@peac/protocol 0.15.2 → 0.16.0

package/dist/index.cjs

@@ -2406,7 +2406,14 @@ var JOSE_CODE_MAP = {
   CRYPTO_JWS_CRIT_REJECTED: "E_JWS_CRIT_REJECTED",
   CRYPTO_JWS_MISSING_KID: "E_JWS_MISSING_KID",
   CRYPTO_JWS_B64_REJECTED: "E_JWS_B64_REJECTED",
-  CRYPTO_JWS_ZIP_REJECTED: "E_JWS_ZIP_REJECTED"
+  CRYPTO_JWS_ZIP_REJECTED: "E_JWS_ZIP_REJECTED",
+  // Raw-input I-JSON gate (RFC 7493): specific E_IJSON_* codes so callers can
+  // distinguish duplicate member names, out-of-range numbers, and invalid
+  // strings from ordinary format errors. (Generic JSON syntax errors from the
+  // gate use CRYPTO_INVALID_JWS_FORMAT -> E_INVALID_FORMAT via FORMAT_ERROR_CODES.)
+  CRYPTO_IJSON_DUPLICATE_MEMBER_NAME: "E_IJSON_DUPLICATE_MEMBER_NAME",
+  CRYPTO_IJSON_NUMBER_OUT_OF_RANGE: "E_IJSON_NUMBER_OUT_OF_RANGE",
+  CRYPTO_IJSON_INVALID_STRING: "E_IJSON_INVALID_STRING"
 };
 var MAX_PARSE_ISSUES = 25;
 function sanitizeParseIssues(issues) {
@@ -2430,10 +2437,12 @@ async function verifyLocal(jws, publicKey, options = {}) {
   try {
     const result = await defaultCodec.decode(jws, publicKey);
     if (!result.valid) {
+      const signatureBytes = ed25519SignatureByteLength(jws);
+      const invalidLength = signatureBytes !== null && signatureBytes !== ED25519_SIGNATURE_BYTES;
       return {
         valid: false,
         code: "E_INVALID_SIGNATURE",
-        message: "Ed25519 signature verification failed"
+        message: invalidLength ? "Ed25519 signature has invalid length" : "Ed25519 signature verification failed"
       };
     }
     const accumulatedWarnings = [];
@@ -4072,6 +4081,80 @@ async function verifyAndFetchPointer(pointerHeader, fetchOptions) {
   });
 }
 
+// src/replay-guard.ts
+var DEFAULT_MAX_CLOCK_SKEW_SECONDS = 300;
+var DEFAULT_MAX_ENTRIES = 1e5;
+function safeInteger(value, name) {
+  if (!Number.isSafeInteger(value)) {
+    throw new Error(`createReplayGuard: ${name} must be a safe integer`);
+  }
+  return value;
+}
+function positiveInt(value, name) {
+  safeInteger(value, name);
+  if (value <= 0) {
+    throw new Error(`createReplayGuard: ${name} must be a positive integer`);
+  }
+  return value;
+}
+function nonNegativeInt(value, name) {
+  safeInteger(value, name);
+  if (value < 0) {
+    throw new Error(`createReplayGuard: ${name} must be a non-negative integer`);
+  }
+  return value;
+}
+function nonEmptyString(value, name) {
+  if (typeof value !== "string" || value.length === 0) {
+    throw new Error(`createReplayGuard: ${name} must be a non-empty string`);
+  }
+  return value;
+}
+function createReplayGuard(options) {
+  const windowSeconds = positiveInt(options.windowSeconds, "windowSeconds");
+  const maxClockSkewSeconds = options.maxClockSkewSeconds === void 0 ? DEFAULT_MAX_CLOCK_SKEW_SECONDS : nonNegativeInt(options.maxClockSkewSeconds, "maxClockSkewSeconds");
+  const maxEntries = options.maxEntries === void 0 ? DEFAULT_MAX_ENTRIES : positiveInt(options.maxEntries, "maxEntries");
+  const now = options.now ?? (() => Math.floor(Date.now() / 1e3));
+  let lastNow = Number.NEGATIVE_INFINITY;
+  const currentNow = () => {
+    const raw = safeInteger(now(), "now()");
+    if (raw < lastNow) return lastNow;
+    lastNow = raw;
+    return raw;
+  };
+  const seen = /* @__PURE__ */ new Map();
+  const keyOf = (iss, jti) => `${iss.length}:${iss}${jti.length}:${jti}`;
+  const purgeExpired = (nowSeconds) => {
+    for (const [key, entry] of seen) {
+      if (entry.expiresAt > nowSeconds) break;
+      seen.delete(key);
+    }
+  };
+  return {
+    check(record) {
+      const iat = safeInteger(record.iat, "record.iat");
+      const iss = nonEmptyString(record.iss, "record.iss");
+      const jti = nonEmptyString(record.jti, "record.jti");
+      const t = currentNow();
+      purgeExpired(t);
+      if (iat < t - windowSeconds || iat > t + maxClockSkewSeconds) {
+        return "outside-window";
+      }
+      const key = keyOf(iss, jti);
+      if (seen.has(key)) {
+        return "replayed";
+      }
+      const expiresAt = safeInteger(t + windowSeconds + maxClockSkewSeconds, "entry expiry");
+      if (seen.size >= maxEntries) {
+        const oldest = seen.keys().next().value;
+        if (oldest !== void 0) seen.delete(oldest);
+      }
+      seen.set(key, { expiresAt });
+      return "fresh";
+    }
+  };
+}
+
 Object.defineProperty(exports, "base64urlDecode", {
   enumerable: true,
   get: function () { return crypto$1.base64urlDecode; }
@@ -4124,6 +4207,7 @@ exports.computeTextDocumentDigestUtf8 = computeTextDocumentDigestUtf8;
 exports.createDefaultPolicy = createDefaultPolicy;
 exports.createDigest = createDigest;
 exports.createEmptyReport = createEmptyReport;
+exports.createReplayGuard = createReplayGuard;
 exports.createReportBuilder = createReportBuilder;
 exports.fetchDiscovery = fetchDiscovery;
 exports.fetchIssuerConfig = fetchIssuerConfig;