@peac/mappings-ucp 0.9.31

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;GAEG;AACH,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;CAkCb,CAAC;AAEX,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,OAAO,UAAU,CAAC,CAAC;AAErE;;GAEG;AACH,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CA4BrD,CAAC;AAEF;;GAEG;AACH,qBAAa,QAAS,SAAQ,KAAK;IACjC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;gBAE/B,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAQ/E,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAQlC;AAED;;GAEG;AACH,wBAAgB,QAAQ,CACtB,IAAI,EAAE,SAAS,EACf,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,QAAQ,CAEV"}

package/dist/errors.js

@@ -0,0 +1,97 @@
+/**
+ * @peac/mappings-ucp - Error codes
+ *
+ * UCP webhook verification and mapping error codes.
+ * Follows E_UCP_* naming convention.
+ */
+/**
+ * UCP error codes.
+ */
+export const ErrorCodes = {
+    // Signature verification errors (400 - malformed)
+    SIGNATURE_MISSING: 'E_UCP_SIGNATURE_MISSING',
+    SIGNATURE_MALFORMED: 'E_UCP_SIGNATURE_MALFORMED',
+    SIGNATURE_ALGORITHM_UNSUPPORTED: 'E_UCP_SIGNATURE_ALGORITHM_UNSUPPORTED',
+    SIGNATURE_B64_INVALID: 'E_UCP_SIGNATURE_B64_INVALID',
+    // Key errors (401 - auth failure)
+    KEY_NOT_FOUND: 'E_UCP_KEY_NOT_FOUND',
+    KEY_ALGORITHM_MISMATCH: 'E_UCP_KEY_ALGORITHM_MISMATCH',
+    KEY_CURVE_MISMATCH: 'E_UCP_KEY_CURVE_MISMATCH',
+    // Verification errors (401 - auth failure)
+    SIGNATURE_INVALID: 'E_UCP_SIGNATURE_INVALID',
+    VERIFICATION_FAILED: 'E_UCP_VERIFICATION_FAILED',
+    // Profile errors (502 - upstream failure)
+    PROFILE_FETCH_FAILED: 'E_UCP_PROFILE_FETCH_FAILED',
+    PROFILE_INVALID: 'E_UCP_PROFILE_INVALID',
+    PROFILE_NO_SIGNING_KEYS: 'E_UCP_PROFILE_NO_SIGNING_KEYS',
+    // Payload errors (400 - malformed)
+    PAYLOAD_EMPTY: 'E_UCP_PAYLOAD_EMPTY',
+    PAYLOAD_NOT_JSON: 'E_UCP_PAYLOAD_NOT_JSON',
+    PAYLOAD_TOO_LARGE: 'E_UCP_PAYLOAD_TOO_LARGE',
+    // Mapping errors (400 - malformed)
+    ORDER_INVALID: 'E_UCP_ORDER_INVALID',
+    ORDER_MISSING_ID: 'E_UCP_ORDER_MISSING_ID',
+    ORDER_MISSING_LINE_ITEMS: 'E_UCP_ORDER_MISSING_LINE_ITEMS',
+    ORDER_MISSING_TOTALS: 'E_UCP_ORDER_MISSING_TOTALS',
+    // Evidence errors (500 - internal)
+    EVIDENCE_SERIALIZATION_FAILED: 'E_UCP_EVIDENCE_SERIALIZATION_FAILED',
+};
+/**
+ * HTTP status codes for each error.
+ */
+export const ErrorHttpStatus = {
+    // 400 - Bad Request (malformed)
+    [ErrorCodes.SIGNATURE_MISSING]: 400,
+    [ErrorCodes.SIGNATURE_MALFORMED]: 400,
+    [ErrorCodes.SIGNATURE_ALGORITHM_UNSUPPORTED]: 400,
+    [ErrorCodes.SIGNATURE_B64_INVALID]: 400,
+    [ErrorCodes.PAYLOAD_EMPTY]: 400,
+    [ErrorCodes.PAYLOAD_NOT_JSON]: 400,
+    [ErrorCodes.PAYLOAD_TOO_LARGE]: 400,
+    [ErrorCodes.ORDER_INVALID]: 400,
+    [ErrorCodes.ORDER_MISSING_ID]: 400,
+    [ErrorCodes.ORDER_MISSING_LINE_ITEMS]: 400,
+    [ErrorCodes.ORDER_MISSING_TOTALS]: 400,
+    // 401 - Unauthorized (auth failure)
+    [ErrorCodes.KEY_NOT_FOUND]: 401,
+    [ErrorCodes.KEY_ALGORITHM_MISMATCH]: 401,
+    [ErrorCodes.KEY_CURVE_MISMATCH]: 401,
+    [ErrorCodes.SIGNATURE_INVALID]: 401,
+    [ErrorCodes.VERIFICATION_FAILED]: 401,
+    // 500 - Internal Server Error
+    [ErrorCodes.EVIDENCE_SERIALIZATION_FAILED]: 500,
+    // 502 - Bad Gateway (upstream failure)
+    [ErrorCodes.PROFILE_FETCH_FAILED]: 502,
+    [ErrorCodes.PROFILE_INVALID]: 502,
+    [ErrorCodes.PROFILE_NO_SIGNING_KEYS]: 502,
+};
+/**
+ * UCP-specific error class.
+ */
+export class UcpError extends Error {
+    code;
+    httpStatus;
+    details;
+    constructor(code, message, details) {
+        super(message);
+        this.name = 'UcpError';
+        this.code = code;
+        this.httpStatus = ErrorHttpStatus[code];
+        this.details = details;
+    }
+    toJSON() {
+        return {
+            code: this.code,
+            message: this.message,
+            httpStatus: this.httpStatus,
+            ...(this.details && { details: this.details }),
+        };
+    }
+}
+/**
+ * Create a UCP error with standard format.
+ */
+export function ucpError(code, message, details) {
+    return new UcpError(code, message, details);
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;GAEG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,kDAAkD;IAClD,iBAAiB,EAAE,yBAAyB;IAC5C,mBAAmB,EAAE,2BAA2B;IAChD,+BAA+B,EAAE,uCAAuC;IACxE,qBAAqB,EAAE,6BAA6B;IAEpD,kCAAkC;IAClC,aAAa,EAAE,qBAAqB;IACpC,sBAAsB,EAAE,8BAA8B;IACtD,kBAAkB,EAAE,0BAA0B;IAE9C,2CAA2C;IAC3C,iBAAiB,EAAE,yBAAyB;IAC5C,mBAAmB,EAAE,2BAA2B;IAEhD,0CAA0C;IAC1C,oBAAoB,EAAE,4BAA4B;IAClD,eAAe,EAAE,uBAAuB;IACxC,uBAAuB,EAAE,+BAA+B;IAExD,mCAAmC;IACnC,aAAa,EAAE,qBAAqB;IACpC,gBAAgB,EAAE,wBAAwB;IAC1C,iBAAiB,EAAE,yBAAyB;IAE5C,mCAAmC;IACnC,aAAa,EAAE,qBAAqB;IACpC,gBAAgB,EAAE,wBAAwB;IAC1C,wBAAwB,EAAE,gCAAgC;IAC1D,oBAAoB,EAAE,4BAA4B;IAElD,mCAAmC;IACnC,6BAA6B,EAAE,qCAAqC;CAC5D,CAAC;AAIX;;GAEG;AACH,MAAM,CAAC,MAAM,eAAe,GAA8B;IACxD,gCAAgC;IAChC,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,GAAG;IACnC,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,GAAG;IACrC,CAAC,UAAU,CAAC,+BAA+B,CAAC,EAAE,GAAG;IACjD,CAAC,UAAU,CAAC,qBAAqB,CAAC,EAAE,GAAG;IACvC,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,GAAG;IAC/B,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,GAAG;IAClC,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,GAAG;IACnC,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,GAAG;IAC/B,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,GAAG;IAClC,CAAC,UAAU,CAAC,wBAAwB,CAAC,EAAE,GAAG;IAC1C,CAAC,UAAU,CAAC,oBAAoB,CAAC,EAAE,GAAG;IAEtC,oCAAoC;IACpC,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,GAAG;IAC/B,CAAC,UAAU,CAAC,sBAAsB,CAAC,EAAE,GAAG;IACxC,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,GAAG;IACpC,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,GAAG;IACnC,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,GAAG;IAErC,8BAA8B;IAC9B,CAAC,UAAU,CAAC,6BAA6B,CAAC,EAAE,GAAG;IAE/C,uCAAuC;IACvC,CAAC,UAAU,CAAC,oBAAoB,CAAC,EAAE,GAAG;IACtC,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,GAAG;IACjC,CAAC,UAAU,CAAC,uBAAuB,CAAC,EAAE,GAAG;CAC1C,CAAC;AAEF;;GAEG;AACH,MAAM,OAAO,QAAS,SAAQ,KAAK;IACxB,IAAI,CAAY;IAChB,UAAU,CAAS;IACnB,OAAO,CAA2B;IAE3C,YAAY,IAAe,EAAE,OAAe,EAAE,OAAiC;QAC7E,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED,MAAM;QACJ,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;SAC/C,CAAC;IACJ,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,QAAQ,CACtB,IAAe,EACf,OAAe,EACf,OAAiC;IAEjC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAC9C,CAAC"}

package/dist/evidence.d.ts

@@ -0,0 +1,69 @@
+/**
+ * @peac/mappings-ucp - Evidence YAML generation
+ *
+ * Generates deterministic YAML for UCP webhook evidence.
+ * Uses fixed key ordering (manual string building) for byte-stable output.
+ *
+ * Key design principles:
+ * 1. Cannot be misinterpreted as executable policy (peac_bundle_metadata_version first)
+ * 2. Stores both raw and JCS payload representations for reproducible verification
+ * 3. Includes full signature header value for offline replay
+ * 4. Records all verification attempts for debugging
+ * 5. Timestamps are injected, not generated, for deterministic fixtures
+ */
+import type { UcpWebhookEvidence, PayloadEvidence, SignatureEvidence, ProfileSnapshot, WebhookEventMeta, LinkedReceipt, VerificationAttempt, UcpSigningKey } from './types.js';
+/**
+ * Options for creating UCP webhook evidence.
+ */
+export interface CreateEvidenceOptions {
+    /** HTTP method */
+    method: string;
+    /** Request path */
+    path: string;
+    /** When request was received (ISO 8601) - REQUIRED for determinism */
+    received_at: string;
+    /** Payload evidence */
+    payload: PayloadEvidence;
+    /** Signature evidence */
+    signature: SignatureEvidence;
+    /** Profile snapshot */
+    profile: ProfileSnapshot;
+    /** Event metadata (optional) */
+    event?: WebhookEventMeta;
+    /** Linked receipts (optional) */
+    linked_receipts?: LinkedReceipt[];
+}
+/**
+ * Create UCP webhook evidence object.
+ * Use serializeEvidenceYaml() to convert to deterministic YAML string.
+ */
+export declare function createUcpWebhookEvidence(options: CreateEvidenceOptions): UcpWebhookEvidence;
+/**
+ * Serialize evidence to deterministic YAML string.
+ * Uses fixed key ordering for byte-stable output.
+ *
+ * IMPORTANT: Do NOT use a YAML serializer library as they may reorder keys.
+ */
+export declare function serializeEvidenceYaml(evidence: UcpWebhookEvidence): string;
+/**
+ * Create payload evidence from raw request body.
+ */
+export declare function createPayloadEvidence(bodyBytes: Uint8Array, options?: {
+    maxBodyEvidenceBytes?: number;
+    includeJcsText?: boolean;
+}): PayloadEvidence;
+/**
+ * Create signature evidence from verification result.
+ */
+export declare function createSignatureEvidence(headerValue: string, header: {
+    kid: string;
+    alg: string;
+    b64?: boolean;
+    crit?: string[];
+}, verified: boolean, attempts: VerificationAttempt[], modeUsed?: 'raw' | 'jcs'): SignatureEvidence;
+/**
+ * Create profile snapshot from fetched profile.
+ */
+export declare function createProfileSnapshot(url: string, profile: Record<string, unknown>, keyUsed: UcpSigningKey, fetchedAt: string): ProfileSnapshot;
+export { sha256Hex, sha256Bytes, base64urlEncode, jcsCanonicalizeSync } from './util.js';
+//# sourceMappingURL=evidence.d.ts.map

package/dist/evidence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidence.d.ts","sourceRoot":"","sources":["../src/evidence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EACV,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,gBAAgB,EAChB,aAAa,EACb,mBAAmB,EACnB,aAAa,EACd,MAAM,YAAY,CAAC;AASpB;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,kBAAkB;IAClB,MAAM,EAAE,MAAM,CAAC;IAEf,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IAEb,sEAAsE;IACtE,WAAW,EAAE,MAAM,CAAC;IAEpB,uBAAuB;IACvB,OAAO,EAAE,eAAe,CAAC;IAEzB,yBAAyB;IACzB,SAAS,EAAE,iBAAiB,CAAC;IAE7B,uBAAuB;IACvB,OAAO,EAAE,eAAe,CAAC;IAEzB,gCAAgC;IAChC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAEzB,iCAAiC;IACjC,eAAe,CAAC,EAAE,aAAa,EAAE,CAAC;CACnC;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,qBAAqB,GAAG,kBAAkB,CAmB3F;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,MAAM,CAwH1E;AAcD;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,UAAU,EACrB,OAAO,GAAE;IACP,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,cAAc,CAAC,EAAE,OAAO,CAAC;CACrB,GACL,eAAe,CAyCjB;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CACrC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,EACpE,QAAQ,EAAE,OAAO,EACjB,QAAQ,EAAE,mBAAmB,EAAE,EAC/B,QAAQ,CAAC,EAAE,KAAK,GAAG,KAAK,GACvB,iBAAiB,CAWnB;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,OAAO,EAAE,aAAa,EACtB,SAAS,EAAE,MAAM,GAChB,eAAe,CAuBjB;AAGD,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC"}

package/dist/evidence.js

@@ -0,0 +1,249 @@
+/**
+ * @peac/mappings-ucp - Evidence YAML generation
+ *
+ * Generates deterministic YAML for UCP webhook evidence.
+ * Uses fixed key ordering (manual string building) for byte-stable output.
+ *
+ * Key design principles:
+ * 1. Cannot be misinterpreted as executable policy (peac_bundle_metadata_version first)
+ * 2. Stores both raw and JCS payload representations for reproducible verification
+ * 3. Includes full signature header value for offline replay
+ * 4. Records all verification attempts for debugging
+ * 5. Timestamps are injected, not generated, for deterministic fixtures
+ */
+import { UCP_EVIDENCE_VERSION } from './types.js';
+import { sha256Hex, sha256Bytes, base64urlEncode, jcsCanonicalizeSync } from './util.js';
+/**
+ * Maximum body size to include as base64url in evidence (256KB).
+ */
+const DEFAULT_MAX_BODY_EVIDENCE_BYTES = 256 * 1024;
+/**
+ * Create UCP webhook evidence object.
+ * Use serializeEvidenceYaml() to convert to deterministic YAML string.
+ */
+export function createUcpWebhookEvidence(options) {
+    const { method, path, received_at, payload, signature, profile, event, linked_receipts } = options;
+    return {
+        peac_bundle_metadata_version: UCP_EVIDENCE_VERSION,
+        kind: 'evidence_attachment',
+        scope: 'ucp_webhook',
+        request: {
+            method,
+            path,
+            received_at,
+        },
+        payload,
+        signature,
+        ...(event && { event }),
+        profile,
+        ...(linked_receipts && linked_receipts.length > 0 && { linked_receipts }),
+    };
+}
+/**
+ * Serialize evidence to deterministic YAML string.
+ * Uses fixed key ordering for byte-stable output.
+ *
+ * IMPORTANT: Do NOT use a YAML serializer library as they may reorder keys.
+ */
+export function serializeEvidenceYaml(evidence) {
+    const lines = [];
+    // Header comment
+    lines.push('# PEAC UCP Webhook Evidence');
+    lines.push('# This file is evidence data, NOT executable policy');
+    lines.push('');
+    // Top-level metadata (prevents misinterpretation as policy)
+    lines.push(`peac_bundle_metadata_version: "${evidence.peac_bundle_metadata_version}"`);
+    lines.push(`kind: "${evidence.kind}"`);
+    lines.push(`scope: "${evidence.scope}"`);
+    lines.push('');
+    // Request section
+    lines.push('request:');
+    lines.push(`  method: "${evidence.request.method}"`);
+    lines.push(`  path: "${escapeYamlString(evidence.request.path)}"`);
+    lines.push(`  received_at: "${evidence.request.received_at}"`);
+    lines.push('');
+    // Payload section
+    lines.push('payload:');
+    lines.push(`  raw_sha256_hex: "${evidence.payload.raw_sha256_hex}"`);
+    if (evidence.payload.raw_bytes_b64url) {
+        lines.push(`  raw_bytes_b64url: "${evidence.payload.raw_bytes_b64url}"`);
+    }
+    if (evidence.payload.jcs_sha256_hex) {
+        lines.push(`  jcs_sha256_hex: "${evidence.payload.jcs_sha256_hex}"`);
+    }
+    if (evidence.payload.jcs_text) {
+        lines.push('  jcs_text: |');
+        const jcsLines = evidence.payload.jcs_text.split('\n');
+        for (const line of jcsLines) {
+            lines.push(`    ${line}`);
+        }
+    }
+    lines.push(`  json_parseable: ${evidence.payload.json_parseable}`);
+    lines.push('');
+    // Signature section
+    lines.push('signature:');
+    lines.push(`  header_value: "${escapeYamlString(evidence.signature.header_value)}"`);
+    lines.push(`  kid: "${evidence.signature.kid}"`);
+    lines.push(`  alg: "${evidence.signature.alg}"`);
+    lines.push(`  b64: ${evidence.signature.b64 === null ? 'null' : evidence.signature.b64}`);
+    if (evidence.signature.crit && evidence.signature.crit.length > 0) {
+        lines.push('  crit:');
+        for (const c of evidence.signature.crit) {
+            lines.push(`    - "${c}"`);
+        }
+    }
+    lines.push(`  verified: ${evidence.signature.verified}`);
+    if (evidence.signature.verification_mode_used) {
+        lines.push(`  verification_mode_used: "${evidence.signature.verification_mode_used}"`);
+    }
+    lines.push('  verification_attempts:');
+    for (const attempt of evidence.signature.verification_attempts) {
+        lines.push(`    - mode: "${attempt.mode}"`);
+        lines.push(`      success: ${attempt.success}`);
+        if (attempt.error_code) {
+            lines.push(`      error_code: "${attempt.error_code}"`);
+        }
+        if (attempt.error_message) {
+            lines.push(`      error_message: "${escapeYamlString(attempt.error_message)}"`);
+        }
+    }
+    lines.push('');
+    // Event section (optional)
+    if (evidence.event) {
+        lines.push('event:');
+        lines.push(`  type: "${evidence.event.type}"`);
+        if (evidence.event.resource_id) {
+            lines.push(`  resource_id: "${evidence.event.resource_id}"`);
+        }
+        if (evidence.event.timestamp) {
+            lines.push(`  timestamp: "${evidence.event.timestamp}"`);
+        }
+        lines.push('');
+    }
+    // Profile section
+    lines.push('profile:');
+    lines.push(`  url: "${evidence.profile.url}"`);
+    lines.push(`  fetched_at: "${evidence.profile.fetched_at}"`);
+    lines.push(`  profile_jcs_sha256_hex: "${evidence.profile.profile_jcs_sha256_hex}"`);
+    if (evidence.profile.key_thumbprint) {
+        lines.push(`  key_thumbprint: "${evidence.profile.key_thumbprint}"`);
+    }
+    if (evidence.profile.key_jwk) {
+        lines.push('  key_jwk:');
+        lines.push(`    kty: "${evidence.profile.key_jwk.kty}"`);
+        lines.push(`    crv: "${evidence.profile.key_jwk.crv}"`);
+        lines.push(`    kid: "${evidence.profile.key_jwk.kid}"`);
+        lines.push(`    x: "${evidence.profile.key_jwk.x}"`);
+        lines.push(`    y: "${evidence.profile.key_jwk.y}"`);
+        if (evidence.profile.key_jwk.alg) {
+            lines.push(`    alg: "${evidence.profile.key_jwk.alg}"`);
+        }
+        if (evidence.profile.key_jwk.use) {
+            lines.push(`    use: "${evidence.profile.key_jwk.use}"`);
+        }
+    }
+    lines.push('');
+    // Linked receipts (optional)
+    if (evidence.linked_receipts && evidence.linked_receipts.length > 0) {
+        lines.push('linked_receipts:');
+        for (const lr of evidence.linked_receipts) {
+            lines.push(`  - receipt_id: "${lr.receipt_id}"`);
+            lines.push(`    relationship: "${lr.relationship}"`);
+        }
+    }
+    // Remove trailing empty lines and ensure exactly one trailing newline (LF)
+    while (lines.length > 0 && lines[lines.length - 1] === '') {
+        lines.pop();
+    }
+    return lines.join('\n') + '\n';
+}
+/**
+ * Escape special characters in YAML string values.
+ */
+function escapeYamlString(s) {
+    return s
+        .replace(/\\/g, '\\\\')
+        .replace(/"/g, '\\"')
+        .replace(/\n/g, '\\n')
+        .replace(/\r/g, '\\r')
+        .replace(/\t/g, '\\t');
+}
+/**
+ * Create payload evidence from raw request body.
+ */
+export function createPayloadEvidence(bodyBytes, options = {}) {
+    const { maxBodyEvidenceBytes = DEFAULT_MAX_BODY_EVIDENCE_BYTES, includeJcsText = false } = options;
+    // Compute raw hash
+    const rawSha256Hex = sha256Hex(bodyBytes);
+    // Include raw bytes if under size limit
+    let rawBytesB64url;
+    if (bodyBytes.length <= maxBodyEvidenceBytes) {
+        rawBytesB64url = base64urlEncode(bodyBytes);
+    }
+    // Try to parse as JSON and compute JCS hash
+    let jcsSha256Hex;
+    let jcsText;
+    let jsonParseable = false;
+    try {
+        const bodyText = new TextDecoder().decode(bodyBytes);
+        const parsed = JSON.parse(bodyText);
+        jsonParseable = true;
+        // JCS canonicalize
+        const canonicalized = jcsCanonicalizeSync(parsed);
+        jcsSha256Hex = sha256Hex(new TextEncoder().encode(canonicalized));
+        if (includeJcsText) {
+            jcsText = canonicalized;
+        }
+    }
+    catch {
+        // Not valid JSON, that's fine
+    }
+    return {
+        raw_sha256_hex: rawSha256Hex,
+        ...(rawBytesB64url && { raw_bytes_b64url: rawBytesB64url }),
+        ...(jcsSha256Hex && { jcs_sha256_hex: jcsSha256Hex }),
+        ...(jcsText && { jcs_text: jcsText }),
+        json_parseable: jsonParseable,
+    };
+}
+/**
+ * Create signature evidence from verification result.
+ */
+export function createSignatureEvidence(headerValue, header, verified, attempts, modeUsed) {
+    return {
+        header_value: headerValue,
+        kid: header.kid,
+        alg: header.alg,
+        b64: header.b64 === undefined ? null : header.b64,
+        ...(header.crit && header.crit.length > 0 && { crit: header.crit }),
+        verified,
+        ...(modeUsed && { verification_mode_used: modeUsed }),
+        verification_attempts: attempts,
+    };
+}
+/**
+ * Create profile snapshot from fetched profile.
+ */
+export function createProfileSnapshot(url, profile, keyUsed, fetchedAt) {
+    // JCS canonicalize the profile
+    const canonicalized = jcsCanonicalizeSync(profile);
+    const profileJcsSha256Hex = sha256Hex(new TextEncoder().encode(canonicalized));
+    // Compute JWK thumbprint (SHA-256 of JCS-canonicalized required members)
+    const thumbprintInput = {
+        crv: keyUsed.crv,
+        kty: keyUsed.kty,
+        x: keyUsed.x,
+        y: keyUsed.y,
+    };
+    const thumbprint = base64urlEncode(sha256Bytes(new TextEncoder().encode(jcsCanonicalizeSync(thumbprintInput))));
+    return {
+        url,
+        fetched_at: fetchedAt,
+        profile_jcs_sha256_hex: profileJcsSha256Hex,
+        key_thumbprint: thumbprint,
+        key_jwk: keyUsed,
+    };
+}
+// Re-export utilities for backwards compatibility
+export { sha256Hex, sha256Bytes, base64urlEncode, jcsCanonicalizeSync } from './util.js';
+//# sourceMappingURL=evidence.js.map

package/dist/evidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidence.js","sourceRoot":"","sources":["../src/evidence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAYH,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAEzF;;GAEG;AACH,MAAM,+BAA+B,GAAG,GAAG,GAAG,IAAI,CAAC;AA+BnD;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAA8B;IACrE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,GACtF,OAAO,CAAC;IAEV,OAAO;QACL,4BAA4B,EAAE,oBAAoB;QAClD,IAAI,EAAE,qBAAqB;QAC3B,KAAK,EAAE,aAAa;QACpB,OAAO,EAAE;YACP,MAAM;YACN,IAAI;YACJ,WAAW;SACZ;QACD,OAAO;QACP,SAAS;QACT,GAAG,CAAC,KAAK,IAAI,EAAE,KAAK,EAAE,CAAC;QACvB,OAAO;QACP,GAAG,CAAC,eAAe,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,eAAe,EAAE,CAAC;KAC1E,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAA4B;IAChE,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,iBAAiB;IACjB,KAAK,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IAC1C,KAAK,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;IAClE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,4DAA4D;IAC5D,KAAK,CAAC,IAAI,CAAC,kCAAkC,QAAQ,CAAC,4BAA4B,GAAG,CAAC,CAAC;IACvF,KAAK,CAAC,IAAI,CAAC,UAAU,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC;IACvC,KAAK,CAAC,IAAI,CAAC,WAAW,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC;IACzC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,kBAAkB;IAClB,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACvB,KAAK,CAAC,IAAI,CAAC,cAAc,QAAQ,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IACrD,KAAK,CAAC,IAAI,CAAC,YAAY,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnE,KAAK,CAAC,IAAI,CAAC,mBAAmB,QAAQ,CAAC,OAAO,CAAC,WAAW,GAAG,CAAC,CAAC;IAC/D,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,kBAAkB;IAClB,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACvB,KAAK,CAAC,IAAI,CAAC,sBAAsB,QAAQ,CAAC,OAAO,CAAC,cAAc,GAAG,CAAC,CAAC;IACrE,IAAI,QAAQ,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;QACtC,KAAK,CAAC,IAAI,CAAC,wBAAwB,QAAQ,CAAC,OAAO,CAAC,gBAAgB,GAAG,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,QAAQ,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CAAC,sBAAsB,QAAQ,CAAC,OAAO,CAAC,cAAc,GAAG,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC5B,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACvD,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC5B,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,qBAAqB,QAAQ,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IACnE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,oBAAoB;IACpB,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACzB,KAAK,CAAC,IAAI,CAAC,oBAAoB,gBAAgB,CAAC,QAAQ,CAAC,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IACrF,KAAK,CAAC,IAAI,CAAC,WAAW,QAAQ,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC,CAAC;IACjD,KAAK,CAAC,IAAI,CAAC,WAAW,QAAQ,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC,CAAC;IACjD,KAAK,CAAC,IAAI,CAAC,UAAU,QAAQ,CAAC,SAAS,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC;IAC1F,IAAI,QAAQ,CAAC,SAAS,CAAC,IAAI,IAAI,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtB,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;YACxC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,eAAe,QAAQ,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC;IACzD,IAAI,QAAQ,CAAC,SAAS,CAAC,sBAAsB,EAAE,CAAC;QAC9C,KAAK,CAAC,IAAI,CAAC,8BAA8B,QAAQ,CAAC,SAAS,CAAC,sBAAsB,GAAG,CAAC,CAAC;IACzF,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACvC,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,SAAS,CAAC,qBAAqB,EAAE,CAAC;QAC/D,KAAK,CAAC,IAAI,CAAC,gBAAgB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;QAC5C,KAAK,CAAC,IAAI,CAAC,kBAAkB,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QAChD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,sBAAsB,OAAO,CAAC,UAAU,GAAG,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;YAC1B,KAAK,CAAC,IAAI,CAAC,yBAAyB,gBAAgB,CAAC,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,2BAA2B;IAC3B,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnB,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrB,KAAK,CAAC,IAAI,CAAC,YAAY,QAAQ,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC;QAC/C,IAAI,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;YAC/B,KAAK,CAAC,IAAI,CAAC,mBAAmB,QAAQ,CAAC,KAAK,CAAC,WAAW,GAAG,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;YAC7B,KAAK,CAAC,IAAI,CAAC,iBAAiB,QAAQ,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;QAC3D,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,kBAAkB;IAClB,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACvB,KAAK,CAAC,IAAI,CAAC,WAAW,QAAQ,CAAC,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;IAC/C,KAAK,CAAC,IAAI,CAAC,kBAAkB,QAAQ,CAAC,OAAO,CAAC,UAAU,GAAG,CAAC,CAAC;IAC7D,KAAK,CAAC,IAAI,CAAC,8BAA8B,QAAQ,CAAC,OAAO,CAAC,sBAAsB,GAAG,CAAC,CAAC;IACrF,IAAI,QAAQ,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CAAC,sBAAsB,QAAQ,CAAC,OAAO,CAAC,cAAc,GAAG,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,aAAa,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;QACzD,KAAK,CAAC,IAAI,CAAC,aAAa,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;QACzD,KAAK,CAAC,IAAI,CAAC,aAAa,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;QACzD,KAAK,CAAC,IAAI,CAAC,WAAW,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC;QACrD,KAAK,CAAC,IAAI,CAAC,WAAW,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC;QACrD,IAAI,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YACjC,KAAK,CAAC,IAAI,CAAC,aAAa,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YACjC,KAAK,CAAC,IAAI,CAAC,aAAa,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,6BAA6B;IAC7B,IAAI,QAAQ,CAAC,eAAe,IAAI,QAAQ,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpE,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAC/B,KAAK,MAAM,EAAE,IAAI,QAAQ,CAAC,eAAe,EAAE,CAAC;YAC1C,KAAK,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC,UAAU,GAAG,CAAC,CAAC;YACjD,KAAK,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC,YAAY,GAAG,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;QAC1D,KAAK,CAAC,GAAG,EAAE,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AACjC,CAAC;AAED;;GAEG;AACH,SAAS,gBAAgB,CAAC,CAAS;IACjC,OAAO,CAAC;SACL,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC;SACpB,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;SACrB,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;SACrB,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CACnC,SAAqB,EACrB,UAGI,EAAE;IAEN,MAAM,EAAE,oBAAoB,GAAG,+BAA+B,EAAE,cAAc,GAAG,KAAK,EAAE,GACtF,OAAO,CAAC;IAEV,mBAAmB;IACnB,MAAM,YAAY,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;IAE1C,wCAAwC;IACxC,IAAI,cAAkC,CAAC;IACvC,IAAI,SAAS,CAAC,MAAM,IAAI,oBAAoB,EAAE,CAAC;QAC7C,cAAc,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAC9C,CAAC;IAED,4CAA4C;IAC5C,IAAI,YAAgC,CAAC;IACrC,IAAI,OAA2B,CAAC;IAChC,IAAI,aAAa,GAAG,KAAK,CAAC;IAE1B,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACpC,aAAa,GAAG,IAAI,CAAC;QAErB,mBAAmB;QACnB,MAAM,aAAa,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAClD,YAAY,GAAG,SAAS,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;QAElE,IAAI,cAAc,EAAE,CAAC;YACnB,OAAO,GAAG,aAAa,CAAC;QAC1B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,8BAA8B;IAChC,CAAC;IAED,OAAO;QACL,cAAc,EAAE,YAAY;QAC5B,GAAG,CAAC,cAAc,IAAI,EAAE,gBAAgB,EAAE,cAAc,EAAE,CAAC;QAC3D,GAAG,CAAC,YAAY,IAAI,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC;QACrD,GAAG,CAAC,OAAO,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;QACrC,cAAc,EAAE,aAAa;KAC9B,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB,CACrC,WAAmB,EACnB,MAAoE,EACpE,QAAiB,EACjB,QAA+B,EAC/B,QAAwB;IAExB,OAAO;QACL,YAAY,EAAE,WAAW;QACzB,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,GAAG,EAAE,MAAM,CAAC,GAA+B;QAC3C,GAAG,EAAE,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG;QACjD,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;QACnE,QAAQ;QACR,GAAG,CAAC,QAAQ,IAAI,EAAE,sBAAsB,EAAE,QAAQ,EAAE,CAAC;QACrD,qBAAqB,EAAE,QAAQ;KAChC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CACnC,GAAW,EACX,OAAgC,EAChC,OAAsB,EACtB,SAAiB;IAEjB,+BAA+B;IAC/B,MAAM,aAAa,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACnD,MAAM,mBAAmB,GAAG,SAAS,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;IAE/E,yEAAyE;IACzE,MAAM,eAAe,GAAG;QACtB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,CAAC,EAAE,OAAO,CAAC,CAAC;QACZ,CAAC,EAAE,OAAO,CAAC,CAAC;KACb,CAAC;IACF,MAAM,UAAU,GAAG,eAAe,CAChC,WAAW,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,eAAe,CAAC,CAAC,CAAC,CAC5E,CAAC;IAEF,OAAO;QACL,GAAG;QACH,UAAU,EAAE,SAAS;QACrB,sBAAsB,EAAE,mBAAmB;QAC3C,cAAc,EAAE,UAAU;QAC1B,OAAO,EAAE,OAAO;KACjB,CAAC;AACJ,CAAC;AAED,kDAAkD;AAClD,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,51 @@
+/**
+ * @peac/mappings-ucp
+ *
+ * Google Universal Commerce Protocol (UCP) mapping to PEAC receipts
+ * and dispute evidence.
+ *
+ * Features:
+ * - Webhook signature verification (raw-first, JCS fallback)
+ * - UCP order to PEAC receipt mapping
+ * - Dispute evidence generation for @peac/audit bundles
+ *
+ * @example
+ * ```ts
+ * import {
+ *   verifyUcpWebhookSignature,
+ *   mapUcpOrderToReceipt,
+ *   createUcpDisputeEvidence,
+ * } from '@peac/mappings-ucp';
+ *
+ * // Verify webhook signature
+ * const result = await verifyUcpWebhookSignature({
+ *   signature_header: req.headers['request-signature'],
+ *   body_bytes: rawBody,
+ *   profile_url: 'https://business.example.com/.well-known/ucp',
+ * });
+ *
+ * if (result.valid) {
+ *   // Map order to PEAC receipt
+ *   const claims = mapUcpOrderToReceipt({
+ *     order: body.order,
+ *     issuer: 'https://platform.example.com',
+ *     subject: 'buyer:123',
+ *     currency: 'USD',
+ *   });
+ *
+ *   // Sign with @peac/protocol
+ *   const receipt = await issue(claims, privateKey, kid);
+ * }
+ * ```
+ */
+export type { UcpSignatureAlgorithm, MinorUnits, VerificationMode, B64Mode, UcpJwsHeader, ParsedDetachedJws, UcpSigningKey, UcpProfile, UcpCapability, VerificationAttempt, PayloadEvidence, SignatureEvidence, ProfileSnapshot, WebhookEventMeta, UcpWebhookEvidence, LinkedReceipt, VerifyUcpWebhookOptions, VerifyUcpWebhookResult, UcpLineItem, UcpOrder, MapUcpOrderOptions, MappedReceiptClaims, } from './types.js';
+export { UCP_EVIDENCE_VERSION } from './types.js';
+export { ErrorCodes, ErrorHttpStatus, UcpError, ucpError } from './errors.js';
+export type { ErrorCode } from './errors.js';
+export { verifyUcpWebhookSignature, parseDetachedJws, findSigningKey } from './verify.js';
+export { mapUcpOrderToReceipt, extractLineItemSummary, calculateOrderStats } from './mapper.js';
+export { createUcpWebhookEvidence, serializeEvidenceYaml, createPayloadEvidence, createSignatureEvidence, createProfileSnapshot, } from './evidence.js';
+export type { CreateEvidenceOptions } from './evidence.js';
+export { createUcpDisputeEvidence, parseWebhookEvent, determineReceiptRelationship, } from './bundle.js';
+export type { CreateUcpDisputeEvidenceOptions, CreateUcpDisputeEvidenceResult } from './bundle.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAGH,YAAY,EAEV,qBAAqB,EACrB,UAAU,EACV,gBAAgB,EAChB,OAAO,EAEP,YAAY,EACZ,iBAAiB,EAEjB,aAAa,EACb,UAAU,EACV,aAAa,EAEb,mBAAmB,EACnB,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EAClB,aAAa,EAEb,uBAAuB,EACvB,sBAAsB,EAEtB,WAAW,EACX,QAAQ,EACR,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAGlD,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC9E,YAAY,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAG7C,OAAO,EAAE,yBAAyB,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAG1F,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAGhG,OAAO,EACL,wBAAwB,EACxB,qBAAqB,EACrB,qBAAqB,EACrB,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,eAAe,CAAC;AAEvB,YAAY,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAG3D,OAAO,EACL,wBAAwB,EACxB,iBAAiB,EACjB,4BAA4B,GAC7B,MAAM,aAAa,CAAC;AAErB,YAAY,EAAE,+BAA+B,EAAE,8BAA8B,EAAE,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -0,0 +1,52 @@
+/**
+ * @peac/mappings-ucp
+ *
+ * Google Universal Commerce Protocol (UCP) mapping to PEAC receipts
+ * and dispute evidence.
+ *
+ * Features:
+ * - Webhook signature verification (raw-first, JCS fallback)
+ * - UCP order to PEAC receipt mapping
+ * - Dispute evidence generation for @peac/audit bundles
+ *
+ * @example
+ * ```ts
+ * import {
+ *   verifyUcpWebhookSignature,
+ *   mapUcpOrderToReceipt,
+ *   createUcpDisputeEvidence,
+ * } from '@peac/mappings-ucp';
+ *
+ * // Verify webhook signature
+ * const result = await verifyUcpWebhookSignature({
+ *   signature_header: req.headers['request-signature'],
+ *   body_bytes: rawBody,
+ *   profile_url: 'https://business.example.com/.well-known/ucp',
+ * });
+ *
+ * if (result.valid) {
+ *   // Map order to PEAC receipt
+ *   const claims = mapUcpOrderToReceipt({
+ *     order: body.order,
+ *     issuer: 'https://platform.example.com',
+ *     subject: 'buyer:123',
+ *     currency: 'USD',
+ *   });
+ *
+ *   // Sign with @peac/protocol
+ *   const receipt = await issue(claims, privateKey, kid);
+ * }
+ * ```
+ */
+export { UCP_EVIDENCE_VERSION } from './types.js';
+// Errors
+export { ErrorCodes, ErrorHttpStatus, UcpError, ucpError } from './errors.js';
+// Verification
+export { verifyUcpWebhookSignature, parseDetachedJws, findSigningKey } from './verify.js';
+// Mapping
+export { mapUcpOrderToReceipt, extractLineItemSummary, calculateOrderStats } from './mapper.js';
+// Evidence
+export { createUcpWebhookEvidence, serializeEvidenceYaml, createPayloadEvidence, createSignatureEvidence, createProfileSnapshot, } from './evidence.js';
+// Bundle helpers
+export { createUcpDisputeEvidence, parseWebhookEvent, determineReceiptRelationship, } from './bundle.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAkCH,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAElD,SAAS;AACT,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAG9E,eAAe;AACf,OAAO,EAAE,yBAAyB,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE1F,UAAU;AACV,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEhG,WAAW;AACX,OAAO,EACL,wBAAwB,EACxB,qBAAqB,EACrB,qBAAqB,EACrB,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,eAAe,CAAC;AAIvB,iBAAiB;AACjB,OAAO,EACL,wBAAwB,EACxB,iBAAiB,EACjB,4BAA4B,GAC7B,MAAM,aAAa,CAAC"}

package/dist/mapper.d.ts

@@ -0,0 +1,48 @@
+/**
+ * @peac/mappings-ucp - UCP to PEAC receipt mapping
+ *
+ * Maps UCP order data to PEAC receipt claims.
+ * Amounts are in minor units (cents), NOT micros.
+ */
+import type { UcpOrder, MapUcpOrderOptions, MappedReceiptClaims, MinorUnits } from './types.js';
+/**
+ * Map a UCP order to PEAC receipt claims.
+ *
+ * @param options - Mapping options
+ * @returns PEAC receipt claims (ready for signing)
+ *
+ * @example
+ * ```ts
+ * const claims = mapUcpOrderToReceipt({
+ *   order: ucpOrder,
+ *   issuer: 'https://merchant.example.com',
+ *   subject: 'agent:shopper-bot-123',
+ *   currency: 'USD',
+ * });
+ *
+ * // Sign with @peac/protocol
+ * const receipt = await issue(claims, privateKey, kid);
+ * ```
+ */
+export declare function mapUcpOrderToReceipt(options: MapUcpOrderOptions): MappedReceiptClaims;
+/**
+ * Extract line item summary for evidence.
+ */
+export declare function extractLineItemSummary(order: UcpOrder): Array<{
+    id: string;
+    title: string;
+    quantity: number;
+    price: MinorUnits;
+    status: string;
+}>;
+/**
+ * Calculate order summary statistics.
+ */
+export declare function calculateOrderStats(order: UcpOrder): {
+    total_items: number;
+    fulfilled_items: number;
+    pending_items: number;
+    total_quantity: number;
+    fulfilled_quantity: number;
+};
+//# sourceMappingURL=mapper.d.ts.map

package/dist/mapper.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mapper.d.ts","sourceRoot":"","sources":["../src/mapper.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAyEhG;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,kBAAkB,GAAG,mBAAmB,CAgDrF;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,QAAQ,GAAG,KAAK,CAAC;IAC7D,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,UAAU,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC,CAQD;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,QAAQ,GAAG;IACpD,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,kBAAkB,EAAE,MAAM,CAAC;CAC5B,CA0BA"}