@peac/cli 0.16.3 → 0.16.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +33 -1
- package/package.json +8 -8
package/README.md
CHANGED
|
@@ -27,7 +27,39 @@ peac verify <jws>
|
|
|
27
27
|
peac verify receipt.jws --verbose
|
|
28
28
|
```
|
|
29
29
|
|
|
30
|
-
Decodes the receipt, displays claims (issuer, audience, amount, payment rail), and verifies the cryptographic signature. Exit code 0 on success, 1 on failure.
|
|
30
|
+
Decodes the receipt, displays claims (issuer, audience, amount, payment rail), and verifies the cryptographic signature. Without `--public-key`, verification resolves the issuer's keys over the network via issuer discovery. Exit code 0 on success, 1 on failure.
|
|
31
|
+
|
|
32
|
+
### Verify offline with a supplied public key
|
|
33
|
+
|
|
34
|
+
```bash
|
|
35
|
+
peac verify <jws-or-path> --public-key <jwk-or-single-key-jwks.json>
|
|
36
|
+
```
|
|
37
|
+
|
|
38
|
+
`--public-key <path>` verifies the record locally against the supplied public Ed25519 key using `verifyLocal()` from `@peac/protocol`. No network request, issuer discovery, or JWKS fetch is made, and there is no fallback to the network path. The record structure is validated as well as the signature.
|
|
39
|
+
|
|
40
|
+
The key file must be one of:
|
|
41
|
+
|
|
42
|
+
- a bare public Ed25519 JWK (`{"kty":"OKP","crv":"Ed25519","x":"..."}`), or
|
|
43
|
+
- a single-key JWKS (`{"keys":[<that JWK>]}`).
|
|
44
|
+
|
|
45
|
+
The loader fails closed and rejects: a file that is not valid JSON or not an object; a JWKS with no keys or with more than one key; a JWK that contains private key material (`d`); a key that is not `kty` `OKP` with `crv` `Ed25519`; a JWK missing the public value `x`, or whose `x` is not a 32-byte base64url value; and key files larger than 16 KiB. Error messages never echo key material.
|
|
46
|
+
|
|
47
|
+
Try it on the shipped samples. `samples generate` writes valid records under `valid/` and the matching public key set to `bundles/sandbox-jwks.json`:
|
|
48
|
+
|
|
49
|
+
```bash
|
|
50
|
+
peac samples generate -o ./s
|
|
51
|
+
peac verify ./s/valid/basic-record.jws --public-key ./s/bundles/sandbox-jwks.json
|
|
52
|
+
```
|
|
53
|
+
|
|
54
|
+
Expected output:
|
|
55
|
+
|
|
56
|
+
```text
|
|
57
|
+
Signature valid (offline).
|
|
58
|
+
```
|
|
59
|
+
|
|
60
|
+
On failure the command prints `Verification failed: <message>` with the error code (for example `E_INVALID_SIGNATURE` for a modified record) and exits 1.
|
|
61
|
+
|
|
62
|
+
A valid result establishes that the record was signed by the private key matching the supplied public key and has not changed since. It does not establish that the key or its holder should be trusted, or that the statements inside the record are true.
|
|
31
63
|
|
|
32
64
|
### Decode a receipt without verification
|
|
33
65
|
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@peac/cli",
|
|
3
|
-
"version": "0.16.
|
|
3
|
+
"version": "0.16.5",
|
|
4
4
|
"description": "PEAC protocol command-line tools",
|
|
5
5
|
"main": "dist/index.cjs",
|
|
6
6
|
"types": "dist/index.d.ts",
|
|
@@ -38,13 +38,13 @@
|
|
|
38
38
|
"dependencies": {
|
|
39
39
|
"chalk": "^4.1.2",
|
|
40
40
|
"commander": "^11.0.0",
|
|
41
|
-
"@peac/
|
|
42
|
-
"@peac/
|
|
43
|
-
"@peac/
|
|
44
|
-
"@peac/net-node": "0.16.
|
|
45
|
-
"@peac/
|
|
46
|
-
"@peac/protocol": "0.16.
|
|
47
|
-
"@peac/schema": "0.16.
|
|
41
|
+
"@peac/audit": "0.16.5",
|
|
42
|
+
"@peac/crypto": "0.16.5",
|
|
43
|
+
"@peac/kernel": "0.16.5",
|
|
44
|
+
"@peac/net-node": "0.16.5",
|
|
45
|
+
"@peac/policy-kit": "0.16.5",
|
|
46
|
+
"@peac/protocol": "0.16.5",
|
|
47
|
+
"@peac/schema": "0.16.5"
|
|
48
48
|
},
|
|
49
49
|
"devDependencies": {
|
|
50
50
|
"@types/node": "^22.19.11",
|