@peac/protocol 0.16.3 → 0.16.4

package/dist/index.mjs

@@ -1,5 +1,5 @@
 import { uuidv7 } from 'uuidv7';
-import { sign, decode, verify, jcsHash, sha256Hex, computeJwkThumbprint, jwkToPublicKeyBytes, base64urlDecode, signWire02, base64urlDecodeString, base64urlEncode } from '@peac/crypto';
+import { sign, CryptoError, decode, verify, jcsHash, sha256Hex, computeJwkThumbprint, jwkToPublicKeyBytes, base64urlDecode, signWire02, base64urlDecodeString, base64urlEncode } from '@peac/crypto';
 export { base64urlDecode, base64urlEncode, computeJwkThumbprint, generateKeypair, jwkToPublicKeyBytes, sha256Bytes, sha256Hex, verify } from '@peac/crypto';
 import { isValidPurposeToken, isCanonicalPurpose, isValidPurposeReason, isValidWorkflowContext, createWorkflowContextInvalidError, hasValidDagSemantics, createWorkflowDagInvalidError, WORKFLOW_EXTENSION_KEY, validateKernelConstraints, createConstraintViolationError, ReceiptClaims, createEvidenceNotJsonError, validateSubjectSnapshot, isCanonicalIss, Wire02ClaimsSchema, PEAC_ISSUER_CONFIG_MAX_BYTES, validateRevokedKeys, PEAC_ISSUER_CONFIG_PATH, PEAC_POLICY_MAX_BYTES, PEAC_POLICY_PATH, PEAC_POLICY_FALLBACK_PATH, WARNING_TYP_MISSING, parseReceiptClaims, checkOccurredAtSkew, REGISTERED_RECEIPT_TYPES, WARNING_TYPE_UNREGISTERED, REGISTERED_EXTENSION_GROUP_KEYS, isValidExtensionKey, WARNING_UNKNOWN_EXTENSION, WARNING_EXTENSION_GROUP_MISSING, WARNING_EXTENSION_GROUP_MISMATCH, verifyPolicyBinding, sortWarnings, PEAC_RECEIPT_HEADER, PEAC_PURPOSE_HEADER, parsePurposeHeader, PEAC_PURPOSE_APPLIED_HEADER, PEAC_PURPOSE_REASON_HEADER, KERNEL_CONSTRAINTS } from '@peac/schema';
 import { VERIFIER_LIMITS, VERIFIER_NETWORK, TYPE_TO_EXTENSION_MAP, HASH, VERIFIER_POLICY_VERSION, VERIFICATION_REPORT_VERSION, WIRE_TYPE, OCCURRED_AT_TOLERANCE_SECONDS, ISS_CANONICAL, EXTENSION_BUDGET } from '@peac/kernel';
@@ -210,13 +210,32 @@ function validateTypeExtensionMappingInternal(input) {
 }
 
 // src/_internal/record-core/validators/jose-hardening.ts
-var KID_MAX_LENGTH = 256;
+var KID_MAX_UTF8_BYTES = 256;
+function isAcceptableKid(kid) {
+  if (typeof kid !== "string" || kid.length === 0) return false;
+  let bytes = 0;
+  for (let i = 0; i < kid.length; i++) {
+    const c = kid.charCodeAt(i);
+    if (c < 128) bytes += 1;
+    else if (c < 2048) bytes += 2;
+    else if (c >= 55296 && c <= 56319) {
+      const next = i + 1 < kid.length ? kid.charCodeAt(i + 1) : 0;
+      if (next < 56320 || next > 57343) return false;
+      bytes += 4;
+      i++;
+    } else if (c >= 56320 && c <= 57343) {
+      return false;
+    } else bytes += 3;
+    if (bytes > KID_MAX_UTF8_BYTES) return false;
+  }
+  return true;
+}
 var ACCEPTED = { accepted: true };
 function rejected(errorCode) {
   return { accepted: false, errorCode };
 }
 function validateJoseHardeningInternal(header) {
-  if (!header.kid || typeof header.kid !== "string" || header.kid.length === 0 || header.kid.length > KID_MAX_LENGTH) {
+  if (!isAcceptableKid(header.kid)) {
     return rejected("CRYPTO_JWS_MISSING_KID");
   }
   if (header.jwk !== void 0 || header.x5c !== void 0 || header.x5u !== void 0 || header.jku !== void 0) {
@@ -941,6 +960,25 @@ var IssueError = class extends Error {
     this.peacError = peacError;
   }
 };
+var CRYPTO_ISSUANCE_CODE_MAP = {
+  CRYPTO_JWS_MISSING_KID: "E_JWS_MISSING_KID",
+  CRYPTO_IJSON_INVALID_STRING: "E_IJSON_INVALID_STRING",
+  CRYPTO_IJSON_NUMBER_OUT_OF_RANGE: "E_IJSON_NUMBER_OUT_OF_RANGE",
+  CRYPTO_IJSON_DUPLICATE_MEMBER_NAME: "E_IJSON_DUPLICATE_MEMBER_NAME"
+};
+function issueErrorFromCryptoError(err) {
+  const code = CRYPTO_ISSUANCE_CODE_MAP[err.code] ?? "E_INVALID_FORMAT";
+  const issueError = new IssueError({
+    code,
+    category: "validation",
+    severity: "error",
+    retryable: false,
+    http_status: 400,
+    details: { message: err.message }
+  });
+  issueError.cause = err;
+  return issueError;
+}
 async function issueWire01(options) {
   if (!options.iss.startsWith("https://")) {
     throw new Error("Issuer URL must start with https://");
@@ -1149,7 +1187,15 @@ async function issueWire02(options) {
       });
     }
   }
-  const jws = await defaultCodec.encode(claims, options.privateKey, options.kid);
+  let jws;
+  try {
+    jws = await defaultCodec.encode(claims, options.privateKey, options.kid);
+  } catch (err) {
+    if (err instanceof CryptoError) {
+      throw issueErrorFromCryptoError(err);
+    }
+    throw err;
+  }
   if (legacyPath && isShadowEnabled(options)) {
     scheduleShadow({
       call: "issue",