@peac/protocol 0.10.13 → 0.11.0

package/dist/index.mjs

@@ -2,7 +2,7 @@ import { uuidv7 } from 'uuidv7';
 import { sign, decode, verify, sha256Hex, computeJwkThumbprint, jwkToPublicKeyBytes, base64urlDecode } from '@peac/crypto';
 export { base64urlDecode, base64urlEncode, computeJwkThumbprint, generateKeypair, jwkToPublicKeyBytes, sha256Bytes, sha256Hex, verify } from '@peac/crypto';
 import { ZodError } from 'zod';
-import { isValidPurposeToken, isCanonicalPurpose, isValidPurposeReason, isValidWorkflowContext, createWorkflowContextInvalidError, hasValidDagSemantics, createWorkflowDagInvalidError, WORKFLOW_EXTENSION_KEY, ReceiptClaims, createEvidenceNotJsonError, validateSubjectSnapshot, parseReceiptClaims, PEAC_RECEIPT_HEADER, PEAC_PURPOSE_HEADER, parsePurposeHeader, PEAC_PURPOSE_APPLIED_HEADER, PEAC_PURPOSE_REASON_HEADER, PEAC_ISSUER_CONFIG_MAX_BYTES, PEAC_ISSUER_CONFIG_PATH, PEAC_POLICY_MAX_BYTES, PEAC_POLICY_PATH, PEAC_POLICY_FALLBACK_PATH } from '@peac/schema';
+import { isValidPurposeToken, isCanonicalPurpose, isValidPurposeReason, isValidWorkflowContext, createWorkflowContextInvalidError, hasValidDagSemantics, createWorkflowDagInvalidError, WORKFLOW_EXTENSION_KEY, validateKernelConstraints, createConstraintViolationError, ReceiptClaims, createEvidenceNotJsonError, validateSubjectSnapshot, parseReceiptClaims, PEAC_RECEIPT_HEADER, PEAC_PURPOSE_HEADER, parsePurposeHeader, PEAC_PURPOSE_APPLIED_HEADER, PEAC_PURPOSE_REASON_HEADER, PEAC_ISSUER_CONFIG_MAX_BYTES, PEAC_ISSUER_CONFIG_PATH, PEAC_POLICY_MAX_BYTES, PEAC_POLICY_PATH, PEAC_POLICY_FALLBACK_PATH } from '@peac/schema';
 import { createHash } from 'crypto';
 import { VERIFIER_LIMITS, VERIFIER_NETWORK, VERIFIER_POLICY_VERSION, VERIFICATION_REPORT_VERSION, WIRE_TYPE } from '@peac/kernel';
 
@@ -139,6 +139,10 @@ async function issue(options) {
     ...options.purpose_enforced && { purpose_enforced: options.purpose_enforced },
     ...options.purpose_reason && { purpose_reason: options.purpose_reason }
   };
+  const constraintResult = validateKernelConstraints(claims);
+  if (!constraintResult.valid) {
+    throw new IssueError(createConstraintViolationError(constraintResult.violations));
+  }
   try {
     ReceiptClaims.parse(claims);
   } catch (err) {
@@ -147,7 +151,10 @@ async function issue(options) {
         (issue2) => issue2.path.some((p) => p === "evidence" || p === "payment")
       );
       if (evidenceIssue && evidenceIssue.path.includes("evidence")) {
-        const peacError = createEvidenceNotJsonError(evidenceIssue.message, evidenceIssue.path);
+        const peacError = createEvidenceNotJsonError(
+          evidenceIssue.message,
+          evidenceIssue.path
+        );
         throw new IssueError(peacError);
       }
     }
@@ -242,6 +249,15 @@ async function verifyReceipt(optionsOrJws) {
   let jwksFetchTime;
   try {
     const { header, payload } = decode(receiptJws);
+    const constraintResult = validateKernelConstraints(payload);
+    if (!constraintResult.valid) {
+      const v = constraintResult.violations[0];
+      return {
+        ok: false,
+        reason: "constraint_violation",
+        details: `Kernel constraint violated: ${v.constraint} (actual: ${v.actual}, limit: ${v.limit})`
+      };
+    }
     ReceiptClaims.parse(payload);
     if (payload.exp && payload.exp < Math.floor(Date.now() / 1e3)) {
       const durationMs = performance.now() - startTime;
@@ -361,6 +377,15 @@ async function verifyLocal(jws, publicKey, options = {}) {
         message: "Ed25519 signature verification failed"
       };
     }
+    const constraintResult = validateKernelConstraints(result.payload);
+    if (!constraintResult.valid) {
+      const v = constraintResult.violations[0];
+      return {
+        valid: false,
+        code: "E_CONSTRAINT_VIOLATION",
+        message: `Kernel constraint violated: ${v.constraint} (actual: ${v.actual}, limit: ${v.limit})`
+      };
+    }
     const pr = parseReceiptClaims(result.payload);
     if (!pr.ok) {
       return {