@peac/protocol 0.10.8 → 0.10.10

package/dist/issue.js

@@ -1,208 +0,0 @@
-"use strict";
-/**
- * Receipt issuance
- * Validates input, generates UUIDv7 rid, and signs with Ed25519
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.IssueError = void 0;
-exports.issue = issue;
-exports.issueJws = issueJws;
-const uuidv7_1 = require("uuidv7");
-const crypto_1 = require("@peac/crypto");
-const zod_1 = require("zod");
-const schema_1 = require("@peac/schema");
-const telemetry_1 = require("@peac/telemetry");
-const telemetry_js_1 = require("./telemetry.js");
-/**
- * Error thrown during receipt issuance
- *
- * Wraps a structured PEACError for programmatic handling.
- */
-class IssueError extends Error {
-    /** Structured error details */
-    peacError;
-    constructor(peacError) {
-        const details = peacError.details;
-        super(details?.message ?? peacError.code);
-        this.name = 'IssueError';
-        this.peacError = peacError;
-    }
-}
-exports.IssueError = IssueError;
-/**
- * Issue a PEAC receipt
- *
- * @param options - Receipt options
- * @returns Issue result with JWS and optional subject_snapshot
- * @throws IssueError if evidence contains non-JSON-safe values
- */
-async function issue(options) {
-    // Validate URLs
-    if (!options.iss.startsWith('https://')) {
-        throw new Error('Issuer URL must start with https://');
-    }
-    if (!options.aud.startsWith('https://')) {
-        throw new Error('Audience URL must start with https://');
-    }
-    if (options.subject && !options.subject.startsWith('https://')) {
-        throw new Error('Subject URI must start with https://');
-    }
-    // Validate currency code
-    if (!/^[A-Z]{3}$/.test(options.cur)) {
-        throw new Error('Currency must be ISO 4217 uppercase (e.g., USD)');
-    }
-    // Validate amount
-    if (!Number.isInteger(options.amt) || options.amt < 0) {
-        throw new Error('Amount must be a non-negative integer');
-    }
-    // Validate expiry (if provided)
-    if (options.exp !== undefined) {
-        if (!Number.isInteger(options.exp) || options.exp < 0) {
-            throw new Error('Expiry must be a non-negative integer');
-        }
-    }
-    // Normalize and validate purpose (v0.9.24+)
-    let purposeDeclared;
-    if (options.purpose !== undefined) {
-        // Normalize to array
-        const rawPurposes = Array.isArray(options.purpose) ? options.purpose : [options.purpose];
-        // Validate each token
-        const invalidTokens = [];
-        for (const token of rawPurposes) {
-            if (!(0, schema_1.isValidPurposeToken)(token)) {
-                invalidTokens.push(token);
-            }
-        }
-        if (invalidTokens.length > 0) {
-            throw new Error(`Invalid purpose tokens: ${invalidTokens.join(', ')}`);
-        }
-        // Check for explicit 'undeclared' which is invalid on wire
-        if (rawPurposes.includes('undeclared')) {
-            throw new Error("Explicit 'undeclared' is not a valid purpose token (internal-only)");
-        }
-        purposeDeclared = rawPurposes;
-    }
-    // Validate purpose_enforced (must be canonical)
-    if (options.purpose_enforced !== undefined) {
-        if (!(0, schema_1.isCanonicalPurpose)(options.purpose_enforced)) {
-            throw new Error(`purpose_enforced must be a canonical purpose, got: ${options.purpose_enforced}`);
-        }
-    }
-    // Validate purpose_reason
-    if (options.purpose_reason !== undefined) {
-        if (!(0, schema_1.isValidPurposeReason)(options.purpose_reason)) {
-            throw new Error(`Invalid purpose_reason: ${options.purpose_reason}`);
-        }
-    }
-    // Validate workflow_context (v0.10.2+)
-    if (options.workflow_context !== undefined) {
-        if (!(0, schema_1.isValidWorkflowContext)(options.workflow_context)) {
-            throw new IssueError((0, schema_1.createWorkflowContextInvalidError)('Does not conform to WorkflowContextSchema'));
-        }
-        if (!(0, schema_1.hasValidDagSemantics)(options.workflow_context)) {
-            // Determine specific reason
-            const ctx = options.workflow_context;
-            const isSelfParent = ctx.parent_step_ids.includes(ctx.step_id);
-            const hasDuplicates = new Set(ctx.parent_step_ids).size !== ctx.parent_step_ids.length;
-            const reason = isSelfParent ? 'self_parent' : hasDuplicates ? 'duplicate_parent' : 'cycle';
-            throw new IssueError((0, schema_1.createWorkflowDagInvalidError)(reason));
-        }
-    }
-    // Generate UUIDv7 for receipt ID
-    const rid = (0, uuidv7_1.uuidv7)();
-    // Get current timestamp
-    const iat = Math.floor(Date.now() / 1000);
-    // Build receipt claims
-    const claims = {
-        iss: options.iss,
-        aud: options.aud,
-        iat,
-        rid,
-        amt: options.amt,
-        cur: options.cur,
-        payment: {
-            rail: options.rail,
-            reference: options.reference,
-            amount: options.amt,
-            currency: options.cur,
-            asset: options.asset ?? options.cur, // Default asset to currency for backward compatibility
-            env: options.env ?? 'test', // Default to test environment for backward compatibility
-            evidence: options.evidence ?? {}, // Default to empty object for backward compatibility
-            ...(options.network && { network: options.network }),
-            ...(options.facilitator_ref && { facilitator_ref: options.facilitator_ref }),
-            ...(options.idempotency_key && { idempotency_key: options.idempotency_key }),
-            ...(options.metadata && { metadata: options.metadata }),
-        },
-        ...(options.exp && { exp: options.exp }),
-        ...(options.subject && { subject: { uri: options.subject } }),
-        // Build extensions (merge user-provided ext with workflow_context)
-        ...((options.ext || options.workflow_context) && {
-            ext: {
-                ...options.ext,
-                ...(options.workflow_context && {
-                    [schema_1.WORKFLOW_EXTENSION_KEY]: options.workflow_context,
-                }),
-            },
-        }),
-        // Purpose claims (v0.9.24+)
-        ...(purposeDeclared && { purpose_declared: purposeDeclared }),
-        ...(options.purpose_enforced && { purpose_enforced: options.purpose_enforced }),
-        ...(options.purpose_reason && { purpose_reason: options.purpose_reason }),
-    };
-    // Validate claims with Zod - map evidence errors to typed error
-    try {
-        schema_1.ReceiptClaims.parse(claims);
-    }
-    catch (err) {
-        if (err instanceof zod_1.ZodError) {
-            // Check if any error path touches evidence
-            const evidenceIssue = err.issues.find((issue) => issue.path.some((p) => p === 'evidence' || p === 'payment'));
-            if (evidenceIssue && evidenceIssue.path.includes('evidence')) {
-                const peacError = (0, schema_1.createEvidenceNotJsonError)(evidenceIssue.message, evidenceIssue.path);
-                throw new IssueError(peacError);
-            }
-        }
-        throw err;
-    }
-    // Validate subject_snapshot if provided (v0.9.17+)
-    // This validates schema and logs advisory PII warning if applicable
-    const validatedSnapshot = (0, schema_1.validateSubjectSnapshot)(options.subject_snapshot);
-    // Track start time for telemetry
-    const startTime = performance.now();
-    // Sign with Ed25519
-    const jws = await (0, crypto_1.sign)(claims, options.privateKey, options.kid);
-    // Emit telemetry (no-throw guard)
-    const p = telemetry_1.providerRef.current;
-    if (p) {
-        try {
-            const durationMs = performance.now() - startTime;
-            p.onReceiptIssued({
-                receiptHash: (0, telemetry_js_1.hashReceipt)(jws),
-                issuer: options.iss,
-                kid: options.kid,
-                durationMs,
-            });
-        }
-        catch {
-            // Telemetry MUST NOT break core flow
-        }
-    }
-    return {
-        jws,
-        ...(validatedSnapshot && { subject_snapshot: validatedSnapshot }),
-    };
-}
-/**
- * Issue a PEAC receipt and return just the JWS string
- *
- * Convenience wrapper for common header-centric flows where only the JWS is needed.
- * For access to validated subject_snapshot, use issue() instead.
- *
- * @param options - Receipt options
- * @returns JWS compact serialization
- */
-async function issueJws(options) {
-    const result = await issue(options);
-    return result.jws;
-}
-//# sourceMappingURL=issue.js.map

package/dist/issue.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"issue.js","sourceRoot":"","sources":["../src/issue.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AA8JH,sBAmLC;AAWD,4BAGC;AA7VD,mCAAgC;AAChC,yCAAoC;AAEpC,6BAA+B;AAC/B,yCAoBsB;AACtB,+CAA8C;AAC9C,iDAA6C;AA0G7C;;;;GAIG;AACH,MAAa,UAAW,SAAQ,KAAK;IACnC,+BAA+B;IACtB,SAAS,CAAY;IAE9B,YAAY,SAAoB;QAC9B,MAAM,OAAO,GAAG,SAAS,CAAC,OAA2C,CAAC;QACtE,KAAK,CAAC,OAAO,EAAE,OAAO,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;QACzB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;CACF;AAVD,gCAUC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,KAAK,CAAC,OAAqB;IAC/C,gBAAgB;IAChB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAED,yBAAyB;IACzB,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IAED,kBAAkB;IAClB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IAED,gCAAgC;IAChC,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAED,4CAA4C;IAC5C,IAAI,eAA2C,CAAC;IAChD,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAClC,qBAAqB;QACrB,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAEzF,sBAAsB;QACtB,MAAM,aAAa,GAAa,EAAE,CAAC;QACnC,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;YAChC,IAAI,CAAC,IAAA,4BAAmB,EAAC,KAAK,CAAC,EAAE,CAAC;gBAChC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QACD,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,2BAA2B,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,2DAA2D;QAC3D,IAAI,WAAW,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;QACxF,CAAC;QAED,eAAe,GAAG,WAAW,CAAC;IAChC,CAAC;IAED,gDAAgD;IAChD,IAAI,OAAO,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QAC3C,IAAI,CAAC,IAAA,2BAAkB,EAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CACb,sDAAsD,OAAO,CAAC,gBAAgB,EAAE,CACjF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,0BAA0B;IAC1B,IAAI,OAAO,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QACzC,IAAI,CAAC,IAAA,6BAAoB,EAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CAAC,2BAA2B,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAED,uCAAuC;IACvC,IAAI,OAAO,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QAC3C,IAAI,CAAC,IAAA,+BAAsB,EAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,UAAU,CAClB,IAAA,0CAAiC,EAAC,2CAA2C,CAAC,CAC/E,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAA,6BAAoB,EAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACpD,4BAA4B;YAC5B,MAAM,GAAG,GAAG,OAAO,CAAC,gBAAgB,CAAC;YACrC,MAAM,YAAY,GAAG,GAAG,CAAC,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC/D,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC;YACvF,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC;YAC3F,MAAM,IAAI,UAAU,CAAC,IAAA,sCAA6B,EAAC,MAAM,CAAC,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAED,iCAAiC;IACjC,MAAM,GAAG,GAAG,IAAA,eAAM,GAAE,CAAC;IAErB,wBAAwB;IACxB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAE1C,uBAAuB;IACvB,MAAM,MAAM,GAAsB;QAChC,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,GAAG;QACH,GAAG;QACH,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,OAAO,EAAE;YACP,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,MAAM,EAAE,OAAO,CAAC,GAAG;YACnB,QAAQ,EAAE,OAAO,CAAC,GAAG;YACrB,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,EAAE,uDAAuD;YAC5F,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,MAAM,EAAE,yDAAyD;YACrF,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,EAAE,EAAE,qDAAqD;YACvF,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;YACpD,GAAG,CAAC,OAAO,CAAC,eAAe,IAAI,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC;YAC5E,GAAG,CAAC,OAAO,CAAC,eAAe,IAAI,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC;YAC5E,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;SACxD;QACD,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;QACxC,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QAC7D,mEAAmE;QACnE,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,gBAAgB,CAAC,IAAI;YAC/C,GAAG,EAAE;gBACH,GAAG,OAAO,CAAC,GAAG;gBACd,GAAG,CAAC,OAAO,CAAC,gBAAgB,IAAI;oBAC9B,CAAC,+BAAsB,CAAC,EAAE,OAAO,CAAC,gBAAgB;iBACnD,CAAC;aACH;SACF,CAAC;QACF,4BAA4B;QAC5B,GAAG,CAAC,eAAe,IAAI,EAAE,gBAAgB,EAAE,eAAe,EAAE,CAAC;QAC7D,GAAG,CAAC,OAAO,CAAC,gBAAgB,IAAI,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC/E,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC;KAC1E,CAAC;IAEF,gEAAgE;IAChE,IAAI,CAAC;QACH,sBAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,IAAI,GAAG,YAAY,cAAQ,EAAE,CAAC;YAC5B,2CAA2C;YAC3C,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CACnC,CAAC,KAAqD,EAAE,EAAE,CACxD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAkB,EAAE,EAAE,CAAC,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,SAAS,CAAC,CAC/E,CAAC;YACF,IAAI,aAAa,IAAI,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC7D,MAAM,SAAS,GAAG,IAAA,mCAA0B,EAAC,aAAa,CAAC,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC;gBACxF,MAAM,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,mDAAmD;IACnD,oEAAoE;IACpE,MAAM,iBAAiB,GAAG,IAAA,gCAAuB,EAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAE5E,iCAAiC;IACjC,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAEpC,oBAAoB;IACpB,MAAM,GAAG,GAAG,MAAM,IAAA,aAAI,EAAC,MAAM,EAAE,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAEhE,kCAAkC;IAClC,MAAM,CAAC,GAAG,uBAAW,CAAC,OAAO,CAAC;IAC9B,IAAI,CAAC,EAAE,CAAC;QACN,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YACjD,CAAC,CAAC,eAAe,CAAC;gBAChB,WAAW,EAAE,IAAA,0BAAW,EAAC,GAAG,CAAC;gBAC7B,MAAM,EAAE,OAAO,CAAC,GAAG;gBACnB,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,UAAU;aACX,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,qCAAqC;QACvC,CAAC;IACH,CAAC;IAED,OAAO;QACL,GAAG;QACH,GAAG,CAAC,iBAAiB,IAAI,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,CAAC;KAClE,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACI,KAAK,UAAU,QAAQ,CAAC,OAAqB;IAClD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;IACpC,OAAO,MAAM,CAAC,GAAG,CAAC;AACpB,CAAC"}

package/dist/pointer-fetch.js

@@ -1,305 +0,0 @@
-"use strict";
-/**
- * PEAC Pointer Fetch with Digest Verification
- *
- * Implements secure receipt fetching via pointers per TRANSPORT-PROFILES.md:
- * - SSRF-safe fetch
- * - SHA-256 digest verification
- * - Size limits
- *
- * @packageDocumentation
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.fetchPointerWithDigest = fetchPointerWithDigest;
-exports.verifyAndFetchPointer = verifyAndFetchPointer;
-const crypto_1 = require("@peac/crypto");
-const kernel_1 = require("@peac/kernel");
-const ssrf_safe_fetch_js_1 = require("./ssrf-safe-fetch.js");
-// ---------------------------------------------------------------------------
-// Error Mapping
-// ---------------------------------------------------------------------------
-/**
- * Map SSRF error reason to pointer error reason
- */
-function mapSsrfError(ssrfError) {
-    const reason = ssrfError.reason;
-    switch (reason) {
-        case 'not_https':
-        case 'private_ip':
-        case 'loopback':
-        case 'link_local':
-        case 'dns_failure':
-        case 'cross_origin_redirect':
-            return {
-                ok: false,
-                reason: 'pointer_fetch_blocked',
-                errorCode: 'E_VERIFY_POINTER_FETCH_BLOCKED',
-                message: ssrfError.message,
-            };
-        case 'timeout':
-            return {
-                ok: false,
-                reason: 'pointer_fetch_timeout',
-                errorCode: 'E_VERIFY_POINTER_FETCH_TIMEOUT',
-                message: ssrfError.message,
-            };
-        case 'response_too_large':
-            return {
-                ok: false,
-                reason: 'pointer_fetch_too_large',
-                errorCode: 'E_VERIFY_POINTER_FETCH_TOO_LARGE',
-                message: ssrfError.message,
-            };
-        default:
-            return {
-                ok: false,
-                reason: 'pointer_fetch_failed',
-                errorCode: 'E_VERIFY_POINTER_FETCH_FAILED',
-                message: ssrfError.message,
-            };
-    }
-}
-// ---------------------------------------------------------------------------
-// Pointer Fetch
-// ---------------------------------------------------------------------------
-/**
- * Fetch a receipt via pointer with digest verification
- *
- * Per TRANSPORT-PROFILES.md:
- * - Fetch the URL using SSRF-safe fetch
- * - Compute SHA-256 digest of response
- * - Verify digest matches expected value from header
- * - Return receipt only if digest matches
- *
- * @param options - Pointer fetch options
- * @returns Fetch result
- */
-async function fetchPointerWithDigest(options) {
-    const { url, expectedDigest, fetchOptions = {} } = options;
-    // Validate expected digest format
-    const hexRegex = /^[0-9a-f]{64}$/;
-    if (!hexRegex.test(expectedDigest)) {
-        return {
-            ok: false,
-            reason: 'pointer_fetch_failed',
-            errorCode: 'E_VERIFY_POINTER_FETCH_FAILED',
-            message: 'Invalid expected digest: must be 64 lowercase hex characters',
-        };
-    }
-    // Validate URL is HTTPS (pre-check before fetch)
-    try {
-        const parsedUrl = new URL(url);
-        if (parsedUrl.protocol !== 'https:') {
-            return {
-                ok: false,
-                reason: 'pointer_fetch_blocked',
-                errorCode: 'E_VERIFY_POINTER_FETCH_BLOCKED',
-                message: 'Pointer URL must use HTTPS',
-            };
-        }
-    }
-    catch {
-        return {
-            ok: false,
-            reason: 'pointer_fetch_failed',
-            errorCode: 'E_VERIFY_POINTER_FETCH_FAILED',
-            message: 'Invalid pointer URL',
-        };
-    }
-    // Fetch with SSRF protection and DoS bounds
-    // - Size cap: maxReceiptBytes (prevents memory exhaustion)
-    // - No redirects: prevents redirect-based SSRF (pointer URL must be direct)
-    // - Timeout: prevents slow-loris style attacks
-    const fetchResult = await (0, ssrf_safe_fetch_js_1.ssrfSafeFetch)(url, {
-        ...fetchOptions,
-        maxBytes: kernel_1.VERIFIER_LIMITS.maxReceiptBytes,
-        allowRedirects: false, // Pointer URL must be direct - no redirects
-        timeoutMs: fetchOptions?.timeoutMs ?? kernel_1.VERIFIER_LIMITS.fetchTimeoutMs,
-        headers: {
-            Accept: 'application/jose, application/json, text/plain',
-            ...fetchOptions.headers,
-        },
-    });
-    if (!fetchResult.ok) {
-        return mapSsrfError(fetchResult);
-    }
-    const receipt = fetchResult.body;
-    // Validate Content-Type if present (warn but don't reject for interoperability)
-    // Expected: application/jose, application/json, or text/plain
-    const contentType = fetchResult.contentType;
-    const expectedContentTypes = ['application/jose', 'application/json', 'text/plain'];
-    const contentTypeWarning = contentType && !expectedContentTypes.some((expected) => contentType.startsWith(expected))
-        ? `Unexpected Content-Type: ${contentType}; expected application/jose, application/json, or text/plain`
-        : undefined;
-    // Validate: reject empty body
-    if (!receipt || receipt.trim().length === 0) {
-        return {
-            ok: false,
-            reason: 'malformed_receipt',
-            errorCode: 'E_VERIFY_MALFORMED_RECEIPT',
-            message: 'Pointer target returned empty content',
-        };
-    }
-    // Validate: content must look like JWS compact serialization (3 dot-separated segments)
-    const jwsValidation = validateJwsCompactStructure(receipt);
-    if (!jwsValidation.valid) {
-        return {
-            ok: false,
-            reason: 'malformed_receipt',
-            errorCode: 'E_VERIFY_MALFORMED_RECEIPT',
-            message: jwsValidation.message,
-        };
-    }
-    // Compute digest of fetched content (hash the raw string bytes)
-    const actualDigest = await (0, crypto_1.sha256Hex)(receipt);
-    // Verify digest matches
-    if (actualDigest !== expectedDigest) {
-        return {
-            ok: false,
-            reason: 'pointer_digest_mismatch',
-            errorCode: 'E_VERIFY_POINTER_DIGEST_MISMATCH',
-            message: 'Fetched receipt digest does not match expected digest',
-            actualDigest,
-            expectedDigest,
-        };
-    }
-    return {
-        ok: true,
-        receipt,
-        actualDigest,
-        digestMatched: true,
-        contentType: fetchResult.contentType,
-        ...(contentTypeWarning && { contentTypeWarning }),
-    };
-}
-/**
- * Validate that a string looks like JWS compact serialization
- *
- * A valid JWS compact has exactly 3 dot-separated base64url segments.
- *
- * @param value - String to validate
- * @returns Validation result
- */
-function validateJwsCompactStructure(value) {
-    const segments = value.split('.');
-    if (segments.length !== 3) {
-        return {
-            valid: false,
-            message: `Invalid JWS compact serialization: expected 3 segments, got ${segments.length}`,
-        };
-    }
-    // All segments must be non-empty and contain only base64url characters
-    const base64urlRegex = /^[A-Za-z0-9_-]+$/;
-    for (let i = 0; i < segments.length; i++) {
-        const segment = segments[i];
-        if (segment.length === 0) {
-            return {
-                valid: false,
-                message: `Invalid JWS compact serialization: segment ${i + 1} is empty`,
-            };
-        }
-        if (!base64urlRegex.test(segment)) {
-            return {
-                valid: false,
-                message: `Invalid JWS compact serialization: segment ${i + 1} contains invalid characters`,
-            };
-        }
-    }
-    return { valid: true };
-}
-/**
- * Parse pointer header key=value pairs (ReDoS-safe)
- *
- * Handles both quoted and unquoted values without complex regex alternation.
- */
-function parsePointerHeader(input) {
-    const params = {};
-    let i = 0;
-    const len = input.length;
-    while (i < len) {
-        // Skip whitespace and commas
-        while (i < len && (input[i] === ' ' || input[i] === ',' || input[i] === '\t')) {
-            i++;
-        }
-        if (i >= len)
-            break;
-        // Parse key (word characters only)
-        const keyStart = i;
-        while (i < len && /\w/.test(input[i])) {
-            i++;
-        }
-        const key = input.slice(keyStart, i);
-        if (!key)
-            break;
-        // Skip whitespace before '='
-        while (i < len && input[i] === ' ')
-            i++;
-        // Expect '='
-        if (i >= len || input[i] !== '=')
-            break;
-        i++; // skip '='
-        // Skip whitespace after '='
-        while (i < len && input[i] === ' ')
-            i++;
-        // Parse value (quoted or unquoted)
-        let value;
-        if (input[i] === '"') {
-            // Quoted value - find closing quote
-            i++; // skip opening quote
-            const valueStart = i;
-            while (i < len && input[i] !== '"') {
-                i++;
-            }
-            value = input.slice(valueStart, i);
-            if (i < len)
-                i++; // skip closing quote
-        }
-        else {
-            // Unquoted value - read until comma or whitespace
-            const valueStart = i;
-            while (i < len && input[i] !== ',' && input[i] !== ' ' && input[i] !== '\t') {
-                i++;
-            }
-            value = input.slice(valueStart, i);
-        }
-        params[key] = value;
-    }
-    return params;
-}
-/**
- * Verify a pointer header and fetch the receipt
- *
- * Combines parsing and fetching in a single operation.
- *
- * @param pointerHeader - PEAC-Receipt-Pointer header value
- * @param fetchOptions - Optional SSRF fetch options
- * @returns Fetch result
- */
-async function verifyAndFetchPointer(pointerHeader, fetchOptions) {
-    // Parse pointer header (RFC 8941 dictionary format)
-    // Format: sha256="<hex>", url="<url>"
-    // Using explicit parsing to avoid ReDoS in regex alternation
-    const params = parsePointerHeader(pointerHeader);
-    if (!params.sha256) {
-        return {
-            ok: false,
-            reason: 'pointer_fetch_failed',
-            errorCode: 'E_VERIFY_POINTER_FETCH_FAILED',
-            message: 'PEAC-Receipt-Pointer missing sha256 parameter',
-        };
-    }
-    if (!params.url) {
-        return {
-            ok: false,
-            reason: 'pointer_fetch_failed',
-            errorCode: 'E_VERIFY_POINTER_FETCH_FAILED',
-            message: 'PEAC-Receipt-Pointer missing url parameter',
-        };
-    }
-    return fetchPointerWithDigest({
-        url: params.url,
-        expectedDigest: params.sha256,
-        fetchOptions,
-    });
-}
-//# sourceMappingURL=pointer-fetch.js.map

package/dist/pointer-fetch.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"pointer-fetch.js","sourceRoot":"","sources":["../src/pointer-fetch.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;AAyIH,wDA8GC;AAkHD,sDAgCC;AAvYD,yCAAyC;AACzC,yCAA+C;AAC/C,6DAAiG;AAmEjG,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E;;GAEG;AACH,SAAS,YAAY,CAAC,SAAyB;IAC7C,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;IAEhC,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,WAAW,CAAC;QACjB,KAAK,YAAY,CAAC;QAClB,KAAK,UAAU,CAAC;QAChB,KAAK,YAAY,CAAC;QAClB,KAAK,aAAa,CAAC;QACnB,KAAK,uBAAuB;YAC1B,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,uBAAuB;gBAC/B,SAAS,EAAE,gCAAgC;gBAC3C,OAAO,EAAE,SAAS,CAAC,OAAO;aAC3B,CAAC;QAEJ,KAAK,SAAS;YACZ,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,uBAAuB;gBAC/B,SAAS,EAAE,gCAAgC;gBAC3C,OAAO,EAAE,SAAS,CAAC,OAAO;aAC3B,CAAC;QAEJ,KAAK,oBAAoB;YACvB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,yBAAyB;gBACjC,SAAS,EAAE,kCAAkC;gBAC7C,OAAO,EAAE,SAAS,CAAC,OAAO;aAC3B,CAAC;QAEJ;YACE,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,sBAAsB;gBAC9B,SAAS,EAAE,+BAA+B;gBAC1C,OAAO,EAAE,SAAS,CAAC,OAAO;aAC3B,CAAC;IACN,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACI,KAAK,UAAU,sBAAsB,CAC1C,OAA4B;IAE5B,MAAM,EAAE,GAAG,EAAE,cAAc,EAAE,YAAY,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC;IAE3D,kCAAkC;IAClC,MAAM,QAAQ,GAAG,gBAAgB,CAAC;IAClC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;QACnC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,sBAAsB;YAC9B,SAAS,EAAE,+BAA+B;YAC1C,OAAO,EAAE,8DAA8D;SACxE,CAAC;IACJ,CAAC;IAED,iDAAiD;IACjD,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,SAAS,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACpC,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,uBAAuB;gBAC/B,SAAS,EAAE,gCAAgC;gBAC3C,OAAO,EAAE,4BAA4B;aACtC,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,sBAAsB;YAC9B,SAAS,EAAE,+BAA+B;YAC1C,OAAO,EAAE,qBAAqB;SAC/B,CAAC;IACJ,CAAC;IAED,4CAA4C;IAC5C,2DAA2D;IAC3D,4EAA4E;IAC5E,+CAA+C;IAC/C,MAAM,WAAW,GAAG,MAAM,IAAA,kCAAa,EAAC,GAAG,EAAE;QAC3C,GAAG,YAAY;QACf,QAAQ,EAAE,wBAAe,CAAC,eAAe;QACzC,cAAc,EAAE,KAAK,EAAE,4CAA4C;QACnE,SAAS,EAAE,YAAY,EAAE,SAAS,IAAI,wBAAe,CAAC,cAAc;QACpE,OAAO,EAAE;YACP,MAAM,EAAE,gDAAgD;YACxD,GAAG,YAAY,CAAC,OAAO;SACxB;KACF,CAAC,CAAC;IAEH,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;QACpB,OAAO,YAAY,CAAC,WAAW,CAAC,CAAC;IACnC,CAAC;IAED,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC;IAEjC,gFAAgF;IAChF,8DAA8D;IAC9D,MAAM,WAAW,GAAG,WAAW,CAAC,WAAW,CAAC;IAC5C,MAAM,oBAAoB,GAAG,CAAC,kBAAkB,EAAE,kBAAkB,EAAE,YAAY,CAAC,CAAC;IACpF,MAAM,kBAAkB,GACtB,WAAW,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QACvF,CAAC,CAAC,4BAA4B,WAAW,8DAA8D;QACvG,CAAC,CAAC,SAAS,CAAC;IAEhB,8BAA8B;IAC9B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,mBAAmB;YAC3B,SAAS,EAAE,4BAA4B;YACvC,OAAO,EAAE,uCAAuC;SACjD,CAAC;IACJ,CAAC;IAED,wFAAwF;IACxF,MAAM,aAAa,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;IAC3D,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC;QACzB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,mBAAmB;YAC3B,SAAS,EAAE,4BAA4B;YACvC,OAAO,EAAE,aAAa,CAAC,OAAO;SAC/B,CAAC;IACJ,CAAC;IAED,gEAAgE;IAChE,MAAM,YAAY,GAAG,MAAM,IAAA,kBAAS,EAAC,OAAO,CAAC,CAAC;IAE9C,wBAAwB;IACxB,IAAI,YAAY,KAAK,cAAc,EAAE,CAAC;QACpC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,yBAAyB;YACjC,SAAS,EAAE,kCAAkC;YAC7C,OAAO,EAAE,uDAAuD;YAChE,YAAY;YACZ,cAAc;SACf,CAAC;IACJ,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,OAAO;QACP,YAAY;QACZ,aAAa,EAAE,IAAI;QACnB,WAAW,EAAE,WAAW,CAAC,WAAW;QACpC,GAAG,CAAC,kBAAkB,IAAI,EAAE,kBAAkB,EAAE,CAAC;KAClD,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,2BAA2B,CAClC,KAAa;IAEb,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAElC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,OAAO,EAAE,+DAA+D,QAAQ,CAAC,MAAM,EAAE;SAC1F,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,MAAM,cAAc,GAAG,kBAAkB,CAAC;IAE1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,OAAO,EAAE,8CAA8C,CAAC,GAAG,CAAC,WAAW;aACxE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAClC,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,OAAO,EAAE,8CAA8C,CAAC,GAAG,CAAC,8BAA8B;aAC3F,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,KAAa;IACvC,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC;IAEzB,OAAO,CAAC,GAAG,GAAG,EAAE,CAAC;QACf,6BAA6B;QAC7B,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;YAC9E,CAAC,EAAE,CAAC;QACN,CAAC;QACD,IAAI,CAAC,IAAI,GAAG;YAAE,MAAM;QAEpB,mCAAmC;QACnC,MAAM,QAAQ,GAAG,CAAC,CAAC;QACnB,OAAO,CAAC,GAAG,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACtC,CAAC,EAAE,CAAC;QACN,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QACrC,IAAI,CAAC,GAAG;YAAE,MAAM;QAEhB,6BAA6B;QAC7B,OAAO,CAAC,GAAG,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,CAAC,EAAE,CAAC;QAExC,aAAa;QACb,IAAI,CAAC,IAAI,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,MAAM;QACxC,CAAC,EAAE,CAAC,CAAC,WAAW;QAEhB,4BAA4B;QAC5B,OAAO,CAAC,GAAG,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,CAAC,EAAE,CAAC;QAExC,mCAAmC;QACnC,IAAI,KAAa,CAAC;QAClB,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACrB,oCAAoC;YACpC,CAAC,EAAE,CAAC,CAAC,qBAAqB;YAC1B,MAAM,UAAU,GAAG,CAAC,CAAC;YACrB,OAAO,CAAC,GAAG,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBACnC,CAAC,EAAE,CAAC;YACN,CAAC;YACD,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;YACnC,IAAI,CAAC,GAAG,GAAG;gBAAE,CAAC,EAAE,CAAC,CAAC,qBAAqB;QACzC,CAAC;aAAM,CAAC;YACN,kDAAkD;YAClD,MAAM,UAAU,GAAG,CAAC,CAAC;YACrB,OAAO,CAAC,GAAG,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC5E,CAAC,EAAE,CAAC;YACN,CAAC;YACD,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QACrC,CAAC;QAED,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACtB,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;GAQG;AACI,KAAK,UAAU,qBAAqB,CACzC,aAAqB,EACrB,YAAiD;IAEjD,oDAAoD;IACpD,sCAAsC;IACtC,6DAA6D;IAC7D,MAAM,MAAM,GAAG,kBAAkB,CAAC,aAAa,CAAC,CAAC;IAEjD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,sBAAsB;YAC9B,SAAS,EAAE,+BAA+B;YAC1C,OAAO,EAAE,+CAA+C;SACzD,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QAChB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,sBAAsB;YAC9B,SAAS,EAAE,+BAA+B;YAC1C,OAAO,EAAE,4CAA4C;SACtD,CAAC;IACJ,CAAC;IAED,OAAO,sBAAsB,CAAC;QAC5B,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,cAAc,EAAE,MAAM,CAAC,MAAM;QAC7B,YAAY;KACb,CAAC,CAAC;AACL,CAAC"}