@peac/middleware-core 0.10.9

package/LICENSE

@@ -0,0 +1,190 @@
+Apache License
+Version 2.0, January 2004
+http://www.apache.org/licenses/
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1. Definitions.
+
+   "License" shall mean the terms and conditions for use, reproduction,
+   and distribution as defined by Sections 1 through 9 of this document.
+
+   "Licensor" shall mean the copyright owner or entity authorized by
+   the copyright owner that is granting the License.
+
+   "Legal Entity" shall mean the union of the acting entity and all
+   other entities that control, are controlled by, or are under common
+   control with that entity. For the purposes of this definition,
+   "control" means (i) the power, direct or indirect, to cause the
+   direction or management of such entity, whether by contract or
+   otherwise, or (ii) ownership of fifty percent (50%) or more of the
+   outstanding shares, or (iii) beneficial ownership of such entity.
+
+   "You" (or "Your") shall mean an individual or Legal Entity
+   exercising permissions granted by this License.
+
+   "Source" form shall mean the preferred form for making modifications,
+   including but not limited to software source code, documentation
+   source, and configuration files.
+
+   "Object" form shall mean any form resulting from mechanical
+   transformation or translation of a Source form, including but
+   not limited to compiled object code, generated documentation,
+   and conversions to other media types.
+
+   "Work" shall mean the work of authorship, whether in Source or
+   Object form, made available under the License, as indicated by a
+   copyright notice that is included in or attached to the work
+   (an example is provided in the Appendix below).
+
+   "Derivative Works" shall mean any work, whether in Source or Object
+   form, that is based on (or derived from) the Work and for which the
+   editorial revisions, annotations, elaborations, or other modifications
+   represent, as a whole, an original work of authorship. For the purposes
+   of this License, Derivative Works shall not include works that remain
+   separable from, or merely link (or bind by name) to the interfaces of,
+   the Work and Derivative Works thereof.
+
+   "Contribution" shall mean any work of authorship, including
+   the original version of the Work and any modifications or additions
+   to that Work or Derivative Works thereof, that is intentionally
+   submitted to Licensor for inclusion in the Work by the copyright owner
+   or by an individual or Legal Entity authorized to submit on behalf of
+   the copyright owner. For the purposes of this definition, "submitted"
+   means any form of electronic, verbal, or written communication sent
+   to the Licensor or its representatives, including but not limited to
+   communication on electronic mailing lists, source code control systems,
+   and issue tracking systems that are managed by, or on behalf of, the
+   Licensor for the purpose of discussing and improving the Work, but
+   excluding communication that is conspicuously marked or otherwise
+   designated in writing by the copyright owner as "Not a Contribution."
+
+   "Contributor" shall mean Licensor and any individual or Legal Entity
+   on behalf of whom a Contribution has been received by Licensor and
+   subsequently incorporated within the Work.
+
+2. Grant of Copyright License. Subject to the terms and conditions of
+   this License, each Contributor hereby grants to You a perpetual,
+   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+   copyright license to reproduce, prepare Derivative Works of,
+   publicly display, publicly perform, sublicense, and distribute the
+   Work and such Derivative Works in Source or Object form.
+
+3. Grant of Patent License. Subject to the terms and conditions of
+   this License, each Contributor hereby grants to You a perpetual,
+   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+   (except as stated in this section) patent license to make, have made,
+   use, offer to sell, sell, import, and otherwise transfer the Work,
+   where such license applies only to those patent claims licensable
+   by such Contributor that are necessarily infringed by their
+   Contribution(s) alone or by combination of their Contribution(s)
+   with the Work to which such Contribution(s) was submitted. If You
+   institute patent litigation against any entity (including a
+   cross-claim or counterclaim in a lawsuit) alleging that the Work
+   or a Contribution incorporated within the Work constitutes direct
+   or contributory patent infringement, then any patent licenses
+   granted to You under this License for that Work shall terminate
+   as of the date such litigation is filed.
+
+4. Redistribution. You may reproduce and distribute copies of the
+   Work or Derivative Works thereof in any medium, with or without
+   modifications, and in Source or Object form, provided that You
+   meet the following conditions:
+
+   (a) You must give any other recipients of the Work or
+       Derivative Works a copy of this License; and
+
+   (b) You must cause any modified files to carry prominent notices
+       stating that You changed the files; and
+
+   (c) You must retain, in the Source form of any Derivative Works
+       that You distribute, all copyright, patent, trademark, and
+       attribution notices from the Source form of the Work,
+       excluding those notices that do not pertain to any part of
+       the Derivative Works; and
+
+   (d) If the Work includes a "NOTICE" text file as part of its
+       distribution, then any Derivative Works that You distribute must
+       include a readable copy of the attribution notices contained
+       within such NOTICE file, excluding those notices that do not
+       pertain to any part of the Derivative Works, in at least one
+       of the following places: within a NOTICE text file distributed
+       as part of the Derivative Works; within the Source form or
+       documentation, if provided along with the Derivative Works; or,
+       within a display generated by the Derivative Works, if and
+       wherever such third-party notices normally appear. The contents
+       of the NOTICE file are for informational purposes only and
+       do not modify the License. You may add Your own attribution
+       notices within Derivative Works that You distribute, alongside
+       or as an addendum to the NOTICE text from the Work, provided
+       that such additional attribution notices cannot be construed
+       as modifying the License.
+
+   You may add Your own copyright statement to Your modifications and
+   may provide additional or different license terms and conditions
+   for use, reproduction, or distribution of Your modifications, or
+   for any such Derivative Works as a whole, provided Your use,
+   reproduction, and distribution of the Work otherwise complies with
+   the conditions stated in this License.
+
+5. Submission of Contributions. Unless You explicitly state otherwise,
+   any Contribution intentionally submitted for inclusion in the Work
+   by You to the Licensor shall be under the terms and conditions of
+   this License, without any additional terms or conditions.
+   Notwithstanding the above, nothing herein shall supersede or modify
+   the terms of any separate license agreement you may have executed
+   with Licensor regarding such Contributions.
+
+6. Trademarks. This License does not grant permission to use the trade
+   names, trademarks, service marks, or product names of the Licensor,
+   except as required for reasonable and customary use in describing the
+   origin of the Work and reproducing the content of the NOTICE file.
+
+7. Disclaimer of Warranty. Unless required by applicable law or
+   agreed to in writing, Licensor provides the Work (and each
+   Contributor provides its Contributions) on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+   implied, including, without limitation, any warranties or conditions
+   of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+   PARTICULAR PURPOSE. You are solely responsible for determining the
+   appropriateness of using or redistributing the Work and assume any
+   risks associated with Your exercise of permissions under this License.
+
+8. Limitation of Liability. In no event and under no legal theory,
+   whether in tort (including negligence), contract, or otherwise,
+   unless required by applicable law (such as deliberate and grossly
+   negligent acts) or agreed to in writing, shall any Contributor be
+   liable to You for damages, including any direct, indirect, special,
+   incidental, or consequential damages of any character arising as a
+   result of this License or out of the use or inability to use the
+   Work (including but not limited to damages for loss of goodwill,
+   work stoppage, computer failure or malfunction, or any and all
+   other commercial damages or losses), even if such Contributor
+   has been advised of the possibility of such damages.
+
+9. Accepting Warranty or Additional Liability. While redistributing
+   the Work or Derivative Works thereof, You may choose to offer,
+   and charge a fee for, acceptance of support, warranty, indemnity,
+   or other liability obligations and/or rights consistent with this
+   License. However, in accepting such obligations, You may act only
+   on Your own behalf and on Your sole responsibility, not on behalf
+   of any other Contributor, and only if You agree to indemnify,
+   defend, and hold each Contributor harmless for any liability
+   incurred by, or claims asserted against, such Contributor by reason
+   of your accepting any such warranty or additional liability.
+
+END OF TERMS AND CONDITIONS
+
+Copyright 2025 PEAC Protocol Contributors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

package/README.md

@@ -0,0 +1,86 @@
+# @peac/middleware-core
+
+Framework-agnostic middleware primitives for PEAC receipt issuance.
+
+## Installation
+
+```bash
+pnpm add @peac/middleware-core
+```
+
+## Quick Start
+
+```typescript
+import { createReceipt, validateConfig } from '@peac/middleware-core';
+
+// Validate configuration at startup
+const config = {
+  issuer: 'https://api.example.com',
+  signingKey: privateJwk, // Ed25519 JWK
+  keyId: 'prod-2026-02',
+};
+validateConfig(config);
+
+// In a request handler
+const result = await createReceipt(config, requestCtx, responseCtx);
+
+// Add PEAC-Receipt header to response
+for (const [key, value] of Object.entries(result.headers)) {
+  res.setHeader(key, value);
+}
+```
+
+## API
+
+### `createReceipt(config, request, response)`
+
+Create a signed PEAC receipt for a request/response pair. Returns a `ReceiptResult` with the JWS receipt, transport headers, and optional body wrapper.
+
+### `createReceiptWithClaims(config, claims)`
+
+Create a receipt from explicit claims (bypasses request/response context extraction).
+
+### `wrapResponse(data, receipt)`
+
+Wrap a response body with a PEAC receipt for body transport profile. Returns `{ data, peac_receipt }`.
+
+### `selectTransport(receipt, config)`
+
+Determine appropriate transport based on receipt size: `'header'`, `'body'`, or `'pointer'`. Auto-falls back from header to body if receipt exceeds `maxHeaderSize` (default 4096 bytes).
+
+### `validateConfig(config)` / `validateConfigAsync(config)`
+
+Validate middleware configuration at startup. Throws `ConfigError` if configuration is invalid.
+
+### `buildResponseHeaders(receipt)` / `buildReceiptResult(receipt, transport, body?)`
+
+Lower-level utilities for constructing response headers and receipt results.
+
+## Configuration
+
+```typescript
+interface MiddlewareConfig {
+  issuer: string; // Issuer URL (becomes `iss` claim)
+  signingKey: Ed25519PrivateJwk; // Ed25519 private key (JWK format)
+  keyId: string; // Key ID for JWKS lookup
+  expiresIn?: number; // Receipt expiration in seconds (default: 300)
+  transport?: 'header' | 'body' | 'pointer'; // Transport profile (default: 'header')
+  maxHeaderSize?: number; // Max header size before fallback (default: 4096)
+  pointerUrlGenerator?: (receipt: string) => Promise<string>;
+  claimsGenerator?: (context: RequestContext) => Promise<Partial<ReceiptClaimsInput>>;
+}
+```
+
+## Error Handling
+
+Configuration errors throw `ConfigError` at startup. Receipt generation errors are returned in the result rather than thrown, so receipt failures never break the HTTP response.
+
+## License
+
+Apache-2.0
+
+---
+
+PEAC Protocol is an open source project stewarded by Originary and community contributors.
+
+[Docs](https://www.peacprotocol.org) | [GitHub](https://github.com/peacprotocol/peac) | [Originary](https://www.originary.xyz)

package/dist/config.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Middleware Configuration Validation
+ *
+ * Validates middleware configuration before use.
+ *
+ * @packageDocumentation
+ */
+import type { MiddlewareConfig, ConfigValidationError } from './types.js';
+/**
+ * Maximum path length for interaction binding (DoS protection)
+ */
+export declare const MAX_PATH_LENGTH = 2048;
+/**
+ * Default configuration values
+ */
+export declare const CONFIG_DEFAULTS: {
+    readonly expiresIn: 300;
+    readonly transport: "header";
+    readonly maxHeaderSize: 4096;
+    readonly interactionBinding: "minimal";
+};
+/**
+ * Configuration validation error
+ */
+export declare class ConfigError extends Error {
+    readonly errors: ConfigValidationError[];
+    constructor(errors: ConfigValidationError[]);
+}
+/**
+ * Validate middleware configuration
+ *
+ * @param config - Configuration to validate
+ * @throws ConfigError if configuration is invalid
+ *
+ * @example
+ * ```typescript
+ * try {
+ *   validateConfig(config);
+ * } catch (e) {
+ *   if (e instanceof ConfigError) {
+ *     console.error('Config errors:', e.errors);
+ *   }
+ * }
+ * ```
+ */
+export declare function validateConfig(config: MiddlewareConfig): void;
+/**
+ * Validate middleware configuration with async keypair verification
+ *
+ * This extends basic validation with cryptographic verification that
+ * the private key (d) correctly derives to the public key (x).
+ *
+ * @param config - Configuration to validate
+ * @throws ConfigError if configuration is invalid
+ *
+ * @example
+ * ```typescript
+ * await validateConfigAsync(config);
+ * ```
+ */
+export declare function validateConfigAsync(config: MiddlewareConfig): Promise<void>;
+/**
+ * Apply default values to configuration
+ */
+export declare function applyDefaults(config: MiddlewareConfig): Required<Pick<MiddlewareConfig, 'expiresIn' | 'transport' | 'maxHeaderSize' | 'interactionBinding'>> & MiddlewareConfig;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAE,qBAAqB,EAAqB,MAAM,YAAY,CAAC;AAE7F;;GAEG;AACH,eAAO,MAAM,eAAe,OAAO,CAAC;AAEpC;;GAEG;AACH,eAAO,MAAM,eAAe;;;;;CAKlB,CAAC;AAEX;;GAEG;AACH,qBAAa,WAAY,SAAQ,KAAK;IACpC,QAAQ,CAAC,MAAM,EAAE,qBAAqB,EAAE,CAAC;gBAE7B,MAAM,EAAE,qBAAqB,EAAE;CAM5C;AAgED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,gBAAgB,GAAG,IAAI,CA4E7D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBjF;AAED;;GAEG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,gBAAgB,GACvB,QAAQ,CACT,IAAI,CAAC,gBAAgB,EAAE,WAAW,GAAG,WAAW,GAAG,eAAe,GAAG,oBAAoB,CAAC,CAC3F,GACC,gBAAgB,CAQjB"}

package/dist/config.js

@@ -0,0 +1,226 @@
+"use strict";
+/**
+ * Middleware Configuration Validation
+ *
+ * Validates middleware configuration before use.
+ *
+ * @packageDocumentation
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ConfigError = exports.CONFIG_DEFAULTS = exports.MAX_PATH_LENGTH = void 0;
+exports.validateConfig = validateConfig;
+exports.validateConfigAsync = validateConfigAsync;
+exports.applyDefaults = applyDefaults;
+const crypto_1 = require("@peac/crypto");
+/**
+ * Maximum path length for interaction binding (DoS protection)
+ */
+exports.MAX_PATH_LENGTH = 2048;
+/**
+ * Default configuration values
+ */
+exports.CONFIG_DEFAULTS = {
+    expiresIn: 300,
+    transport: 'header',
+    maxHeaderSize: 4096,
+    interactionBinding: 'minimal',
+};
+/**
+ * Configuration validation error
+ */
+class ConfigError extends Error {
+    errors;
+    constructor(errors) {
+        const message = errors.map((e) => `${e.field}: ${e.message}`).join('; ');
+        super(`Invalid middleware configuration: ${message}`);
+        this.name = 'ConfigError';
+        this.errors = errors;
+    }
+}
+exports.ConfigError = ConfigError;
+/**
+ * Validate a URL is HTTPS
+ */
+function isValidHttpsUrl(url) {
+    try {
+        const parsed = new URL(url);
+        return parsed.protocol === 'https:';
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Validate Ed25519 JWK private key
+ */
+function validateSigningKey(key, errors) {
+    if (!key || typeof key !== 'object') {
+        errors.push({ field: 'signingKey', message: 'must be an object' });
+        return;
+    }
+    const jwk = key;
+    // Validate key type
+    if (jwk.kty !== 'OKP') {
+        errors.push({ field: 'signingKey.kty', message: 'must be "OKP" for Ed25519 keys' });
+    }
+    // Validate curve
+    if (jwk.crv !== 'Ed25519') {
+        errors.push({ field: 'signingKey.crv', message: 'must be "Ed25519"' });
+    }
+    // Validate public key
+    if (typeof jwk.x !== 'string') {
+        errors.push({ field: 'signingKey.x', message: 'must be a base64url string' });
+    }
+    else {
+        try {
+            const xBytes = (0, crypto_1.base64urlDecode)(jwk.x);
+            if (xBytes.length !== 32) {
+                errors.push({ field: 'signingKey.x', message: 'must be 32 bytes (base64url encoded)' });
+            }
+        }
+        catch {
+            errors.push({ field: 'signingKey.x', message: 'must be valid base64url encoding' });
+        }
+    }
+    // Validate private key
+    if (typeof jwk.d !== 'string') {
+        errors.push({ field: 'signingKey.d', message: 'must be a base64url string (private key)' });
+    }
+    else {
+        try {
+            const dBytes = (0, crypto_1.base64urlDecode)(jwk.d);
+            if (dBytes.length !== 32) {
+                errors.push({ field: 'signingKey.d', message: 'must be 32 bytes (base64url encoded)' });
+            }
+        }
+        catch {
+            errors.push({ field: 'signingKey.d', message: 'must be valid base64url encoding' });
+        }
+    }
+}
+/**
+ * Validate middleware configuration
+ *
+ * @param config - Configuration to validate
+ * @throws ConfigError if configuration is invalid
+ *
+ * @example
+ * ```typescript
+ * try {
+ *   validateConfig(config);
+ * } catch (e) {
+ *   if (e instanceof ConfigError) {
+ *     console.error('Config errors:', e.errors);
+ *   }
+ * }
+ * ```
+ */
+function validateConfig(config) {
+    const errors = [];
+    // Validate issuer URL
+    if (!config.issuer) {
+        errors.push({ field: 'issuer', message: 'is required' });
+    }
+    else if (!isValidHttpsUrl(config.issuer)) {
+        errors.push({ field: 'issuer', message: 'must be a valid HTTPS URL' });
+    }
+    // Validate signing key
+    if (!config.signingKey) {
+        errors.push({ field: 'signingKey', message: 'is required' });
+    }
+    else {
+        validateSigningKey(config.signingKey, errors);
+    }
+    // Validate key ID
+    if (!config.keyId) {
+        errors.push({ field: 'keyId', message: 'is required' });
+    }
+    else if (typeof config.keyId !== 'string' || config.keyId.length === 0) {
+        errors.push({ field: 'keyId', message: 'must be a non-empty string' });
+    }
+    // Validate expiresIn (if provided)
+    if (config.expiresIn !== undefined) {
+        if (!Number.isInteger(config.expiresIn) || config.expiresIn <= 0) {
+            errors.push({ field: 'expiresIn', message: 'must be a positive integer' });
+        }
+    }
+    // Validate transport (if provided)
+    if (config.transport !== undefined) {
+        if (!['header', 'body', 'pointer'].includes(config.transport)) {
+            errors.push({ field: 'transport', message: 'must be "header", "body", or "pointer"' });
+        }
+    }
+    // Validate maxHeaderSize (if provided)
+    if (config.maxHeaderSize !== undefined) {
+        if (!Number.isInteger(config.maxHeaderSize) || config.maxHeaderSize <= 0) {
+            errors.push({ field: 'maxHeaderSize', message: 'must be a positive integer' });
+        }
+    }
+    // Validate pointer transport has URL generator
+    if (config.transport === 'pointer' && !config.pointerUrlGenerator) {
+        errors.push({
+            field: 'pointerUrlGenerator',
+            message: 'is required when transport is "pointer"',
+        });
+    }
+    // Validate interactionBinding (if provided)
+    if (config.interactionBinding !== undefined) {
+        if (!['minimal', 'off', 'full'].includes(config.interactionBinding)) {
+            errors.push({ field: 'interactionBinding', message: 'must be "minimal", "off", or "full"' });
+        }
+    }
+    // Validate claimsGenerator is a function (if provided)
+    if (config.claimsGenerator !== undefined && typeof config.claimsGenerator !== 'function') {
+        errors.push({ field: 'claimsGenerator', message: 'must be a function' });
+    }
+    // Validate pointerUrlGenerator is a function (if provided)
+    if (config.pointerUrlGenerator !== undefined &&
+        typeof config.pointerUrlGenerator !== 'function') {
+        errors.push({ field: 'pointerUrlGenerator', message: 'must be a function' });
+    }
+    if (errors.length > 0) {
+        throw new ConfigError(errors);
+    }
+}
+/**
+ * Validate middleware configuration with async keypair verification
+ *
+ * This extends basic validation with cryptographic verification that
+ * the private key (d) correctly derives to the public key (x).
+ *
+ * @param config - Configuration to validate
+ * @throws ConfigError if configuration is invalid
+ *
+ * @example
+ * ```typescript
+ * await validateConfigAsync(config);
+ * ```
+ */
+async function validateConfigAsync(config) {
+    // First run synchronous validation
+    validateConfig(config);
+    // Then validate keypair consistency (d derives to x)
+    const jwk = config.signingKey;
+    const isValidKeypair = await (0, crypto_1.validateKeypair)(jwk);
+    if (!isValidKeypair) {
+        throw new ConfigError([
+            {
+                field: 'signingKey',
+                message: 'keypair inconsistent: private key (d) does not derive to public key (x)',
+            },
+        ]);
+    }
+}
+/**
+ * Apply default values to configuration
+ */
+function applyDefaults(config) {
+    return {
+        ...config,
+        expiresIn: config.expiresIn ?? exports.CONFIG_DEFAULTS.expiresIn,
+        transport: config.transport ?? exports.CONFIG_DEFAULTS.transport,
+        maxHeaderSize: config.maxHeaderSize ?? exports.CONFIG_DEFAULTS.maxHeaderSize,
+        interactionBinding: config.interactionBinding ?? exports.CONFIG_DEFAULTS.interactionBinding,
+    };
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;AAiHH,wCA4EC;AAgBD,kDAgBC;AAKD,sCAaC;AA7OD,yCAAgE;AAGhE;;GAEG;AACU,QAAA,eAAe,GAAG,IAAI,CAAC;AAEpC;;GAEG;AACU,QAAA,eAAe,GAAG;IAC7B,SAAS,EAAE,GAAG;IACd,SAAS,EAAE,QAAiB;IAC5B,aAAa,EAAE,IAAI;IACnB,kBAAkB,EAAE,SAAkB;CAC9B,CAAC;AAEX;;GAEG;AACH,MAAa,WAAY,SAAQ,KAAK;IAC3B,MAAM,CAA0B;IAEzC,YAAY,MAA+B;QACzC,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzE,KAAK,CAAC,qCAAqC,OAAO,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;QAC1B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AATD,kCASC;AAED;;GAEG;AACH,SAAS,eAAe,CAAC,GAAW;IAClC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,kBAAkB,CAAC,GAAY,EAAE,MAA+B;IACvE,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACnE,OAAO;IACT,CAAC;IAED,MAAM,GAAG,GAAG,GAA8B,CAAC;IAE3C,oBAAoB;IACpB,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,EAAE,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC,CAAC;IACtF,CAAC;IAED,iBAAiB;IACjB,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;IACzE,CAAC;IAED,sBAAsB;IACtB,IAAI,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC,CAAC;IAChF,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAA,wBAAe,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACtC,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;gBACzB,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC,CAAC;YAC1F,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,kCAAkC,EAAE,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;IAED,uBAAuB;IACvB,IAAI,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,0CAA0C,EAAE,CAAC,CAAC;IAC9F,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAA,wBAAe,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACtC,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;gBACzB,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC,CAAC;YAC1F,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,kCAAkC,EAAE,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAgB,cAAc,CAAC,MAAwB;IACrD,MAAM,MAAM,GAA4B,EAAE,CAAC;IAE3C,sBAAsB;IACtB,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC;IAC3D,CAAC;SAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC,CAAC;IACzE,CAAC;IAED,uBAAuB;IACvB,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACvB,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC;IAC/D,CAAC;SAAM,CAAC;QACN,kBAAkB,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAChD,CAAC;IAED,kBAAkB;IAClB,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC;IAC1D,CAAC;SAAM,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC,CAAC;IACzE,CAAC;IAED,mCAAmC;IACnC,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,SAAS,IAAI,CAAC,EAAE,CAAC;YACjE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IAED,mCAAmC;IACnC,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACnC,IAAI,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9D,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,wCAAwC,EAAE,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IAED,uCAAuC;IACvC,IAAI,MAAM,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACvC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,MAAM,CAAC,aAAa,IAAI,CAAC,EAAE,CAAC;YACzE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IAED,+CAA+C;IAC/C,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC;QAClE,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,qBAAqB;YAC5B,OAAO,EAAE,yCAAyC;SACnD,CAAC,CAAC;IACL,CAAC;IAED,4CAA4C;IAC5C,IAAI,MAAM,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;QAC5C,IAAI,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACpE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC;IAED,uDAAuD;IACvD,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,eAAe,KAAK,UAAU,EAAE,CAAC;QACzF,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,2DAA2D;IAC3D,IACE,MAAM,CAAC,mBAAmB,KAAK,SAAS;QACxC,OAAO,MAAM,CAAC,mBAAmB,KAAK,UAAU,EAChD,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACI,KAAK,UAAU,mBAAmB,CAAC,MAAwB;IAChE,mCAAmC;IACnC,cAAc,CAAC,MAAM,CAAC,CAAC;IAEvB,qDAAqD;IACrD,MAAM,GAAG,GAAG,MAAM,CAAC,UAA+B,CAAC;IACnD,MAAM,cAAc,GAAG,MAAM,IAAA,wBAAe,EAAC,GAAG,CAAC,CAAC;IAElD,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,WAAW,CAAC;YACpB;gBACE,KAAK,EAAE,YAAY;gBACnB,OAAO,EAAE,yEAAyE;aACnF;SACF,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAgB,aAAa,CAC3B,MAAwB;IAKxB,OAAO;QACL,GAAG,MAAM;QACT,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,uBAAe,CAAC,SAAS;QACxD,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,uBAAe,CAAC,SAAS;QACxD,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,uBAAe,CAAC,aAAa;QACpE,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,IAAI,uBAAe,CAAC,kBAAkB;KACpF,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,42 @@
+/**
+ * PEAC Middleware Core
+ *
+ * Framework-agnostic middleware primitives for PEAC receipt issuance.
+ *
+ * This package provides the core building blocks for integrating PEAC
+ * receipt issuance into any HTTP framework. For framework-specific
+ * implementations, see:
+ * - `@peac/middleware-express` for Express.js
+ *
+ * @example
+ * ```typescript
+ * import { createReceipt, validateConfig, wrapResponse } from '@peac/middleware-core';
+ *
+ * // Validate configuration at startup
+ * validateConfig(config);
+ *
+ * // In request handler
+ * const result = await createReceipt(config, requestCtx, responseCtx);
+ *
+ * // Add headers
+ * for (const [key, value] of Object.entries(result.headers)) {
+ *   res.setHeader(key, value);
+ * }
+ *
+ * // Handle body transport
+ * if (result.bodyWrapper) {
+ *   res.json(result.bodyWrapper);
+ * } else {
+ *   res.json(originalBody);
+ * }
+ * ```
+ *
+ * @packageDocumentation
+ */
+export type { MiddlewareConfig, RequestContext, ResponseContext, ReceiptResult, ReceiptClaimsInput, ConfigValidationError, Ed25519PrivateJwk, TransportSelectionInput, InteractionBindingMode, } from './types.js';
+export { validateConfig, validateConfigAsync, ConfigError, CONFIG_DEFAULTS, MAX_PATH_LENGTH, applyDefaults, } from './config.js';
+export { selectTransport, wrapResponse, buildResponseHeaders, buildReceiptResult, } from './transport.js';
+export { createReceipt, createReceiptWithClaims } from './receipt.js';
+export type { RateLimitStore, MemoryRateLimitStoreOptions } from './rate-limit.js';
+export { MemoryRateLimitStore } from './rate-limit.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAGH,YAAY,EACV,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,aAAa,EACb,kBAAkB,EAClB,qBAAqB,EACrB,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,WAAW,EACX,eAAe,EACf,eAAe,EACf,aAAa,GACd,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,eAAe,EACf,YAAY,EACZ,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAAE,aAAa,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAGtE,YAAY,EAAE,cAAc,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AACnF,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC"}