@peac/protocol 0.10.14 → 0.11.0

package/dist/index.cjs

@@ -140,6 +140,10 @@ async function issue(options) {
     ...options.purpose_enforced && { purpose_enforced: options.purpose_enforced },
     ...options.purpose_reason && { purpose_reason: options.purpose_reason }
   };
+  const constraintResult = schema.validateKernelConstraints(claims);
+  if (!constraintResult.valid) {
+    throw new IssueError(schema.createConstraintViolationError(constraintResult.violations));
+  }
   try {
     schema.ReceiptClaims.parse(claims);
   } catch (err) {
@@ -148,7 +152,10 @@ async function issue(options) {
         (issue2) => issue2.path.some((p) => p === "evidence" || p === "payment")
       );
       if (evidenceIssue && evidenceIssue.path.includes("evidence")) {
-        const peacError = schema.createEvidenceNotJsonError(evidenceIssue.message, evidenceIssue.path);
+        const peacError = schema.createEvidenceNotJsonError(
+          evidenceIssue.message,
+          evidenceIssue.path
+        );
         throw new IssueError(peacError);
       }
     }
@@ -243,6 +250,15 @@ async function verifyReceipt(optionsOrJws) {
   let jwksFetchTime;
   try {
     const { header, payload } = crypto.decode(receiptJws);
+    const constraintResult = schema.validateKernelConstraints(payload);
+    if (!constraintResult.valid) {
+      const v = constraintResult.violations[0];
+      return {
+        ok: false,
+        reason: "constraint_violation",
+        details: `Kernel constraint violated: ${v.constraint} (actual: ${v.actual}, limit: ${v.limit})`
+      };
+    }
     schema.ReceiptClaims.parse(payload);
     if (payload.exp && payload.exp < Math.floor(Date.now() / 1e3)) {
       const durationMs = performance.now() - startTime;
@@ -362,6 +378,15 @@ async function verifyLocal(jws, publicKey, options = {}) {
         message: "Ed25519 signature verification failed"
       };
     }
+    const constraintResult = schema.validateKernelConstraints(result.payload);
+    if (!constraintResult.valid) {
+      const v = constraintResult.violations[0];
+      return {
+        valid: false,
+        code: "E_CONSTRAINT_VIOLATION",
+        message: `Kernel constraint violated: ${v.constraint} (actual: ${v.actual}, limit: ${v.limit})`
+      };
+    }
     const pr = schema.parseReceiptClaims(result.payload);
     if (!pr.ok) {
       return {