@peac/cli 0.12.14 → 0.13.1

package/dist/index.mjs

@@ -6,13 +6,14 @@ import * as fs6 from 'fs';
 import { existsSync, readFileSync } from 'fs';
 import * as path6 from 'path';
 import { join } from 'path';
-import { loadProfile, serializePolicyJson, serializePolicyYaml, ProfileError, createExamplePolicy, loadPolicy, PolicyValidationError, PolicyLoadError, compilePeacTxt, compileRobotsSnippet, compileAiprefTemplates, renderPolicyMarkdown, explainMatches, evaluate, listProfiles, getProfileSummary } from '@peac/policy-kit';
+import { loadProfile, serializePolicyJson, serializePolicyYaml, ProfileError, createExamplePolicy, loadPolicy, PolicyValidationError, PolicyLoadError, compilePeacTxt, compileRobotsSnippet, compileAiprefTemplates, renderPolicyMarkdown, explainMatches, evaluate, listProfiles, getProfileSummary, parsePolicyDocument } from '@peac/policy-kit';
 import { execSync } from 'child_process';
 import { createHash } from 'crypto';
 import { computeReceiptRef, validateWorkflowContextOrdered, isValidPurposeToken, isCanonicalPurpose, validateObligationsExtension, validateInteractionOrdered, validateDisputeAttestation, validateAttributionAttestation, validateAgentIdentityAttestation, ReceiptClaimsSchema, parseReceiptClaims } from '@peac/schema';
-import { parse } from '@peac/disc';
+import { POLICY } from '@peac/kernel';
 import { readDisputeBundle } from '@peac/audit';
 import { createRequire } from 'module';
+import chalk from 'chalk';
 
 function getGlobalOptions(cmd) {
   const parent = cmd.parent;
@@ -682,7 +683,7 @@ var PROFILE_CAPABILITIES = {
   discovery: {
     profile: "discovery.config",
     level: "semantic",
-    validator: "@peac/disc:parse"
+    validator: "@peac/policy-kit:parsePolicyDocument (via cli compat helper)"
   },
   dispute: {
     profile: "receipt.verify.dispute",
@@ -762,6 +763,124 @@ function shouldRunAtLevel(fixtureVersion, level) {
   const levelOrder = ["basic", "standard", "full"];
   return levelOrder.indexOf(fixtureLevel) <= levelOrder.indexOf(level);
 }
+var DISCOVER_TIMEOUT_MS = 5e3;
+var DISCOVER_MAX_BYTES = POLICY.maxBytes;
+var PEAC_TXT_PATH = POLICY.manifestPath;
+var DEFAULT_USER_AGENT = "peac-cli";
+var LEGACY_KEY_LINE = /^\s*(verify|public_keys|jwks)\s*:/m;
+var LEGACY_KEY_FULL_LINE_GLOBAL = /^\s*(verify|public_keys|jwks)\s*:.*\r?\n?/gm;
+var legacyWarningFired = false;
+function fireLegacyWarning(field) {
+  if (legacyWarningFired) return;
+  legacyWarningFired = true;
+  if (typeof process !== "undefined" && typeof process.emitWarning === "function") {
+    process.emitWarning(
+      `peac.txt legacy key-discovery field "${field}" is deprecated and ignored. peac.txt is a policy-document surface (docs/specs/PEAC-TXT.md). Key resolution uses iss -> /.well-known/peac-issuer.json -> jwks_uri -> JWKS.`,
+      { code: "PEAC_LEGACY_PEAC_TXT_KEY_FIELD", type: "DeprecationWarning" }
+    );
+  }
+}
+function collectLegacyWarnings(text, warnings) {
+  const lines = text.split(/\r?\n/);
+  let firstField = null;
+  lines.forEach((line, idx) => {
+    const m = line.match(/^\s*(verify|public_keys|jwks)\s*:/);
+    if (m) {
+      if (firstField === null) firstField = m[1];
+      warnings.push(
+        `Line ${idx + 1}: legacy key-discovery field "${m[1]}" ignored (peac.txt is policy-only; use peac-issuer.json for keys)`
+      );
+    }
+  });
+  if (firstField) fireLegacyWarning(firstField);
+}
+function failureFrom(err, warnings) {
+  const errors = [];
+  if (err instanceof PolicyValidationError) {
+    const issues = err.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ");
+    errors.push(`Policy validation failed: ${issues}`);
+  } else if (err instanceof PolicyLoadError) {
+    errors.push(err.message);
+  } else {
+    errors.push(`Unexpected parse error: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  return {
+    valid: false,
+    errors,
+    warnings: warnings.length > 0 ? warnings : void 0
+  };
+}
+function parsePolicyDocumentCompat(text) {
+  if (text.trim().length === 0) {
+    return {
+      valid: false,
+      errors: ["Empty policy document. Expected peac-policy/0.1 YAML or JSON."]
+    };
+  }
+  const hasLegacyLines = LEGACY_KEY_LINE.test(text);
+  const warnings = [];
+  try {
+    const data = parsePolicyDocument(text);
+    if (hasLegacyLines) collectLegacyWarnings(text, warnings);
+    return {
+      valid: true,
+      data,
+      warnings: warnings.length > 0 ? warnings : void 0
+    };
+  } catch (firstErr) {
+    if (!hasLegacyLines) return failureFrom(firstErr, warnings);
+    collectLegacyWarnings(text, warnings);
+    const stripped = text.replace(LEGACY_KEY_FULL_LINE_GLOBAL, "");
+    try {
+      const data = parsePolicyDocument(stripped);
+      return { valid: true, data, warnings };
+    } catch (secondErr) {
+      return failureFrom(secondErr, warnings);
+    }
+  }
+}
+async function fetchPolicyDocumentText(origin, options = {}) {
+  let target;
+  try {
+    target = new URL(PEAC_TXT_PATH, origin);
+  } catch (err) {
+    return {
+      ok: false,
+      code: "INVALID_URL",
+      error: `Invalid origin: ${err instanceof Error ? err.message : String(err)}`
+    };
+  }
+  const fetchOptions = {
+    timeoutMs: options.timeoutMs ?? DISCOVER_TIMEOUT_MS,
+    maxResponseBytes: options.maxBytes ?? DISCOVER_MAX_BYTES,
+    headers: { "user-agent": options.userAgent ?? DEFAULT_USER_AGENT },
+    allowedMethods: ["GET"]
+  };
+  const { safeFetchRaw } = await import('@peac/net-node');
+  const raw = await safeFetchRaw(target.toString(), fetchOptions);
+  if (!raw.ok) {
+    return {
+      ok: false,
+      code: raw.code,
+      error: `${raw.code}: ${raw.error}`
+    };
+  }
+  try {
+    if (!raw.response.ok) {
+      return {
+        ok: false,
+        code: `HTTP_${raw.response.status}`,
+        error: `HTTP ${raw.response.status}: ${raw.response.statusText}`
+      };
+    }
+    const text = await raw.response.text();
+    return { ok: true, text, warnings: raw.warnings };
+  } finally {
+    await raw.close();
+  }
+}
+
+// src/lib/conformance/validators.ts
 function zodCodeToKeyword(code) {
   const mapping = {
     invalid_type: "type",
@@ -816,7 +935,7 @@ function validateParseReceiptClaims(payload) {
 }
 function validateDiscoveryInput(input) {
   if (typeof input === "string") {
-    const result = parse(input);
+    const result = parsePolicyDocumentCompat(input);
     if (result.valid) {
       return { valid: true };
     }
@@ -2572,6 +2691,118 @@ function doctor(program2) {
     process.exit(exitCode);
   });
 }
+function formatOutput(result, json = false) {
+  if (json) {
+    return JSON.stringify(result, null, 2);
+  }
+  if (!result.success) {
+    return chalk.red(`Error: ${result.error}`);
+  }
+  if (result.data && typeof result.data === "object") {
+    if (result.data.sources) {
+      return formatDiscoveryResult(result.data);
+    } else if (result.data.digest) {
+      return formatHashResult(result.data);
+    } else if (result.data.valid !== void 0) {
+      return formatVerifyResult(result.data);
+    }
+  }
+  return JSON.stringify(result.data, null, 2);
+}
+function formatDiscoveryResult(data) {
+  const lines = [`Discovery for: ${chalk.blue(data.url)}`, ""];
+  for (const source of data.sources) {
+    const status = source.status === "found" ? chalk.green("[found]") : source.status === "not_found" ? chalk.yellow("[not found]") : chalk.red("[error]");
+    lines.push(`${status} ${source.type}: ${source.url}`);
+    if (source.etag) {
+      lines.push(`  ETag: ${source.etag}`);
+    }
+  }
+  return lines.join("\\n");
+}
+function formatHashResult(data) {
+  return [
+    `Algorithm: ${data.algorithm}`,
+    `Format: ${data.format}`,
+    `Digest: ${chalk.green(data.digest)}`,
+    `Input size: ${data.input_size} bytes`
+  ].join("\\n");
+}
+function formatVerifyResult(data) {
+  if (data.valid) {
+    const lines = [chalk.green("Receipt verified successfully"), ""];
+    if (data.policy_hash) {
+      lines.push(`Policy hash: ${data.policy_hash}`);
+    }
+    if (data.resource) {
+      lines.push(`Resource: ${data.resource}`);
+    }
+    return lines.join("\\n");
+  } else {
+    return chalk.red(`Verification failed: ${data.error || "Unknown error"}`);
+  }
+}
+function handleError(error) {
+  return {
+    success: false,
+    error: error.message
+  };
+}
+function timing() {
+  const started = Date.now();
+  return {
+    started,
+    end: () => {
+      const completed = Date.now();
+      return {
+        started,
+        completed,
+        duration: completed - started
+      };
+    }
+  };
+}
+
+// src/commands/discover.ts
+var DiscoverCommand = class {
+  async execute(url, _options = {}) {
+    const timer = timing();
+    try {
+      const parsedUrl = new URL(url);
+      if (!["http:", "https:"].includes(parsedUrl.protocol)) {
+        throw new Error("URL must use http: or https: protocol");
+      }
+      const fetched = await fetchPolicyDocumentText(url);
+      if (!fetched.ok) {
+        return {
+          success: false,
+          error: fetched.error,
+          timing: timer.end()
+        };
+      }
+      const parsed = parsePolicyDocumentCompat(fetched.text);
+      const data = { ...parsed };
+      if (fetched.warnings && fetched.warnings.length > 0) {
+        data.warnings = [...parsed.warnings ?? [], ...fetched.warnings];
+      }
+      if (data.warnings && data.warnings.length > 0) {
+        data.hints = [
+          "peac.txt is a policy-document surface (docs/specs/PEAC-TXT.md). For key discovery, use /.well-known/peac-issuer.json (docs/specs/PEAC-ISSUER.md)."
+        ];
+      }
+      return {
+        success: true,
+        data,
+        timing: timer.end()
+      };
+    } catch (error) {
+      return {
+        ...handleError(error),
+        timing: timer.end()
+      };
+    }
+  }
+};
 
 // src/index.ts
 var program = new Command();
@@ -2709,6 +2940,12 @@ program.addCommand(conformance);
 program.addCommand(samples);
 program.addCommand(reconcileCommand());
 doctor(program);
+program.command("discover").description("Discover and parse a remote /.well-known/peac.txt policy document").argument("<url>", "Origin URL (http/https) whose /.well-known/peac.txt to fetch").option("-j, --json", "output in JSON format").action(async (url, opts) => {
+  const cmd = new DiscoverCommand();
+  const result = await cmd.execute(url, { json: opts.json });
+  console.log(formatOutput(result, opts.json));
+  process.exitCode = result.success ? 0 : 1;
+});
 try {
   program.parse();
 } catch (err) {