@peac/protocol 0.12.13 → 0.13.0

package/dist/index.d.ts

@@ -7,8 +7,10 @@ export * from './verify';
 export * from './verify-local';
 export * from './headers';
 export * from './discovery';
-export * from './jwks-resolver';
+export type { JWK, JWKS, RevokedKeyInfo, JWKSResolveSuccess, JWKSResolveError, JWKSResolveResult, ResolveJWKSOptions, } from './jwks-resolver';
+export { clearKidThumbprints, getKidThumbprintSize, clearJWKSCache, getJWKSCacheSize, resolveJWKS, } from './jwks-resolver';
 export { computePolicyDigestJcs, checkPolicyBinding } from './policy-binding';
+export { computeJsonDocumentDigestJcs, computeTextDocumentDigestUtf8, computeDocumentDigest, checkDocumentBinding, } from './document-binding';
 export * from './verifier-types';
 export * from './verifier-core';
 export * from './verification-report';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,cAAc,SAAS,CAAC;AACxB,cAAc,UAAU,CAAC;AACzB,cAAc,gBAAgB,CAAC;AAC/B,cAAc,WAAW,CAAC;AAC1B,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAGhC,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAG9E,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,sBAAsB,CAAC;AACrC,cAAc,iBAAiB,CAAC;AAGhC,OAAO,EACL,eAAe,EACf,eAAe,EACf,oBAAoB,EACpB,eAAe,EACf,mBAAmB,EACnB,WAAW,EACX,SAAS,EACT,MAAM,GACP,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,cAAc,SAAS,CAAC;AACxB,cAAc,UAAU,CAAC;AACzB,cAAc,gBAAgB,CAAC;AAC/B,cAAc,WAAW,CAAC;AAC1B,cAAc,aAAa,CAAC;AAC5B,YAAY,EACV,GAAG,EACH,IAAI,EACJ,cAAc,EACd,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,cAAc,EACd,gBAAgB,EAChB,WAAW,GACZ,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAK9E,OAAO,EACL,4BAA4B,EAC5B,6BAA6B,EAC7B,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAG5B,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,sBAAsB,CAAC;AACrC,cAAc,iBAAiB,CAAC;AAGhC,OAAO,EACL,eAAe,EACf,eAAe,EACf,oBAAoB,EACpB,eAAe,EACf,mBAAmB,EACnB,WAAW,EACX,SAAS,EACT,MAAM,GACP,MAAM,cAAc,CAAC"}

package/dist/index.mjs

@@ -990,8 +990,23 @@ async function fetchPointerSafe(pointerUrl, options) {
 }
 
 // src/jwks-resolver.ts
-var DEFAULT_CACHE_TTL_MS = 5 * 60 * 1e3;
-var DEFAULT_MAX_CACHE_ENTRIES = 1e3;
+var HARD_CACHE_TTL_MS_BUILTIN = 5 * 60 * 1e3;
+var HARD_MAX_CACHE_ENTRIES_BUILTIN = 1e3;
+function __parseEnvPositiveInt(name, fallback, env = typeof process !== "undefined" ? process.env : {}) {
+  const raw = env[name];
+  if (!raw) return fallback;
+  if (!/^[1-9][0-9]*$/.test(raw)) return fallback;
+  const parsed = parseInt(raw, 10);
+  return parsed > 0 ? parsed : fallback;
+}
+var DEFAULT_CACHE_TTL_MS = __parseEnvPositiveInt(
+  "PEAC_JWKS_CACHE_TTL_MS",
+  HARD_CACHE_TTL_MS_BUILTIN
+);
+var DEFAULT_MAX_CACHE_ENTRIES = __parseEnvPositiveInt(
+  "PEAC_JWKS_CACHE_MAX_ENTRIES",
+  HARD_MAX_CACHE_ENTRIES_BUILTIN
+);
 var jwksCache = /* @__PURE__ */ new Map();
 var KID_RETENTION_MS = 30 * 24 * 60 * 60 * 1e3;
 var MAX_KID_THUMBPRINT_ENTRIES = 1e4;
@@ -1446,7 +1461,14 @@ function sanitizeParseIssues(issues) {
   }));
 }
 async function verifyLocal(jws, publicKey, options = {}) {
-  const { issuer, subjectUri, maxClockSkew = 300, strictness = "strict", policyDigest } = options;
+  const {
+    issuer,
+    subjectUri,
+    maxClockSkew = 300,
+    strictness = "strict",
+    policyDigest,
+    bindings: callerBindings
+  } = options;
   const now = options.now ?? Math.floor(Date.now() / 1e3);
   try {
     const result = await verify(jws, publicKey);
@@ -1596,6 +1618,11 @@ async function verifyLocal(jws, publicKey, options = {}) {
           }
         };
       }
+      const bindings = {
+        policy: bindingStatus,
+        ...callerBindings?.terms !== void 0 && { terms: callerBindings.terms },
+        ...callerBindings?.documents !== void 0 && callerBindings.documents.length > 0 && { documents: callerBindings.documents }
+      };
       return {
         valid: true,
         variant: "wire-02",
@@ -1603,7 +1630,8 @@ async function verifyLocal(jws, publicKey, options = {}) {
         kid: result.header.kid,
         wireVersion: "0.2",
         warnings: sortWarnings(accumulatedWarnings),
-        policy_binding: bindingStatus
+        policy_binding: bindingStatus,
+        bindings
       };
     }
     return {
@@ -1708,16 +1736,44 @@ function setVaryPurposeHeader(headers) {
     headers.set("Vary", PEAC_PURPOSE_HEADER);
   }
 }
-async function computePolicyDigestJcs(policy) {
-  const hex = await jcsHash(policy);
+async function computeJsonDocumentDigestJcs(value) {
+  const hex = await jcsHash(value);
   return `${HASH.prefix}${hex}`;
 }
-function checkPolicyBinding(receiptDigest, localDigest) {
+async function computeTextDocumentDigestUtf8(bytes, _representation) {
+  const normalized = bytes.replace(/\r\n/g, "\n").replace(/\r/g, "\n").normalize("NFC");
+  const buf = new TextEncoder().encode(normalized);
+  const hashBuffer = await crypto.subtle.digest("SHA-256", buf);
+  const hashArray = Array.from(new Uint8Array(hashBuffer));
+  const hex = hashArray.map((b) => b.toString(16).padStart(2, "0")).join("");
+  return `${HASH.prefix}${hex}`;
+}
+async function computeDocumentDigest(input) {
+  switch (input.representation) {
+    case "json":
+      return computeJsonDocumentDigestJcs(input.value);
+    case "markdown":
+    case "plaintext":
+      return computeTextDocumentDigestUtf8(input.bytes, input.representation);
+    case "uri":
+      if (typeof input.bytes !== "string") return "unavailable";
+      return computeTextDocumentDigestUtf8(input.bytes);
+  }
+}
+function checkDocumentBinding(receiptDigest, localDigest) {
   if (receiptDigest === void 0 || localDigest === void 0) {
     return "unavailable";
   }
   return verifyPolicyBinding(receiptDigest, localDigest);
 }
+
+// src/policy-binding.ts
+async function computePolicyDigestJcs(policy) {
+  return computeJsonDocumentDigestJcs(policy);
+}
+function checkPolicyBinding(receiptDigest, localDigest) {
+  return checkDocumentBinding(receiptDigest, localDigest);
+}
 var DEFAULT_VERIFIER_LIMITS = {
   max_receipt_bytes: VERIFIER_LIMITS.maxReceiptBytes,
   max_jwks_bytes: VERIFIER_LIMITS.maxJwksBytes,
@@ -2993,6 +3049,6 @@ async function verifyAndFetchPointer(pointerHeader, fetchOptions) {
   });
 }
 
-export { CHECK_IDS, DEFAULT_NETWORK_SECURITY, DEFAULT_VERIFIER_LIMITS, IssueError, NON_DETERMINISTIC_ARTIFACT_KEYS, VerificationReportBuilder, buildFailureReport, buildSuccessReport, checkPolicyBinding, clearJWKSCache, clearKidThumbprints, computePolicyDigestJcs, computeReceiptDigest, createDefaultPolicy, createDigest, createEmptyReport, createReportBuilder, fetchDiscovery, fetchIssuerConfig, fetchJWKSSafe, fetchPointerSafe, fetchPointerWithDigest, fetchPolicyManifest, getJWKSCacheSize, getKidThumbprintSize, getPurposeHeader, getReceiptHeader, getSSRFCapabilities, isAttestationResult, isBlockedIP, isCommerceResult, isWire02Result, issue, issueJws, issueWire01, issueWire02, parseBodyProfile, parseDiscovery, parseHeaderProfile, parseIssuerConfig, parsePointerProfile, parsePolicyManifest, parseTransportProfile, reasonCodeToErrorCode, reasonCodeToSeverity, resetSSRFCapabilitiesCache, resolveJWKS, setPurposeAppliedHeader, setPurposeReasonHeader, setReceiptHeader, setVaryHeader, setVaryPurposeHeader, ssrfErrorToReasonCode, ssrfSafeFetch, verifyAndFetchPointer, verifyLocal, verifyReceipt, verifyReceiptCore };
+export { CHECK_IDS, DEFAULT_NETWORK_SECURITY, DEFAULT_VERIFIER_LIMITS, IssueError, NON_DETERMINISTIC_ARTIFACT_KEYS, VerificationReportBuilder, buildFailureReport, buildSuccessReport, checkDocumentBinding, checkPolicyBinding, clearJWKSCache, clearKidThumbprints, computeDocumentDigest, computeJsonDocumentDigestJcs, computePolicyDigestJcs, computeReceiptDigest, computeTextDocumentDigestUtf8, createDefaultPolicy, createDigest, createEmptyReport, createReportBuilder, fetchDiscovery, fetchIssuerConfig, fetchJWKSSafe, fetchPointerSafe, fetchPointerWithDigest, fetchPolicyManifest, getJWKSCacheSize, getKidThumbprintSize, getPurposeHeader, getReceiptHeader, getSSRFCapabilities, isAttestationResult, isBlockedIP, isCommerceResult, isWire02Result, issue, issueJws, issueWire01, issueWire02, parseBodyProfile, parseDiscovery, parseHeaderProfile, parseIssuerConfig, parsePointerProfile, parsePolicyManifest, parseTransportProfile, reasonCodeToErrorCode, reasonCodeToSeverity, resetSSRFCapabilitiesCache, resolveJWKS, setPurposeAppliedHeader, setPurposeReasonHeader, setReceiptHeader, setVaryHeader, setVaryPurposeHeader, ssrfErrorToReasonCode, ssrfSafeFetch, verifyAndFetchPointer, verifyLocal, verifyReceipt, verifyReceiptCore };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map