@peac/mappings-ucp 0.9.31

package/dist/util.js

@@ -0,0 +1,103 @@
+/**
+ * @peac/mappings-ucp - Shared utilities
+ *
+ * Crypto and encoding helpers used by both verification and evidence generation.
+ * Extracted to prevent architectural coupling between modules.
+ */
+import { createHash } from 'node:crypto';
+import { ErrorCodes, ucpError } from './errors.js';
+/**
+ * SHA-256 hash as hex string.
+ */
+export function sha256Hex(data) {
+    return createHash('sha256').update(data).digest('hex');
+}
+/**
+ * SHA-256 hash as Uint8Array.
+ */
+export function sha256Bytes(data) {
+    return new Uint8Array(createHash('sha256').update(data).digest());
+}
+/**
+ * Convert base64 to base64url by replacing chars.
+ */
+function base64ToBase64url(base64) {
+    let result = '';
+    for (let i = 0; i < base64.length; i++) {
+        const c = base64.charCodeAt(i);
+        if (c === 43) {
+            // '+' -> '-'
+            result += '-';
+        }
+        else if (c === 47) {
+            // '/' -> '_'
+            result += '_';
+        }
+        else if (c === 61) {
+            // '=' padding - skip
+            break;
+        }
+        else {
+            result += base64.charAt(i);
+        }
+    }
+    return result;
+}
+// Maximum size for base64url encoding (16MB - reasonable limit for webhook payloads)
+const MAX_ENCODE_SIZE = 16 * 1024 * 1024;
+/**
+ * Base64url encode without padding.
+ * Uses standard base64 + manual conversion for maximum portability.
+ * Works with Node.js 12+ (does not require 'base64url' encoding from Node 15.7.0+).
+ */
+export function base64urlEncode(data) {
+    // Safety check for unreasonably large input
+    if (data.length > MAX_ENCODE_SIZE) {
+        throw ucpError(ErrorCodes.SIGNATURE_MALFORMED, `Input too large for base64url encoding: ${data.length} bytes`);
+    }
+    // Use Buffer in Node.js, then convert base64 to base64url
+    if (typeof Buffer !== 'undefined' && typeof Buffer.from === 'function') {
+        const base64 = Buffer.from(data).toString('base64');
+        return base64ToBase64url(base64);
+    }
+    // Fallback for non-Node environments (browsers)
+    // Build binary string with bounded iteration
+    const len = data.length;
+    let binary = '';
+    for (let i = 0; i < len; i++) {
+        binary += String.fromCharCode(data[i]);
+    }
+    const base64 = btoa(binary);
+    return base64ToBase64url(base64);
+}
+/**
+ * JCS canonicalize (RFC 8785) - synchronous.
+ * Produces deterministic JSON with sorted keys and no whitespace.
+ */
+export function jcsCanonicalizeSync(obj) {
+    if (obj === null)
+        return 'null';
+    if (typeof obj === 'boolean')
+        return obj ? 'true' : 'false';
+    if (typeof obj === 'number') {
+        if (!Number.isFinite(obj)) {
+            throw ucpError(ErrorCodes.EVIDENCE_SERIALIZATION_FAILED, 'JCS does not support NaN or Infinity');
+        }
+        // Use ES6 number serialization (matches JSON.stringify for finite numbers)
+        return Object.is(obj, -0) ? '0' : String(obj);
+    }
+    if (typeof obj === 'string')
+        return JSON.stringify(obj);
+    if (Array.isArray(obj)) {
+        return '[' + obj.map(jcsCanonicalizeSync).join(',') + ']';
+    }
+    if (typeof obj === 'object') {
+        const keys = Object.keys(obj).sort();
+        const pairs = keys
+            .filter((k) => obj[k] !== undefined)
+            .map((k) => JSON.stringify(k) + ':' + jcsCanonicalizeSync(obj[k]));
+        return '{' + pairs.join(',') + '}';
+    }
+    throw ucpError(ErrorCodes.EVIDENCE_SERIALIZATION_FAILED, `Cannot canonicalize type: ${typeof obj}`);
+}
+//# sourceMappingURL=util.js.map

package/dist/util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"util.js","sourceRoot":"","sources":["../src/util.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEnD;;GAEG;AACH,MAAM,UAAU,SAAS,CAAC,IAAgB;IACxC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,IAAgB;IAC1C,OAAO,IAAI,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AACpE,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,MAAc;IACvC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YACb,aAAa;YACb,MAAM,IAAI,GAAG,CAAC;QAChB,CAAC;aAAM,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YACpB,aAAa;YACb,MAAM,IAAI,GAAG,CAAC;QAChB,CAAC;aAAM,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YACpB,qBAAqB;YACrB,MAAM;QACR,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,qFAAqF;AACrF,MAAM,eAAe,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAEzC;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,IAAgB;IAC9C,4CAA4C;IAC5C,IAAI,IAAI,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;QAClC,MAAM,QAAQ,CACZ,UAAU,CAAC,mBAAmB,EAC9B,2CAA2C,IAAI,CAAC,MAAM,QAAQ,CAC/D,CAAC;IACJ,CAAC;IAED,0DAA0D;IAC1D,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACvE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACpD,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IAED,gDAAgD;IAChD,6CAA6C;IAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC;IACxB,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAC;AACnC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAY;IAC9C,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAChC,IAAI,OAAO,GAAG,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;IAC5D,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,QAAQ,CACZ,UAAU,CAAC,6BAA6B,EACxC,sCAAsC,CACvC,CAAC;QACJ,CAAC;QACD,2EAA2E;QAC3E,OAAO,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACxD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IAC5D,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAA8B,CAAC,CAAC,IAAI,EAAE,CAAC;QAChE,MAAM,KAAK,GAAG,IAAI;aACf,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,GAA+B,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC;aAChE,GAAG,CACF,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,mBAAmB,CAAE,GAA+B,CAAC,CAAC,CAAC,CAAC,CAC1F,CAAC;QACJ,OAAO,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IACrC,CAAC;IACD,MAAM,QAAQ,CACZ,UAAU,CAAC,6BAA6B,EACxC,6BAA6B,OAAO,GAAG,EAAE,CAC1C,CAAC;AACJ,CAAC"}

package/dist/verify.d.ts

@@ -0,0 +1,40 @@
+/**
+ * @peac/mappings-ucp - Webhook signature verification
+ *
+ * Verifies UCP webhook signatures using detached JWS (RFC 7797).
+ * Supports ES256, ES384, ES512 algorithms with ECDSA keys.
+ *
+ * Verification strategy (raw-first, JCS fallback):
+ * 1. Try verifying against raw request body bytes
+ * 2. If that fails AND body is valid JSON, try JCS-canonicalized body
+ * 3. Record all attempts for evidence
+ *
+ * The UCP spec is ambiguous on canonicalization for webhooks (unlike AP2 which
+ * explicitly requires JCS). This implementation tries raw bytes first because
+ * the spec says "detached JWT over the request body".
+ */
+import type { UcpProfile, UcpSigningKey, ParsedDetachedJws, VerifyUcpWebhookOptions, VerifyUcpWebhookResult } from './types.js';
+/**
+ * Parse a detached JWS from the Request-Signature header.
+ * Format: <protected>..<signature> (empty payload section)
+ */
+export declare function parseDetachedJws(headerValue: string): ParsedDetachedJws;
+/**
+ * Find the signing key by kid in the profile.
+ */
+export declare function findSigningKey(profile: UcpProfile, kid: string): UcpSigningKey | undefined;
+/**
+ * Verify a UCP webhook signature.
+ *
+ * Strategy: raw-first, JCS fallback
+ * 1. Parse the detached JWS from Request-Signature header
+ * 2. Find the signing key in the profile by kid
+ * 3. Try verifying against raw body bytes
+ * 4. If that fails and body is valid JSON, try JCS-canonicalized body
+ * 5. Return result with all verification attempts
+ *
+ * @param options - Verification options
+ * @returns Verification result with profile and key information for evidence capture
+ */
+export declare function verifyUcpWebhookSignature(options: VerifyUcpWebhookOptions): Promise<VerifyUcpWebhookResult>;
+//# sourceMappingURL=verify.d.ts.map

package/dist/verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EACV,UAAU,EACV,aAAa,EAEb,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EAGvB,MAAM,YAAY,CAAC;AAmBpB;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,iBAAiB,CAiIvE;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAE1F;AA4ED;;;;;;;;;;;;GAYG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,sBAAsB,CAAC,CAkKjC"}

package/dist/verify.js

@@ -0,0 +1,406 @@
+/**
+ * @peac/mappings-ucp - Webhook signature verification
+ *
+ * Verifies UCP webhook signatures using detached JWS (RFC 7797).
+ * Supports ES256, ES384, ES512 algorithms with ECDSA keys.
+ *
+ * Verification strategy (raw-first, JCS fallback):
+ * 1. Try verifying against raw request body bytes
+ * 2. If that fails AND body is valid JSON, try JCS-canonicalized body
+ * 3. Record all attempts for evidence
+ *
+ * The UCP spec is ambiguous on canonicalization for webhooks (unlike AP2 which
+ * explicitly requires JCS). This implementation tries raw bytes first because
+ * the spec says "detached JWT over the request body".
+ */
+import * as jose from 'jose';
+import { ErrorCodes, ucpError, UcpError } from './errors.js';
+import { jcsCanonicalizeSync, base64urlEncode } from './util.js';
+/**
+ * Supported ECDSA algorithms and their curve mappings.
+ */
+const ALG_TO_CURVE = {
+    ES256: 'P-256',
+    ES384: 'P-384',
+    ES512: 'P-521',
+};
+/**
+ * Known/understood critical header parameters.
+ * Per JOSE rules: if `crit` exists, every entry MUST be understood by the implementation.
+ */
+const UNDERSTOOD_CRIT_PARAMS = new Set(['b64']);
+/**
+ * Parse a detached JWS from the Request-Signature header.
+ * Format: <protected>..<signature> (empty payload section)
+ */
+export function parseDetachedJws(headerValue) {
+    const trimmed = headerValue.trim();
+    // Detached JWS format: header..signature (double dot, empty payload)
+    const parts = trimmed.split('.');
+    if (parts.length !== 3) {
+        throw ucpError(ErrorCodes.SIGNATURE_MALFORMED, 'Invalid detached JWS format, expected 3 parts', {
+            parts: parts.length,
+        });
+    }
+    const [protectedB64url, payloadPart, signatureB64url] = parts;
+    // Payload MUST be empty for detached JWS
+    if (payloadPart !== '') {
+        throw ucpError(ErrorCodes.SIGNATURE_MALFORMED, 'Detached JWS must have empty payload section', {
+            payloadLength: payloadPart.length,
+        });
+    }
+    // Decode protected header
+    let header;
+    try {
+        const headerJson = base64urlDecode(protectedB64url);
+        header = JSON.parse(new TextDecoder('utf-8').decode(headerJson));
+    }
+    catch (err) {
+        throw ucpError(ErrorCodes.SIGNATURE_MALFORMED, 'Failed to decode protected header', {
+            error: String(err),
+        });
+    }
+    // Validate algorithm
+    if (!header.alg || !['ES256', 'ES384', 'ES512'].includes(header.alg)) {
+        throw ucpError(ErrorCodes.SIGNATURE_ALGORITHM_UNSUPPORTED, `Unsupported algorithm: ${header.alg}`, {
+            alg: header.alg,
+            supported: ['ES256', 'ES384', 'ES512'],
+        });
+    }
+    // Validate kid
+    if (!header.kid) {
+        throw ucpError(ErrorCodes.SIGNATURE_MALFORMED, 'Missing kid in protected header');
+    }
+    // Validate b64 parameter type if present (must be boolean)
+    if ('b64' in header && typeof header.b64 !== 'boolean') {
+        throw ucpError(ErrorCodes.SIGNATURE_MALFORMED, `b64 header must be a boolean, got ${typeof header.b64}`, { b64_type: typeof header.b64 });
+    }
+    // Validate crit parameter if present
+    if ('crit' in header) {
+        // crit must be an array
+        if (!Array.isArray(header.crit)) {
+            throw ucpError(ErrorCodes.SIGNATURE_MALFORMED, `crit header must be an array, got ${typeof header.crit}`, { crit_type: typeof header.crit });
+        }
+        // crit must contain only strings
+        const nonStrings = header.crit.filter((param) => typeof param !== 'string');
+        if (nonStrings.length > 0) {
+            throw ucpError(ErrorCodes.SIGNATURE_MALFORMED, 'crit array must contain only strings', {
+                invalid_types: nonStrings.map((p) => typeof p),
+            });
+        }
+        // crit must not contain duplicates
+        const seen = new Set();
+        const duplicates = [];
+        for (const param of header.crit) {
+            if (seen.has(param)) {
+                duplicates.push(param);
+            }
+            seen.add(param);
+        }
+        if (duplicates.length > 0) {
+            throw ucpError(ErrorCodes.SIGNATURE_MALFORMED, `crit array contains duplicates: ${duplicates.join(', ')}`, { duplicates });
+        }
+        // Enforce JOSE crit semantics: reject unknown critical parameters
+        const unknownCrit = header.crit.filter((param) => !UNDERSTOOD_CRIT_PARAMS.has(param));
+        if (unknownCrit.length > 0) {
+            throw ucpError(ErrorCodes.SIGNATURE_MALFORMED, `Unknown critical header parameters: ${unknownCrit.join(', ')}`, { unknown_crit: unknownCrit, understood: [...UNDERSTOOD_CRIT_PARAMS] });
+        }
+    }
+    // Handle b64 parameter
+    const isUnencodedPayload = header.b64 === false;
+    // If b64=false is used, it MUST be in crit (RFC 7797 requirement)
+    if (isUnencodedPayload) {
+        if (!header.crit || !header.crit.includes('b64')) {
+            throw ucpError(ErrorCodes.SIGNATURE_B64_INVALID, 'When b64=false, "b64" must be in the "crit" array');
+        }
+    }
+    return {
+        raw_header_value: trimmed,
+        header: header,
+        protected_b64url: protectedB64url,
+        signature_b64url: signatureB64url,
+        is_unencoded_payload: isUnencodedPayload,
+    };
+}
+/**
+ * Find the signing key by kid in the profile.
+ */
+export function findSigningKey(profile, kid) {
+    return profile.signing_keys.find((k) => k.kid === kid);
+}
+/**
+ * Verify that a key's curve matches the algorithm.
+ */
+function validateKeyForAlgorithm(key, alg) {
+    const expectedCurve = ALG_TO_CURVE[alg];
+    if (key.kty !== 'EC') {
+        throw ucpError(ErrorCodes.KEY_ALGORITHM_MISMATCH, `Expected EC key, got ${key.kty}`, {
+            kid: key.kid,
+            kty: key.kty,
+        });
+    }
+    if (key.crv !== expectedCurve) {
+        throw ucpError(ErrorCodes.KEY_CURVE_MISMATCH, `Algorithm ${alg} requires curve ${expectedCurve}, got ${key.crv}`, { kid: key.kid, alg, expected: expectedCurve, got: key.crv });
+    }
+}
+/**
+ * Verify a detached JWS signature against payload bytes.
+ *
+ * For b64=false (RFC 7797 unencoded payload):
+ * - jose.flattenedVerify accepts Uint8Array directly as payload
+ * - The signing input is: ASCII(BASE64URL(header)) || '.' || payload_bytes
+ *
+ * For standard JWS (b64=true or absent):
+ * - Payload is base64url-encoded in the signing input
+ *
+ * @param parsed - Parsed detached JWS
+ * @param payloadBytes - The payload bytes to verify against
+ * @param key - The EC public key (JWK)
+ * @returns true if signature is valid
+ */
+async function verifyDetachedSignature(parsed, payloadBytes, key) {
+    // Import the public key
+    const publicKey = await jose.importJWK({
+        kty: key.kty,
+        crv: key.crv,
+        x: key.x,
+        y: key.y,
+    }, parsed.header.alg);
+    // Construct the JWS input for verification
+    // jose.flattenedVerify handles b64=false correctly when payload is Uint8Array
+    const jws = {
+        protected: parsed.protected_b64url,
+        // For b64=false: pass raw bytes directly (jose handles RFC 7797 semantics)
+        // For standard JWS: pass base64url-encoded string
+        payload: parsed.is_unencoded_payload ? payloadBytes : base64urlEncode(payloadBytes),
+        signature: parsed.signature_b64url,
+    };
+    try {
+        // jose.flattenedVerify handles b64=false correctly when it sees it in the protected header
+        await jose.flattenedVerify(jws, publicKey, {
+            algorithms: [parsed.header.alg],
+        });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Verify a UCP webhook signature.
+ *
+ * Strategy: raw-first, JCS fallback
+ * 1. Parse the detached JWS from Request-Signature header
+ * 2. Find the signing key in the profile by kid
+ * 3. Try verifying against raw body bytes
+ * 4. If that fails and body is valid JSON, try JCS-canonicalized body
+ * 5. Return result with all verification attempts
+ *
+ * @param options - Verification options
+ * @returns Verification result with profile and key information for evidence capture
+ */
+export async function verifyUcpWebhookSignature(options) {
+    const { signature_header, body_bytes, profile_url, profile: providedProfile } = options;
+    // Track verification attempts
+    const attempts = [];
+    // Parse the detached JWS
+    let parsed;
+    try {
+        parsed = parseDetachedJws(signature_header);
+    }
+    catch (err) {
+        if (err instanceof UcpError) {
+            return {
+                valid: false,
+                header: { alg: 'ES256', kid: '' },
+                attempts,
+                error_code: err.code,
+                error_message: err.message,
+            };
+        }
+        throw err;
+    }
+    // Get the profile (use provided or fetch)
+    let profile;
+    let profileRaw;
+    if (providedProfile) {
+        profile = providedProfile;
+    }
+    else {
+        try {
+            const fetchResult = await fetchUcpProfile(profile_url);
+            profile = fetchResult.profile;
+            profileRaw = fetchResult.raw;
+        }
+        catch (err) {
+            return {
+                valid: false,
+                header: parsed.header,
+                attempts,
+                error_code: ErrorCodes.PROFILE_FETCH_FAILED,
+                error_message: `Failed to fetch UCP profile: ${err}`,
+            };
+        }
+    }
+    // Find the signing key
+    const key = findSigningKey(profile, parsed.header.kid);
+    if (!key) {
+        return {
+            valid: false,
+            header: parsed.header,
+            profile,
+            profile_raw: profileRaw,
+            attempts,
+            error_code: ErrorCodes.KEY_NOT_FOUND,
+            error_message: `Key not found in profile: ${parsed.header.kid}`,
+        };
+    }
+    // Validate key matches algorithm
+    try {
+        validateKeyForAlgorithm(key, parsed.header.alg);
+    }
+    catch (err) {
+        if (err instanceof UcpError) {
+            return {
+                valid: false,
+                header: parsed.header,
+                key,
+                profile,
+                profile_raw: profileRaw,
+                attempts,
+                error_code: err.code,
+                error_message: err.message,
+            };
+        }
+        throw err;
+    }
+    // Attempt 1: Verify against raw body bytes
+    try {
+        const rawValid = await verifyDetachedSignature(parsed, body_bytes, key);
+        attempts.push({
+            mode: 'raw',
+            success: rawValid,
+            ...(!rawValid && {
+                error_code: ErrorCodes.SIGNATURE_INVALID,
+                error_message: 'Signature verification failed',
+            }),
+        });
+        if (rawValid) {
+            return {
+                valid: true,
+                mode_used: 'raw',
+                header: parsed.header,
+                key,
+                profile,
+                profile_raw: profileRaw,
+                attempts,
+            };
+        }
+    }
+    catch (err) {
+        attempts.push({
+            mode: 'raw',
+            success: false,
+            error_code: ErrorCodes.VERIFICATION_FAILED,
+            error_message: String(err),
+        });
+    }
+    // Attempt 2: Try JCS-canonicalized body (only if JSON parseable)
+    try {
+        const bodyText = new TextDecoder('utf-8').decode(body_bytes);
+        const parsed_body = JSON.parse(bodyText);
+        const canonicalized = jcsCanonicalizeSync(parsed_body);
+        const canonicalizedBytes = new TextEncoder().encode(canonicalized);
+        const jcsValid = await verifyDetachedSignature(parsed, canonicalizedBytes, key);
+        attempts.push({
+            mode: 'jcs',
+            success: jcsValid,
+            ...(!jcsValid && {
+                error_code: ErrorCodes.SIGNATURE_INVALID,
+                error_message: 'JCS signature verification failed',
+            }),
+        });
+        if (jcsValid) {
+            return {
+                valid: true,
+                mode_used: 'jcs',
+                header: parsed.header,
+                key,
+                profile,
+                profile_raw: profileRaw,
+                attempts,
+            };
+        }
+    }
+    catch (err) {
+        // Body is not valid JSON or JCS canonicalization failed
+        // This is fine, we just don't try JCS verification
+        if (attempts.length === 1) {
+            // Only add JCS attempt if we haven't already
+            attempts.push({
+                mode: 'jcs',
+                success: false,
+                error_code: ErrorCodes.PAYLOAD_NOT_JSON,
+                error_message: 'Body is not valid JSON, cannot try JCS verification',
+            });
+        }
+    }
+    // Both attempts failed
+    return {
+        valid: false,
+        header: parsed.header,
+        key,
+        profile,
+        profile_raw: profileRaw,
+        attempts,
+        error_code: ErrorCodes.VERIFICATION_FAILED,
+        error_message: 'All verification attempts failed',
+    };
+}
+/**
+ * Fetch a UCP profile from a URL.
+ * Returns both the parsed profile and raw JSON for evidence capture.
+ */
+async function fetchUcpProfile(url) {
+    const response = await fetch(url);
+    if (!response.ok) {
+        throw ucpError(ErrorCodes.PROFILE_FETCH_FAILED, `HTTP ${response.status} from ${url}`);
+    }
+    // Capture raw response text for evidence (deterministic)
+    const raw = await response.text();
+    let profile;
+    try {
+        profile = JSON.parse(raw);
+    }
+    catch {
+        throw ucpError(ErrorCodes.PROFILE_INVALID, 'Profile response is not valid JSON');
+    }
+    if (!profile.signing_keys || !Array.isArray(profile.signing_keys)) {
+        throw ucpError(ErrorCodes.PROFILE_NO_SIGNING_KEYS, 'Profile has no signing_keys array');
+    }
+    if (profile.signing_keys.length === 0) {
+        throw ucpError(ErrorCodes.PROFILE_NO_SIGNING_KEYS, 'Profile signing_keys array is empty');
+    }
+    return { profile, raw };
+}
+/**
+ * Base64url decode to Uint8Array.
+ * Uses Buffer for Node.js compatibility (avoids atob issues).
+ */
+function base64urlDecode(s) {
+    // Use Buffer.from with 'base64url' encoding (Node.js 15.7.0+)
+    // Falls back to manual conversion for older environments
+    if (typeof Buffer !== 'undefined' && typeof Buffer.from === 'function') {
+        return new Uint8Array(Buffer.from(s, 'base64url'));
+    }
+    // Fallback for non-Node environments
+    const padded = s + '==='.slice(0, (4 - (s.length % 4)) % 4);
+    const base64 = padded.replace(/-/g, '+').replace(/_/g, '/');
+    const binary = atob(base64);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) {
+        bytes[i] = binary.charCodeAt(i);
+    }
+    return bytes;
+}
+//# sourceMappingURL=verify.js.map

package/dist/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAW7B,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAEjE;;GAEG;AACH,MAAM,YAAY,GAA0C;IAC1D,KAAK,EAAE,OAAO;IACd,KAAK,EAAE,OAAO;IACd,KAAK,EAAE,OAAO;CACf,CAAC;AAEF;;;GAGG;AACH,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AAEhD;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,WAAmB;IAClD,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC;IAEnC,qEAAqE;IACrE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAEjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,QAAQ,CACZ,UAAU,CAAC,mBAAmB,EAC9B,+CAA+C,EAC/C;YACE,KAAK,EAAE,KAAK,CAAC,MAAM;SACpB,CACF,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,eAAe,EAAE,WAAW,EAAE,eAAe,CAAC,GAAG,KAAK,CAAC;IAE9D,yCAAyC;IACzC,IAAI,WAAW,KAAK,EAAE,EAAE,CAAC;QACvB,MAAM,QAAQ,CAAC,UAAU,CAAC,mBAAmB,EAAE,8CAA8C,EAAE;YAC7F,aAAa,EAAE,WAAW,CAAC,MAAM;SAClC,CAAC,CAAC;IACL,CAAC;IAED,0BAA0B;IAC1B,IAAI,MAAoB,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,eAAe,CAAC,eAAe,CAAC,CAAC;QACpD,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IACnE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,QAAQ,CAAC,UAAU,CAAC,mBAAmB,EAAE,mCAAmC,EAAE;YAClF,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC;SACnB,CAAC,CAAC;IACL,CAAC;IAED,qBAAqB;IACrB,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QACrE,MAAM,QAAQ,CACZ,UAAU,CAAC,+BAA+B,EAC1C,0BAA0B,MAAM,CAAC,GAAG,EAAE,EACtC;YACE,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,SAAS,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;SACvC,CACF,CAAC;IACJ,CAAC;IAED,eAAe;IACf,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QAChB,MAAM,QAAQ,CAAC,UAAU,CAAC,mBAAmB,EAAE,iCAAiC,CAAC,CAAC;IACpF,CAAC;IAED,2DAA2D;IAC3D,IAAI,KAAK,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QACvD,MAAM,QAAQ,CACZ,UAAU,CAAC,mBAAmB,EAC9B,qCAAqC,OAAO,MAAM,CAAC,GAAG,EAAE,EACxD,EAAE,QAAQ,EAAE,OAAO,MAAM,CAAC,GAAG,EAAE,CAChC,CAAC;IACJ,CAAC;IAED,qCAAqC;IACrC,IAAI,MAAM,IAAI,MAAM,EAAE,CAAC;QACrB,wBAAwB;QACxB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,MAAM,QAAQ,CACZ,UAAU,CAAC,mBAAmB,EAC9B,qCAAqC,OAAO,MAAM,CAAC,IAAI,EAAE,EACzD,EAAE,SAAS,EAAE,OAAO,MAAM,CAAC,IAAI,EAAE,CAClC,CAAC;QACJ,CAAC;QAED,iCAAiC;QACjC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC;QAC5E,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,QAAQ,CAAC,UAAU,CAAC,mBAAmB,EAAE,sCAAsC,EAAE;gBACrF,aAAa,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC;aAC/C,CAAC,CAAC;QACL,CAAC;QAED,mCAAmC;QACnC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAChC,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBACpB,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACzB,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,QAAQ,CACZ,UAAU,CAAC,mBAAmB,EAC9B,mCAAmC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAC1D,EAAE,UAAU,EAAE,CACf,CAAC;QACJ,CAAC;QAED,kEAAkE;QAClE,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QACtF,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,QAAQ,CACZ,UAAU,CAAC,mBAAmB,EAC9B,uCAAuC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAC/D,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,GAAG,sBAAsB,CAAC,EAAE,CACvE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,uBAAuB;IACvB,MAAM,kBAAkB,GAAG,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC;IAEhD,kEAAkE;IAClE,IAAI,kBAAkB,EAAE,CAAC;QACvB,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,MAAM,QAAQ,CACZ,UAAU,CAAC,qBAAqB,EAChC,mDAAmD,CACpD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,gBAAgB,EAAE,OAAO;QACzB,MAAM,EAAE,MAAsB;QAC9B,gBAAgB,EAAE,eAAe;QACjC,gBAAgB,EAAE,eAAe;QACjC,oBAAoB,EAAE,kBAAkB;KACzC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,OAAmB,EAAE,GAAW;IAC7D,OAAO,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;AACzD,CAAC;AAED;;GAEG;AACH,SAAS,uBAAuB,CAAC,GAAkB,EAAE,GAA0B;IAC7E,MAAM,aAAa,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAExC,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,QAAQ,CAAC,UAAU,CAAC,sBAAsB,EAAE,wBAAwB,GAAG,CAAC,GAAG,EAAE,EAAE;YACnF,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,GAAG,EAAE,GAAG,CAAC,GAAG;SACb,CAAC,CAAC;IACL,CAAC;IAED,IAAI,GAAG,CAAC,GAAG,KAAK,aAAa,EAAE,CAAC;QAC9B,MAAM,QAAQ,CACZ,UAAU,CAAC,kBAAkB,EAC7B,aAAa,GAAG,mBAAmB,aAAa,SAAS,GAAG,CAAC,GAAG,EAAE,EAClE,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAC7D,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,KAAK,UAAU,uBAAuB,CACpC,MAAyB,EACzB,YAAwB,EACxB,GAAkB;IAElB,wBAAwB;IACxB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CACpC;QACE,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,CAAC,EAAE,GAAG,CAAC,CAAC;QACR,CAAC,EAAE,GAAG,CAAC,CAAC;KACT,EACD,MAAM,CAAC,MAAM,CAAC,GAAG,CAClB,CAAC;IAEF,2CAA2C;IAC3C,8EAA8E;IAC9E,MAAM,GAAG,GAA2B;QAClC,SAAS,EAAE,MAAM,CAAC,gBAAgB;QAClC,2EAA2E;QAC3E,kDAAkD;QAClD,OAAO,EAAE,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,eAAe,CAAC,YAAY,CAAC;QACnF,SAAS,EAAE,MAAM,CAAC,gBAAgB;KACnC,CAAC;IAEF,IAAI,CAAC;QACH,2FAA2F;QAC3F,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,SAAS,EAAE;YACzC,UAAU,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;SAChC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,OAAgC;IAEhC,MAAM,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC;IAExF,8BAA8B;IAC9B,MAAM,QAAQ,GAA0B,EAAE,CAAC;IAE3C,yBAAyB;IACzB,IAAI,MAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,GAAG,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,QAAQ,EAAE,CAAC;YAC5B,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAkB;gBACjD,QAAQ;gBACR,UAAU,EAAE,GAAG,CAAC,IAAI;gBACpB,aAAa,EAAE,GAAG,CAAC,OAAO;aAC3B,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,0CAA0C;IAC1C,IAAI,OAAmB,CAAC;IACxB,IAAI,UAA8B,CAAC;IACnC,IAAI,eAAe,EAAE,CAAC;QACpB,OAAO,GAAG,eAAe,CAAC;IAC5B,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,WAAW,CAAC,CAAC;YACvD,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC;YAC9B,UAAU,GAAG,WAAW,CAAC,GAAG,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,QAAQ;gBACR,UAAU,EAAE,UAAU,CAAC,oBAAoB;gBAC3C,aAAa,EAAE,gCAAgC,GAAG,EAAE;aACrD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,uBAAuB;IACvB,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACvD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,OAAO;YACP,WAAW,EAAE,UAAU;YACvB,QAAQ;YACR,UAAU,EAAE,UAAU,CAAC,aAAa;YACpC,aAAa,EAAE,6BAA6B,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE;SAChE,CAAC;IACJ,CAAC;IAED,iCAAiC;IACjC,IAAI,CAAC;QACH,uBAAuB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,QAAQ,EAAE,CAAC;YAC5B,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,GAAG;gBACH,OAAO;gBACP,WAAW,EAAE,UAAU;gBACvB,QAAQ;gBACR,UAAU,EAAE,GAAG,CAAC,IAAI;gBACpB,aAAa,EAAE,GAAG,CAAC,OAAO;aAC3B,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,2CAA2C;IAC3C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;QACxE,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,KAAK;YACX,OAAO,EAAE,QAAQ;YACjB,GAAG,CAAC,CAAC,QAAQ,IAAI;gBACf,UAAU,EAAE,UAAU,CAAC,iBAAiB;gBACxC,aAAa,EAAE,+BAA+B;aAC/C,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO;gBACL,KAAK,EAAE,IAAI;gBACX,SAAS,EAAE,KAAK;gBAChB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,GAAG;gBACH,OAAO;gBACP,WAAW,EAAE,UAAU;gBACvB,QAAQ;aACT,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,KAAK;YACX,OAAO,EAAE,KAAK;YACd,UAAU,EAAE,UAAU,CAAC,mBAAmB;YAC1C,aAAa,EAAE,MAAM,CAAC,GAAG,CAAC;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,iEAAiE;IACjE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC7D,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACzC,MAAM,aAAa,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;QACvD,MAAM,kBAAkB,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAEnE,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC,MAAM,EAAE,kBAAkB,EAAE,GAAG,CAAC,CAAC;QAChF,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,KAAK;YACX,OAAO,EAAE,QAAQ;YACjB,GAAG,CAAC,CAAC,QAAQ,IAAI;gBACf,UAAU,EAAE,UAAU,CAAC,iBAAiB;gBACxC,aAAa,EAAE,mCAAmC;aACnD,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO;gBACL,KAAK,EAAE,IAAI;gBACX,SAAS,EAAE,KAAK;gBAChB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,GAAG;gBACH,OAAO;gBACP,WAAW,EAAE,UAAU;gBACvB,QAAQ;aACT,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,wDAAwD;QACxD,mDAAmD;QACnD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,6CAA6C;YAC7C,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,KAAK;gBACX,OAAO,EAAE,KAAK;gBACd,UAAU,EAAE,UAAU,CAAC,gBAAgB;gBACvC,aAAa,EAAE,qDAAqD;aACrE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,uBAAuB;IACvB,OAAO;QACL,KAAK,EAAE,KAAK;QACZ,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,GAAG;QACH,OAAO;QACP,WAAW,EAAE,UAAU;QACvB,QAAQ;QACR,UAAU,EAAE,UAAU,CAAC,mBAAmB;QAC1C,aAAa,EAAE,kCAAkC;KAClD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,eAAe,CAAC,GAAW;IACxC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IAElC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,QAAQ,CAAC,UAAU,CAAC,oBAAoB,EAAE,QAAQ,QAAQ,CAAC,MAAM,SAAS,GAAG,EAAE,CAAC,CAAC;IACzF,CAAC;IAED,yDAAyD;IACzD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAClC,IAAI,OAAmB,CAAC;IAExB,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAe,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,QAAQ,CAAC,UAAU,CAAC,eAAe,EAAE,oCAAoC,CAAC,CAAC;IACnF,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QAClE,MAAM,QAAQ,CAAC,UAAU,CAAC,uBAAuB,EAAE,mCAAmC,CAAC,CAAC;IAC1F,CAAC;IAED,IAAI,OAAO,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtC,MAAM,QAAQ,CAAC,UAAU,CAAC,uBAAuB,EAAE,qCAAqC,CAAC,CAAC;IAC5F,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;AAC1B,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CAAC,CAAS;IAChC,8DAA8D;IAC9D,yDAAyD;IACzD,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACvE,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC;IACrD,CAAC;IAED,qCAAqC;IACrC,MAAM,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/package.json

@@ -0,0 +1,52 @@
+{
+  "name": "@peac/mappings-ucp",
+  "version": "0.9.31",
+  "description": "Google Universal Commerce Protocol (UCP) mapping to PEAC receipts and dispute evidence",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "keywords": [
+    "ucp",
+    "google",
+    "commerce",
+    "webhooks",
+    "ap2",
+    "peac"
+  ],
+  "author": "PEAC Protocol Contributors",
+  "license": "Apache-2.0",
+  "bugs": {
+    "url": "https://github.com/peacprotocol/peac/issues"
+  },
+  "homepage": "https://peacprotocol.org",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/peacprotocol/peac.git",
+    "directory": "packages/mappings/ucp"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "jose": "^5.2.0",
+    "@peac/kernel": "0.9.31"
+  },
+  "devDependencies": {
+    "typescript": "^5.3.0",
+    "vitest": "^2.0.0"
+  },
+  "scripts": {
+    "build": "tsc",
+    "test": "vitest run",
+    "test:watch": "vitest"
+  }
+}