@peac/protocol 0.12.0-preview.1 → 0.12.0

package/dist/index.mjs

@@ -34,7 +34,7 @@ var IssueError = class extends Error {
     this.peacError = peacError;
   }
 };
-async function issue(options) {
+async function issueWire01(options) {
   if (!options.iss.startsWith("https://")) {
     throw new Error("Issuer URL must start with https://");
   }
@@ -175,9 +175,12 @@ async function issue(options) {
   };
 }
 async function issueJws(options) {
-  const result = await issue(options);
+  const result = await issueWire01(options);
   return result.jws;
 }
+async function issue(options) {
+  return issueWire02(options);
+}
 async function issueWire02(options) {
   if (!isCanonicalIss(options.iss)) {
     throw new IssueError({
@@ -187,7 +190,7 @@ async function issueWire02(options) {
       retryable: false,
       http_status: 400,
       details: {
-        message: `iss is not in canonical form: "${options.iss}". Use https:// origin or did: identifier.`
+        message: `iss is not in canonical form: "${options.iss}". Use an https://<origin> or did:<method> identifier.`
       }
     });
   }
@@ -1414,16 +1417,7 @@ function sanitizeParseIssues(issues) {
   }));
 }
 async function verifyLocal(jws, publicKey, options = {}) {
-  const {
-    issuer,
-    audience,
-    subjectUri,
-    rid,
-    requireExp = false,
-    maxClockSkew = 300,
-    strictness = "strict",
-    policyDigest
-  } = options;
+  const { issuer, subjectUri, maxClockSkew = 300, strictness = "strict", policyDigest } = options;
   const now = options.now ?? Math.floor(Date.now() / 1e3);
   try {
     const result = await verify(jws, publicKey);
@@ -1555,86 +1549,11 @@ async function verifyLocal(jws, publicKey, options = {}) {
         policy_binding: bindingStatus
       };
     }
-    const w01 = pr.claims;
-    if (issuer !== void 0 && w01.iss !== issuer) {
-      return {
-        valid: false,
-        code: "E_INVALID_ISSUER",
-        message: `Issuer mismatch: expected "${issuer}", got "${w01.iss}"`
-      };
-    }
-    if (audience !== void 0 && w01.aud !== audience) {
-      return {
-        valid: false,
-        code: "E_INVALID_AUDIENCE",
-        message: `Audience mismatch: expected "${audience}", got "${w01.aud}"`
-      };
-    }
-    if (rid !== void 0 && w01.rid !== rid) {
-      return {
-        valid: false,
-        code: "E_INVALID_RECEIPT_ID",
-        message: `Receipt ID mismatch: expected "${rid}", got "${w01.rid}"`
-      };
-    }
-    if (requireExp && w01.exp === void 0) {
-      return {
-        valid: false,
-        code: "E_MISSING_EXP",
-        message: "Receipt missing required exp claim"
-      };
-    }
-    if (w01.iat > now + maxClockSkew) {
-      return {
-        valid: false,
-        code: "E_NOT_YET_VALID",
-        message: `Receipt not yet valid: issued at ${new Date(w01.iat * 1e3).toISOString()}, now is ${new Date(now * 1e3).toISOString()}`
-      };
-    }
-    if (w01.exp !== void 0 && w01.exp < now - maxClockSkew) {
-      return {
-        valid: false,
-        code: "E_EXPIRED",
-        message: `Receipt expired at ${new Date(w01.exp * 1e3).toISOString()}`
-      };
-    }
-    if (pr.variant === "commerce") {
-      const claims = pr.claims;
-      if (subjectUri !== void 0 && claims.subject?.uri !== subjectUri) {
-        return {
-          valid: false,
-          code: "E_INVALID_SUBJECT",
-          message: `Subject mismatch: expected "${subjectUri}", got "${claims.subject?.uri ?? "undefined"}"`
-        };
-      }
-      return {
-        valid: true,
-        variant: "commerce",
-        claims,
-        kid: result.header.kid,
-        wireVersion: "0.1",
-        warnings: [],
-        policy_binding: "unavailable"
-      };
-    } else {
-      const claims = pr.claims;
-      if (subjectUri !== void 0 && claims.sub !== subjectUri) {
-        return {
-          valid: false,
-          code: "E_INVALID_SUBJECT",
-          message: `Subject mismatch: expected "${subjectUri}", got "${claims.sub ?? "undefined"}"`
-        };
-      }
-      return {
-        valid: true,
-        variant: "attestation",
-        claims,
-        kid: result.header.kid,
-        wireVersion: "0.1",
-        warnings: [],
-        policy_binding: "unavailable"
-      };
-    }
+    return {
+      valid: false,
+      code: "E_UNSUPPORTED_WIRE_VERSION",
+      message: "Wire 0.1 receipts are not supported. Re-issue as Wire 0.2 using issue()."
+    };
   } catch (err) {
     if (isCryptoError(err)) {
       if (Object.prototype.hasOwnProperty.call(JOSE_CODE_MAP, err.code)) {
@@ -1683,10 +1602,10 @@ async function verifyLocal(jws, publicKey, options = {}) {
   }
 }
 function isCommerceResult(r) {
-  return r.valid === true && r.variant === "commerce";
+  return false;
 }
 function isAttestationResult(r) {
-  return r.valid === true && r.variant === "attestation";
+  return false;
 }
 function isWire02Result(r) {
   return r.valid === true && r.variant === "wire-02";
@@ -3017,6 +2936,6 @@ async function verifyAndFetchPointer(pointerHeader, fetchOptions) {
   });
 }
 
-export { CHECK_IDS, DEFAULT_NETWORK_SECURITY, DEFAULT_VERIFIER_LIMITS, IssueError, NON_DETERMINISTIC_ARTIFACT_KEYS, VerificationReportBuilder, buildFailureReport, buildSuccessReport, checkPolicyBinding, clearJWKSCache, clearKidThumbprints, computePolicyDigestJcs, computeReceiptDigest, createDefaultPolicy, createDigest, createEmptyReport, createReportBuilder, fetchDiscovery, fetchIssuerConfig, fetchJWKSSafe, fetchPointerSafe, fetchPointerWithDigest, fetchPolicyManifest, getJWKSCacheSize, getKidThumbprintSize, getPurposeHeader, getReceiptHeader, getSSRFCapabilities, isAttestationResult, isBlockedIP, isCommerceResult, isWire02Result, issue, issueJws, issueWire02, parseBodyProfile, parseDiscovery, parseHeaderProfile, parseIssuerConfig, parsePointerProfile, parsePolicyManifest, parseTransportProfile, reasonCodeToErrorCode, reasonCodeToSeverity, resetSSRFCapabilitiesCache, resolveJWKS, setPurposeAppliedHeader, setPurposeReasonHeader, setReceiptHeader, setVaryHeader, setVaryPurposeHeader, ssrfErrorToReasonCode, ssrfSafeFetch, verifyAndFetchPointer, verifyLocal, verifyReceipt, verifyReceiptCore };
+export { CHECK_IDS, DEFAULT_NETWORK_SECURITY, DEFAULT_VERIFIER_LIMITS, IssueError, NON_DETERMINISTIC_ARTIFACT_KEYS, VerificationReportBuilder, buildFailureReport, buildSuccessReport, checkPolicyBinding, clearJWKSCache, clearKidThumbprints, computePolicyDigestJcs, computeReceiptDigest, createDefaultPolicy, createDigest, createEmptyReport, createReportBuilder, fetchDiscovery, fetchIssuerConfig, fetchJWKSSafe, fetchPointerSafe, fetchPointerWithDigest, fetchPolicyManifest, getJWKSCacheSize, getKidThumbprintSize, getPurposeHeader, getReceiptHeader, getSSRFCapabilities, isAttestationResult, isBlockedIP, isCommerceResult, isWire02Result, issue, issueJws, issueWire01, issueWire02, parseBodyProfile, parseDiscovery, parseHeaderProfile, parseIssuerConfig, parsePointerProfile, parsePolicyManifest, parseTransportProfile, reasonCodeToErrorCode, reasonCodeToSeverity, resetSSRFCapabilitiesCache, resolveJWKS, setPurposeAppliedHeader, setPurposeReasonHeader, setReceiptHeader, setVaryHeader, setVaryPurposeHeader, ssrfErrorToReasonCode, ssrfSafeFetch, verifyAndFetchPointer, verifyLocal, verifyReceipt, verifyReceiptCore };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map