@peac/disc 0.12.13 → 0.12.14

package/README.md

@@ -1,6 +1,6 @@
 # @peac/disc
 
-PEAC issuer discovery: ABNF-compliant `.well-known/peac.txt` parser, generator, and remote fetcher.
+Thin loader / validator and remote fetcher for `peac.txt` policy documents.
 
 ## Installation
 
@@ -10,37 +10,65 @@ pnpm add @peac/disc
 
 ## What It Does
 
-`@peac/disc` parses and generates `.well-known/peac.txt` discovery documents that allow verifiers to find an issuer's public keys and policy information. It enforces the normative 20-line limit, validates document structure against the ABNF grammar, and provides a convenience `discover()` function for remote resolution.
+`@peac/disc` is a thin wrapper around
+[`@peac/policy-kit`](../policy-kit) specialized for the `peac.txt`
+discovery surface. It:
+
+- fetches `/.well-known/peac.txt` with `discover(origin)`,
+- delegates parsing of `peac-policy/0.1` YAML / JSON bytes to
+  `@peac/policy-kit.parsePolicyDocument`,
+- returns a tolerant `ParseResult` (rather than throwing) that carries a
+  validated `PolicyDocument`, error messages, and advisory warnings,
+- tolerates legacy key-discovery lines (`verify:`, `public_keys:`, `jwks:`)
+  in older example documents by stripping them before validation and
+  surfacing a structured `PEAC_LEGACY_PEAC_TXT_KEY_FIELD`
+  `DeprecationWarning`.
+
+`peac.txt` is the **policy-document surface** per
+`docs/specs/PEAC-TXT.md`. It is **not** a key discovery surface.
+Cryptographic key resolution uses the normative chain
+`iss` -> `/.well-known/peac-issuer.json` -> `jwks_uri` -> JWKS (see
+`docs/specs/PEAC-ISSUER.md`). For that flow, use `parseIssuerConfig` /
+`fetchIssuerConfig` from `@peac/protocol`.
 
 ## How Do I Use It?
 
-### Parse a discovery document
+### Parse a policy document
 
 ```typescript
-import { parse, validate } from '@peac/disc';
+import { parse } from '@peac/disc';
 
 const result = parse(`
-version: peac/0.1
-issuer: https://example.com
-jwks: https://example.com/.well-known/jwks.json
+version: 'peac-policy/0.1'
+defaults:
+  decision: deny
+rules:
+  - name: allow-verified-agents
+    subject:
+      type: agent
+      labels: [verified]
+    purpose: inference
+    decision: allow
 `);
 
 if (result.valid) {
-  console.log(result.discovery.issuer); // 'https://example.com'
+  console.log(result.data?.version); // 'peac-policy/0.1'
+  console.log(result.data?.rules[0].decision); // 'allow'
+}
+
+if (result.warnings) {
+  // e.g. legacy key-discovery lines were stripped on parse
+  console.warn(result.warnings);
 }
 ```
 
-### Generate a discovery document
+### Emit a policy document as YAML
 
 ```typescript
 import { emit } from '@peac/disc';
+import { createExamplePolicy } from '@peac/policy-kit';
 
-const txt = emit({
-  version: 'peac/0.1',
-  issuer: 'https://example.com',
-  jwks_uri: 'https://example.com/.well-known/jwks.json',
-});
-
+const yaml = emit(createExamplePolicy());
 // Serve at /.well-known/peac.txt
 ```
 
@@ -51,25 +79,30 @@ import { discover, WELL_KNOWN_PATH } from '@peac/disc';
 
 const result = await discover('https://example.com');
 if (result.valid) {
-  console.log(result.discovery);
+  console.log(result.data);
 }
-
 console.log(WELL_KNOWN_PATH); // '/.well-known/peac.txt'
 ```
 
-## Integrates With
+The caller's user-agent is taken from the `PEAC_USER_AGENT` environment
+variable when present; otherwise `peac-disc` is used. `@peac/disc` does
+not hard-code a package version in the user-agent (runtime-visible
+version constants belong in release tooling).
 
-- `@peac/policy-kit`: Policy compilation generates `peac.txt` artifacts
-- `@peac/protocol` (Layer 3): Issuer resolution during receipt verification
-- `@peac/jwks-cache`: Fetches JWKS from the URI discovered via `peac.txt`
+## Limits
 
-## For Agent Developers
+Per `docs/specs/PEAC-TXT.md` §6.1, remote documents larger than
+**256 KiB** are rejected by `discover()`. Nesting depth, array length,
+and string length limits are enforced by the underlying
+`@peac/policy-kit` validator.
 
-If you are building an AI agent or MCP server that needs evidence receipts:
+## Integrates With
 
-- Start with [`@peac/mcp-server`](https://www.npmjs.com/package/@peac/mcp-server) for a ready-to-use MCP tool server
-- Use `@peac/protocol` for programmatic receipt issuance and verification
-- See the [llms.txt](https://github.com/peacprotocol/peac/blob/main/llms.txt) for a concise overview
+- `@peac/policy-kit`: canonical compiler / parser / evaluator for
+  `peac-policy/0.1` documents. `@peac/disc.parse` delegates to
+  `@peac/policy-kit.parsePolicyDocument`.
+- `@peac/protocol`: `parseIssuerConfig` / `fetchIssuerConfig` for the
+  normative key-discovery chain.
 
 ## License
 
@@ -77,6 +110,7 @@ Apache-2.0
 
 ---
 
-PEAC Protocol is an open source project stewarded by Originary and community contributors.
+PEAC Protocol is an open source project stewarded by Originary and community
+contributors.
 
 [Docs](https://www.peacprotocol.org) | [GitHub](https://github.com/peacprotocol/peac) | [Originary](https://www.originary.xyz)

package/dist/index.cjs

@@ -1,5 +1,7 @@
 'use strict';
 
+var policyKit = require('@peac/policy-kit');
+
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __esm = (fn, res) => function __init() {
@@ -13,162 +15,153 @@ var __export = (target, all) => {
 // src/parser.ts
 var parser_exports = {};
 __export(parser_exports, {
+  __resetLegacyWarningForTests: () => __resetLegacyWarningForTests,
   emit: () => emit,
   parse: () => parse,
   validate: () => validate
 });
-function parse(content, options = {}) {
-  const maxLines = options.maxLines ?? MAX_LINES;
-  const errors = [];
-  const data = {};
-  const lines = content.split("\n").map((l) => l.trim()).filter((l) => l && !l.startsWith("#"));
-  if (lines.length > maxLines) {
+function fireLegacyWarning(field) {
+  if (legacyWarningFired) return;
+  legacyWarningFired = true;
+  if (typeof process !== "undefined" && typeof process.emitWarning === "function") {
+    process.emitWarning(
+      `peac.txt legacy key-discovery field "${field}" is deprecated and ignored. peac.txt is a policy-document surface (docs/specs/PEAC-TXT.md). Key resolution uses iss -> /.well-known/peac-issuer.json -> jwks_uri -> JWKS.`,
+      { code: "PEAC_LEGACY_PEAC_TXT_KEY_FIELD", type: "DeprecationWarning" }
+    );
+  }
+}
+function __resetLegacyWarningForTests() {
+  legacyWarningFired = false;
+}
+function collectLegacyWarnings(text) {
+  const warnings = [];
+  let firstField = null;
+  const lines = text.split(/\r?\n/);
+  lines.forEach((line, idx) => {
+    const match = line.match(/^\s*(verify|public_keys|jwks)\s*:/);
+    if (match) {
+      if (firstField === null) firstField = match[1];
+      warnings.push(
+        `Line ${idx + 1}: legacy key-discovery field "${match[1]}" ignored (peac.txt is policy-only; use peac-issuer.json for keys)`
+      );
+    }
+  });
+  return { warnings, firstField };
+}
+function parse(text) {
+  const warnings = [];
+  if (text.trim().length === 0) {
     return {
       valid: false,
-      errors: [`Line limit exceeded: ${lines.length} > ${maxLines}`],
-      lineCount: lines.length
+      errors: ["Empty policy document. Expected peac-policy/0.1 YAML or JSON."]
     };
   }
-  for (const [index, line] of lines.entries()) {
-    let matched = false;
-    for (const [field, pattern] of Object.entries(FIELD_PATTERNS)) {
-      const match = line.match(pattern);
-      if (match) {
-        matched = true;
-        try {
-          switch (field) {
-            case "preferences":
-            case "access_control":
-            case "provenance":
-            case "verify":
-              data[field] = match[1].trim();
-              break;
-            case "receipts":
-              data.receipts = match[1];
-              break;
-            case "payments":
-              data.payments = parseArray(match[1]);
-              break;
-            case "public_keys":
-              data.public_keys = parsePublicKeys(match[1]);
-              break;
-          }
-        } catch (error) {
-          errors.push(
-            `Line ${index + 1}: ${error instanceof Error ? error.message : String(error)}`
-          );
-        }
-        break;
-      }
+  const hasLegacyLines = LEGACY_KEY_LINE.test(text);
+  try {
+    const data = policyKit.parsePolicyDocument(text);
+    if (hasLegacyLines) {
+      const legacy = collectLegacyWarnings(text);
+      warnings.push(...legacy.warnings);
+      if (legacy.firstField) fireLegacyWarning(legacy.firstField);
     }
-    if (!matched) {
-      errors.push(`Line ${index + 1}: Invalid format: ${line}`);
+    return {
+      valid: true,
+      data,
+      warnings: warnings.length > 0 ? warnings : void 0
+    };
+  } catch (firstErr) {
+    if (!hasLegacyLines) {
+      return failure(firstErr, warnings);
     }
-  }
-  if (!data.verify) {
-    errors.push("Missing required field: verify");
-  }
-  return {
-    valid: errors.length === 0,
-    data: errors.length === 0 ? data : void 0,
-    errors: errors.length > 0 ? errors : void 0,
-    lineCount: lines.length
-  };
-}
-function parseArray(content) {
-  return content.split(",").map((item) => item.trim().replace(/^["']|["']$/g, "")).filter((item) => item.length > 0);
-}
-function parsePublicKeys(content) {
-  const keyStrings = parseArray(content);
-  const keys = [];
-  for (const keyString of keyStrings) {
-    const keyMatch = keyString.match(/^([^:]+):([^:]+):(.+)$/);
-    if (!keyMatch) {
-      throw new Error(`Invalid public key format: ${keyString}`);
+    const legacy = collectLegacyWarnings(text);
+    warnings.push(...legacy.warnings);
+    if (legacy.firstField) fireLegacyWarning(legacy.firstField);
+    const stripped = text.replace(LEGACY_KEY_FULL_LINE_GLOBAL, "");
+    if (stripped.trim().length === 0) {
+      return {
+        valid: false,
+        errors: ["Empty policy document after stripping legacy key-discovery lines."],
+        warnings: warnings.length > 0 ? warnings : void 0
+      };
+    }
+    try {
+      const data = policyKit.parsePolicyDocument(stripped);
+      return {
+        valid: true,
+        data,
+        warnings: warnings.length > 0 ? warnings : void 0
+      };
+    } catch (retryErr) {
+      return failure(retryErr, warnings);
     }
-    keys.push({
-      kid: keyMatch[1],
-      alg: keyMatch[2],
-      key: keyMatch[3]
-    });
   }
-  return keys;
 }
-function assertSafeFieldValue(value, fieldName) {
-  if (UNSAFE_FIELD_CHARS.test(value)) {
-    throw new Error(
-      `Invalid ${fieldName}: must not contain quotes, colons, brackets, newlines, or control characters`
-    );
+function failure(err, warnings) {
+  if (err instanceof policyKit.PolicyValidationError || err instanceof policyKit.PolicyLoadError) {
+    return {
+      valid: false,
+      errors: [err.message],
+      warnings: warnings.length > 0 ? warnings : void 0
+    };
   }
+  return {
+    valid: false,
+    errors: [err instanceof Error ? err.message : String(err)],
+    warnings: warnings.length > 0 ? warnings : void 0
+  };
 }
-function emit(data) {
-  const lines = [];
-  if (data.preferences) {
-    lines.push(`preferences: ${data.preferences}`);
-  }
-  if (data.access_control) {
-    lines.push(`access_control: ${data.access_control}`);
-  }
-  if (data.payments && data.payments.length > 0) {
-    data.payments.forEach((p) => assertSafeFieldValue(p, "payment"));
-    const paymentsStr = data.payments.map((p) => `"${p}"`).join(", ");
-    lines.push(`payments: [${paymentsStr}]`);
-  }
-  if (data.provenance) {
-    lines.push(`provenance: ${data.provenance}`);
-  }
-  if (data.receipts) {
-    lines.push(`receipts: ${data.receipts}`);
-  }
-  if (data.verify) {
-    lines.push(`verify: ${data.verify}`);
-  }
-  if (data.public_keys && data.public_keys.length > 0) {
-    data.public_keys.forEach((k) => {
-      assertSafeFieldValue(k.kid, "kid");
-      assertSafeFieldValue(k.alg, "alg");
-      assertSafeFieldValue(k.key, "key");
-    });
-    const keysStr = data.public_keys.map((k) => `"${k.kid}:${k.alg}:${k.key}"`).join(", ");
-    lines.push(`public_keys: [${keysStr}]`);
-  }
-  if (lines.length > MAX_LINES) {
-    throw new Error(`Generated peac.txt exceeds ${MAX_LINES} lines: ${lines.length}`);
-  }
-  return lines.join("\n");
+function emit(doc) {
+  return policyKit.serializePolicyYaml(doc);
 }
-function validate(content) {
-  const result = parse(content);
-  return result.valid;
+function validate(text) {
+  return parse(text).valid;
 }
-var MAX_LINES, FIELD_PATTERNS, UNSAFE_FIELD_CHARS;
+var LEGACY_KEY_LINE, LEGACY_KEY_FULL_LINE_GLOBAL, legacyWarningFired;
 var init_parser = __esm({
   "src/parser.ts"() {
-    MAX_LINES = 20;
-    FIELD_PATTERNS = {
-      preferences: /^preferences:\s*(.+)$/,
-      access_control: /^access_control:\s*(.+)$/,
-      payments: /^payments:\s*\[([^\]]+)\]$/,
-      provenance: /^provenance:\s*(.+)$/,
-      receipts: /^receipts:\s*(required|optional)$/,
-      verify: /^verify:\s*(.+)$/,
-      public_keys: /^public_keys:\s*\[([^\]]+)\]$/
-    };
-    UNSAFE_FIELD_CHARS = /["\n\r\x00-\x1f:[\]]/;
+    LEGACY_KEY_LINE = /^\s*(verify|public_keys|jwks)\s*:/m;
+    LEGACY_KEY_FULL_LINE_GLOBAL = /^\s*(verify|public_keys|jwks)\s*:.*\r?\n?/gm;
+    legacyWarningFired = false;
   }
 });
 
 // src/index.ts
 init_parser();
-var VERSION = "0.9.15";
-var MAX_LINES2 = 20;
+var MAX_BYTES = 262144;
 var WELL_KNOWN_PATH = "/.well-known/peac.txt";
-var UA = `PEAC/${VERSION} (+https://www.peacprotocol.org)`;
-async function discover(origin) {
+var DEFAULT_TIMEOUT_MS = 5e3;
+var DEFAULT_USER_AGENT = "peac-disc";
+async function discover(origin, options = {}) {
+  const fetchImpl = options.fetchImpl ?? globalThis.fetch;
+  if (typeof fetchImpl !== "function") {
+    return {
+      valid: false,
+      errors: [
+        "Discovery failed: no fetch implementation available (supply options.fetchImpl or provide a global fetch)"
+      ]
+    };
+  }
+  const envUa = typeof process !== "undefined" && typeof process.env === "object" ? process.env.PEAC_USER_AGENT : void 0;
+  const userAgent = options.userAgent ?? envUa ?? DEFAULT_USER_AGENT;
+  const maxBytes = options.maxBytes ?? MAX_BYTES;
+  const redirect = options.redirect ?? "error";
+  let localController;
+  let timer;
+  let signal = options.signal;
+  if (!signal) {
+    localController = new AbortController();
+    signal = localController.signal;
+    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    if (timeoutMs > 0 && Number.isFinite(timeoutMs)) {
+      timer = setTimeout(() => localController?.abort(), timeoutMs);
+    }
+  }
   try {
     const url = new URL(WELL_KNOWN_PATH, origin);
-    const response = await fetch(url.toString(), {
-      headers: { "User-Agent": UA }
+    const response = await fetchImpl(url.toString(), {
+      headers: { "User-Agent": userAgent },
+      signal,
+      redirect
     });
     if (!response.ok) {
       return {
@@ -177,6 +170,12 @@ async function discover(origin) {
       };
     }
     const content = await response.text();
+    if (content.length > maxBytes) {
+      return {
+        valid: false,
+        errors: [`peac.txt exceeds ${maxBytes} bytes (got ${content.length})`]
+      };
+    }
     const { parse: parse2 } = await Promise.resolve().then(() => (init_parser(), parser_exports));
     return parse2(content);
   } catch (error) {
@@ -184,12 +183,15 @@ async function discover(origin) {
       valid: false,
       errors: [`Discovery failed: ${error instanceof Error ? error.message : String(error)}`]
     };
+  } finally {
+    if (timer) clearTimeout(timer);
   }
 }
 
-exports.MAX_LINES = MAX_LINES2;
-exports.VERSION = VERSION;
+exports.DEFAULT_TIMEOUT_MS = DEFAULT_TIMEOUT_MS;
+exports.MAX_BYTES = MAX_BYTES;
 exports.WELL_KNOWN_PATH = WELL_KNOWN_PATH;
+exports.__resetLegacyWarningForTests = __resetLegacyWarningForTests;
 exports.discover = discover;
 exports.emit = emit;
 exports.parse = parse;

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/parser.ts","../src/index.ts"],"names":["MAX_LINES","parse"],"mappings":";;;;;;;;;;;;;AAAA,IAAA,cAAA,GAAA,EAAA;AAAA,QAAA,CAAA,cAAA,EAAA;AAAA,EAAA,IAAA,EAAA,MAAA,IAAA;AAAA,EAAA,KAAA,EAAA,MAAA,KAAA;AAAA,EAAA,QAAA,EAAA,MAAA;AAAA,CAAA,CAAA;AAkBO,SAAS,KAAA,CAAM,OAAA,EAAiB,OAAA,GAA6B,EAAC,EAAgB;AACnF,EAAA,MAAM,QAAA,GAAW,QAAQ,QAAA,IAAY,SAAA;AACrC,EAAA,MAAM,SAAmB,EAAC;AAC1B,EAAA,MAAM,OAAsB,EAAC;AAE7B,EAAA,MAAM,KAAA,GAAQ,QACX,KAAA,CAAM,IAAI,EACV,GAAA,CAAI,CAAC,MAAM,CAAA,CAAE,IAAA,EAAM,CAAA,CACnB,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,IAAK,CAAC,CAAA,CAAE,UAAA,CAAW,GAAG,CAAC,CAAA;AAGxC,EAAA,IAAI,KAAA,CAAM,SAAS,QAAA,EAAU;AAC3B,IAAA,OAAO;AAAA,MACL,KAAA,EAAO,KAAA;AAAA,MACP,QAAQ,CAAC,CAAA,qBAAA,EAAwB,MAAM,MAAM,CAAA,GAAA,EAAM,QAAQ,CAAA,CAAE,CAAA;AAAA,MAC7D,WAAW,KAAA,CAAM;AAAA,KACnB;AAAA,EACF;AAGA,EAAA,KAAA,MAAW,CAAC,KAAA,EAAO,IAAI,CAAA,IAAK,KAAA,CAAM,SAAQ,EAAG;AAC3C,IAAA,IAAI,OAAA,GAAU,KAAA;AAEd,IAAA,KAAA,MAAW,CAAC,KAAA,EAAO,OAAO,KAAK,MAAA,CAAO,OAAA,CAAQ,cAAc,CAAA,EAAG;AAC7D,MAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,CAAM,OAAO,CAAA;AAChC,MAAA,IAAI,KAAA,EAAO;AACT,QAAA,OAAA,GAAU,IAAA;AACV,QAAA,IAAI;AACF,UAAA,QAAQ,KAAA;AAAO,YACb,KAAK,aAAA;AAAA,YACL,KAAK,gBAAA;AAAA,YACL,KAAK,YAAA;AAAA,YACL,KAAK,QAAA;AACH,cAAA,IAAA,CAAK,KAAK,CAAA,GAAI,KAAA,CAAM,CAAC,EAAE,IAAA,EAAK;AAC5B,cAAA;AAAA,YACF,KAAK,UAAA;AACH,cAAA,IAAA,CAAK,QAAA,GAAW,MAAM,CAAC,CAAA;AACvB,cAAA;AAAA,YACF,KAAK,UAAA;AACH,cAAA,IAAA,CAAK,QAAA,GAAW,UAAA,CAAW,KAAA,CAAM,CAAC,CAAC,CAAA;AACnC,cAAA;AAAA,YACF,KAAK,aAAA;AACH,cAAA,IAAA,CAAK,WAAA,GAAc,eAAA,CAAgB,KAAA,CAAM,CAAC,CAAC,CAAA;AAC3C,cAAA;AAAA;AACJ,QACF,SAAS,KAAA,EAAO;AACd,UAAA,MAAA,CAAO,IAAA;AAAA,YACL,CAAA,KAAA,EAAQ,KAAA,GAAQ,CAAC,CAAA,EAAA,EAAK,KAAA,YAAiB,QAAQ,KAAA,CAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,WAC9E;AAAA,QACF;AACA,QAAA;AAAA,MACF;AAAA,IACF;AAEA,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,MAAA,CAAO,KAAK,CAAA,KAAA,EAAQ,KAAA,GAAQ,CAAC,CAAA,kBAAA,EAAqB,IAAI,CAAA,CAAE,CAAA;AAAA,IAC1D;AAAA,EACF;AAGA,EAAA,IAAI,CAAC,KAAK,MAAA,EAAQ;AAChB,IAAA,MAAA,CAAO,KAAK,gCAAgC,CAAA;AAAA,EAC9C;AAEA,EAAA,OAAO;AAAA,IACL,KAAA,EAAO,OAAO,MAAA,KAAW,CAAA;AAAA,IACzB,IAAA,EAAM,MAAA,CAAO,MAAA,KAAW,CAAA,GAAI,IAAA,GAAO,MAAA;AAAA,IACnC,MAAA,EAAQ,MAAA,CAAO,MAAA,GAAS,CAAA,GAAI,MAAA,GAAS,MAAA;AAAA,IACrC,WAAW,KAAA,CAAM;AAAA,GACnB;AACF;AAEA,SAAS,WAAW,OAAA,EAA2B;AAC7C,EAAA,OAAO,OAAA,CACJ,MAAM,GAAG,CAAA,CACT,IAAI,CAAC,IAAA,KAAS,KAAK,IAAA,EAAK,CAAE,QAAQ,cAAA,EAAgB,EAAE,CAAC,CAAA,CACrD,MAAA,CAAO,CAAC,IAAA,KAAS,IAAA,CAAK,SAAS,CAAC,CAAA;AACrC;AAEA,SAAS,gBAAgB,OAAA,EAAkC;AACzD,EAAA,MAAM,UAAA,GAAa,WAAW,OAAO,CAAA;AACrC,EAAA,MAAM,OAAwB,EAAC;AAE/B,EAAA,KAAA,MAAW,aAAa,UAAA,EAAY;AAClC,IAAA,MAAM,QAAA,GAAW,SAAA,CAAU,KAAA,CAAM,wBAAwB,CAAA;AACzD,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,2BAAA,EAA8B,SAAS,CAAA,CAAE,CAAA;AAAA,IAC3D;AAEA,IAAA,IAAA,CAAK,IAAA,CAAK;AAAA,MACR,GAAA,EAAK,SAAS,CAAC,CAAA;AAAA,MACf,GAAA,EAAK,SAAS,CAAC,CAAA;AAAA,MACf,GAAA,EAAK,SAAS,CAAC;AAAA,KAChB,CAAA;AAAA,EACH;AAEA,EAAA,OAAO,IAAA;AACT;AAKA,SAAS,oBAAA,CAAqB,OAAe,SAAA,EAAyB;AACpE,EAAA,IAAI,kBAAA,CAAmB,IAAA,CAAK,KAAK,CAAA,EAAG;AAClC,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,WAAW,SAAS,CAAA,4EAAA;AAAA,KACtB;AAAA,EACF;AACF;AAEO,SAAS,KAAK,IAAA,EAA6B;AAChD,EAAA,MAAM,QAAkB,EAAC;AAEzB,EAAA,IAAI,KAAK,WAAA,EAAa;AACpB,IAAA,KAAA,CAAM,IAAA,CAAK,CAAA,aAAA,EAAgB,IAAA,CAAK,WAAW,CAAA,CAAE,CAAA;AAAA,EAC/C;AAEA,EAAA,IAAI,KAAK,cAAA,EAAgB;AACvB,IAAA,KAAA,CAAM,IAAA,CAAK,CAAA,gBAAA,EAAmB,IAAA,CAAK,cAAc,CAAA,CAAE,CAAA;AAAA,EACrD;AAEA,EAAA,IAAI,IAAA,CAAK,QAAA,IAAY,IAAA,CAAK,QAAA,CAAS,SAAS,CAAA,EAAG;AAC7C,IAAA,IAAA,CAAK,SAAS,OAAA,CAAQ,CAAC,MAAM,oBAAA,CAAqB,CAAA,EAAG,SAAS,CAAC,CAAA;AAC/D,IAAA,MAAM,WAAA,GAAc,IAAA,CAAK,QAAA,CAAS,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAA,EAAI,CAAC,CAAA,CAAA,CAAG,CAAA,CAAE,IAAA,CAAK,IAAI,CAAA;AAChE,IAAA,KAAA,CAAM,IAAA,CAAK,CAAA,WAAA,EAAc,WAAW,CAAA,CAAA,CAAG,CAAA;AAAA,EACzC;AAEA,EAAA,IAAI,KAAK,UAAA,EAAY;AACnB,IAAA,KAAA,CAAM,IAAA,CAAK,CAAA,YAAA,EAAe,IAAA,CAAK,UAAU,CAAA,CAAE,CAAA;AAAA,EAC7C;AAEA,EAAA,IAAI,KAAK,QAAA,EAAU;AACjB,IAAA,KAAA,CAAM,IAAA,CAAK,CAAA,UAAA,EAAa,IAAA,CAAK,QAAQ,CAAA,CAAE,CAAA;AAAA,EACzC;AAEA,EAAA,IAAI,KAAK,MAAA,EAAQ;AACf,IAAA,KAAA,CAAM,IAAA,CAAK,CAAA,QAAA,EAAW,IAAA,CAAK,MAAM,CAAA,CAAE,CAAA;AAAA,EACrC;AAEA,EAAA,IAAI,IAAA,CAAK,WAAA,IAAe,IAAA,CAAK,WAAA,CAAY,SAAS,CAAA,EAAG;AACnD,IAAA,IAAA,CAAK,WAAA,CAAY,OAAA,CAAQ,CAAC,CAAA,KAAM;AAC9B,MAAA,oBAAA,CAAqB,CAAA,CAAE,KAAK,KAAK,CAAA;AACjC,MAAA,oBAAA,CAAqB,CAAA,CAAE,KAAK,KAAK,CAAA;AACjC,MAAA,oBAAA,CAAqB,CAAA,CAAE,KAAK,KAAK,CAAA;AAAA,IACnC,CAAC,CAAA;AACD,IAAA,MAAM,UAAU,IAAA,CAAK,WAAA,CAAY,IAAI,CAAC,CAAA,KAAM,IAAI,CAAA,CAAE,GAAG,CAAA,CAAA,EAAI,CAAA,CAAE,GAAG,CAAA,CAAA,EAAI,CAAA,CAAE,GAAG,CAAA,CAAA,CAAG,CAAA,CAAE,KAAK,IAAI,CAAA;AACrF,IAAA,KAAA,CAAM,IAAA,CAAK,CAAA,cAAA,EAAiB,OAAO,CAAA,CAAA,CAAG,CAAA;AAAA,EACxC;AAGA,EAAA,IAAI,KAAA,CAAM,SAAS,SAAA,EAAW;AAC5B,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,2BAAA,EAA8B,SAAS,CAAA,QAAA,EAAW,KAAA,CAAM,MAAM,CAAA,CAAE,CAAA;AAAA,EAClF;AAEA,EAAA,OAAO,KAAA,CAAM,KAAK,IAAI,CAAA;AACxB;AAEO,SAAS,SAAS,OAAA,EAA0B;AACjD,EAAA,MAAM,MAAA,GAAS,MAAM,OAAO,CAAA;AAC5B,EAAA,OAAO,MAAA,CAAO,KAAA;AAChB;AAlLA,IAOM,WACA,cAAA,EA8GA,kBAAA;AAtHN,IAAA,WAAA,GAAA,KAAA,CAAA;AAAA,EAAA,eAAA,GAAA;AAOA,IAAM,SAAA,GAAY,EAAA;AAClB,IAAM,cAAA,GAAiB;AAAA,MACrB,WAAA,EAAa,uBAAA;AAAA,MACb,cAAA,EAAgB,0BAAA;AAAA,MAChB,QAAA,EAAU,4BAAA;AAAA,MACV,UAAA,EAAY,sBAAA;AAAA,MACZ,QAAA,EAAU,mCAAA;AAAA,MACV,MAAA,EAAQ,kBAAA;AAAA,MACR,WAAA,EAAa;AAAA,KACf;AAsGA,IAAM,kBAAA,GAAqB,sBAAA;AAAA,EAAA;AAAA,CAAA,CAAA;;;ACjH3B,WAAA,EAAA;AAIO,IAAM,OAAA,GAAU;AAChB,IAAMA,UAAAA,GAAY;AAClB,IAAM,eAAA,GAAkB;AAE/B,IAAM,EAAA,GAAK,QAAQ,OAAO,CAAA,gCAAA,CAAA;AAG1B,eAAsB,SAAS,MAAA,EAA2D;AACxF,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,eAAA,EAAiB,MAAM,CAAA;AAC3C,IAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,GAAA,CAAI,UAAS,EAAG;AAAA,MAC3C,OAAA,EAAS,EAAE,YAAA,EAAc,EAAA;AAAG,KAC7B,CAAA;AAED,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,OAAO;AAAA,QACL,KAAA,EAAO,KAAA;AAAA,QACP,MAAA,EAAQ,CAAC,CAAA,KAAA,EAAQ,QAAA,CAAS,MAAM,CAAA,EAAA,EAAK,QAAA,CAAS,UAAU,CAAA,CAAE;AAAA,OAC5D;AAAA,IACF;AAEA,IAAA,MAAM,OAAA,GAAU,MAAM,QAAA,CAAS,IAAA,EAAK;AACpC,IAAA,MAAM,EAAE,KAAA,EAAAC,MAAAA,EAAM,GAAI,MAAM,OAAA,CAAA,OAAA,EAAA,CAAA,IAAA,CAAA,OAAA,WAAA,EAAA,EAAA,cAAA,CAAA,CAAA;AACxB,IAAA,OAAOA,OAAM,OAAO,CAAA;AAAA,EACtB,SAAS,KAAA,EAAO;AACd,IAAA,OAAO;AAAA,MACL,KAAA,EAAO,KAAA;AAAA,MACP,MAAA,EAAQ,CAAC,CAAA,kBAAA,EAAqB,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA,CAAE;AAAA,KACxF;AAAA,EACF;AACF","file":"index.cjs","sourcesContent":["/**\n * @peac/disc/parser - peac.txt parser with ≤20 lines enforcement\n * ABNF-compliant discovery document parsing\n */\n\nimport type { PeacDiscovery, ParseResult, PublicKeyInfo, ValidationOptions } from './types.js';\n\nconst MAX_LINES = 20;\nconst FIELD_PATTERNS = {\n  preferences: /^preferences:\\s*(.+)$/,\n  access_control: /^access_control:\\s*(.+)$/,\n  payments: /^payments:\\s*\\[([^\\]]+)\\]$/,\n  provenance: /^provenance:\\s*(.+)$/,\n  receipts: /^receipts:\\s*(required|optional)$/,\n  verify: /^verify:\\s*(.+)$/,\n  public_keys: /^public_keys:\\s*\\[([^\\]]+)\\]$/,\n};\n\nexport function parse(content: string, options: ValidationOptions = {}): ParseResult {\n  const maxLines = options.maxLines ?? MAX_LINES;\n  const errors: string[] = [];\n  const data: PeacDiscovery = {};\n\n  const lines = content\n    .split('\\n')\n    .map((l) => l.trim())\n    .filter((l) => l && !l.startsWith('#'));\n\n  // Enforce line limit\n  if (lines.length > maxLines) {\n    return {\n      valid: false,\n      errors: [`Line limit exceeded: ${lines.length} > ${maxLines}`],\n      lineCount: lines.length,\n    };\n  }\n\n  // Parse each line\n  for (const [index, line] of lines.entries()) {\n    let matched = false;\n\n    for (const [field, pattern] of Object.entries(FIELD_PATTERNS)) {\n      const match = line.match(pattern);\n      if (match) {\n        matched = true;\n        try {\n          switch (field) {\n            case 'preferences':\n            case 'access_control':\n            case 'provenance':\n            case 'verify':\n              data[field] = match[1].trim();\n              break;\n            case 'receipts':\n              data.receipts = match[1] as 'required' | 'optional';\n              break;\n            case 'payments':\n              data.payments = parseArray(match[1]);\n              break;\n            case 'public_keys':\n              data.public_keys = parsePublicKeys(match[1]);\n              break;\n          }\n        } catch (error) {\n          errors.push(\n            `Line ${index + 1}: ${error instanceof Error ? error.message : String(error)}`\n          );\n        }\n        break;\n      }\n    }\n\n    if (!matched) {\n      errors.push(`Line ${index + 1}: Invalid format: ${line}`);\n    }\n  }\n\n  // Validate required fields\n  if (!data.verify) {\n    errors.push('Missing required field: verify');\n  }\n\n  return {\n    valid: errors.length === 0,\n    data: errors.length === 0 ? data : undefined,\n    errors: errors.length > 0 ? errors : undefined,\n    lineCount: lines.length,\n  };\n}\n\nfunction parseArray(content: string): string[] {\n  return content\n    .split(',')\n    .map((item) => item.trim().replace(/^[\"']|[\"']$/g, ''))\n    .filter((item) => item.length > 0);\n}\n\nfunction parsePublicKeys(content: string): PublicKeyInfo[] {\n  const keyStrings = parseArray(content);\n  const keys: PublicKeyInfo[] = [];\n\n  for (const keyString of keyStrings) {\n    const keyMatch = keyString.match(/^([^:]+):([^:]+):(.+)$/);\n    if (!keyMatch) {\n      throw new Error(`Invalid public key format: ${keyString}`);\n    }\n\n    keys.push({\n      kid: keyMatch[1],\n      alg: keyMatch[2],\n      key: keyMatch[3],\n    });\n  }\n\n  return keys;\n}\n\n/** Characters that break peac.txt wire format: quotes, colons, brackets, control chars */\nconst UNSAFE_FIELD_CHARS = /[\"\\n\\r\\x00-\\x1f:[\\]]/;\n\nfunction assertSafeFieldValue(value: string, fieldName: string): void {\n  if (UNSAFE_FIELD_CHARS.test(value)) {\n    throw new Error(\n      `Invalid ${fieldName}: must not contain quotes, colons, brackets, newlines, or control characters`\n    );\n  }\n}\n\nexport function emit(data: PeacDiscovery): string {\n  const lines: string[] = [];\n\n  if (data.preferences) {\n    lines.push(`preferences: ${data.preferences}`);\n  }\n\n  if (data.access_control) {\n    lines.push(`access_control: ${data.access_control}`);\n  }\n\n  if (data.payments && data.payments.length > 0) {\n    data.payments.forEach((p) => assertSafeFieldValue(p, 'payment'));\n    const paymentsStr = data.payments.map((p) => `\"${p}\"`).join(', ');\n    lines.push(`payments: [${paymentsStr}]`);\n  }\n\n  if (data.provenance) {\n    lines.push(`provenance: ${data.provenance}`);\n  }\n\n  if (data.receipts) {\n    lines.push(`receipts: ${data.receipts}`);\n  }\n\n  if (data.verify) {\n    lines.push(`verify: ${data.verify}`);\n  }\n\n  if (data.public_keys && data.public_keys.length > 0) {\n    data.public_keys.forEach((k) => {\n      assertSafeFieldValue(k.kid, 'kid');\n      assertSafeFieldValue(k.alg, 'alg');\n      assertSafeFieldValue(k.key, 'key');\n    });\n    const keysStr = data.public_keys.map((k) => `\"${k.kid}:${k.alg}:${k.key}\"`).join(', ');\n    lines.push(`public_keys: [${keysStr}]`);\n  }\n\n  // Enforce line limit during emission\n  if (lines.length > MAX_LINES) {\n    throw new Error(`Generated peac.txt exceeds ${MAX_LINES} lines: ${lines.length}`);\n  }\n\n  return lines.join('\\n');\n}\n\nexport function validate(content: string): boolean {\n  const result = parse(content);\n  return result.valid;\n}\n","/**\n * @peac/disc - PEAC discovery with ≤20 lines enforcement\n * ABNF-compliant .well-known/peac.txt parser and generator\n */\n\nexport { parse, emit, validate } from './parser.js';\nexport type { PeacDiscovery, PublicKeyInfo, ParseResult, ValidationOptions } from './types.js';\n\n// Constants\nexport const VERSION = '0.9.15';\nexport const MAX_LINES = 20;\nexport const WELL_KNOWN_PATH = '/.well-known/peac.txt';\n\nconst UA = `PEAC/${VERSION} (+https://www.peacprotocol.org)`;\n\n// Convenience function for fetching and parsing discovery documents\nexport async function discover(origin: string): Promise<import('./types.js').ParseResult> {\n  try {\n    const url = new URL(WELL_KNOWN_PATH, origin);\n    const response = await fetch(url.toString(), {\n      headers: { 'User-Agent': UA },\n    });\n\n    if (!response.ok) {\n      return {\n        valid: false,\n        errors: [`HTTP ${response.status}: ${response.statusText}`],\n      };\n    }\n\n    const content = await response.text();\n    const { parse } = await import('./parser.js');\n    return parse(content);\n  } catch (error) {\n    return {\n      valid: false,\n      errors: [`Discovery failed: ${error instanceof Error ? error.message : String(error)}`],\n    };\n  }\n}\n"]}
+{"version":3,"sources":["../src/parser.ts","../src/index.ts"],"names":["parsePolicyDocument","PolicyValidationError","PolicyLoadError","serializePolicyYaml","parse"],"mappings":";;;;;;;;;;;;;;;AAAA,IAAA,cAAA,GAAA,EAAA;AAAA,QAAA,CAAA,cAAA,EAAA;AAAA,EAAA,4BAAA,EAAA,MAAA,4BAAA;AAAA,EAAA,IAAA,EAAA,MAAA,IAAA;AAAA,EAAA,KAAA,EAAA,MAAA,KAAA;AAAA,EAAA,QAAA,EAAA,MAAA;AAAA,CAAA,CAAA;AAqCA,SAAS,kBAAkB,KAAA,EAAqB;AAC9C,EAAA,IAAI,kBAAA,EAAoB;AACxB,EAAA,kBAAA,GAAqB,IAAA;AACrB,EAAA,IAAI,OAAO,OAAA,KAAY,WAAA,IAAe,OAAO,OAAA,CAAQ,gBAAgB,UAAA,EAAY;AAC/E,IAAA,OAAA,CAAQ,WAAA;AAAA,MACN,wCAAwC,KAAK,CAAA,0KAAA,CAAA;AAAA,MAG7C,EAAE,IAAA,EAAM,gCAAA,EAAkC,IAAA,EAAM,oBAAA;AAAqB,KACvE;AAAA,EACF;AACF;AAMO,SAAS,4BAAA,GAAqC;AACnD,EAAA,kBAAA,GAAqB,KAAA;AACvB;AAEA,SAAS,sBAAsB,IAAA,EAAiE;AAC9F,EAAA,MAAM,WAAqB,EAAC;AAC5B,EAAA,IAAI,UAAA,GAA4B,IAAA;AAChC,EAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,CAAM,OAAO,CAAA;AAChC,EAAA,KAAA,CAAM,OAAA,CAAQ,CAAC,IAAA,EAAM,GAAA,KAAQ;AAC3B,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,CAAM,mCAAmC,CAAA;AAC5D,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,IAAI,UAAA,KAAe,IAAA,EAAM,UAAA,GAAa,KAAA,CAAM,CAAC,CAAA;AAC7C,MAAA,QAAA,CAAS,IAAA;AAAA,QACP,QAAQ,GAAA,GAAM,CAAC,CAAA,8BAAA,EAAiC,KAAA,CAAM,CAAC,CAAC,CAAA,kEAAA;AAAA,OAE1D;AAAA,IACF;AAAA,EACF,CAAC,CAAA;AACD,EAAA,OAAO,EAAE,UAAU,UAAA,EAAW;AAChC;AAiBO,SAAS,MAAM,IAAA,EAA2B;AAC/C,EAAA,MAAM,WAAqB,EAAC;AAE5B,EAAA,IAAI,IAAA,CAAK,IAAA,EAAK,CAAE,MAAA,KAAW,CAAA,EAAG;AAC5B,IAAA,OAAO;AAAA,MACL,KAAA,EAAO,KAAA;AAAA,MACP,MAAA,EAAQ,CAAC,+DAA+D;AAAA,KAC1E;AAAA,EACF;AAEA,EAAA,MAAM,cAAA,GAAiB,eAAA,CAAgB,IAAA,CAAK,IAAI,CAAA;AAKhD,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,GAAOA,8BAAoB,IAAI,CAAA;AACrC,IAAA,IAAI,cAAA,EAAgB;AAClB,MAAA,MAAM,MAAA,GAAS,sBAAsB,IAAI,CAAA;AACzC,MAAA,QAAA,CAAS,IAAA,CAAK,GAAG,MAAA,CAAO,QAAQ,CAAA;AAChC,MAAA,IAAI,MAAA,CAAO,UAAA,EAAY,iBAAA,CAAkB,MAAA,CAAO,UAAU,CAAA;AAAA,IAC5D;AACA,IAAA,OAAO;AAAA,MACL,KAAA,EAAO,IAAA;AAAA,MACP,IAAA;AAAA,MACA,QAAA,EAAU,QAAA,CAAS,MAAA,GAAS,CAAA,GAAI,QAAA,GAAW,KAAA;AAAA,KAC7C;AAAA,EACF,SAAS,QAAA,EAAU;AACjB,IAAA,IAAI,CAAC,cAAA,EAAgB;AACnB,MAAA,OAAO,OAAA,CAAQ,UAAU,QAAQ,CAAA;AAAA,IACnC;AAEA,IAAA,MAAM,MAAA,GAAS,sBAAsB,IAAI,CAAA;AACzC,IAAA,QAAA,CAAS,IAAA,CAAK,GAAG,MAAA,CAAO,QAAQ,CAAA;AAChC,IAAA,IAAI,MAAA,CAAO,UAAA,EAAY,iBAAA,CAAkB,MAAA,CAAO,UAAU,CAAA;AAE1D,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,2BAAA,EAA6B,EAAE,CAAA;AAC7D,IAAA,IAAI,QAAA,CAAS,IAAA,EAAK,CAAE,MAAA,KAAW,CAAA,EAAG;AAChC,MAAA,OAAO;AAAA,QACL,KAAA,EAAO,KAAA;AAAA,QACP,MAAA,EAAQ,CAAC,mEAAmE,CAAA;AAAA,QAC5E,QAAA,EAAU,QAAA,CAAS,MAAA,GAAS,CAAA,GAAI,QAAA,GAAW;AAAA,OAC7C;AAAA,IACF;AACA,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,GAAOA,8BAAoB,QAAQ,CAAA;AACzC,MAAA,OAAO;AAAA,QACL,KAAA,EAAO,IAAA;AAAA,QACP,IAAA;AAAA,QACA,QAAA,EAAU,QAAA,CAAS,MAAA,GAAS,CAAA,GAAI,QAAA,GAAW,KAAA;AAAA,OAC7C;AAAA,IACF,SAAS,QAAA,EAAU;AACjB,MAAA,OAAO,OAAA,CAAQ,UAAU,QAAQ,CAAA;AAAA,IACnC;AAAA,EACF;AACF;AAEA,SAAS,OAAA,CAAQ,KAAc,QAAA,EAAiC;AAC9D,EAAA,IAAI,GAAA,YAAeC,+BAAA,IAAyB,GAAA,YAAeC,yBAAA,EAAiB;AAC1E,IAAA,OAAO;AAAA,MACL,KAAA,EAAO,KAAA;AAAA,MACP,MAAA,EAAQ,CAAC,GAAA,CAAI,OAAO,CAAA;AAAA,MACpB,QAAA,EAAU,QAAA,CAAS,MAAA,GAAS,CAAA,GAAI,QAAA,GAAW;AAAA,KAC7C;AAAA,EACF;AACA,EAAA,OAAO;AAAA,IACL,KAAA,EAAO,KAAA;AAAA,IACP,MAAA,EAAQ,CAAC,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA,IACzD,QAAA,EAAU,QAAA,CAAS,MAAA,GAAS,CAAA,GAAI,QAAA,GAAW;AAAA,GAC7C;AACF;AAOO,SAAS,KAAK,GAAA,EAA6B;AAChD,EAAA,OAAOC,8BAAoB,GAAG,CAAA;AAChC;AAMO,SAAS,SAAS,IAAA,EAAuB;AAC9C,EAAA,OAAO,KAAA,CAAM,IAAI,CAAA,CAAE,KAAA;AACrB;AAjLA,IA+BM,iBAEA,2BAAA,EAEF,kBAAA;AAnCJ,IAAA,WAAA,GAAA,KAAA,CAAA;AAAA,EAAA,eAAA,GAAA;AA+BA,IAAM,eAAA,GAAkB,oCAAA;AAExB,IAAM,2BAAA,GAA8B,6CAAA;AAEpC,IAAI,kBAAA,GAAqB,KAAA;AAAA,EAAA;AAAA,CAAA,CAAA;;;ACfzB,WAAA,EAAA;AAWO,IAAM,SAAA,GAAY;AAClB,IAAM,eAAA,GAAkB;AACxB,IAAM,kBAAA,GAAqB;AAClC,IAAM,kBAAA,GAAqB,WAAA;AAuD3B,eAAsB,QAAA,CACpB,MAAA,EACA,OAAA,GAA2B,EAAC,EACe;AAC3C,EAAA,MAAM,SAAA,GAAa,OAAA,CAAQ,SAAA,IAAc,UAAA,CAAyC,KAAA;AAGlF,EAAA,IAAI,OAAO,cAAc,UAAA,EAAY;AACnC,IAAA,OAAO;AAAA,MACL,KAAA,EAAO,KAAA;AAAA,MACP,MAAA,EAAQ;AAAA,QACN;AAAA;AACF,KACF;AAAA,EACF;AAEA,EAAA,MAAM,KAAA,GACJ,OAAO,OAAA,KAAY,WAAA,IAAe,OAAO,QAAQ,GAAA,KAAQ,QAAA,GACrD,OAAA,CAAQ,GAAA,CAAI,eAAA,GACZ,MAAA;AACN,EAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,SAAA,IAAa,KAAA,IAAS,kBAAA;AAChD,EAAA,MAAM,QAAA,GAAW,QAAQ,QAAA,IAAY,SAAA;AACrC,EAAA,MAAM,QAAA,GAAW,QAAQ,QAAA,IAAY,OAAA;AAGrC,EAAA,IAAI,eAAA;AACJ,EAAA,IAAI,KAAA;AACJ,EAAA,IAAI,SAAS,OAAA,CAAQ,MAAA;AACrB,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,eAAA,GAAkB,IAAI,eAAA,EAAgB;AACtC,IAAA,MAAA,GAAS,eAAA,CAAgB,MAAA;AACzB,IAAA,MAAM,SAAA,GAAY,QAAQ,SAAA,IAAa,kBAAA;AACvC,IAAA,IAAI,SAAA,GAAY,CAAA,IAAK,MAAA,CAAO,QAAA,CAAS,SAAS,CAAA,EAAG;AAC/C,MAAA,KAAA,GAAQ,UAAA,CAAW,MAAM,eAAA,EAAiB,KAAA,IAAS,SAAS,CAAA;AAAA,IAC9D;AAAA,EACF;AAEA,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,eAAA,EAAiB,MAAM,CAAA;AAC3C,IAAA,MAAM,QAAA,GAAW,MAAM,SAAA,CAAU,GAAA,CAAI,UAAS,EAAG;AAAA,MAC/C,OAAA,EAAS,EAAE,YAAA,EAAc,SAAA,EAAU;AAAA,MACnC,MAAA;AAAA,MACA;AAAA,KACD,CAAA;AAED,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,OAAO;AAAA,QACL,KAAA,EAAO,KAAA;AAAA,QACP,MAAA,EAAQ,CAAC,CAAA,KAAA,EAAQ,QAAA,CAAS,MAAM,CAAA,EAAA,EAAK,QAAA,CAAS,UAAU,CAAA,CAAE;AAAA,OAC5D;AAAA,IACF;AAEA,IAAA,MAAM,OAAA,GAAU,MAAM,QAAA,CAAS,IAAA,EAAK;AACpC,IAAA,IAAI,OAAA,CAAQ,SAAS,QAAA,EAAU;AAC7B,MAAA,OAAO;AAAA,QACL,KAAA,EAAO,KAAA;AAAA,QACP,QAAQ,CAAC,CAAA,iBAAA,EAAoB,QAAQ,CAAA,YAAA,EAAe,OAAA,CAAQ,MAAM,CAAA,CAAA,CAAG;AAAA,OACvE;AAAA,IACF;AACA,IAAA,MAAM,EAAE,KAAA,EAAAC,MAAAA,EAAM,GAAI,MAAM,OAAA,CAAA,OAAA,EAAA,CAAA,IAAA,CAAA,OAAA,WAAA,EAAA,EAAA,cAAA,CAAA,CAAA;AACxB,IAAA,OAAOA,OAAM,OAAO,CAAA;AAAA,EACtB,SAAS,KAAA,EAAO;AACd,IAAA,OAAO;AAAA,MACL,KAAA,EAAO,KAAA;AAAA,MACP,MAAA,EAAQ,CAAC,CAAA,kBAAA,EAAqB,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA,CAAE;AAAA,KACxF;AAAA,EACF,CAAA,SAAE;AACA,IAAA,IAAI,KAAA,eAAoB,KAAK,CAAA;AAAA,EAC/B;AACF","file":"index.cjs","sourcesContent":["/**\n * @peac/disc/parser - thin peac.txt policy-document loader/validator.\n *\n * peac.txt is a POLICY DOCUMENT surface per docs/specs/PEAC-TXT.md.\n * Full parsing is delegated to `@peac/policy-kit.parsePolicyDocument`;\n * this module only provides:\n *\n *   - format detection (YAML vs JSON) per PEAC-TXT.md §5.1\n *   - a tolerant `parse()` wrapper that returns a structured `ParseResult`\n *     (rather than throwing)\n *   - structured warnings for legacy key-discovery lines (`verify`,\n *     `public_keys`, `jwks`) that appeared in pre-v0.12.14 peac.txt\n *     examples. Those lines are NEVER honored here: key discovery flows\n *     through `iss` -> /.well-known/peac-issuer.json -> `jwks_uri` -> JWKS\n *     (docs/specs/PEAC-ISSUER.md).\n *   - a tiny `emit()` helper that serializes a `PolicyDocument` via\n *     `@peac/policy-kit.serializePolicyYaml`\n *\n * @see docs/specs/PEAC-TXT.md\n * @see docs/specs/PEAC-ISSUER.md\n */\n\nimport {\n  PolicyLoadError,\n  PolicyValidationError,\n  parsePolicyDocument,\n  serializePolicyYaml,\n  type PolicyDocument,\n} from '@peac/policy-kit';\nimport type { ParseResult } from './types.js';\n\nconst LEGACY_KEY_LINE = /^\\s*(verify|public_keys|jwks)\\s*:/m;\n/** Strips the whole line (including the trailing newline) when matched. */\nconst LEGACY_KEY_FULL_LINE_GLOBAL = /^\\s*(verify|public_keys|jwks)\\s*:.*\\r?\\n?/gm;\n\nlet legacyWarningFired = false;\n\nfunction fireLegacyWarning(field: string): void {\n  if (legacyWarningFired) return;\n  legacyWarningFired = true;\n  if (typeof process !== 'undefined' && typeof process.emitWarning === 'function') {\n    process.emitWarning(\n      `peac.txt legacy key-discovery field \"${field}\" is deprecated and ignored. ` +\n        `peac.txt is a policy-document surface (docs/specs/PEAC-TXT.md). ` +\n        `Key resolution uses iss -> /.well-known/peac-issuer.json -> jwks_uri -> JWKS.`,\n      { code: 'PEAC_LEGACY_PEAC_TXT_KEY_FIELD', type: 'DeprecationWarning' }\n    );\n  }\n}\n\n/**\n * Reset the one-shot legacy-warning flag. Exposed for tests that need to\n * observe the warning more than once per process.\n */\nexport function __resetLegacyWarningForTests(): void {\n  legacyWarningFired = false;\n}\n\nfunction collectLegacyWarnings(text: string): { warnings: string[]; firstField: string | null } {\n  const warnings: string[] = [];\n  let firstField: string | null = null;\n  const lines = text.split(/\\r?\\n/);\n  lines.forEach((line, idx) => {\n    const match = line.match(/^\\s*(verify|public_keys|jwks)\\s*:/);\n    if (match) {\n      if (firstField === null) firstField = match[1];\n      warnings.push(\n        `Line ${idx + 1}: legacy key-discovery field \"${match[1]}\" ignored ` +\n          `(peac.txt is policy-only; use peac-issuer.json for keys)`\n      );\n    }\n  });\n  return { warnings, firstField };\n}\n\n/**\n * Parse a peac.txt policy document. Accepts YAML or JSON per\n * `docs/specs/PEAC-TXT.md` §5.1. On success, `data` is the validated\n * `peac-policy/0.1` `PolicyDocument`.\n *\n * Legacy key-discovery lines (`verify:`, `public_keys:`, `jwks:`) are\n * tolerated via a two-pass strategy: first the raw bytes are handed to\n * `parsePolicyDocument`; if validation fails AND top-level legacy lines\n * are present, the legacy lines are stripped and parsing is retried\n * once. Detected legacy lines are listed in `warnings` and surface a\n * structured `PEAC_LEGACY_PEAC_TXT_KEY_FIELD` `DeprecationWarning` once\n * per process. They never populate the parsed result. This preserves\n * the original bytes when a policy document happens to mention those\n * tokens inside comments, block scalars, or rule text.\n */\nexport function parse(text: string): ParseResult {\n  const warnings: string[] = [];\n\n  if (text.trim().length === 0) {\n    return {\n      valid: false,\n      errors: ['Empty policy document. Expected peac-policy/0.1 YAML or JSON.'],\n    };\n  }\n\n  const hasLegacyLines = LEGACY_KEY_LINE.test(text);\n\n  // First pass: try the raw bytes. If they parse cleanly, legacy-looking\n  // substrings inside block scalars / comments / rule text are not\n  // mutated.\n  try {\n    const data = parsePolicyDocument(text);\n    if (hasLegacyLines) {\n      const legacy = collectLegacyWarnings(text);\n      warnings.push(...legacy.warnings);\n      if (legacy.firstField) fireLegacyWarning(legacy.firstField);\n    }\n    return {\n      valid: true,\n      data,\n      warnings: warnings.length > 0 ? warnings : undefined,\n    };\n  } catch (firstErr) {\n    if (!hasLegacyLines) {\n      return failure(firstErr, warnings);\n    }\n    // Second pass: strip top-level legacy key-discovery lines and retry.\n    const legacy = collectLegacyWarnings(text);\n    warnings.push(...legacy.warnings);\n    if (legacy.firstField) fireLegacyWarning(legacy.firstField);\n\n    const stripped = text.replace(LEGACY_KEY_FULL_LINE_GLOBAL, '');\n    if (stripped.trim().length === 0) {\n      return {\n        valid: false,\n        errors: ['Empty policy document after stripping legacy key-discovery lines.'],\n        warnings: warnings.length > 0 ? warnings : undefined,\n      };\n    }\n    try {\n      const data = parsePolicyDocument(stripped);\n      return {\n        valid: true,\n        data,\n        warnings: warnings.length > 0 ? warnings : undefined,\n      };\n    } catch (retryErr) {\n      return failure(retryErr, warnings);\n    }\n  }\n}\n\nfunction failure(err: unknown, warnings: string[]): ParseResult {\n  if (err instanceof PolicyValidationError || err instanceof PolicyLoadError) {\n    return {\n      valid: false,\n      errors: [err.message],\n      warnings: warnings.length > 0 ? warnings : undefined,\n    };\n  }\n  return {\n    valid: false,\n    errors: [err instanceof Error ? err.message : String(err)],\n    warnings: warnings.length > 0 ? warnings : undefined,\n  };\n}\n\n/**\n * Serialize a `peac-policy/0.1` `PolicyDocument` as YAML suitable for\n * serving at `/.well-known/peac.txt`. Delegates to\n * `@peac/policy-kit.serializePolicyYaml`.\n */\nexport function emit(doc: PolicyDocument): string {\n  return serializePolicyYaml(doc);\n}\n\n/**\n * Convenience predicate: returns `true` iff `text` parses as a valid\n * `peac-policy/0.1` document.\n */\nexport function validate(text: string): boolean {\n  return parse(text).valid;\n}\n","/**\n * @peac/disc - thin peac.txt policy-document loader/validator and remote fetcher.\n *\n * peac.txt is a POLICY DOCUMENT surface per docs/specs/PEAC-TXT.md. Full\n * parsing is delegated to `@peac/policy-kit.parsePolicyDocument`; this\n * package provides a tolerant `parse()` wrapper, a `discover()` remote\n * fetcher, and structured warnings for legacy key-discovery lines that\n * appeared in older peac.txt examples.\n *\n * `peac.txt` is NOT a key discovery surface. Cryptographic key resolution\n * flows through `iss` -> /.well-known/peac-issuer.json -> `jwks_uri` -> JWKS\n * (docs/specs/PEAC-ISSUER.md). Callers that need key material MUST use\n * `parseIssuerConfig` / `fetchIssuerConfig` from `@peac/protocol`.\n *\n * Legacy key-discovery lines (`verify:`, `public_keys:`, `jwks:`) are\n * tolerated on parse: they are stripped before validation, surfaced on\n * `ParseResult.warnings`, and fire a structured `process.emitWarning`\n * with code `PEAC_LEGACY_PEAC_TXT_KEY_FIELD` once per process.\n */\n\nexport { parse, emit, validate, __resetLegacyWarningForTests } from './parser.js';\nexport type { ParseResult, ValidationOptions, PolicyDocument } from './types.js';\n\n/**\n * @deprecated Retained for one minor to keep existing import paths\n * compiling. peac.txt policy documents now resolve to a `PolicyDocument`\n * (re-exported from `@peac/policy-kit`). Removal target: next cleanup\n * release.\n */\nexport type { PeacDiscovery, PublicKeyInfo } from './types.js';\n\nexport const MAX_BYTES = 262144; // 256 KiB, per docs/specs/PEAC-TXT.md §6.1\nexport const WELL_KNOWN_PATH = '/.well-known/peac.txt';\nexport const DEFAULT_TIMEOUT_MS = 5000;\nconst DEFAULT_USER_AGENT = 'peac-disc';\n\n/**\n * Minimal fetch signature accepted by `discover`. `undici` / `node-fetch` /\n * browser / test-double implementations all satisfy this.\n */\nexport type DiscoverFetch = (\n  input: string,\n  init?: {\n    headers?: Record<string, string>;\n    signal?: AbortSignal;\n    redirect?: 'follow' | 'error' | 'manual';\n  }\n) => Promise<{\n  ok: boolean;\n  status: number;\n  statusText: string;\n  text(): Promise<string>;\n}>;\n\nexport interface DiscoverOptions {\n  /**\n   * HTTP fetch implementation. Defaults to the ambient `fetch` global.\n   * Supply `undici.fetch`, a test double, or a policy-wrapping client as\n   * needed.\n   */\n  fetchImpl?: DiscoverFetch;\n  /**\n   * User-agent string. Precedence (highest first): this option, the\n   * `PEAC_USER_AGENT` environment variable, then `peac-disc`.\n   */\n  userAgent?: string;\n  /** Caller-supplied abort signal. */\n  signal?: AbortSignal;\n  /**\n   * Millisecond timeout. Ignored when `signal` is supplied (the caller\n   * owns cancellation). Defaults to 5_000 when neither is provided.\n   */\n  timeoutMs?: number;\n  /** Override the 256 KiB body cap from docs/specs/PEAC-TXT.md §6.1. */\n  maxBytes?: number;\n  /**\n   * Redirect policy. Defaults to `error` to avoid cross-origin surprise\n   * on a well-known discovery endpoint; set to `follow` explicitly if the\n   * deployment relies on server-side redirects.\n   */\n  redirect?: 'follow' | 'error' | 'manual';\n}\n\n/**\n * Fetch and parse a remote peac.txt policy document. On success returns a\n * `ParseResult` whose `data` is the validated `peac-policy/0.1`\n * `PolicyDocument`. Legacy key-discovery lines in the fetched bytes are\n * surfaced as warnings but never populate `data`.\n */\nexport async function discover(\n  origin: string,\n  options: DiscoverOptions = {}\n): Promise<import('./types.js').ParseResult> {\n  const fetchImpl = (options.fetchImpl ?? (globalThis as { fetch?: DiscoverFetch }).fetch) as\n    | DiscoverFetch\n    | undefined;\n  if (typeof fetchImpl !== 'function') {\n    return {\n      valid: false,\n      errors: [\n        'Discovery failed: no fetch implementation available (supply options.fetchImpl or provide a global fetch)',\n      ],\n    };\n  }\n\n  const envUa =\n    typeof process !== 'undefined' && typeof process.env === 'object'\n      ? process.env.PEAC_USER_AGENT\n      : undefined;\n  const userAgent = options.userAgent ?? envUa ?? DEFAULT_USER_AGENT;\n  const maxBytes = options.maxBytes ?? MAX_BYTES;\n  const redirect = options.redirect ?? 'error';\n\n  // If the caller did not supply an AbortSignal, install a local one driven by timeoutMs.\n  let localController: AbortController | undefined;\n  let timer: ReturnType<typeof setTimeout> | undefined;\n  let signal = options.signal;\n  if (!signal) {\n    localController = new AbortController();\n    signal = localController.signal;\n    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;\n    if (timeoutMs > 0 && Number.isFinite(timeoutMs)) {\n      timer = setTimeout(() => localController?.abort(), timeoutMs);\n    }\n  }\n\n  try {\n    const url = new URL(WELL_KNOWN_PATH, origin);\n    const response = await fetchImpl(url.toString(), {\n      headers: { 'User-Agent': userAgent },\n      signal,\n      redirect,\n    });\n\n    if (!response.ok) {\n      return {\n        valid: false,\n        errors: [`HTTP ${response.status}: ${response.statusText}`],\n      };\n    }\n\n    const content = await response.text();\n    if (content.length > maxBytes) {\n      return {\n        valid: false,\n        errors: [`peac.txt exceeds ${maxBytes} bytes (got ${content.length})`],\n      };\n    }\n    const { parse } = await import('./parser.js');\n    return parse(content);\n  } catch (error) {\n    return {\n      valid: false,\n      errors: [`Discovery failed: ${error instanceof Error ? error.message : String(error)}`],\n    };\n  } finally {\n    if (timer) clearTimeout(timer);\n  }\n}\n"]}

package/dist/index.d.ts

@@ -1,11 +1,81 @@
 /**
- * @peac/disc - PEAC discovery with ≤20 lines enforcement
- * ABNF-compliant .well-known/peac.txt parser and generator
+ * @peac/disc - thin peac.txt policy-document loader/validator and remote fetcher.
+ *
+ * peac.txt is a POLICY DOCUMENT surface per docs/specs/PEAC-TXT.md. Full
+ * parsing is delegated to `@peac/policy-kit.parsePolicyDocument`; this
+ * package provides a tolerant `parse()` wrapper, a `discover()` remote
+ * fetcher, and structured warnings for legacy key-discovery lines that
+ * appeared in older peac.txt examples.
+ *
+ * `peac.txt` is NOT a key discovery surface. Cryptographic key resolution
+ * flows through `iss` -> /.well-known/peac-issuer.json -> `jwks_uri` -> JWKS
+ * (docs/specs/PEAC-ISSUER.md). Callers that need key material MUST use
+ * `parseIssuerConfig` / `fetchIssuerConfig` from `@peac/protocol`.
+ *
+ * Legacy key-discovery lines (`verify:`, `public_keys:`, `jwks:`) are
+ * tolerated on parse: they are stripped before validation, surfaced on
+ * `ParseResult.warnings`, and fire a structured `process.emitWarning`
+ * with code `PEAC_LEGACY_PEAC_TXT_KEY_FIELD` once per process.
  */
-export { parse, emit, validate } from './parser.js';
-export type { PeacDiscovery, PublicKeyInfo, ParseResult, ValidationOptions } from './types.js';
-export declare const VERSION = "0.9.15";
-export declare const MAX_LINES = 20;
+export { parse, emit, validate, __resetLegacyWarningForTests } from './parser.js';
+export type { ParseResult, ValidationOptions, PolicyDocument } from './types.js';
+/**
+ * @deprecated Retained for one minor to keep existing import paths
+ * compiling. peac.txt policy documents now resolve to a `PolicyDocument`
+ * (re-exported from `@peac/policy-kit`). Removal target: next cleanup
+ * release.
+ */
+export type { PeacDiscovery, PublicKeyInfo } from './types.js';
+export declare const MAX_BYTES = 262144;
 export declare const WELL_KNOWN_PATH = "/.well-known/peac.txt";
-export declare function discover(origin: string): Promise<import('./types.js').ParseResult>;
+export declare const DEFAULT_TIMEOUT_MS = 5000;
+/**
+ * Minimal fetch signature accepted by `discover`. `undici` / `node-fetch` /
+ * browser / test-double implementations all satisfy this.
+ */
+export type DiscoverFetch = (input: string, init?: {
+    headers?: Record<string, string>;
+    signal?: AbortSignal;
+    redirect?: 'follow' | 'error' | 'manual';
+}) => Promise<{
+    ok: boolean;
+    status: number;
+    statusText: string;
+    text(): Promise<string>;
+}>;
+export interface DiscoverOptions {
+    /**
+     * HTTP fetch implementation. Defaults to the ambient `fetch` global.
+     * Supply `undici.fetch`, a test double, or a policy-wrapping client as
+     * needed.
+     */
+    fetchImpl?: DiscoverFetch;
+    /**
+     * User-agent string. Precedence (highest first): this option, the
+     * `PEAC_USER_AGENT` environment variable, then `peac-disc`.
+     */
+    userAgent?: string;
+    /** Caller-supplied abort signal. */
+    signal?: AbortSignal;
+    /**
+     * Millisecond timeout. Ignored when `signal` is supplied (the caller
+     * owns cancellation). Defaults to 5_000 when neither is provided.
+     */
+    timeoutMs?: number;
+    /** Override the 256 KiB body cap from docs/specs/PEAC-TXT.md §6.1. */
+    maxBytes?: number;
+    /**
+     * Redirect policy. Defaults to `error` to avoid cross-origin surprise
+     * on a well-known discovery endpoint; set to `follow` explicitly if the
+     * deployment relies on server-side redirects.
+     */
+    redirect?: 'follow' | 'error' | 'manual';
+}
+/**
+ * Fetch and parse a remote peac.txt policy document. On success returns a
+ * `ParseResult` whose `data` is the validated `peac-policy/0.1`
+ * `PolicyDocument`. Legacy key-discovery lines in the fetched bytes are
+ * surfaced as warnings but never populate `data`.
+ */
+export declare function discover(origin: string, options?: DiscoverOptions): Promise<import('./types.js').ParseResult>;
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACpD,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAG/F,eAAO,MAAM,OAAO,WAAW,CAAC;AAChC,eAAO,MAAM,SAAS,KAAK,CAAC;AAC5B,eAAO,MAAM,eAAe,0BAA0B,CAAC;AAKvD,wBAAsB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,YAAY,EAAE,WAAW,CAAC,CAuBxF"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,4BAA4B,EAAE,MAAM,aAAa,CAAC;AAClF,YAAY,EAAE,WAAW,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjF;;;;;GAKG;AACH,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE/D,eAAO,MAAM,SAAS,SAAS,CAAC;AAChC,eAAO,MAAM,eAAe,0BAA0B,CAAC;AACvD,eAAO,MAAM,kBAAkB,OAAO,CAAC;AAGvC;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,CAC1B,KAAK,EAAE,MAAM,EACb,IAAI,CAAC,EAAE;IACL,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,QAAQ,CAAC,EAAE,QAAQ,GAAG,OAAO,GAAG,QAAQ,CAAC;CAC1C,KACE,OAAO,CAAC;IACX,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CACzB,CAAC,CAAC;AAEH,MAAM,WAAW,eAAe;IAC9B;;;;OAIG;IACH,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oCAAoC;IACpC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sEAAsE;IACtE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,QAAQ,GAAG,OAAO,GAAG,QAAQ,CAAC;CAC1C;AAED;;;;;GAKG;AACH,wBAAsB,QAAQ,CAC5B,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,OAAO,YAAY,EAAE,WAAW,CAAC,CAkE3C"}

package/dist/index.js

@@ -1,3 +1,5 @@
+import { parsePolicyDocument, PolicyValidationError, PolicyLoadError, serializePolicyYaml } from '@peac/policy-kit';
+
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __esm = (fn, res) => function __init() {
@@ -11,162 +13,153 @@ var __export = (target, all) => {
 // src/parser.ts
 var parser_exports = {};
 __export(parser_exports, {
+  __resetLegacyWarningForTests: () => __resetLegacyWarningForTests,
   emit: () => emit,
   parse: () => parse,
   validate: () => validate
 });
-function parse(content, options = {}) {
-  const maxLines = options.maxLines ?? MAX_LINES;
-  const errors = [];
-  const data = {};
-  const lines = content.split("\n").map((l) => l.trim()).filter((l) => l && !l.startsWith("#"));
-  if (lines.length > maxLines) {
+function fireLegacyWarning(field) {
+  if (legacyWarningFired) return;
+  legacyWarningFired = true;
+  if (typeof process !== "undefined" && typeof process.emitWarning === "function") {
+    process.emitWarning(
+      `peac.txt legacy key-discovery field "${field}" is deprecated and ignored. peac.txt is a policy-document surface (docs/specs/PEAC-TXT.md). Key resolution uses iss -> /.well-known/peac-issuer.json -> jwks_uri -> JWKS.`,
+      { code: "PEAC_LEGACY_PEAC_TXT_KEY_FIELD", type: "DeprecationWarning" }
+    );
+  }
+}
+function __resetLegacyWarningForTests() {
+  legacyWarningFired = false;
+}
+function collectLegacyWarnings(text) {
+  const warnings = [];
+  let firstField = null;
+  const lines = text.split(/\r?\n/);
+  lines.forEach((line, idx) => {
+    const match = line.match(/^\s*(verify|public_keys|jwks)\s*:/);
+    if (match) {
+      if (firstField === null) firstField = match[1];
+      warnings.push(
+        `Line ${idx + 1}: legacy key-discovery field "${match[1]}" ignored (peac.txt is policy-only; use peac-issuer.json for keys)`
+      );
+    }
+  });
+  return { warnings, firstField };
+}
+function parse(text) {
+  const warnings = [];
+  if (text.trim().length === 0) {
     return {
       valid: false,
-      errors: [`Line limit exceeded: ${lines.length} > ${maxLines}`],
-      lineCount: lines.length
+      errors: ["Empty policy document. Expected peac-policy/0.1 YAML or JSON."]
     };
   }
-  for (const [index, line] of lines.entries()) {
-    let matched = false;
-    for (const [field, pattern] of Object.entries(FIELD_PATTERNS)) {
-      const match = line.match(pattern);
-      if (match) {
-        matched = true;
-        try {
-          switch (field) {
-            case "preferences":
-            case "access_control":
-            case "provenance":
-            case "verify":
-              data[field] = match[1].trim();
-              break;
-            case "receipts":
-              data.receipts = match[1];
-              break;
-            case "payments":
-              data.payments = parseArray(match[1]);
-              break;
-            case "public_keys":
-              data.public_keys = parsePublicKeys(match[1]);
-              break;
-          }
-        } catch (error) {
-          errors.push(
-            `Line ${index + 1}: ${error instanceof Error ? error.message : String(error)}`
-          );
-        }
-        break;
-      }
+  const hasLegacyLines = LEGACY_KEY_LINE.test(text);
+  try {
+    const data = parsePolicyDocument(text);
+    if (hasLegacyLines) {
+      const legacy = collectLegacyWarnings(text);
+      warnings.push(...legacy.warnings);
+      if (legacy.firstField) fireLegacyWarning(legacy.firstField);
     }
-    if (!matched) {
-      errors.push(`Line ${index + 1}: Invalid format: ${line}`);
+    return {
+      valid: true,
+      data,
+      warnings: warnings.length > 0 ? warnings : void 0
+    };
+  } catch (firstErr) {
+    if (!hasLegacyLines) {
+      return failure(firstErr, warnings);
     }
-  }
-  if (!data.verify) {
-    errors.push("Missing required field: verify");
-  }
-  return {
-    valid: errors.length === 0,
-    data: errors.length === 0 ? data : void 0,
-    errors: errors.length > 0 ? errors : void 0,
-    lineCount: lines.length
-  };
-}
-function parseArray(content) {
-  return content.split(",").map((item) => item.trim().replace(/^["']|["']$/g, "")).filter((item) => item.length > 0);
-}
-function parsePublicKeys(content) {
-  const keyStrings = parseArray(content);
-  const keys = [];
-  for (const keyString of keyStrings) {
-    const keyMatch = keyString.match(/^([^:]+):([^:]+):(.+)$/);
-    if (!keyMatch) {
-      throw new Error(`Invalid public key format: ${keyString}`);
+    const legacy = collectLegacyWarnings(text);
+    warnings.push(...legacy.warnings);
+    if (legacy.firstField) fireLegacyWarning(legacy.firstField);
+    const stripped = text.replace(LEGACY_KEY_FULL_LINE_GLOBAL, "");
+    if (stripped.trim().length === 0) {
+      return {
+        valid: false,
+        errors: ["Empty policy document after stripping legacy key-discovery lines."],
+        warnings: warnings.length > 0 ? warnings : void 0
+      };
+    }
+    try {
+      const data = parsePolicyDocument(stripped);
+      return {
+        valid: true,
+        data,
+        warnings: warnings.length > 0 ? warnings : void 0
+      };
+    } catch (retryErr) {
+      return failure(retryErr, warnings);
     }
-    keys.push({
-      kid: keyMatch[1],
-      alg: keyMatch[2],
-      key: keyMatch[3]
-    });
   }
-  return keys;
 }
-function assertSafeFieldValue(value, fieldName) {
-  if (UNSAFE_FIELD_CHARS.test(value)) {
-    throw new Error(
-      `Invalid ${fieldName}: must not contain quotes, colons, brackets, newlines, or control characters`
-    );
+function failure(err, warnings) {
+  if (err instanceof PolicyValidationError || err instanceof PolicyLoadError) {
+    return {
+      valid: false,
+      errors: [err.message],
+      warnings: warnings.length > 0 ? warnings : void 0
+    };
   }
+  return {
+    valid: false,
+    errors: [err instanceof Error ? err.message : String(err)],
+    warnings: warnings.length > 0 ? warnings : void 0
+  };
 }
-function emit(data) {
-  const lines = [];
-  if (data.preferences) {
-    lines.push(`preferences: ${data.preferences}`);
-  }
-  if (data.access_control) {
-    lines.push(`access_control: ${data.access_control}`);
-  }
-  if (data.payments && data.payments.length > 0) {
-    data.payments.forEach((p) => assertSafeFieldValue(p, "payment"));
-    const paymentsStr = data.payments.map((p) => `"${p}"`).join(", ");
-    lines.push(`payments: [${paymentsStr}]`);
-  }
-  if (data.provenance) {
-    lines.push(`provenance: ${data.provenance}`);
-  }
-  if (data.receipts) {
-    lines.push(`receipts: ${data.receipts}`);
-  }
-  if (data.verify) {
-    lines.push(`verify: ${data.verify}`);
-  }
-  if (data.public_keys && data.public_keys.length > 0) {
-    data.public_keys.forEach((k) => {
-      assertSafeFieldValue(k.kid, "kid");
-      assertSafeFieldValue(k.alg, "alg");
-      assertSafeFieldValue(k.key, "key");
-    });
-    const keysStr = data.public_keys.map((k) => `"${k.kid}:${k.alg}:${k.key}"`).join(", ");
-    lines.push(`public_keys: [${keysStr}]`);
-  }
-  if (lines.length > MAX_LINES) {
-    throw new Error(`Generated peac.txt exceeds ${MAX_LINES} lines: ${lines.length}`);
-  }
-  return lines.join("\n");
+function emit(doc) {
+  return serializePolicyYaml(doc);
 }
-function validate(content) {
-  const result = parse(content);
-  return result.valid;
+function validate(text) {
+  return parse(text).valid;
 }
-var MAX_LINES, FIELD_PATTERNS, UNSAFE_FIELD_CHARS;
+var LEGACY_KEY_LINE, LEGACY_KEY_FULL_LINE_GLOBAL, legacyWarningFired;
 var init_parser = __esm({
   "src/parser.ts"() {
-    MAX_LINES = 20;
-    FIELD_PATTERNS = {
-      preferences: /^preferences:\s*(.+)$/,
-      access_control: /^access_control:\s*(.+)$/,
-      payments: /^payments:\s*\[([^\]]+)\]$/,
-      provenance: /^provenance:\s*(.+)$/,
-      receipts: /^receipts:\s*(required|optional)$/,
-      verify: /^verify:\s*(.+)$/,
-      public_keys: /^public_keys:\s*\[([^\]]+)\]$/
-    };
-    UNSAFE_FIELD_CHARS = /["\n\r\x00-\x1f:[\]]/;
+    LEGACY_KEY_LINE = /^\s*(verify|public_keys|jwks)\s*:/m;
+    LEGACY_KEY_FULL_LINE_GLOBAL = /^\s*(verify|public_keys|jwks)\s*:.*\r?\n?/gm;
+    legacyWarningFired = false;
   }
 });
 
 // src/index.ts
 init_parser();
-var VERSION = "0.9.15";
-var MAX_LINES2 = 20;
+var MAX_BYTES = 262144;
 var WELL_KNOWN_PATH = "/.well-known/peac.txt";
-var UA = `PEAC/${VERSION} (+https://www.peacprotocol.org)`;
-async function discover(origin) {
+var DEFAULT_TIMEOUT_MS = 5e3;
+var DEFAULT_USER_AGENT = "peac-disc";
+async function discover(origin, options = {}) {
+  const fetchImpl = options.fetchImpl ?? globalThis.fetch;
+  if (typeof fetchImpl !== "function") {
+    return {
+      valid: false,
+      errors: [
+        "Discovery failed: no fetch implementation available (supply options.fetchImpl or provide a global fetch)"
+      ]
+    };
+  }
+  const envUa = typeof process !== "undefined" && typeof process.env === "object" ? process.env.PEAC_USER_AGENT : void 0;
+  const userAgent = options.userAgent ?? envUa ?? DEFAULT_USER_AGENT;
+  const maxBytes = options.maxBytes ?? MAX_BYTES;
+  const redirect = options.redirect ?? "error";
+  let localController;
+  let timer;
+  let signal = options.signal;
+  if (!signal) {
+    localController = new AbortController();
+    signal = localController.signal;
+    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    if (timeoutMs > 0 && Number.isFinite(timeoutMs)) {
+      timer = setTimeout(() => localController?.abort(), timeoutMs);
+    }
+  }
   try {
     const url = new URL(WELL_KNOWN_PATH, origin);
-    const response = await fetch(url.toString(), {
-      headers: { "User-Agent": UA }
+    const response = await fetchImpl(url.toString(), {
+      headers: { "User-Agent": userAgent },
+      signal,
+      redirect
     });
     if (!response.ok) {
       return {
@@ -175,6 +168,12 @@ async function discover(origin) {
       };
     }
     const content = await response.text();
+    if (content.length > maxBytes) {
+      return {
+        valid: false,
+        errors: [`peac.txt exceeds ${maxBytes} bytes (got ${content.length})`]
+      };
+    }
     const { parse: parse2 } = await Promise.resolve().then(() => (init_parser(), parser_exports));
     return parse2(content);
   } catch (error) {
@@ -182,9 +181,11 @@ async function discover(origin) {
       valid: false,
       errors: [`Discovery failed: ${error instanceof Error ? error.message : String(error)}`]
     };
+  } finally {
+    if (timer) clearTimeout(timer);
   }
 }
 
-export { MAX_LINES2 as MAX_LINES, VERSION, WELL_KNOWN_PATH, discover, emit, parse, validate };
+export { DEFAULT_TIMEOUT_MS, MAX_BYTES, WELL_KNOWN_PATH, __resetLegacyWarningForTests, discover, emit, parse, validate };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/parser.ts","../src/index.ts"],"names":["MAX_LINES","parse"],"mappings":";;;;;;;;;;;AAAA,IAAA,cAAA,GAAA,EAAA;AAAA,QAAA,CAAA,cAAA,EAAA;AAAA,EAAA,IAAA,EAAA,MAAA,IAAA;AAAA,EAAA,KAAA,EAAA,MAAA,KAAA;AAAA,EAAA,QAAA,EAAA,MAAA;AAAA,CAAA,CAAA;AAkBO,SAAS,KAAA,CAAM,OAAA,EAAiB,OAAA,GAA6B,EAAC,EAAgB;AACnF,EAAA,MAAM,QAAA,GAAW,QAAQ,QAAA,IAAY,SAAA;AACrC,EAAA,MAAM,SAAmB,EAAC;AAC1B,EAAA,MAAM,OAAsB,EAAC;AAE7B,EAAA,MAAM,KAAA,GAAQ,QACX,KAAA,CAAM,IAAI,EACV,GAAA,CAAI,CAAC,MAAM,CAAA,CAAE,IAAA,EAAM,CAAA,CACnB,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,IAAK,CAAC,CAAA,CAAE,UAAA,CAAW,GAAG,CAAC,CAAA;AAGxC,EAAA,IAAI,KAAA,CAAM,SAAS,QAAA,EAAU;AAC3B,IAAA,OAAO;AAAA,MACL,KAAA,EAAO,KAAA;AAAA,MACP,QAAQ,CAAC,CAAA,qBAAA,EAAwB,MAAM,MAAM,CAAA,GAAA,EAAM,QAAQ,CAAA,CAAE,CAAA;AAAA,MAC7D,WAAW,KAAA,CAAM;AAAA,KACnB;AAAA,EACF;AAGA,EAAA,KAAA,MAAW,CAAC,KAAA,EAAO,IAAI,CAAA,IAAK,KAAA,CAAM,SAAQ,EAAG;AAC3C,IAAA,IAAI,OAAA,GAAU,KAAA;AAEd,IAAA,KAAA,MAAW,CAAC,KAAA,EAAO,OAAO,KAAK,MAAA,CAAO,OAAA,CAAQ,cAAc,CAAA,EAAG;AAC7D,MAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,CAAM,OAAO,CAAA;AAChC,MAAA,IAAI,KAAA,EAAO;AACT,QAAA,OAAA,GAAU,IAAA;AACV,QAAA,IAAI;AACF,UAAA,QAAQ,KAAA;AAAO,YACb,KAAK,aAAA;AAAA,YACL,KAAK,gBAAA;AAAA,YACL,KAAK,YAAA;AAAA,YACL,KAAK,QAAA;AACH,cAAA,IAAA,CAAK,KAAK,CAAA,GAAI,KAAA,CAAM,CAAC,EAAE,IAAA,EAAK;AAC5B,cAAA;AAAA,YACF,KAAK,UAAA;AACH,cAAA,IAAA,CAAK,QAAA,GAAW,MAAM,CAAC,CAAA;AACvB,cAAA;AAAA,YACF,KAAK,UAAA;AACH,cAAA,IAAA,CAAK,QAAA,GAAW,UAAA,CAAW,KAAA,CAAM,CAAC,CAAC,CAAA;AACnC,cAAA;AAAA,YACF,KAAK,aAAA;AACH,cAAA,IAAA,CAAK,WAAA,GAAc,eAAA,CAAgB,KAAA,CAAM,CAAC,CAAC,CAAA;AAC3C,cAAA;AAAA;AACJ,QACF,SAAS,KAAA,EAAO;AACd,UAAA,MAAA,CAAO,IAAA;AAAA,YACL,CAAA,KAAA,EAAQ,KAAA,GAAQ,CAAC,CAAA,EAAA,EAAK,KAAA,YAAiB,QAAQ,KAAA,CAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,WAC9E;AAAA,QACF;AACA,QAAA;AAAA,MACF;AAAA,IACF;AAEA,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,MAAA,CAAO,KAAK,CAAA,KAAA,EAAQ,KAAA,GAAQ,CAAC,CAAA,kBAAA,EAAqB,IAAI,CAAA,CAAE,CAAA;AAAA,IAC1D;AAAA,EACF;AAGA,EAAA,IAAI,CAAC,KAAK,MAAA,EAAQ;AAChB,IAAA,MAAA,CAAO,KAAK,gCAAgC,CAAA;AAAA,EAC9C;AAEA,EAAA,OAAO;AAAA,IACL,KAAA,EAAO,OAAO,MAAA,KAAW,CAAA;AAAA,IACzB,IAAA,EAAM,MAAA,CAAO,MAAA,KAAW,CAAA,GAAI,IAAA,GAAO,MAAA;AAAA,IACnC,MAAA,EAAQ,MAAA,CAAO,MAAA,GAAS,CAAA,GAAI,MAAA,GAAS,MAAA;AAAA,IACrC,WAAW,KAAA,CAAM;AAAA,GACnB;AACF;AAEA,SAAS,WAAW,OAAA,EAA2B;AAC7C,EAAA,OAAO,OAAA,CACJ,MAAM,GAAG,CAAA,CACT,IAAI,CAAC,IAAA,KAAS,KAAK,IAAA,EAAK,CAAE,QAAQ,cAAA,EAAgB,EAAE,CAAC,CAAA,CACrD,MAAA,CAAO,CAAC,IAAA,KAAS,IAAA,CAAK,SAAS,CAAC,CAAA;AACrC;AAEA,SAAS,gBAAgB,OAAA,EAAkC;AACzD,EAAA,MAAM,UAAA,GAAa,WAAW,OAAO,CAAA;AACrC,EAAA,MAAM,OAAwB,EAAC;AAE/B,EAAA,KAAA,MAAW,aAAa,UAAA,EAAY;AAClC,IAAA,MAAM,QAAA,GAAW,SAAA,CAAU,KAAA,CAAM,wBAAwB,CAAA;AACzD,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,2BAAA,EAA8B,SAAS,CAAA,CAAE,CAAA;AAAA,IAC3D;AAEA,IAAA,IAAA,CAAK,IAAA,CAAK;AAAA,MACR,GAAA,EAAK,SAAS,CAAC,CAAA;AAAA,MACf,GAAA,EAAK,SAAS,CAAC,CAAA;AAAA,MACf,GAAA,EAAK,SAAS,CAAC;AAAA,KAChB,CAAA;AAAA,EACH;AAEA,EAAA,OAAO,IAAA;AACT;AAKA,SAAS,oBAAA,CAAqB,OAAe,SAAA,EAAyB;AACpE,EAAA,IAAI,kBAAA,CAAmB,IAAA,CAAK,KAAK,CAAA,EAAG;AAClC,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,WAAW,SAAS,CAAA,4EAAA;AAAA,KACtB;AAAA,EACF;AACF;AAEO,SAAS,KAAK,IAAA,EAA6B;AAChD,EAAA,MAAM,QAAkB,EAAC;AAEzB,EAAA,IAAI,KAAK,WAAA,EAAa;AACpB,IAAA,KAAA,CAAM,IAAA,CAAK,CAAA,aAAA,EAAgB,IAAA,CAAK,WAAW,CAAA,CAAE,CAAA;AAAA,EAC/C;AAEA,EAAA,IAAI,KAAK,cAAA,EAAgB;AACvB,IAAA,KAAA,CAAM,IAAA,CAAK,CAAA,gBAAA,EAAmB,IAAA,CAAK,cAAc,CAAA,CAAE,CAAA;AAAA,EACrD;AAEA,EAAA,IAAI,IAAA,CAAK,QAAA,IAAY,IAAA,CAAK,QAAA,CAAS,SAAS,CAAA,EAAG;AAC7C,IAAA,IAAA,CAAK,SAAS,OAAA,CAAQ,CAAC,MAAM,oBAAA,CAAqB,CAAA,EAAG,SAAS,CAAC,CAAA;AAC/D,IAAA,MAAM,WAAA,GAAc,IAAA,CAAK,QAAA,CAAS,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAA,EAAI,CAAC,CAAA,CAAA,CAAG,CAAA,CAAE,IAAA,CAAK,IAAI,CAAA;AAChE,IAAA,KAAA,CAAM,IAAA,CAAK,CAAA,WAAA,EAAc,WAAW,CAAA,CAAA,CAAG,CAAA;AAAA,EACzC;AAEA,EAAA,IAAI,KAAK,UAAA,EAAY;AACnB,IAAA,KAAA,CAAM,IAAA,CAAK,CAAA,YAAA,EAAe,IAAA,CAAK,UAAU,CAAA,CAAE,CAAA;AAAA,EAC7C;AAEA,EAAA,IAAI,KAAK,QAAA,EAAU;AACjB,IAAA,KAAA,CAAM,IAAA,CAAK,CAAA,UAAA,EAAa,IAAA,CAAK,QAAQ,CAAA,CAAE,CAAA;AAAA,EACzC;AAEA,EAAA,IAAI,KAAK,MAAA,EAAQ;AACf,IAAA,KAAA,CAAM,IAAA,CAAK,CAAA,QAAA,EAAW,IAAA,CAAK,MAAM,CAAA,CAAE,CAAA;AAAA,EACrC;AAEA,EAAA,IAAI,IAAA,CAAK,WAAA,IAAe,IAAA,CAAK,WAAA,CAAY,SAAS,CAAA,EAAG;AACnD,IAAA,IAAA,CAAK,WAAA,CAAY,OAAA,CAAQ,CAAC,CAAA,KAAM;AAC9B,MAAA,oBAAA,CAAqB,CAAA,CAAE,KAAK,KAAK,CAAA;AACjC,MAAA,oBAAA,CAAqB,CAAA,CAAE,KAAK,KAAK,CAAA;AACjC,MAAA,oBAAA,CAAqB,CAAA,CAAE,KAAK,KAAK,CAAA;AAAA,IACnC,CAAC,CAAA;AACD,IAAA,MAAM,UAAU,IAAA,CAAK,WAAA,CAAY,IAAI,CAAC,CAAA,KAAM,IAAI,CAAA,CAAE,GAAG,CAAA,CAAA,EAAI,CAAA,CAAE,GAAG,CAAA,CAAA,EAAI,CAAA,CAAE,GAAG,CAAA,CAAA,CAAG,CAAA,CAAE,KAAK,IAAI,CAAA;AACrF,IAAA,KAAA,CAAM,IAAA,CAAK,CAAA,cAAA,EAAiB,OAAO,CAAA,CAAA,CAAG,CAAA;AAAA,EACxC;AAGA,EAAA,IAAI,KAAA,CAAM,SAAS,SAAA,EAAW;AAC5B,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,2BAAA,EAA8B,SAAS,CAAA,QAAA,EAAW,KAAA,CAAM,MAAM,CAAA,CAAE,CAAA;AAAA,EAClF;AAEA,EAAA,OAAO,KAAA,CAAM,KAAK,IAAI,CAAA;AACxB;AAEO,SAAS,SAAS,OAAA,EAA0B;AACjD,EAAA,MAAM,MAAA,GAAS,MAAM,OAAO,CAAA;AAC5B,EAAA,OAAO,MAAA,CAAO,KAAA;AAChB;AAlLA,IAOM,WACA,cAAA,EA8GA,kBAAA;AAtHN,IAAA,WAAA,GAAA,KAAA,CAAA;AAAA,EAAA,eAAA,GAAA;AAOA,IAAM,SAAA,GAAY,EAAA;AAClB,IAAM,cAAA,GAAiB;AAAA,MACrB,WAAA,EAAa,uBAAA;AAAA,MACb,cAAA,EAAgB,0BAAA;AAAA,MAChB,QAAA,EAAU,4BAAA;AAAA,MACV,UAAA,EAAY,sBAAA;AAAA,MACZ,QAAA,EAAU,mCAAA;AAAA,MACV,MAAA,EAAQ,kBAAA;AAAA,MACR,WAAA,EAAa;AAAA,KACf;AAsGA,IAAM,kBAAA,GAAqB,sBAAA;AAAA,EAAA;AAAA,CAAA,CAAA;;;ACjH3B,WAAA,EAAA;AAIO,IAAM,OAAA,GAAU;AAChB,IAAMA,UAAAA,GAAY;AAClB,IAAM,eAAA,GAAkB;AAE/B,IAAM,EAAA,GAAK,QAAQ,OAAO,CAAA,gCAAA,CAAA;AAG1B,eAAsB,SAAS,MAAA,EAA2D;AACxF,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,eAAA,EAAiB,MAAM,CAAA;AAC3C,IAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,GAAA,CAAI,UAAS,EAAG;AAAA,MAC3C,OAAA,EAAS,EAAE,YAAA,EAAc,EAAA;AAAG,KAC7B,CAAA;AAED,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,OAAO;AAAA,QACL,KAAA,EAAO,KAAA;AAAA,QACP,MAAA,EAAQ,CAAC,CAAA,KAAA,EAAQ,QAAA,CAAS,MAAM,CAAA,EAAA,EAAK,QAAA,CAAS,UAAU,CAAA,CAAE;AAAA,OAC5D;AAAA,IACF;AAEA,IAAA,MAAM,OAAA,GAAU,MAAM,QAAA,CAAS,IAAA,EAAK;AACpC,IAAA,MAAM,EAAE,KAAA,EAAAC,MAAAA,EAAM,GAAI,MAAM,OAAA,CAAA,OAAA,EAAA,CAAA,IAAA,CAAA,OAAA,WAAA,EAAA,EAAA,cAAA,CAAA,CAAA;AACxB,IAAA,OAAOA,OAAM,OAAO,CAAA;AAAA,EACtB,SAAS,KAAA,EAAO;AACd,IAAA,OAAO;AAAA,MACL,KAAA,EAAO,KAAA;AAAA,MACP,MAAA,EAAQ,CAAC,CAAA,kBAAA,EAAqB,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA,CAAE;AAAA,KACxF;AAAA,EACF;AACF","file":"index.js","sourcesContent":["/**\n * @peac/disc/parser - peac.txt parser with ≤20 lines enforcement\n * ABNF-compliant discovery document parsing\n */\n\nimport type { PeacDiscovery, ParseResult, PublicKeyInfo, ValidationOptions } from './types.js';\n\nconst MAX_LINES = 20;\nconst FIELD_PATTERNS = {\n  preferences: /^preferences:\\s*(.+)$/,\n  access_control: /^access_control:\\s*(.+)$/,\n  payments: /^payments:\\s*\\[([^\\]]+)\\]$/,\n  provenance: /^provenance:\\s*(.+)$/,\n  receipts: /^receipts:\\s*(required|optional)$/,\n  verify: /^verify:\\s*(.+)$/,\n  public_keys: /^public_keys:\\s*\\[([^\\]]+)\\]$/,\n};\n\nexport function parse(content: string, options: ValidationOptions = {}): ParseResult {\n  const maxLines = options.maxLines ?? MAX_LINES;\n  const errors: string[] = [];\n  const data: PeacDiscovery = {};\n\n  const lines = content\n    .split('\\n')\n    .map((l) => l.trim())\n    .filter((l) => l && !l.startsWith('#'));\n\n  // Enforce line limit\n  if (lines.length > maxLines) {\n    return {\n      valid: false,\n      errors: [`Line limit exceeded: ${lines.length} > ${maxLines}`],\n      lineCount: lines.length,\n    };\n  }\n\n  // Parse each line\n  for (const [index, line] of lines.entries()) {\n    let matched = false;\n\n    for (const [field, pattern] of Object.entries(FIELD_PATTERNS)) {\n      const match = line.match(pattern);\n      if (match) {\n        matched = true;\n        try {\n          switch (field) {\n            case 'preferences':\n            case 'access_control':\n            case 'provenance':\n            case 'verify':\n              data[field] = match[1].trim();\n              break;\n            case 'receipts':\n              data.receipts = match[1] as 'required' | 'optional';\n              break;\n            case 'payments':\n              data.payments = parseArray(match[1]);\n              break;\n            case 'public_keys':\n              data.public_keys = parsePublicKeys(match[1]);\n              break;\n          }\n        } catch (error) {\n          errors.push(\n            `Line ${index + 1}: ${error instanceof Error ? error.message : String(error)}`\n          );\n        }\n        break;\n      }\n    }\n\n    if (!matched) {\n      errors.push(`Line ${index + 1}: Invalid format: ${line}`);\n    }\n  }\n\n  // Validate required fields\n  if (!data.verify) {\n    errors.push('Missing required field: verify');\n  }\n\n  return {\n    valid: errors.length === 0,\n    data: errors.length === 0 ? data : undefined,\n    errors: errors.length > 0 ? errors : undefined,\n    lineCount: lines.length,\n  };\n}\n\nfunction parseArray(content: string): string[] {\n  return content\n    .split(',')\n    .map((item) => item.trim().replace(/^[\"']|[\"']$/g, ''))\n    .filter((item) => item.length > 0);\n}\n\nfunction parsePublicKeys(content: string): PublicKeyInfo[] {\n  const keyStrings = parseArray(content);\n  const keys: PublicKeyInfo[] = [];\n\n  for (const keyString of keyStrings) {\n    const keyMatch = keyString.match(/^([^:]+):([^:]+):(.+)$/);\n    if (!keyMatch) {\n      throw new Error(`Invalid public key format: ${keyString}`);\n    }\n\n    keys.push({\n      kid: keyMatch[1],\n      alg: keyMatch[2],\n      key: keyMatch[3],\n    });\n  }\n\n  return keys;\n}\n\n/** Characters that break peac.txt wire format: quotes, colons, brackets, control chars */\nconst UNSAFE_FIELD_CHARS = /[\"\\n\\r\\x00-\\x1f:[\\]]/;\n\nfunction assertSafeFieldValue(value: string, fieldName: string): void {\n  if (UNSAFE_FIELD_CHARS.test(value)) {\n    throw new Error(\n      `Invalid ${fieldName}: must not contain quotes, colons, brackets, newlines, or control characters`\n    );\n  }\n}\n\nexport function emit(data: PeacDiscovery): string {\n  const lines: string[] = [];\n\n  if (data.preferences) {\n    lines.push(`preferences: ${data.preferences}`);\n  }\n\n  if (data.access_control) {\n    lines.push(`access_control: ${data.access_control}`);\n  }\n\n  if (data.payments && data.payments.length > 0) {\n    data.payments.forEach((p) => assertSafeFieldValue(p, 'payment'));\n    const paymentsStr = data.payments.map((p) => `\"${p}\"`).join(', ');\n    lines.push(`payments: [${paymentsStr}]`);\n  }\n\n  if (data.provenance) {\n    lines.push(`provenance: ${data.provenance}`);\n  }\n\n  if (data.receipts) {\n    lines.push(`receipts: ${data.receipts}`);\n  }\n\n  if (data.verify) {\n    lines.push(`verify: ${data.verify}`);\n  }\n\n  if (data.public_keys && data.public_keys.length > 0) {\n    data.public_keys.forEach((k) => {\n      assertSafeFieldValue(k.kid, 'kid');\n      assertSafeFieldValue(k.alg, 'alg');\n      assertSafeFieldValue(k.key, 'key');\n    });\n    const keysStr = data.public_keys.map((k) => `\"${k.kid}:${k.alg}:${k.key}\"`).join(', ');\n    lines.push(`public_keys: [${keysStr}]`);\n  }\n\n  // Enforce line limit during emission\n  if (lines.length > MAX_LINES) {\n    throw new Error(`Generated peac.txt exceeds ${MAX_LINES} lines: ${lines.length}`);\n  }\n\n  return lines.join('\\n');\n}\n\nexport function validate(content: string): boolean {\n  const result = parse(content);\n  return result.valid;\n}\n","/**\n * @peac/disc - PEAC discovery with ≤20 lines enforcement\n * ABNF-compliant .well-known/peac.txt parser and generator\n */\n\nexport { parse, emit, validate } from './parser.js';\nexport type { PeacDiscovery, PublicKeyInfo, ParseResult, ValidationOptions } from './types.js';\n\n// Constants\nexport const VERSION = '0.9.15';\nexport const MAX_LINES = 20;\nexport const WELL_KNOWN_PATH = '/.well-known/peac.txt';\n\nconst UA = `PEAC/${VERSION} (+https://www.peacprotocol.org)`;\n\n// Convenience function for fetching and parsing discovery documents\nexport async function discover(origin: string): Promise<import('./types.js').ParseResult> {\n  try {\n    const url = new URL(WELL_KNOWN_PATH, origin);\n    const response = await fetch(url.toString(), {\n      headers: { 'User-Agent': UA },\n    });\n\n    if (!response.ok) {\n      return {\n        valid: false,\n        errors: [`HTTP ${response.status}: ${response.statusText}`],\n      };\n    }\n\n    const content = await response.text();\n    const { parse } = await import('./parser.js');\n    return parse(content);\n  } catch (error) {\n    return {\n      valid: false,\n      errors: [`Discovery failed: ${error instanceof Error ? error.message : String(error)}`],\n    };\n  }\n}\n"]}
+{"version":3,"sources":["../src/parser.ts","../src/index.ts"],"names":["parse"],"mappings":";;;;;;;;;;;;;AAAA,IAAA,cAAA,GAAA,EAAA;AAAA,QAAA,CAAA,cAAA,EAAA;AAAA,EAAA,4BAAA,EAAA,MAAA,4BAAA;AAAA,EAAA,IAAA,EAAA,MAAA,IAAA;AAAA,EAAA,KAAA,EAAA,MAAA,KAAA;AAAA,EAAA,QAAA,EAAA,MAAA;AAAA,CAAA,CAAA;AAqCA,SAAS,kBAAkB,KAAA,EAAqB;AAC9C,EAAA,IAAI,kBAAA,EAAoB;AACxB,EAAA,kBAAA,GAAqB,IAAA;AACrB,EAAA,IAAI,OAAO,OAAA,KAAY,WAAA,IAAe,OAAO,OAAA,CAAQ,gBAAgB,UAAA,EAAY;AAC/E,IAAA,OAAA,CAAQ,WAAA;AAAA,MACN,wCAAwC,KAAK,CAAA,0KAAA,CAAA;AAAA,MAG7C,EAAE,IAAA,EAAM,gCAAA,EAAkC,IAAA,EAAM,oBAAA;AAAqB,KACvE;AAAA,EACF;AACF;AAMO,SAAS,4BAAA,GAAqC;AACnD,EAAA,kBAAA,GAAqB,KAAA;AACvB;AAEA,SAAS,sBAAsB,IAAA,EAAiE;AAC9F,EAAA,MAAM,WAAqB,EAAC;AAC5B,EAAA,IAAI,UAAA,GAA4B,IAAA;AAChC,EAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,CAAM,OAAO,CAAA;AAChC,EAAA,KAAA,CAAM,OAAA,CAAQ,CAAC,IAAA,EAAM,GAAA,KAAQ;AAC3B,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,CAAM,mCAAmC,CAAA;AAC5D,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,IAAI,UAAA,KAAe,IAAA,EAAM,UAAA,GAAa,KAAA,CAAM,CAAC,CAAA;AAC7C,MAAA,QAAA,CAAS,IAAA;AAAA,QACP,QAAQ,GAAA,GAAM,CAAC,CAAA,8BAAA,EAAiC,KAAA,CAAM,CAAC,CAAC,CAAA,kEAAA;AAAA,OAE1D;AAAA,IACF;AAAA,EACF,CAAC,CAAA;AACD,EAAA,OAAO,EAAE,UAAU,UAAA,EAAW;AAChC;AAiBO,SAAS,MAAM,IAAA,EAA2B;AAC/C,EAAA,MAAM,WAAqB,EAAC;AAE5B,EAAA,IAAI,IAAA,CAAK,IAAA,EAAK,CAAE,MAAA,KAAW,CAAA,EAAG;AAC5B,IAAA,OAAO;AAAA,MACL,KAAA,EAAO,KAAA;AAAA,MACP,MAAA,EAAQ,CAAC,+DAA+D;AAAA,KAC1E;AAAA,EACF;AAEA,EAAA,MAAM,cAAA,GAAiB,eAAA,CAAgB,IAAA,CAAK,IAAI,CAAA;AAKhD,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,GAAO,oBAAoB,IAAI,CAAA;AACrC,IAAA,IAAI,cAAA,EAAgB;AAClB,MAAA,MAAM,MAAA,GAAS,sBAAsB,IAAI,CAAA;AACzC,MAAA,QAAA,CAAS,IAAA,CAAK,GAAG,MAAA,CAAO,QAAQ,CAAA;AAChC,MAAA,IAAI,MAAA,CAAO,UAAA,EAAY,iBAAA,CAAkB,MAAA,CAAO,UAAU,CAAA;AAAA,IAC5D;AACA,IAAA,OAAO;AAAA,MACL,KAAA,EAAO,IAAA;AAAA,MACP,IAAA;AAAA,MACA,QAAA,EAAU,QAAA,CAAS,MAAA,GAAS,CAAA,GAAI,QAAA,GAAW,KAAA;AAAA,KAC7C;AAAA,EACF,SAAS,QAAA,EAAU;AACjB,IAAA,IAAI,CAAC,cAAA,EAAgB;AACnB,MAAA,OAAO,OAAA,CAAQ,UAAU,QAAQ,CAAA;AAAA,IACnC;AAEA,IAAA,MAAM,MAAA,GAAS,sBAAsB,IAAI,CAAA;AACzC,IAAA,QAAA,CAAS,IAAA,CAAK,GAAG,MAAA,CAAO,QAAQ,CAAA;AAChC,IAAA,IAAI,MAAA,CAAO,UAAA,EAAY,iBAAA,CAAkB,MAAA,CAAO,UAAU,CAAA;AAE1D,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,2BAAA,EAA6B,EAAE,CAAA;AAC7D,IAAA,IAAI,QAAA,CAAS,IAAA,EAAK,CAAE,MAAA,KAAW,CAAA,EAAG;AAChC,MAAA,OAAO;AAAA,QACL,KAAA,EAAO,KAAA;AAAA,QACP,MAAA,EAAQ,CAAC,mEAAmE,CAAA;AAAA,QAC5E,QAAA,EAAU,QAAA,CAAS,MAAA,GAAS,CAAA,GAAI,QAAA,GAAW;AAAA,OAC7C;AAAA,IACF;AACA,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,GAAO,oBAAoB,QAAQ,CAAA;AACzC,MAAA,OAAO;AAAA,QACL,KAAA,EAAO,IAAA;AAAA,QACP,IAAA;AAAA,QACA,QAAA,EAAU,QAAA,CAAS,MAAA,GAAS,CAAA,GAAI,QAAA,GAAW,KAAA;AAAA,OAC7C;AAAA,IACF,SAAS,QAAA,EAAU;AACjB,MAAA,OAAO,OAAA,CAAQ,UAAU,QAAQ,CAAA;AAAA,IACnC;AAAA,EACF;AACF;AAEA,SAAS,OAAA,CAAQ,KAAc,QAAA,EAAiC;AAC9D,EAAA,IAAI,GAAA,YAAe,qBAAA,IAAyB,GAAA,YAAe,eAAA,EAAiB;AAC1E,IAAA,OAAO;AAAA,MACL,KAAA,EAAO,KAAA;AAAA,MACP,MAAA,EAAQ,CAAC,GAAA,CAAI,OAAO,CAAA;AAAA,MACpB,QAAA,EAAU,QAAA,CAAS,MAAA,GAAS,CAAA,GAAI,QAAA,GAAW;AAAA,KAC7C;AAAA,EACF;AACA,EAAA,OAAO;AAAA,IACL,KAAA,EAAO,KAAA;AAAA,IACP,MAAA,EAAQ,CAAC,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA,IACzD,QAAA,EAAU,QAAA,CAAS,MAAA,GAAS,CAAA,GAAI,QAAA,GAAW;AAAA,GAC7C;AACF;AAOO,SAAS,KAAK,GAAA,EAA6B;AAChD,EAAA,OAAO,oBAAoB,GAAG,CAAA;AAChC;AAMO,SAAS,SAAS,IAAA,EAAuB;AAC9C,EAAA,OAAO,KAAA,CAAM,IAAI,CAAA,CAAE,KAAA;AACrB;AAjLA,IA+BM,iBAEA,2BAAA,EAEF,kBAAA;AAnCJ,IAAA,WAAA,GAAA,KAAA,CAAA;AAAA,EAAA,eAAA,GAAA;AA+BA,IAAM,eAAA,GAAkB,oCAAA;AAExB,IAAM,2BAAA,GAA8B,6CAAA;AAEpC,IAAI,kBAAA,GAAqB,KAAA;AAAA,EAAA;AAAA,CAAA,CAAA;;;ACfzB,WAAA,EAAA;AAWO,IAAM,SAAA,GAAY;AAClB,IAAM,eAAA,GAAkB;AACxB,IAAM,kBAAA,GAAqB;AAClC,IAAM,kBAAA,GAAqB,WAAA;AAuD3B,eAAsB,QAAA,CACpB,MAAA,EACA,OAAA,GAA2B,EAAC,EACe;AAC3C,EAAA,MAAM,SAAA,GAAa,OAAA,CAAQ,SAAA,IAAc,UAAA,CAAyC,KAAA;AAGlF,EAAA,IAAI,OAAO,cAAc,UAAA,EAAY;AACnC,IAAA,OAAO;AAAA,MACL,KAAA,EAAO,KAAA;AAAA,MACP,MAAA,EAAQ;AAAA,QACN;AAAA;AACF,KACF;AAAA,EACF;AAEA,EAAA,MAAM,KAAA,GACJ,OAAO,OAAA,KAAY,WAAA,IAAe,OAAO,QAAQ,GAAA,KAAQ,QAAA,GACrD,OAAA,CAAQ,GAAA,CAAI,eAAA,GACZ,MAAA;AACN,EAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,SAAA,IAAa,KAAA,IAAS,kBAAA;AAChD,EAAA,MAAM,QAAA,GAAW,QAAQ,QAAA,IAAY,SAAA;AACrC,EAAA,MAAM,QAAA,GAAW,QAAQ,QAAA,IAAY,OAAA;AAGrC,EAAA,IAAI,eAAA;AACJ,EAAA,IAAI,KAAA;AACJ,EAAA,IAAI,SAAS,OAAA,CAAQ,MAAA;AACrB,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,eAAA,GAAkB,IAAI,eAAA,EAAgB;AACtC,IAAA,MAAA,GAAS,eAAA,CAAgB,MAAA;AACzB,IAAA,MAAM,SAAA,GAAY,QAAQ,SAAA,IAAa,kBAAA;AACvC,IAAA,IAAI,SAAA,GAAY,CAAA,IAAK,MAAA,CAAO,QAAA,CAAS,SAAS,CAAA,EAAG;AAC/C,MAAA,KAAA,GAAQ,UAAA,CAAW,MAAM,eAAA,EAAiB,KAAA,IAAS,SAAS,CAAA;AAAA,IAC9D;AAAA,EACF;AAEA,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,eAAA,EAAiB,MAAM,CAAA;AAC3C,IAAA,MAAM,QAAA,GAAW,MAAM,SAAA,CAAU,GAAA,CAAI,UAAS,EAAG;AAAA,MAC/C,OAAA,EAAS,EAAE,YAAA,EAAc,SAAA,EAAU;AAAA,MACnC,MAAA;AAAA,MACA;AAAA,KACD,CAAA;AAED,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,OAAO;AAAA,QACL,KAAA,EAAO,KAAA;AAAA,QACP,MAAA,EAAQ,CAAC,CAAA,KAAA,EAAQ,QAAA,CAAS,MAAM,CAAA,EAAA,EAAK,QAAA,CAAS,UAAU,CAAA,CAAE;AAAA,OAC5D;AAAA,IACF;AAEA,IAAA,MAAM,OAAA,GAAU,MAAM,QAAA,CAAS,IAAA,EAAK;AACpC,IAAA,IAAI,OAAA,CAAQ,SAAS,QAAA,EAAU;AAC7B,MAAA,OAAO;AAAA,QACL,KAAA,EAAO,KAAA;AAAA,QACP,QAAQ,CAAC,CAAA,iBAAA,EAAoB,QAAQ,CAAA,YAAA,EAAe,OAAA,CAAQ,MAAM,CAAA,CAAA,CAAG;AAAA,OACvE;AAAA,IACF;AACA,IAAA,MAAM,EAAE,KAAA,EAAAA,MAAAA,EAAM,GAAI,MAAM,OAAA,CAAA,OAAA,EAAA,CAAA,IAAA,CAAA,OAAA,WAAA,EAAA,EAAA,cAAA,CAAA,CAAA;AACxB,IAAA,OAAOA,OAAM,OAAO,CAAA;AAAA,EACtB,SAAS,KAAA,EAAO;AACd,IAAA,OAAO;AAAA,MACL,KAAA,EAAO,KAAA;AAAA,MACP,MAAA,EAAQ,CAAC,CAAA,kBAAA,EAAqB,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA,CAAE;AAAA,KACxF;AAAA,EACF,CAAA,SAAE;AACA,IAAA,IAAI,KAAA,eAAoB,KAAK,CAAA;AAAA,EAC/B;AACF","file":"index.js","sourcesContent":["/**\n * @peac/disc/parser - thin peac.txt policy-document loader/validator.\n *\n * peac.txt is a POLICY DOCUMENT surface per docs/specs/PEAC-TXT.md.\n * Full parsing is delegated to `@peac/policy-kit.parsePolicyDocument`;\n * this module only provides:\n *\n *   - format detection (YAML vs JSON) per PEAC-TXT.md §5.1\n *   - a tolerant `parse()` wrapper that returns a structured `ParseResult`\n *     (rather than throwing)\n *   - structured warnings for legacy key-discovery lines (`verify`,\n *     `public_keys`, `jwks`) that appeared in pre-v0.12.14 peac.txt\n *     examples. Those lines are NEVER honored here: key discovery flows\n *     through `iss` -> /.well-known/peac-issuer.json -> `jwks_uri` -> JWKS\n *     (docs/specs/PEAC-ISSUER.md).\n *   - a tiny `emit()` helper that serializes a `PolicyDocument` via\n *     `@peac/policy-kit.serializePolicyYaml`\n *\n * @see docs/specs/PEAC-TXT.md\n * @see docs/specs/PEAC-ISSUER.md\n */\n\nimport {\n  PolicyLoadError,\n  PolicyValidationError,\n  parsePolicyDocument,\n  serializePolicyYaml,\n  type PolicyDocument,\n} from '@peac/policy-kit';\nimport type { ParseResult } from './types.js';\n\nconst LEGACY_KEY_LINE = /^\\s*(verify|public_keys|jwks)\\s*:/m;\n/** Strips the whole line (including the trailing newline) when matched. */\nconst LEGACY_KEY_FULL_LINE_GLOBAL = /^\\s*(verify|public_keys|jwks)\\s*:.*\\r?\\n?/gm;\n\nlet legacyWarningFired = false;\n\nfunction fireLegacyWarning(field: string): void {\n  if (legacyWarningFired) return;\n  legacyWarningFired = true;\n  if (typeof process !== 'undefined' && typeof process.emitWarning === 'function') {\n    process.emitWarning(\n      `peac.txt legacy key-discovery field \"${field}\" is deprecated and ignored. ` +\n        `peac.txt is a policy-document surface (docs/specs/PEAC-TXT.md). ` +\n        `Key resolution uses iss -> /.well-known/peac-issuer.json -> jwks_uri -> JWKS.`,\n      { code: 'PEAC_LEGACY_PEAC_TXT_KEY_FIELD', type: 'DeprecationWarning' }\n    );\n  }\n}\n\n/**\n * Reset the one-shot legacy-warning flag. Exposed for tests that need to\n * observe the warning more than once per process.\n */\nexport function __resetLegacyWarningForTests(): void {\n  legacyWarningFired = false;\n}\n\nfunction collectLegacyWarnings(text: string): { warnings: string[]; firstField: string | null } {\n  const warnings: string[] = [];\n  let firstField: string | null = null;\n  const lines = text.split(/\\r?\\n/);\n  lines.forEach((line, idx) => {\n    const match = line.match(/^\\s*(verify|public_keys|jwks)\\s*:/);\n    if (match) {\n      if (firstField === null) firstField = match[1];\n      warnings.push(\n        `Line ${idx + 1}: legacy key-discovery field \"${match[1]}\" ignored ` +\n          `(peac.txt is policy-only; use peac-issuer.json for keys)`\n      );\n    }\n  });\n  return { warnings, firstField };\n}\n\n/**\n * Parse a peac.txt policy document. Accepts YAML or JSON per\n * `docs/specs/PEAC-TXT.md` §5.1. On success, `data` is the validated\n * `peac-policy/0.1` `PolicyDocument`.\n *\n * Legacy key-discovery lines (`verify:`, `public_keys:`, `jwks:`) are\n * tolerated via a two-pass strategy: first the raw bytes are handed to\n * `parsePolicyDocument`; if validation fails AND top-level legacy lines\n * are present, the legacy lines are stripped and parsing is retried\n * once. Detected legacy lines are listed in `warnings` and surface a\n * structured `PEAC_LEGACY_PEAC_TXT_KEY_FIELD` `DeprecationWarning` once\n * per process. They never populate the parsed result. This preserves\n * the original bytes when a policy document happens to mention those\n * tokens inside comments, block scalars, or rule text.\n */\nexport function parse(text: string): ParseResult {\n  const warnings: string[] = [];\n\n  if (text.trim().length === 0) {\n    return {\n      valid: false,\n      errors: ['Empty policy document. Expected peac-policy/0.1 YAML or JSON.'],\n    };\n  }\n\n  const hasLegacyLines = LEGACY_KEY_LINE.test(text);\n\n  // First pass: try the raw bytes. If they parse cleanly, legacy-looking\n  // substrings inside block scalars / comments / rule text are not\n  // mutated.\n  try {\n    const data = parsePolicyDocument(text);\n    if (hasLegacyLines) {\n      const legacy = collectLegacyWarnings(text);\n      warnings.push(...legacy.warnings);\n      if (legacy.firstField) fireLegacyWarning(legacy.firstField);\n    }\n    return {\n      valid: true,\n      data,\n      warnings: warnings.length > 0 ? warnings : undefined,\n    };\n  } catch (firstErr) {\n    if (!hasLegacyLines) {\n      return failure(firstErr, warnings);\n    }\n    // Second pass: strip top-level legacy key-discovery lines and retry.\n    const legacy = collectLegacyWarnings(text);\n    warnings.push(...legacy.warnings);\n    if (legacy.firstField) fireLegacyWarning(legacy.firstField);\n\n    const stripped = text.replace(LEGACY_KEY_FULL_LINE_GLOBAL, '');\n    if (stripped.trim().length === 0) {\n      return {\n        valid: false,\n        errors: ['Empty policy document after stripping legacy key-discovery lines.'],\n        warnings: warnings.length > 0 ? warnings : undefined,\n      };\n    }\n    try {\n      const data = parsePolicyDocument(stripped);\n      return {\n        valid: true,\n        data,\n        warnings: warnings.length > 0 ? warnings : undefined,\n      };\n    } catch (retryErr) {\n      return failure(retryErr, warnings);\n    }\n  }\n}\n\nfunction failure(err: unknown, warnings: string[]): ParseResult {\n  if (err instanceof PolicyValidationError || err instanceof PolicyLoadError) {\n    return {\n      valid: false,\n      errors: [err.message],\n      warnings: warnings.length > 0 ? warnings : undefined,\n    };\n  }\n  return {\n    valid: false,\n    errors: [err instanceof Error ? err.message : String(err)],\n    warnings: warnings.length > 0 ? warnings : undefined,\n  };\n}\n\n/**\n * Serialize a `peac-policy/0.1` `PolicyDocument` as YAML suitable for\n * serving at `/.well-known/peac.txt`. Delegates to\n * `@peac/policy-kit.serializePolicyYaml`.\n */\nexport function emit(doc: PolicyDocument): string {\n  return serializePolicyYaml(doc);\n}\n\n/**\n * Convenience predicate: returns `true` iff `text` parses as a valid\n * `peac-policy/0.1` document.\n */\nexport function validate(text: string): boolean {\n  return parse(text).valid;\n}\n","/**\n * @peac/disc - thin peac.txt policy-document loader/validator and remote fetcher.\n *\n * peac.txt is a POLICY DOCUMENT surface per docs/specs/PEAC-TXT.md. Full\n * parsing is delegated to `@peac/policy-kit.parsePolicyDocument`; this\n * package provides a tolerant `parse()` wrapper, a `discover()` remote\n * fetcher, and structured warnings for legacy key-discovery lines that\n * appeared in older peac.txt examples.\n *\n * `peac.txt` is NOT a key discovery surface. Cryptographic key resolution\n * flows through `iss` -> /.well-known/peac-issuer.json -> `jwks_uri` -> JWKS\n * (docs/specs/PEAC-ISSUER.md). Callers that need key material MUST use\n * `parseIssuerConfig` / `fetchIssuerConfig` from `@peac/protocol`.\n *\n * Legacy key-discovery lines (`verify:`, `public_keys:`, `jwks:`) are\n * tolerated on parse: they are stripped before validation, surfaced on\n * `ParseResult.warnings`, and fire a structured `process.emitWarning`\n * with code `PEAC_LEGACY_PEAC_TXT_KEY_FIELD` once per process.\n */\n\nexport { parse, emit, validate, __resetLegacyWarningForTests } from './parser.js';\nexport type { ParseResult, ValidationOptions, PolicyDocument } from './types.js';\n\n/**\n * @deprecated Retained for one minor to keep existing import paths\n * compiling. peac.txt policy documents now resolve to a `PolicyDocument`\n * (re-exported from `@peac/policy-kit`). Removal target: next cleanup\n * release.\n */\nexport type { PeacDiscovery, PublicKeyInfo } from './types.js';\n\nexport const MAX_BYTES = 262144; // 256 KiB, per docs/specs/PEAC-TXT.md §6.1\nexport const WELL_KNOWN_PATH = '/.well-known/peac.txt';\nexport const DEFAULT_TIMEOUT_MS = 5000;\nconst DEFAULT_USER_AGENT = 'peac-disc';\n\n/**\n * Minimal fetch signature accepted by `discover`. `undici` / `node-fetch` /\n * browser / test-double implementations all satisfy this.\n */\nexport type DiscoverFetch = (\n  input: string,\n  init?: {\n    headers?: Record<string, string>;\n    signal?: AbortSignal;\n    redirect?: 'follow' | 'error' | 'manual';\n  }\n) => Promise<{\n  ok: boolean;\n  status: number;\n  statusText: string;\n  text(): Promise<string>;\n}>;\n\nexport interface DiscoverOptions {\n  /**\n   * HTTP fetch implementation. Defaults to the ambient `fetch` global.\n   * Supply `undici.fetch`, a test double, or a policy-wrapping client as\n   * needed.\n   */\n  fetchImpl?: DiscoverFetch;\n  /**\n   * User-agent string. Precedence (highest first): this option, the\n   * `PEAC_USER_AGENT` environment variable, then `peac-disc`.\n   */\n  userAgent?: string;\n  /** Caller-supplied abort signal. */\n  signal?: AbortSignal;\n  /**\n   * Millisecond timeout. Ignored when `signal` is supplied (the caller\n   * owns cancellation). Defaults to 5_000 when neither is provided.\n   */\n  timeoutMs?: number;\n  /** Override the 256 KiB body cap from docs/specs/PEAC-TXT.md §6.1. */\n  maxBytes?: number;\n  /**\n   * Redirect policy. Defaults to `error` to avoid cross-origin surprise\n   * on a well-known discovery endpoint; set to `follow` explicitly if the\n   * deployment relies on server-side redirects.\n   */\n  redirect?: 'follow' | 'error' | 'manual';\n}\n\n/**\n * Fetch and parse a remote peac.txt policy document. On success returns a\n * `ParseResult` whose `data` is the validated `peac-policy/0.1`\n * `PolicyDocument`. Legacy key-discovery lines in the fetched bytes are\n * surfaced as warnings but never populate `data`.\n */\nexport async function discover(\n  origin: string,\n  options: DiscoverOptions = {}\n): Promise<import('./types.js').ParseResult> {\n  const fetchImpl = (options.fetchImpl ?? (globalThis as { fetch?: DiscoverFetch }).fetch) as\n    | DiscoverFetch\n    | undefined;\n  if (typeof fetchImpl !== 'function') {\n    return {\n      valid: false,\n      errors: [\n        'Discovery failed: no fetch implementation available (supply options.fetchImpl or provide a global fetch)',\n      ],\n    };\n  }\n\n  const envUa =\n    typeof process !== 'undefined' && typeof process.env === 'object'\n      ? process.env.PEAC_USER_AGENT\n      : undefined;\n  const userAgent = options.userAgent ?? envUa ?? DEFAULT_USER_AGENT;\n  const maxBytes = options.maxBytes ?? MAX_BYTES;\n  const redirect = options.redirect ?? 'error';\n\n  // If the caller did not supply an AbortSignal, install a local one driven by timeoutMs.\n  let localController: AbortController | undefined;\n  let timer: ReturnType<typeof setTimeout> | undefined;\n  let signal = options.signal;\n  if (!signal) {\n    localController = new AbortController();\n    signal = localController.signal;\n    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;\n    if (timeoutMs > 0 && Number.isFinite(timeoutMs)) {\n      timer = setTimeout(() => localController?.abort(), timeoutMs);\n    }\n  }\n\n  try {\n    const url = new URL(WELL_KNOWN_PATH, origin);\n    const response = await fetchImpl(url.toString(), {\n      headers: { 'User-Agent': userAgent },\n      signal,\n      redirect,\n    });\n\n    if (!response.ok) {\n      return {\n        valid: false,\n        errors: [`HTTP ${response.status}: ${response.statusText}`],\n      };\n    }\n\n    const content = await response.text();\n    if (content.length > maxBytes) {\n      return {\n        valid: false,\n        errors: [`peac.txt exceeds ${maxBytes} bytes (got ${content.length})`],\n      };\n    }\n    const { parse } = await import('./parser.js');\n    return parse(content);\n  } catch (error) {\n    return {\n      valid: false,\n      errors: [`Discovery failed: ${error instanceof Error ? error.message : String(error)}`],\n    };\n  } finally {\n    if (timer) clearTimeout(timer);\n  }\n}\n"]}

package/dist/parser.d.ts

@@ -1,9 +1,56 @@
 /**
- * @peac/disc/parser - peac.txt parser with ≤20 lines enforcement
- * ABNF-compliant discovery document parsing
+ * @peac/disc/parser - thin peac.txt policy-document loader/validator.
+ *
+ * peac.txt is a POLICY DOCUMENT surface per docs/specs/PEAC-TXT.md.
+ * Full parsing is delegated to `@peac/policy-kit.parsePolicyDocument`;
+ * this module only provides:
+ *
+ *   - format detection (YAML vs JSON) per PEAC-TXT.md §5.1
+ *   - a tolerant `parse()` wrapper that returns a structured `ParseResult`
+ *     (rather than throwing)
+ *   - structured warnings for legacy key-discovery lines (`verify`,
+ *     `public_keys`, `jwks`) that appeared in pre-v0.12.14 peac.txt
+ *     examples. Those lines are NEVER honored here: key discovery flows
+ *     through `iss` -> /.well-known/peac-issuer.json -> `jwks_uri` -> JWKS
+ *     (docs/specs/PEAC-ISSUER.md).
+ *   - a tiny `emit()` helper that serializes a `PolicyDocument` via
+ *     `@peac/policy-kit.serializePolicyYaml`
+ *
+ * @see docs/specs/PEAC-TXT.md
+ * @see docs/specs/PEAC-ISSUER.md
  */
-import type { PeacDiscovery, ParseResult, ValidationOptions } from './types.js';
-export declare function parse(content: string, options?: ValidationOptions): ParseResult;
-export declare function emit(data: PeacDiscovery): string;
-export declare function validate(content: string): boolean;
+import { type PolicyDocument } from '@peac/policy-kit';
+import type { ParseResult } from './types.js';
+/**
+ * Reset the one-shot legacy-warning flag. Exposed for tests that need to
+ * observe the warning more than once per process.
+ */
+export declare function __resetLegacyWarningForTests(): void;
+/**
+ * Parse a peac.txt policy document. Accepts YAML or JSON per
+ * `docs/specs/PEAC-TXT.md` §5.1. On success, `data` is the validated
+ * `peac-policy/0.1` `PolicyDocument`.
+ *
+ * Legacy key-discovery lines (`verify:`, `public_keys:`, `jwks:`) are
+ * tolerated via a two-pass strategy: first the raw bytes are handed to
+ * `parsePolicyDocument`; if validation fails AND top-level legacy lines
+ * are present, the legacy lines are stripped and parsing is retried
+ * once. Detected legacy lines are listed in `warnings` and surface a
+ * structured `PEAC_LEGACY_PEAC_TXT_KEY_FIELD` `DeprecationWarning` once
+ * per process. They never populate the parsed result. This preserves
+ * the original bytes when a policy document happens to mention those
+ * tokens inside comments, block scalars, or rule text.
+ */
+export declare function parse(text: string): ParseResult;
+/**
+ * Serialize a `peac-policy/0.1` `PolicyDocument` as YAML suitable for
+ * serving at `/.well-known/peac.txt`. Delegates to
+ * `@peac/policy-kit.serializePolicyYaml`.
+ */
+export declare function emit(doc: PolicyDocument): string;
+/**
+ * Convenience predicate: returns `true` iff `text` parses as a valid
+ * `peac-policy/0.1` document.
+ */
+export declare function validate(text: string): boolean;
 //# sourceMappingURL=parser.d.ts.map

package/dist/parser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parser.d.ts","sourceRoot":"","sources":["../src/parser.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAiB,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAa/F,wBAAgB,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,iBAAsB,GAAG,WAAW,CAsEnF;AAwCD,wBAAgB,IAAI,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CA6ChD;AAED,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAGjD"}
+{"version":3,"file":"parser.d.ts","sourceRoot":"","sources":["../src/parser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAKL,KAAK,cAAc,EACpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAqB9C;;;GAGG;AACH,wBAAgB,4BAA4B,IAAI,IAAI,CAEnD;AAmBD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAuD/C;AAiBD;;;;GAIG;AACH,wBAAgB,IAAI,CAAC,GAAG,EAAE,cAAc,GAAG,MAAM,CAEhD;AAED;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE9C"}

package/dist/types.d.ts

@@ -1,28 +1,57 @@
 /**
- * @peac/disc/types - Discovery types for .well-known/peac.txt
+ * @peac/disc/types - Discovery result types for .well-known/peac.txt
+ *
+ * peac.txt is a POLICY DOCUMENT surface per docs/specs/PEAC-TXT.md.
+ * It is NOT a key discovery surface. Key resolution uses the normative
+ * chain: `iss` -> /.well-known/peac-issuer.json -> `jwks_uri` -> JWKS.
+ *
+ * `@peac/disc` is a thin loader/validator over peac-policy/0.1 bytes
+ * (YAML or JSON). Full parsing is delegated to
+ * `@peac/policy-kit.parsePolicyDocument`; the canonical `PolicyDocument`
+ * type is re-exported from `@peac/policy-kit`.
+ *
+ * @see docs/specs/PEAC-TXT.md
+ * @see docs/specs/PEAC-ISSUER.md
  */
-export interface PeacDiscovery {
-    preferences?: string;
-    access_control?: string;
-    payments?: string[];
-    provenance?: string;
-    receipts?: 'required' | 'optional';
-    verify?: string;
-    public_keys?: PublicKeyInfo[];
+import type { PolicyDocument } from '@peac/policy-kit';
+export type { PolicyDocument };
+/**
+ * Result of `parse()`. On success, `data` is the validated
+ * `peac-policy/0.1` `PolicyDocument`. On failure, `errors` explains why.
+ * `warnings` carries non-fatal advisories; in particular, legacy
+ * key-discovery lines (`verify`, `public_keys`, `jwks`) that appeared in
+ * older peac.txt examples are listed here and also fire a structured
+ * `process.emitWarning` with code `PEAC_LEGACY_PEAC_TXT_KEY_FIELD`
+ * once per process.
+ */
+export interface ParseResult {
+    valid: boolean;
+    data?: PolicyDocument;
+    errors?: string[];
+    warnings?: string[];
+}
+export interface ValidationOptions {
+    /** Soft line cap for advisory purposes (default 100, per PEAC-TXT.md §6.2). */
+    recommendedMaxLines?: number;
 }
+/**
+ * @deprecated Key discovery via peac.txt is retired. Use the normative
+ * discovery chain `iss` -> /.well-known/peac-issuer.json -> `jwks_uri` ->
+ * JWKS instead. This type is retained for one minor to keep existing import
+ * paths compiling. Removal target: next cleanup release.
+ */
 export interface PublicKeyInfo {
     kid: string;
     alg: string;
     key: string;
 }
-export interface ParseResult {
-    valid: boolean;
-    data?: PeacDiscovery;
-    errors?: string[];
-    lineCount?: number;
-}
-export interface ValidationOptions {
-    maxLines?: number;
-    strictAbnf?: boolean;
+/**
+ * @deprecated pre-v0.12.14 alias for the legacy line-based PEAC discovery
+ * shape. Use the `ParseResult.data` (`PolicyDocument`) returned by `parse()`.
+ * Retained for one minor so existing import paths keep compiling; removal
+ * target: next cleanup release.
+ */
+export interface PeacDiscovery {
+    [key: string]: unknown;
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,WAAW,aAAa;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,UAAU,GAAG,UAAU,CAAC;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,aAAa,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEvD,YAAY,EAAE,cAAc,EAAE,CAAC;AAE/B;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,cAAc,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,iBAAiB;IAChC,+EAA+E;IAC/E,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@peac/disc",
-  "version": "0.12.13",
-  "description": "PEAC discovery with ≤20 lines enforcement",
+  "version": "0.12.14",
+  "description": "Thin loader / validator and remote fetcher for peac.txt policy documents (peac-policy/0.1; docs/specs/PEAC-TXT.md)",
   "type": "module",
   "main": "dist/index.cjs",
   "types": "dist/index.d.ts",
@@ -20,7 +20,9 @@
     "README.md",
     "LICENSE"
   ],
-  "dependencies": {},
+  "dependencies": {
+    "@peac/policy-kit": "0.12.14"
+  },
   "devDependencies": {
     "typescript": "^5.0.0",
     "tsup": "^8.0.0"