@peac/cli 0.14.1 → 0.14.3

package/dist/commands/bridge/start.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"start.d.ts","sourceRoot":"","sources":["../../../src/commands/bridge/start.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAMpC,wBAAgB,YAAY,YAgI3B"}
+{"version":3,"file":"start.d.ts","sourceRoot":"","sources":["../../../src/commands/bridge/start.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAcpC,wBAAgB,YAAY,YA+I3B"}

package/dist/commands/bridge/status.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../../src/commands/bridge/status.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKpC,wBAAgB,aAAa,YA8L5B"}
+{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../../src/commands/bridge/status.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAMpC,wBAAgB,aAAa,YAgM5B"}

package/dist/commands/bridge/stop.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stop.d.ts","sourceRoot":"","sources":["../../../src/commands/bridge/stop.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAoCpC,wBAAgB,WAAW,YA6F1B"}
+{"version":3,"file":"stop.d.ts","sourceRoot":"","sources":["../../../src/commands/bridge/stop.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAwCpC,wBAAgB,WAAW,YAiG1B"}

package/dist/commands/bundle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bundle.d.ts","sourceRoot":"","sources":["../../src/commands/bundle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA+FpC,QAAA,MAAM,MAAM,SAA4E,CAAC;AA8RzF,OAAO,EAAE,MAAM,IAAI,aAAa,EAAE,CAAC"}
+{"version":3,"file":"bundle.d.ts","sourceRoot":"","sources":["../../src/commands/bundle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAuGpC,QAAA,MAAM,MAAM,SAA4E,CAAC;AAkTzF,OAAO,EAAE,MAAM,IAAI,aAAa,EAAE,CAAC"}

package/dist/commands/policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/commands/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAiFpC,QAAA,MAAM,MAAM,SAIsC,CAAC;AAmtBnD,OAAO,EAAE,MAAM,EAAE,CAAC"}
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/commands/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA6EpC,QAAA,MAAM,MAAM,SAIsC,CAAC;AA6tBnD,OAAO,EAAE,MAAM,EAAE,CAAC"}

package/dist/commands/reconcile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reconcile.d.ts","sourceRoot":"","sources":["../../src/commands/reconcile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAqNpC,wBAAgB,gBAAgB,IAAI,OAAO,CAuH1C"}
+{"version":3,"file":"reconcile.d.ts","sourceRoot":"","sources":["../../src/commands/reconcile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA4OpC,wBAAgB,gBAAgB,IAAI,OAAO,CAuH1C"}

package/dist/commands/verify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/commands/verify.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAgB,MAAM,aAAa,CAAC;AAG3E,MAAM,WAAW,aAAc,SAAQ,UAAU;IAC/C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,qBAAa,aAAa;IAClB,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,GAAE,aAAkB,GAAG,OAAO,CAAC,aAAa,CAAC;CAkDxF"}
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/commands/verify.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAgB,MAAM,aAAa,CAAC;AAI3E,MAAM,WAAW,aAAc,SAAQ,UAAU;IAC/C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,qBAAa,aAAa;IAClB,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,GAAE,aAAkB,GAAG,OAAO,CAAC,aAAa,CAAC;CAmDxF"}

package/dist/index.cjs

@@ -7,8 +7,8 @@ var crypto = require('@peac/crypto');
 var fs6 = require('fs');
 var path6 = require('path');
 var policyKit = require('@peac/policy-kit');
-var child_process = require('child_process');
 var crypto$1 = require('crypto');
+var child_process = require('child_process');
 var schema = require('@peac/schema');
 var kernel = require('@peac/kernel');
 var audit = require('@peac/audit');
@@ -40,6 +40,55 @@ var fs6__namespace = /*#__PURE__*/_interopNamespace(fs6);
 var path6__namespace = /*#__PURE__*/_interopNamespace(path6);
 var chalk__default = /*#__PURE__*/_interopDefault(chalk);
 
+function readFileBufferSnapshot(path9, options) {
+  let fd;
+  try {
+    fd = fs6.openSync(path9, fs6.constants.O_RDONLY);
+    const stat = fs6.fstatSync(fd);
+    if (stat.isDirectory()) {
+      throw makeErrnoError("EISDIR", `is a directory: ${path9}`);
+    }
+    if (options?.maxBytes !== void 0 && stat.size > options.maxBytes) {
+      throw makeFileTooLargeError(path9, stat.size, options.maxBytes);
+    }
+    const data = fs6.readFileSync(fd);
+    if (options?.maxBytes !== void 0 && data.length > options.maxBytes) {
+      throw makeFileTooLargeError(path9, data.length, options.maxBytes);
+    }
+    return data;
+  } finally {
+    if (fd !== void 0) {
+      try {
+        fs6.closeSync(fd);
+      } catch {
+      }
+    }
+  }
+}
+function makeFileTooLargeError(path9, actualSize, maxBytes) {
+  const err = new Error(
+    `file size ${actualSize} bytes exceeds limit ${maxBytes} bytes: ${path9}`
+  );
+  err.code = "E_PEAC_FILE_TOO_LARGE";
+  err.actualSize = actualSize;
+  err.maxBytes = maxBytes;
+  return err;
+}
+function writeFileNoOverwrite(path9, data, options) {
+  const encoding = typeof data === "string" ? options?.encoding : null;
+  fs6.writeFileSync(path9, data, {
+    encoding,
+    flag: "wx",
+    mode: options?.mode
+  });
+}
+function makeErrnoError(code, message) {
+  const err = new Error(message);
+  err.code = code;
+  return err;
+}
+
+// src/commands/policy.ts
 function getGlobalOptions(cmd) {
   const parent = cmd.parent;
   if (!parent) return {};
@@ -64,14 +113,6 @@ policy.command("init").description("Create a new PEAC policy file").option("-f,
     try {
       const format = options.format?.toLowerCase() || "yaml";
       const outputPath = options.output || (format === "json" ? "peac-policy.json" : "peac-policy.yaml");
-      if (fs6__namespace.existsSync(outputPath) && !options.force && !globalOpts.yes) {
-        outputError(
-          `File already exists: ${outputPath}`,
-          { path: outputPath, hint: "Use --force or --yes to overwrite" },
-          globalOpts
-        );
-        process.exit(1);
-      }
       let content;
       let policyName;
       if (options.profile) {
@@ -92,7 +133,24 @@ policy.command("init").description("Create a new PEAC policy file").option("-f,
         content = format === "json" ? policyKit.serializePolicyJson(example) : policyKit.serializePolicyYaml(example);
         policyName = "Example Policy";
       }
-      fs6__namespace.writeFileSync(outputPath, content, "utf-8");
+      const allowOverwrite = options.force === true || globalOpts.yes === true;
+      try {
+        if (allowOverwrite) {
+          fs6__namespace.writeFileSync(outputPath, content, { encoding: "utf-8", flag: "w" });
+        } else {
+          writeFileNoOverwrite(outputPath, content, { encoding: "utf-8" });
+        }
+      } catch (err) {
+        if (err.code === "EEXIST") {
+          outputError(
+            `File already exists: ${outputPath}`,
+            { path: outputPath, hint: "Use --force or --yes to overwrite" },
+            globalOpts
+          );
+          process.exit(1);
+        }
+        throw err;
+      }
       if (globalOpts.json) {
         output(
           {
@@ -508,7 +566,6 @@ policy.command("show-profile").description("Show details of a specific policy pr
   const globalOpts = getGlobalOptions(cmd);
   try {
     const profile = policyKit.loadProfile(id);
-    const summary = policyKit.getProfileSummary(id);
     if (globalOpts.json) {
       output(
         {
@@ -2383,20 +2440,37 @@ function findDiffFields(jwsA, jwsB) {
   return diffs.sort();
 }
 async function readBundle(bundlePath, label) {
-  if (!fs6__namespace.existsSync(bundlePath)) {
-    return { ok: false, error: `Bundle file not found: ${bundlePath}` };
-  }
-  const stat = fs6__namespace.statSync(bundlePath);
-  if (stat.size > MAX_BUNDLE_SIZE) {
-    return { ok: false, error: `Bundle ${label} exceeds 16 MB size limit (${stat.size} bytes)` };
+  let resolved;
+  try {
+    resolved = fs6__namespace.realpathSync(bundlePath);
+  } catch (err) {
+    if (err.code === "ENOENT") {
+      return { ok: false, error: `Bundle file not found: ${bundlePath}` };
+    }
+    return { ok: false, error: `Failed to read ${label}: ${err.message}` };
   }
-  const resolved = fs6__namespace.realpathSync(bundlePath);
   if (resolved !== bundlePath && !resolved.startsWith(process.cwd())) {
-    if (!fs6__namespace.existsSync(resolved)) {
-      return { ok: false, error: `Path traversal detected for ${label}` };
+    return { ok: false, error: `Path traversal detected for ${label}` };
+  }
+  let zipBuffer;
+  try {
+    zipBuffer = readFileBufferSnapshot(bundlePath, { maxBytes: MAX_BUNDLE_SIZE });
+  } catch (err) {
+    const e = err;
+    if (e.code === "ENOENT") {
+      return { ok: false, error: `Bundle file not found: ${bundlePath}` };
+    }
+    if (e.code === "EISDIR") {
+      return { ok: false, error: `Bundle ${label} is not a regular file: ${bundlePath}` };
     }
+    if (e.code === "E_PEAC_FILE_TOO_LARGE") {
+      return {
+        ok: false,
+        error: `Bundle ${label} exceeds 16 MB size limit (${e.actualSize ?? "unknown"} bytes)`
+      };
+    }
+    return { ok: false, error: `Failed to read ${label}: ${err.message}` };
   }
-  const zipBuffer = fs6__namespace.readFileSync(bundlePath);
   const result = await audit.readDisputeBundle(zipBuffer);
   if (!result.ok) {
     return { ok: false, error: `Failed to read ${label}: ${result.error.message}` };
@@ -4755,7 +4829,7 @@ program.command("verify").description("Verify a PEAC receipt JWS").argument("<jw
       jws = fs6__namespace.readFileSync(jwsInput, "utf-8").trim();
     }
     console.log("Verifying PEAC receipt...\n");
-    const { header, payload } = crypto.decode(jws);
+    const { payload } = crypto.decode(jws);
     console.log("Receipt Information:");
     console.log(`   Receipt ID: ${payload.rid}`);
     console.log(`   Issuer:     ${payload.iss}`);