@peac/kernel 0.12.0 → 0.12.2

package/dist/index.cjs

@@ -58,7 +58,7 @@ var DISCOVERY = {
 };
 var JWKS = {
   rotationDays: 90,
-  /** Normative minimum overlap period (DD-148, v0.11.3+) */
+  /** Normative minimum overlap period (v0.11.3+) */
   overlapDays: 30,
   emergencyRevocationHours: 24
 };
@@ -179,6 +179,14 @@ var POLICY_BLOCK = {
 };
 var OCCURRED_AT_TOLERANCE_SECONDS = 300;
 var PEAC_ALG = ALGORITHMS.default;
+var EXTENSION_BUDGET = {
+  /** Max UTF-8 bytes per extension group after JSON.stringify (64 KB) */
+  maxGroupBytes: 65536,
+  /** Max total UTF-8 bytes across all extensions after JSON.stringify (256 KB) */
+  maxTotalBytes: 262144,
+  /** Max UTF-8 bytes for any single string array field (32 KB) */
+  maxArrayPayloadBytes: 32768
+};
 var CONSTANTS = {
   WIRE_TYPE,
   WIRE_VERSION,
@@ -318,6 +326,8 @@ var ERROR_CODES = {
   E_EAT_UNSUPPORTED_ALG: "E_EAT_UNSUPPORTED_ALG",
   E_EVIDENCE_NOT_JSON: "E_EVIDENCE_NOT_JSON",
   E_EXPIRED: "E_EXPIRED",
+  E_EXTENSION_NON_JSON_VALUE: "E_EXTENSION_NON_JSON_VALUE",
+  E_EXTENSION_SIZE_EXCEEDED: "E_EXTENSION_SIZE_EXCEEDED",
   E_INVALID_AMOUNT: "E_INVALID_AMOUNT",
   E_INVALID_AUDIENCE: "E_INVALID_AUDIENCE",
   E_INVALID_CURRENCY: "E_INVALID_CURRENCY",
@@ -344,6 +354,8 @@ var ERROR_CODES = {
   E_WIRE_VERSION_MISMATCH: "E_WIRE_VERSION_MISMATCH",
   // Verification error codes
   E_EAT_SIGNATURE_FAILED: "E_EAT_SIGNATURE_FAILED",
+  E_EXTENSION_GROUP_MISMATCH: "E_EXTENSION_GROUP_MISMATCH",
+  E_EXTENSION_GROUP_REQUIRED: "E_EXTENSION_GROUP_REQUIRED",
   E_INVALID_SIGNATURE: "E_INVALID_SIGNATURE",
   E_KEY_NOT_FOUND: "E_KEY_NOT_FOUND",
   E_KID_REUSE_DETECTED: "E_KID_REUSE_DETECTED",
@@ -1374,6 +1386,24 @@ var ERRORS = {
     next_action: "retry_with_different_input",
     category: "validation"
   },
+  E_EXTENSION_NON_JSON_VALUE: {
+    code: "E_EXTENSION_NON_JSON_VALUE",
+    http_status: 400,
+    title: "Extension Non-JSON Value",
+    description: "Extension group value is not a plain JSON value; functions, Symbols, BigInt, Date, RegExp, Map, Set, objects with toJSON(), and other non-JSON types are rejected",
+    retryable: false,
+    next_action: "retry_with_different_input",
+    category: "validation"
+  },
+  E_EXTENSION_SIZE_EXCEEDED: {
+    code: "E_EXTENSION_SIZE_EXCEEDED",
+    http_status: 400,
+    title: "Extension Size Exceeded",
+    description: "Extension group or total extensions record exceeds the normative byte-budget limit (EXTENSION_BUDGET)",
+    retryable: false,
+    next_action: "retry_with_different_input",
+    category: "validation"
+  },
   E_INVALID_AMOUNT: {
     code: "E_INVALID_AMOUNT",
     http_status: 400,
@@ -1600,6 +1630,24 @@ var ERRORS = {
     next_action: "retry_with_different_key",
     category: "verification"
   },
+  E_EXTENSION_GROUP_MISMATCH: {
+    code: "E_EXTENSION_GROUP_MISMATCH",
+    http_status: 400,
+    title: "Extension Group Mismatch",
+    description: "Registered receipt type has a mapped extension group, but a different registered first-party extension group is present while the expected one is absent",
+    retryable: false,
+    next_action: "retry_with_different_input",
+    category: "verification"
+  },
+  E_EXTENSION_GROUP_REQUIRED: {
+    code: "E_EXTENSION_GROUP_REQUIRED",
+    http_status: 400,
+    title: "Extension Group Required",
+    description: "Registered receipt type has a mapped extension group, but that group is absent from the extensions record",
+    retryable: false,
+    next_action: "retry_with_different_input",
+    category: "verification"
+  },
   E_INVALID_SIGNATURE: {
     code: "E_INVALID_SIGNATURE",
     http_status: 400,
@@ -1958,13 +2006,13 @@ var DISPUTE_ERRORS = {
   TARGET_NOT_FOUND: "E_DISPUTE_TARGET_NOT_FOUND"
 };
 
-// src/registries.ts
+// src/registries.generated.ts
 var PAYMENT_RAILS = [
   {
-    id: "x402",
-    category: "agentic-payment",
-    description: "HTTP 402-based paid call receipts",
-    reference: "https://www.x402.org/",
+    id: "card-network",
+    category: "card",
+    description: "Generic card network authorizations/clearing",
+    reference: null,
     status: "informational"
   },
   {
@@ -1975,10 +2023,17 @@ var PAYMENT_RAILS = [
     status: "informational"
   },
   {
-    id: "card-network",
-    category: "card",
-    description: "Generic card network authorizations/clearing",
-    reference: null,
+    id: "razorpay",
+    category: "payment-gateway",
+    description: "Razorpay payment gateway (UPI, cards, netbanking, wallets)",
+    reference: "https://razorpay.com/docs/",
+    status: "informational"
+  },
+  {
+    id: "stripe",
+    category: "payment-gateway",
+    description: "Stripe payment processing",
+    reference: "https://stripe.com/docs",
     status: "informational"
   },
   {
@@ -1987,13 +2042,20 @@ var PAYMENT_RAILS = [
     description: "Unified Payments Interface",
     reference: "https://www.npci.org.in/",
     status: "informational"
+  },
+  {
+    id: "x402",
+    category: "agentic-payment",
+    description: "HTTP 402-based paid call receipts",
+    reference: "https://www.x402.org/",
+    status: "informational"
   }
 ];
 var CONTROL_ENGINES = [
   {
-    id: "spend-control-service",
-    category: "limits",
-    description: "Generic spend control decisions (per-tx, daily, monthly limits)",
+    id: "mandate-service",
+    category: "mandate",
+    description: "Generic enterprise mandate/approval chain evaluator",
     reference: null,
     status: "informational"
   },
@@ -2005,11 +2067,25 @@ var CONTROL_ENGINES = [
     status: "informational"
   },
   {
-    id: "mandate-service",
-    category: "mandate",
-    description: "Generic enterprise mandate/approval chain evaluator",
+    id: "rsl",
+    category: "access-policy",
+    description: "Robots Specification Layer usage token evaluation",
     reference: null,
     status: "informational"
+  },
+  {
+    id: "spend-control-service",
+    category: "limits",
+    description: "Generic spend control decisions (per-tx, daily, monthly limits)",
+    reference: null,
+    status: "informational"
+  },
+  {
+    id: "tap",
+    category: "agent-verification",
+    description: "Trusted Agent Protocol control decisions (HTTP signature verification)",
+    reference: "https://developer.visa.com/",
+    status: "informational"
   }
 ];
 var TRANSPORT_METHODS = [
@@ -2037,10 +2113,10 @@ var TRANSPORT_METHODS = [
 ];
 var AGENT_PROTOCOLS = [
   {
-    id: "mcp",
-    category: "tool-protocol",
-    description: "Model Context Protocol (MCP)",
-    reference: "https://modelcontextprotocol.io/",
+    id: "a2a",
+    category: "agent-protocol",
+    description: "Agent-to-Agent Protocol (A2A, Linux Foundation)",
+    reference: "https://a2a-protocol.org/",
     status: "informational"
   },
   {
@@ -2057,31 +2133,274 @@ var AGENT_PROTOCOLS = [
     reference: null,
     status: "informational"
   },
+  {
+    id: "mcp",
+    category: "tool-protocol",
+    description: "Model Context Protocol (MCP)",
+    reference: "https://modelcontextprotocol.io/",
+    status: "informational"
+  },
   {
     id: "tap",
     category: "card-protocol",
     description: "Trusted Agent Protocol (Visa TAP)",
     reference: "https://developer.visa.com/",
     status: "informational"
+  },
+  {
+    id: "ucp",
+    category: "commerce-protocol",
+    description: "Universal Commerce Protocol (UCP)",
+    reference: null,
+    status: "informational"
   }
 ];
+var PROOF_TYPES = [
+  {
+    id: "custom",
+    category: "vendor-defined",
+    description: "Vendor-defined proof type; registered per-issuer in extension metadata",
+    reference: null,
+    status: "informational"
+  },
+  {
+    id: "did",
+    category: "decentralized-identity",
+    description: "W3C Decentralized Identifier (DID) resolution and verification",
+    reference: "https://www.w3.org/TR/did-core/",
+    status: "informational"
+  },
+  {
+    id: "eat-background-check",
+    category: "rats",
+    description: "Verifier fetches attestation result from registry in RATS Background-Check model (RFC 9711)",
+    reference: "https://www.rfc-editor.org/rfc/rfc9711",
+    status: "informational"
+  },
+  {
+    id: "eat-passport",
+    category: "rats",
+    description: "Agent carries Entity Attestation Token in RATS Passport model (RFC 9711)",
+    reference: "https://www.rfc-editor.org/rfc/rfc9711",
+    status: "informational"
+  },
+  {
+    id: "ed25519-cert-chain",
+    category: "attestation-chain",
+    description: "Ed25519 issuer-to-holder attestation chain (RFC 8032)",
+    reference: "https://www.rfc-editor.org/rfc/rfc8032",
+    status: "informational"
+  },
+  {
+    id: "sigstore-oidc",
+    category: "keyless-signing",
+    description: "OIDC-bound keyless signing via Sigstore (Fulcio + Rekor transparency log)",
+    reference: "https://docs.sigstore.dev/",
+    status: "informational"
+  },
+  {
+    id: "spiffe",
+    category: "workload-identity",
+    description: "CNCF SPIFFE workload identity (spiffe:// URI scheme)",
+    reference: "https://spiffe.io/docs/latest/spiffe-about/overview/",
+    status: "informational"
+  },
+  {
+    id: "x509-pki",
+    category: "pki",
+    description: "Traditional X.509 PKI certificate chain verification (RFC 5280)",
+    reference: "https://www.rfc-editor.org/rfc/rfc5280",
+    status: "informational"
+  }
+];
+var RECEIPT_TYPES = [
+  {
+    id: "org.peacprotocol/access-decision",
+    pillar: "access",
+    description: "Access control decision evidence (allow, deny, review)",
+    extension_group: "org.peacprotocol/access",
+    status: "informational"
+  },
+  {
+    id: "org.peacprotocol/attribution-event",
+    pillar: "attribution",
+    description: "Content or action attribution evidence",
+    extension_group: "org.peacprotocol/attribution",
+    status: "informational"
+  },
+  {
+    id: "org.peacprotocol/compliance-check",
+    pillar: "compliance",
+    description: "Regulatory compliance check evidence",
+    extension_group: "org.peacprotocol/compliance",
+    status: "informational"
+  },
+  {
+    id: "org.peacprotocol/consent-record",
+    pillar: "consent",
+    description: "Consent collection or withdrawal evidence",
+    extension_group: "org.peacprotocol/consent",
+    status: "informational"
+  },
+  {
+    id: "org.peacprotocol/identity-attestation",
+    pillar: "identity",
+    description: "Identity verification or attestation evidence",
+    extension_group: "org.peacprotocol/identity",
+    status: "informational"
+  },
+  {
+    id: "org.peacprotocol/payment",
+    pillar: "commerce",
+    description: "Commerce transaction evidence (payment, authorization, settlement)",
+    extension_group: "org.peacprotocol/commerce",
+    status: "informational"
+  },
+  {
+    id: "org.peacprotocol/privacy-signal",
+    pillar: "privacy",
+    description: "Privacy signal observation or enforcement evidence",
+    extension_group: "org.peacprotocol/privacy",
+    status: "informational"
+  },
+  {
+    id: "org.peacprotocol/provenance-record",
+    pillar: "provenance",
+    description: "Data or content provenance tracking evidence",
+    extension_group: "org.peacprotocol/provenance",
+    status: "informational"
+  },
+  {
+    id: "org.peacprotocol/purpose-declaration",
+    pillar: "purpose",
+    description: "Purpose declaration or limitation evidence",
+    extension_group: "org.peacprotocol/purpose",
+    status: "informational"
+  },
+  {
+    id: "org.peacprotocol/safety-review",
+    pillar: "safety",
+    description: "Content or agent safety review evidence",
+    extension_group: "org.peacprotocol/safety",
+    status: "informational"
+  }
+];
+var EXTENSION_GROUPS = [
+  {
+    id: "org.peacprotocol/access",
+    description: "Access extension: resource, action, decision (allow/deny/review)",
+    status: "informational"
+  },
+  {
+    id: "org.peacprotocol/attribution",
+    description: "Attribution extension: creator_ref, license_spdx, obligation_type, attribution_text, content_signal_source, content_digest",
+    status: "informational"
+  },
+  {
+    id: "org.peacprotocol/challenge",
+    description: "Challenge extension: challenge_type, problem (RFC 9457), requirements",
+    status: "informational"
+  },
+  {
+    id: "org.peacprotocol/commerce",
+    description: "Commerce extension: payment_rail, amount_minor, currency, reference, asset, env",
+    status: "informational"
+  },
+  {
+    id: "org.peacprotocol/compliance",
+    description: "Compliance extension: framework, compliance_status, audit_ref, auditor, audit_date, scope, validity_period, evidence_ref",
+    status: "informational"
+  },
+  {
+    id: "org.peacprotocol/consent",
+    description: "Consent extension: consent_basis, consent_status, data_categories, retention_period, consent_method, withdrawal_uri, scope, jurisdiction",
+    status: "informational"
+  },
+  {
+    id: "org.peacprotocol/correlation",
+    description: "Correlation extension: trace_id, span_id, workflow_id, parent_jti, depends_on",
+    status: "informational"
+  },
+  {
+    id: "org.peacprotocol/identity",
+    description: "Identity extension: proof_ref",
+    status: "informational"
+  },
+  {
+    id: "org.peacprotocol/privacy",
+    description: "Privacy extension: data_classification, processing_basis, retention_period, retention_mode, recipient_scope, anonymization_method, data_subject_category, transfer_mechanism",
+    status: "informational"
+  },
+  {
+    id: "org.peacprotocol/provenance",
+    description: "Provenance extension: source_type, source_ref, source_uri, build_provenance_uri, verification_method, custody_chain, slsa",
+    status: "informational"
+  },
+  {
+    id: "org.peacprotocol/purpose",
+    description: "Purpose extension: external_purposes, purpose_basis, purpose_limitation, data_minimization, compatible_purposes, peac_purpose_mapping",
+    status: "informational"
+  },
+  {
+    id: "org.peacprotocol/safety",
+    description: "Safety extension: review_status, risk_level, assessment_method, safety_measures, incident_ref, model_ref, category",
+    status: "informational"
+  }
+];
+var TYPE_TO_EXTENSION_MAP = /* @__PURE__ */ new Map([
+  ["org.peacprotocol/access-decision", "org.peacprotocol/access"],
+  ["org.peacprotocol/attribution-event", "org.peacprotocol/attribution"],
+  ["org.peacprotocol/compliance-check", "org.peacprotocol/compliance"],
+  ["org.peacprotocol/consent-record", "org.peacprotocol/consent"],
+  ["org.peacprotocol/identity-attestation", "org.peacprotocol/identity"],
+  ["org.peacprotocol/payment", "org.peacprotocol/commerce"],
+  ["org.peacprotocol/privacy-signal", "org.peacprotocol/privacy"],
+  ["org.peacprotocol/provenance-record", "org.peacprotocol/provenance"],
+  ["org.peacprotocol/purpose-declaration", "org.peacprotocol/purpose"],
+  ["org.peacprotocol/safety-review", "org.peacprotocol/safety"]
+]);
+var PILLAR_VALUES = [
+  "access",
+  "attribution",
+  "commerce",
+  "compliance",
+  "consent",
+  "identity",
+  "privacy",
+  "provenance",
+  "purpose",
+  "safety"
+];
 var REGISTRIES = {
   payment_rails: PAYMENT_RAILS,
   control_engines: CONTROL_ENGINES,
   transport_methods: TRANSPORT_METHODS,
-  agent_protocols: AGENT_PROTOCOLS
+  agent_protocols: AGENT_PROTOCOLS,
+  proof_types: PROOF_TYPES,
+  receipt_types: RECEIPT_TYPES,
+  extension_groups: EXTENSION_GROUPS,
+  pillar_values: PILLAR_VALUES
 };
 function findPaymentRail(id) {
-  return PAYMENT_RAILS.find((rail) => rail.id === id);
+  return PAYMENT_RAILS.find((entry) => entry.id === id);
 }
 function findControlEngine(id) {
-  return CONTROL_ENGINES.find((engine) => engine.id === id);
+  return CONTROL_ENGINES.find((entry) => entry.id === id);
 }
 function findTransportMethod(id) {
-  return TRANSPORT_METHODS.find((method) => method.id === id);
+  return TRANSPORT_METHODS.find((entry) => entry.id === id);
 }
 function findAgentProtocol(id) {
-  return AGENT_PROTOCOLS.find((protocol) => protocol.id === id);
+  return AGENT_PROTOCOLS.find((entry) => entry.id === id);
+}
+function findProofType(id) {
+  return PROOF_TYPES.find((entry) => entry.id === id);
+}
+function findReceiptType(id) {
+  return RECEIPT_TYPES.find((entry) => entry.id === id);
+}
+function findExtensionGroup(id) {
+  return EXTENSION_GROUPS.find((entry) => entry.id === id);
 }
 
 // src/http.ts
@@ -2125,6 +2444,8 @@ exports.DISPUTE_ERRORS = DISPUTE_ERRORS;
 exports.ERRORS = ERRORS;
 exports.ERROR_CATEGORIES = ERROR_CATEGORIES;
 exports.ERROR_CODES = ERROR_CODES;
+exports.EXTENSION_BUDGET = EXTENSION_BUDGET;
+exports.EXTENSION_GROUPS = EXTENSION_GROUPS;
 exports.HASH = HASH;
 exports.HEADERS = HEADERS;
 exports.ISSUER_CONFIG = ISSUER_CONFIG;
@@ -2136,13 +2457,17 @@ exports.PAYMENT_RAILS = PAYMENT_RAILS;
 exports.PEAC_ALG = PEAC_ALG;
 exports.PEAC_RECEIPT_HEADER = PEAC_RECEIPT_HEADER;
 exports.PEAC_RECEIPT_URL_HEADER = PEAC_RECEIPT_URL_HEADER;
+exports.PILLAR_VALUES = PILLAR_VALUES;
 exports.POLICY = POLICY;
 exports.POLICY_BLOCK = POLICY_BLOCK;
 exports.PRIVATE_IP_RANGES = PRIVATE_IP_RANGES;
+exports.PROOF_TYPES = PROOF_TYPES;
 exports.RECEIPT = RECEIPT;
+exports.RECEIPT_TYPES = RECEIPT_TYPES;
 exports.REGISTRIES = REGISTRIES;
 exports.TRANSPORT_METHODS = TRANSPORT_METHODS;
 exports.TYPE_GRAMMAR = TYPE_GRAMMAR;
+exports.TYPE_TO_EXTENSION_MAP = TYPE_TO_EXTENSION_MAP;
 exports.VARY_HEADERS = VARY_HEADERS;
 exports.VERIFICATION_MODES = VERIFICATION_MODES;
 exports.VERIFICATION_REPORT_VERSION = VERIFICATION_REPORT_VERSION;
@@ -2159,7 +2484,10 @@ exports.WIRE_VERSIONS = WIRE_VERSIONS;
 exports.applyPurposeVary = applyPurposeVary;
 exports.findAgentProtocol = findAgentProtocol;
 exports.findControlEngine = findControlEngine;
+exports.findExtensionGroup = findExtensionGroup;
 exports.findPaymentRail = findPaymentRail;
+exports.findProofType = findProofType;
+exports.findReceiptType = findReceiptType;
 exports.findTransportMethod = findTransportMethod;
 exports.formatHash = formatHash;
 exports.getError = getError;