+}
+
+// src/commands/discover.ts
+var DiscoverCommand = class {
+  async execute(url, _options = {}) {
+    const timer = timing();
+    try {
+      const parsedUrl = new URL(url);
+      if (!["http:", "https:"].includes(parsedUrl.protocol)) {
+        throw new Error("URL must use http: or https: protocol");
+      }
+      const fetched = await fetchPolicyDocumentText(url);
+      if (!fetched.ok) {
+        return {
+          success: false,
+          error: fetched.error,
+          timing: timer.end()
+        };
+      }
+      const parsed = parsePolicyDocumentCompat(fetched.text);
+      const data = { ...parsed };
+      if (fetched.warnings && fetched.warnings.length > 0) {
+        data.warnings = [...parsed.warnings ?? [], ...fetched.warnings];
+      }
+      if (data.warnings && data.warnings.length > 0) {
+        data.hints = [
+          "peac.txt is a policy-document surface (docs/specs/PEAC-TXT.md). For key discovery, use /.well-known/peac-issuer.json (docs/specs/PEAC-ISSUER.md)."
+        ];
+      }
+      return {
+        success: true,
+        data,
+        timing: timer.end()
+      };
+    } catch (error) {
+      return {
+        ...handleError(error),
+        timing: timer.end()
+      };
+    }
+  }
+};
 
 // src/index.ts
 var program = new commander.Command();
@@ -2730,6 +2964,12 @@ program.addCommand(conformance);
 program.addCommand(samples);
 program.addCommand(reconcileCommand());
 doctor(program);
+program.command("discover").description("Discover and parse a remote /.well-known/peac.txt policy document").argument("<url>", "Origin URL (http/https) whose /.well-known/peac.txt to fetch").option("-j, --json", "output in JSON format").action(async (url, opts) => {
+  const cmd = new DiscoverCommand();
+  const result = await cmd.execute(url, { json: opts.json });
+  console.log(formatOutput(result, opts.json));
+  process.exitCode = result.success ? 0 : 1;
+});
 try {
   program.parse();
 } catch (err) {