@peac/kernel 0.11.2 → 0.12.0-preview.1

package/dist/index.cjs

@@ -5,6 +5,7 @@ var ERROR_CATEGORIES = [
   "attribution",
   "bundle",
   "control",
+  "cryptography",
   "dispute",
   "identity",
   "infrastructure",
@@ -57,7 +58,8 @@ var DISCOVERY = {
 };
 var JWKS = {
   rotationDays: 90,
-  overlapDays: 7,
+  /** Normative minimum overlap period (DD-148, v0.11.3+) */
+  overlapDays: 30,
   emergencyRevocationHours: 24
 };
 var RECEIPT = {
@@ -154,6 +156,29 @@ var VERIFICATION_MODES = {
   /** Allow network fetches for key discovery */
   networkAllowed: "network_allowed"
 };
+var WIRE_01_JWS_TYP = "peac-receipt/0.1";
+var WIRE_02_JWS_TYP = "interaction-record+jwt";
+var WIRE_02_JWS_TYP_ACCEPT = [
+  "interaction-record+jwt",
+  "application/interaction-record+jwt"
+];
+var WIRE_02_VERSION = "0.2";
+var WIRE_VERSIONS = ["0.1", "0.2"];
+var ISS_CANONICAL = {
+  maxLength: 2048,
+  supportedSchemes: ["https", "did"],
+  /** Default port for https (rejected if explicit in iss). */
+  defaultPorts: { https: 443 }
+};
+var TYPE_GRAMMAR = { maxLength: 256 };
+var POLICY_BLOCK = {
+  /** Maximum length of the policy.uri HTTPS hint (chars). */
+  uriMaxLength: 2048,
+  /** Maximum length of the policy.version label (chars). */
+  versionMaxLength: 256
+};
+var OCCURRED_AT_TOLERANCE_SECONDS = 300;
+var PEAC_ALG = ALGORITHMS.default;
 var CONSTANTS = {
   WIRE_TYPE,
   WIRE_VERSION,
@@ -208,6 +233,12 @@ var ERROR_CODES = {
   // Control error codes
   E_CONTROL_DENIED: "E_CONTROL_DENIED",
   E_CONTROL_REVIEW_REQUIRED: "E_CONTROL_REVIEW_REQUIRED",
+  // Cryptography error codes
+  E_JWS_B64_REJECTED: "E_JWS_B64_REJECTED",
+  E_JWS_CRIT_REJECTED: "E_JWS_CRIT_REJECTED",
+  E_JWS_EMBEDDED_KEY: "E_JWS_EMBEDDED_KEY",
+  E_JWS_MISSING_KID: "E_JWS_MISSING_KID",
+  E_JWS_ZIP_REJECTED: "E_JWS_ZIP_REJECTED",
   // Dispute error codes
   E_DISPUTE_DUPLICATE: "E_DISPUTE_DUPLICATE",
   E_DISPUTE_EXPIRED: "E_DISPUTE_EXPIRED",
@@ -237,6 +268,7 @@ var ERROR_CODES = {
   E_IDENTITY_NOT_YET_VALID: "E_IDENTITY_NOT_YET_VALID",
   E_IDENTITY_PROOF_UNSUPPORTED: "E_IDENTITY_PROOF_UNSUPPORTED",
   E_IDENTITY_SIG_INVALID: "E_IDENTITY_SIG_INVALID",
+  E_MVIS_INCOMPLETE: "E_MVIS_INCOMPLETE",
   // Infrastructure error codes
   E_CIRCUIT_BREAKER_OPEN: "E_CIRCUIT_BREAKER_OPEN",
   E_INTERNAL: "E_INTERNAL",
@@ -287,18 +319,30 @@ var ERROR_CODES = {
   E_INVALID_CURRENCY: "E_INVALID_CURRENCY",
   E_INVALID_FORMAT: "E_INVALID_FORMAT",
   E_INVALID_ISSUER: "E_INVALID_ISSUER",
+  E_INVALID_KIND: "E_INVALID_KIND",
+  E_INVALID_PILLAR_VALUE: "E_INVALID_PILLAR_VALUE",
   E_INVALID_RAIL: "E_INVALID_RAIL",
   E_INVALID_RECEIPT_ID: "E_INVALID_RECEIPT_ID",
   E_INVALID_SUBJECT: "E_INVALID_SUBJECT",
+  E_INVALID_TYPE: "E_INVALID_TYPE",
+  E_ISS_NOT_CANONICAL: "E_ISS_NOT_CANONICAL",
   E_MISSING_EXP: "E_MISSING_EXP",
   E_MISSING_REQUIRED_CLAIM: "E_MISSING_REQUIRED_CLAIM",
   E_NOT_YET_VALID: "E_NOT_YET_VALID",
+  E_OCCURRED_AT_FUTURE: "E_OCCURRED_AT_FUTURE",
+  E_OCCURRED_AT_ON_CHALLENGE: "E_OCCURRED_AT_ON_CHALLENGE",
   E_PARSE_ATTESTATION_INVALID: "E_PARSE_ATTESTATION_INVALID",
   E_PARSE_COMMERCE_INVALID: "E_PARSE_COMMERCE_INVALID",
   E_PARSE_INVALID_INPUT: "E_PARSE_INVALID_INPUT",
+  E_PILLARS_NOT_SORTED: "E_PILLARS_NOT_SORTED",
+  E_POLICY_BINDING_FAILED: "E_POLICY_BINDING_FAILED",
+  E_UNSUPPORTED_WIRE_VERSION: "E_UNSUPPORTED_WIRE_VERSION",
+  E_WIRE_VERSION_MISMATCH: "E_WIRE_VERSION_MISMATCH",
   // Verification error codes
   E_INVALID_SIGNATURE: "E_INVALID_SIGNATURE",
   E_KEY_NOT_FOUND: "E_KEY_NOT_FOUND",
+  E_KID_REUSE_DETECTED: "E_KID_REUSE_DETECTED",
+  E_REVOKED_KEY_USED: "E_REVOKED_KEY_USED",
   // Verifier error codes
   E_VERIFY_EXTENSION_TOO_LARGE: "E_VERIFY_EXTENSION_TOO_LARGE",
   E_VERIFY_INSECURE_SCHEME_BLOCKED: "E_VERIFY_INSECURE_SCHEME_BLOCKED",
@@ -616,6 +660,52 @@ var ERRORS = {
     next_action: "contact_issuer",
     category: "control"
   },
+  // Cryptography error codes
+  E_JWS_B64_REJECTED: {
+    code: "E_JWS_B64_REJECTED",
+    http_status: 400,
+    title: "JWS b64:false Rejected",
+    description: "JWS header contains b64:false (RFC 7797 unencoded payload); unencoded payloads are not supported",
+    retryable: false,
+    next_action: "abort",
+    category: "cryptography"
+  },
+  E_JWS_CRIT_REJECTED: {
+    code: "E_JWS_CRIT_REJECTED",
+    http_status: 400,
+    title: "JWS crit Header Rejected",
+    description: "JWS header contains a crit field; critical header extensions are not supported and are rejected",
+    retryable: false,
+    next_action: "abort",
+    category: "cryptography"
+  },
+  E_JWS_EMBEDDED_KEY: {
+    code: "E_JWS_EMBEDDED_KEY",
+    http_status: 400,
+    title: "JWS Embedded Key Rejected",
+    description: "JWS header contains an embedded key (jwk, x5c, x5u, or jku); embedded key material is rejected by the PEAC JOSE hardening rules",
+    retryable: false,
+    next_action: "abort",
+    category: "cryptography"
+  },
+  E_JWS_MISSING_KID: {
+    code: "E_JWS_MISSING_KID",
+    http_status: 400,
+    title: "JWS kid Missing or Invalid",
+    description: "JWS header kid field is absent, empty, or exceeds the maximum allowed length (256 characters)",
+    retryable: false,
+    next_action: "abort",
+    category: "cryptography"
+  },
+  E_JWS_ZIP_REJECTED: {
+    code: "E_JWS_ZIP_REJECTED",
+    http_status: 400,
+    title: "JWS zip Header Rejected",
+    description: "JWS header contains a zip compression field; payload compression is not supported",
+    retryable: false,
+    next_action: "abort",
+    category: "cryptography"
+  },
   // Dispute error codes
   E_DISPUTE_DUPLICATE: {
     code: "E_DISPUTE_DUPLICATE",
@@ -861,6 +951,15 @@ var ERRORS = {
     next_action: "retry_with_different_input",
     category: "identity"
   },
+  E_MVIS_INCOMPLETE: {
+    code: "E_MVIS_INCOMPLETE",
+    http_status: 400,
+    title: "MVIS Incomplete",
+    description: "Identity receipt missing one or more Minimum Viable Identity Set required fields (issuer, subject, key_binding, time_bounds, replay_protection)",
+    retryable: false,
+    next_action: "retry_with_different_input",
+    category: "identity"
+  },
   // Infrastructure error codes
   E_CIRCUIT_BREAKER_OPEN: {
     code: "E_CIRCUIT_BREAKER_OPEN",
@@ -1279,6 +1378,24 @@ var ERRORS = {
     next_action: "retry_with_different_input",
     category: "validation"
   },
+  E_INVALID_KIND: {
+    code: "E_INVALID_KIND",
+    http_status: 400,
+    title: "Invalid Kind",
+    description: "Wire 0.2 receipt kind field is missing or not one of the accepted structural kinds (evidence, challenge)",
+    retryable: false,
+    next_action: "abort",
+    category: "validation"
+  },
+  E_INVALID_PILLAR_VALUE: {
+    code: "E_INVALID_PILLAR_VALUE",
+    http_status: 400,
+    title: "Invalid Pillar Value",
+    description: "Wire 0.2 pillars array contains an unrecognized pillar value outside the closed 10-value taxonomy",
+    retryable: false,
+    next_action: "abort",
+    category: "validation"
+  },
   E_INVALID_RAIL: {
     code: "E_INVALID_RAIL",
     http_status: 400,
@@ -1306,6 +1423,24 @@ var ERRORS = {
     next_action: "retry_with_different_input",
     category: "validation"
   },
+  E_INVALID_TYPE: {
+    code: "E_INVALID_TYPE",
+    http_status: 400,
+    title: "Invalid Type",
+    description: "Wire 0.2 receipt type field is missing or does not conform to the required grammar (reverse-DNS or absolute URI)",
+    retryable: false,
+    next_action: "abort",
+    category: "validation"
+  },
+  E_ISS_NOT_CANONICAL: {
+    code: "E_ISS_NOT_CANONICAL",
+    http_status: 400,
+    title: "Issuer Not Canonical",
+    description: "Wire 0.2 iss claim does not conform to canonical form: must be an https:// ASCII origin (no default port, no path) or a did: identifier",
+    retryable: false,
+    next_action: "abort",
+    category: "validation"
+  },
   E_MISSING_EXP: {
     code: "E_MISSING_EXP",
     http_status: 400,
@@ -1333,6 +1468,24 @@ var ERRORS = {
     next_action: "retry_after_delay",
     category: "validation"
   },
+  E_OCCURRED_AT_FUTURE: {
+    code: "E_OCCURRED_AT_FUTURE",
+    http_status: 400,
+    title: "occurred_at in Future",
+    description: "Wire 0.2 occurred_at is more than the tolerance window ahead of the current time; the timestamp appears to be in the future",
+    retryable: false,
+    next_action: "retry_after_delay",
+    category: "validation"
+  },
+  E_OCCURRED_AT_ON_CHALLENGE: {
+    code: "E_OCCURRED_AT_ON_CHALLENGE",
+    http_status: 400,
+    title: "occurred_at on Challenge",
+    description: "Wire 0.2 occurred_at field is present on a challenge-kind receipt; occurred_at is only permitted on evidence-kind receipts",
+    retryable: false,
+    next_action: "abort",
+    category: "validation"
+  },
   E_PARSE_ATTESTATION_INVALID: {
     code: "E_PARSE_ATTESTATION_INVALID",
     http_status: 400,
@@ -1360,6 +1513,42 @@ var ERRORS = {
     next_action: "retry_with_different_input",
     category: "validation"
   },
+  E_PILLARS_NOT_SORTED: {
+    code: "E_PILLARS_NOT_SORTED",
+    http_status: 400,
+    title: "Pillars Not Sorted",
+    description: "Wire 0.2 pillars array is not in ascending lexicographic order or contains duplicates",
+    retryable: false,
+    next_action: "abort",
+    category: "validation"
+  },
+  E_POLICY_BINDING_FAILED: {
+    code: "E_POLICY_BINDING_FAILED",
+    http_status: 400,
+    title: "Policy Binding Failed",
+    description: "Wire 0.2 policy.digest does not match the computed digest of the provided policy document",
+    retryable: false,
+    next_action: "none",
+    category: "validation"
+  },
+  E_UNSUPPORTED_WIRE_VERSION: {
+    code: "E_UNSUPPORTED_WIRE_VERSION",
+    http_status: 400,
+    title: "Unsupported Wire Version",
+    description: "Receipt peac_version field specifies a wire version that is not supported by this implementation",
+    retryable: false,
+    next_action: "abort",
+    category: "validation"
+  },
+  E_WIRE_VERSION_MISMATCH: {
+    code: "E_WIRE_VERSION_MISMATCH",
+    http_status: 400,
+    title: "Wire Version Mismatch",
+    description: "JWS header typ value and peac_version payload claim indicate different wire versions; the receipt is incoherent",
+    retryable: false,
+    next_action: "abort",
+    category: "validation"
+  },
   // Verification error codes
   E_INVALID_SIGNATURE: {
     code: "E_INVALID_SIGNATURE",
@@ -1379,6 +1568,24 @@ var ERRORS = {
     next_action: "retry_with_different_key",
     category: "verification"
   },
+  E_KID_REUSE_DETECTED: {
+    code: "E_KID_REUSE_DETECTED",
+    http_status: 400,
+    title: "Kid Reuse Detected",
+    description: "Same kid value used with different key material within the retention window",
+    retryable: false,
+    next_action: "abort",
+    category: "verification"
+  },
+  E_REVOKED_KEY_USED: {
+    code: "E_REVOKED_KEY_USED",
+    http_status: 400,
+    title: "Revoked Key Used",
+    description: "Receipt signed with a key listed in the issuer revoked_keys set",
+    retryable: false,
+    next_action: "retry_with_different_key",
+    category: "verification"
+  },
   // Verifier error codes
   E_VERIFY_EXTENSION_TOO_LARGE: {
     code: "E_VERIFY_EXTENSION_TOO_LARGE",
@@ -1871,24 +2078,34 @@ exports.ERROR_CODES = ERROR_CODES;
 exports.HASH = HASH;
 exports.HEADERS = HEADERS;
 exports.ISSUER_CONFIG = ISSUER_CONFIG;
+exports.ISS_CANONICAL = ISS_CANONICAL;
 exports.JWKS = JWKS;
 exports.LIMITS = LIMITS;
+exports.OCCURRED_AT_TOLERANCE_SECONDS = OCCURRED_AT_TOLERANCE_SECONDS;
 exports.PAYMENT_RAILS = PAYMENT_RAILS;
+exports.PEAC_ALG = PEAC_ALG;
 exports.PEAC_RECEIPT_HEADER = PEAC_RECEIPT_HEADER;
 exports.PEAC_RECEIPT_URL_HEADER = PEAC_RECEIPT_URL_HEADER;
 exports.POLICY = POLICY;
+exports.POLICY_BLOCK = POLICY_BLOCK;
 exports.PRIVATE_IP_RANGES = PRIVATE_IP_RANGES;
 exports.RECEIPT = RECEIPT;
 exports.REGISTRIES = REGISTRIES;
 exports.TRANSPORT_METHODS = TRANSPORT_METHODS;
+exports.TYPE_GRAMMAR = TYPE_GRAMMAR;
 exports.VARY_HEADERS = VARY_HEADERS;
 exports.VERIFICATION_MODES = VERIFICATION_MODES;
 exports.VERIFICATION_REPORT_VERSION = VERIFICATION_REPORT_VERSION;
 exports.VERIFIER_LIMITS = VERIFIER_LIMITS;
 exports.VERIFIER_NETWORK = VERIFIER_NETWORK;
 exports.VERIFIER_POLICY_VERSION = VERIFIER_POLICY_VERSION;
+exports.WIRE_01_JWS_TYP = WIRE_01_JWS_TYP;
+exports.WIRE_02_JWS_TYP = WIRE_02_JWS_TYP;
+exports.WIRE_02_JWS_TYP_ACCEPT = WIRE_02_JWS_TYP_ACCEPT;
+exports.WIRE_02_VERSION = WIRE_02_VERSION;
 exports.WIRE_TYPE = WIRE_TYPE;
 exports.WIRE_VERSION = WIRE_VERSION;
+exports.WIRE_VERSIONS = WIRE_VERSIONS;
 exports.applyPurposeVary = applyPurposeVary;
 exports.findAgentProtocol = findAgentProtocol;
 exports.findControlEngine = findControlEngine;