@peac/protocol 0.15.3 → 0.16.0

package/dist/index.d.ts

@@ -17,5 +17,6 @@ export * from './verification-report';
 export * from './ssrf-safe-fetch';
 export * from './transport-profiles';
 export * from './pointer-fetch';
+export * from './replay-guard';
 export { base64urlDecode, base64urlEncode, computeJwkThumbprint, generateKeypair, jwkToPublicKeyBytes, sha256Bytes, sha256Hex, verify, } from '@peac/crypto';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,cAAc,SAAS,CAAC;AACxB,cAAc,UAAU,CAAC;AACzB,cAAc,gBAAgB,CAAC;AAC/B,cAAc,WAAW,CAAC;AAC1B,cAAc,aAAa,CAAC;AAC5B,YAAY,EACV,GAAG,EACH,IAAI,EACJ,cAAc,EACd,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,cAAc,EACd,gBAAgB,EAChB,WAAW,GACZ,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAK9E,OAAO,EACL,4BAA4B,EAC5B,6BAA6B,EAC7B,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAG5B,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,sBAAsB,CAAC;AACrC,cAAc,iBAAiB,CAAC;AAGhC,OAAO,EACL,eAAe,EACf,eAAe,EACf,oBAAoB,EACpB,eAAe,EACf,mBAAmB,EACnB,WAAW,EACX,SAAS,EACT,MAAM,GACP,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,cAAc,SAAS,CAAC;AACxB,cAAc,UAAU,CAAC;AACzB,cAAc,gBAAgB,CAAC;AAC/B,cAAc,WAAW,CAAC;AAC1B,cAAc,aAAa,CAAC;AAC5B,YAAY,EACV,GAAG,EACH,IAAI,EACJ,cAAc,EACd,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,cAAc,EACd,gBAAgB,EAChB,WAAW,GACZ,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAK9E,OAAO,EACL,4BAA4B,EAC5B,6BAA6B,EAC7B,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAG5B,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,sBAAsB,CAAC;AACrC,cAAc,iBAAiB,CAAC;AAIhC,cAAc,gBAAgB,CAAC;AAG/B,OAAO,EACL,eAAe,EACf,eAAe,EACf,oBAAoB,EACpB,eAAe,EACf,mBAAmB,EACnB,WAAW,EACX,SAAS,EACT,MAAM,GACP,MAAM,cAAc,CAAC"}

package/dist/index.mjs

@@ -2405,7 +2405,14 @@ var JOSE_CODE_MAP = {
   CRYPTO_JWS_CRIT_REJECTED: "E_JWS_CRIT_REJECTED",
   CRYPTO_JWS_MISSING_KID: "E_JWS_MISSING_KID",
   CRYPTO_JWS_B64_REJECTED: "E_JWS_B64_REJECTED",
-  CRYPTO_JWS_ZIP_REJECTED: "E_JWS_ZIP_REJECTED"
+  CRYPTO_JWS_ZIP_REJECTED: "E_JWS_ZIP_REJECTED",
+  // Raw-input I-JSON gate (RFC 7493): specific E_IJSON_* codes so callers can
+  // distinguish duplicate member names, out-of-range numbers, and invalid
+  // strings from ordinary format errors. (Generic JSON syntax errors from the
+  // gate use CRYPTO_INVALID_JWS_FORMAT -> E_INVALID_FORMAT via FORMAT_ERROR_CODES.)
+  CRYPTO_IJSON_DUPLICATE_MEMBER_NAME: "E_IJSON_DUPLICATE_MEMBER_NAME",
+  CRYPTO_IJSON_NUMBER_OUT_OF_RANGE: "E_IJSON_NUMBER_OUT_OF_RANGE",
+  CRYPTO_IJSON_INVALID_STRING: "E_IJSON_INVALID_STRING"
 };
 var MAX_PARSE_ISSUES = 25;
 function sanitizeParseIssues(issues) {
@@ -2429,10 +2436,12 @@ async function verifyLocal(jws, publicKey, options = {}) {
   try {
     const result = await defaultCodec.decode(jws, publicKey);
     if (!result.valid) {
+      const signatureBytes = ed25519SignatureByteLength(jws);
+      const invalidLength = signatureBytes !== null && signatureBytes !== ED25519_SIGNATURE_BYTES;
       return {
         valid: false,
         code: "E_INVALID_SIGNATURE",
-        message: "Ed25519 signature verification failed"
+        message: invalidLength ? "Ed25519 signature has invalid length" : "Ed25519 signature verification failed"
       };
     }
     const accumulatedWarnings = [];
@@ -4071,6 +4080,80 @@ async function verifyAndFetchPointer(pointerHeader, fetchOptions) {
   });
 }
 
-export { CHECK_IDS, DEFAULT_NETWORK_SECURITY, DEFAULT_VERIFIER_LIMITS, IssueError, NON_DETERMINISTIC_ARTIFACT_KEYS, VerificationReportBuilder, buildFailureReport, buildSuccessReport, checkDocumentBinding, checkPolicyBinding, clearJWKSCache, clearKidThumbprints, computeDocumentDigest, computeJsonDocumentDigestJcs, computePolicyDigestJcs, computeReceiptDigest, computeTextDocumentDigestUtf8, createDefaultPolicy, createDigest, createEmptyReport, createReportBuilder, fetchDiscovery, fetchIssuerConfig, fetchJWKSSafe, fetchPointerSafe, fetchPointerWithDigest, fetchPolicyManifest, getJWKSCacheSize, getKidThumbprintSize, getPurposeHeader, getReceiptHeader, getSSRFCapabilities, isAttestationResult, isBlockedIP, isCommerceResult, isWire02Result, issue, issueJws, issueWire01, issueWire02, parseBodyProfile, parseDiscovery, parseHeaderProfile, parseIssuerConfig, parsePointerProfile, parsePolicyManifest, parseTransportProfile, reasonCodeToErrorCode, reasonCodeToSeverity, resetSSRFCapabilitiesCache, resolveJWKS, setPurposeAppliedHeader, setPurposeReasonHeader, setReceiptHeader, setVaryHeader, setVaryPurposeHeader, ssrfErrorToReasonCode, ssrfSafeFetch, verifyAndFetchPointer, verifyLocal, verifyReceipt, verifyReceiptCore };
+// src/replay-guard.ts
+var DEFAULT_MAX_CLOCK_SKEW_SECONDS = 300;
+var DEFAULT_MAX_ENTRIES = 1e5;
+function safeInteger(value, name) {
+  if (!Number.isSafeInteger(value)) {
+    throw new Error(`createReplayGuard: ${name} must be a safe integer`);
+  }
+  return value;
+}
+function positiveInt(value, name) {
+  safeInteger(value, name);
+  if (value <= 0) {
+    throw new Error(`createReplayGuard: ${name} must be a positive integer`);
+  }
+  return value;
+}
+function nonNegativeInt(value, name) {
+  safeInteger(value, name);
+  if (value < 0) {
+    throw new Error(`createReplayGuard: ${name} must be a non-negative integer`);
+  }
+  return value;
+}
+function nonEmptyString(value, name) {
+  if (typeof value !== "string" || value.length === 0) {
+    throw new Error(`createReplayGuard: ${name} must be a non-empty string`);
+  }
+  return value;
+}
+function createReplayGuard(options) {
+  const windowSeconds = positiveInt(options.windowSeconds, "windowSeconds");
+  const maxClockSkewSeconds = options.maxClockSkewSeconds === void 0 ? DEFAULT_MAX_CLOCK_SKEW_SECONDS : nonNegativeInt(options.maxClockSkewSeconds, "maxClockSkewSeconds");
+  const maxEntries = options.maxEntries === void 0 ? DEFAULT_MAX_ENTRIES : positiveInt(options.maxEntries, "maxEntries");
+  const now = options.now ?? (() => Math.floor(Date.now() / 1e3));
+  let lastNow = Number.NEGATIVE_INFINITY;
+  const currentNow = () => {
+    const raw = safeInteger(now(), "now()");
+    if (raw < lastNow) return lastNow;
+    lastNow = raw;
+    return raw;
+  };
+  const seen = /* @__PURE__ */ new Map();
+  const keyOf = (iss, jti) => `${iss.length}:${iss}${jti.length}:${jti}`;
+  const purgeExpired = (nowSeconds) => {
+    for (const [key, entry] of seen) {
+      if (entry.expiresAt > nowSeconds) break;
+      seen.delete(key);
+    }
+  };
+  return {
+    check(record) {
+      const iat = safeInteger(record.iat, "record.iat");
+      const iss = nonEmptyString(record.iss, "record.iss");
+      const jti = nonEmptyString(record.jti, "record.jti");
+      const t = currentNow();
+      purgeExpired(t);
+      if (iat < t - windowSeconds || iat > t + maxClockSkewSeconds) {
+        return "outside-window";
+      }
+      const key = keyOf(iss, jti);
+      if (seen.has(key)) {
+        return "replayed";
+      }
+      const expiresAt = safeInteger(t + windowSeconds + maxClockSkewSeconds, "entry expiry");
+      if (seen.size >= maxEntries) {
+        const oldest = seen.keys().next().value;
+        if (oldest !== void 0) seen.delete(oldest);
+      }
+      seen.set(key, { expiresAt });
+      return "fresh";
+    }
+  };
+}
+
+export { CHECK_IDS, DEFAULT_NETWORK_SECURITY, DEFAULT_VERIFIER_LIMITS, IssueError, NON_DETERMINISTIC_ARTIFACT_KEYS, VerificationReportBuilder, buildFailureReport, buildSuccessReport, checkDocumentBinding, checkPolicyBinding, clearJWKSCache, clearKidThumbprints, computeDocumentDigest, computeJsonDocumentDigestJcs, computePolicyDigestJcs, computeReceiptDigest, computeTextDocumentDigestUtf8, createDefaultPolicy, createDigest, createEmptyReport, createReplayGuard, createReportBuilder, fetchDiscovery, fetchIssuerConfig, fetchJWKSSafe, fetchPointerSafe, fetchPointerWithDigest, fetchPolicyManifest, getJWKSCacheSize, getKidThumbprintSize, getPurposeHeader, getReceiptHeader, getSSRFCapabilities, isAttestationResult, isBlockedIP, isCommerceResult, isWire02Result, issue, issueJws, issueWire01, issueWire02, parseBodyProfile, parseDiscovery, parseHeaderProfile, parseIssuerConfig, parsePointerProfile, parsePolicyManifest, parseTransportProfile, reasonCodeToErrorCode, reasonCodeToSeverity, resetSSRFCapabilitiesCache, resolveJWKS, setPurposeAppliedHeader, setPurposeReasonHeader, setReceiptHeader, setVaryHeader, setVaryPurposeHeader, ssrfErrorToReasonCode, ssrfSafeFetch, verifyAndFetchPointer, verifyLocal, verifyReceipt, verifyReceiptCore };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map