@peac/protocol 0.12.0 → 0.12.2

package/dist/index.cjs

@@ -1393,6 +1393,35 @@ async function verifyReceipt(optionsOrJws) {
     };
   }
 }
+
+// src/type-extension-check.ts
+function checkTypeExtensionMapping(kind, type, extensions, typeToExtensionMap, registeredExtensionGroupKeys) {
+  if (kind === "challenge") {
+    return { status: "skip" };
+  }
+  const expectedGroup = typeToExtensionMap.get(type);
+  if (expectedGroup === void 0) {
+    return { status: "skip" };
+  }
+  if (extensions !== void 0 && Object.prototype.hasOwnProperty.call(extensions, expectedGroup)) {
+    return { status: "ok" };
+  }
+  const presentRegistered = [];
+  if (extensions !== void 0) {
+    for (const key of Object.keys(extensions)) {
+      if (key !== expectedGroup && registeredExtensionGroupKeys.has(key)) {
+        presentRegistered.push(key);
+      }
+    }
+  }
+  return {
+    status: presentRegistered.length > 0 ? "mismatch" : "missing",
+    expected_extension_group: expectedGroup,
+    present_registered_extension_groups: presentRegistered
+  };
+}
+
+// src/verify-local.ts
 function isCryptoError(err) {
   return err !== null && typeof err === "object" && "name" in err && err.name === "CryptoError" && "code" in err && typeof err.code === "string" && err.code.startsWith("CRYPTO_") && "message" in err && typeof err.message === "string";
 }
@@ -1519,6 +1548,34 @@ async function verifyLocal(jws, publicKey, options = {}) {
           }
         }
       }
+      const typeExtCheck = checkTypeExtensionMapping(
+        claims.kind,
+        claims.type,
+        claims.extensions,
+        kernel.TYPE_TO_EXTENSION_MAP,
+        schema.REGISTERED_EXTENSION_GROUP_KEYS
+      );
+      if (typeExtCheck.status === "missing" || typeExtCheck.status === "mismatch") {
+        const warningCode = typeExtCheck.status === "missing" ? schema.WARNING_EXTENSION_GROUP_MISSING : schema.WARNING_EXTENSION_GROUP_MISMATCH;
+        const errorCode = typeExtCheck.status === "missing" ? "E_EXTENSION_GROUP_REQUIRED" : "E_EXTENSION_GROUP_MISMATCH";
+        if (strictness === "strict") {
+          return {
+            valid: false,
+            code: errorCode,
+            message: `Type "${claims.type}" expects extension group "${typeExtCheck.expected_extension_group}" but it is ${typeExtCheck.status === "mismatch" ? "replaced by a different registered group" : "absent"}`,
+            details: {
+              type: claims.type,
+              expected_extension_group: typeExtCheck.expected_extension_group,
+              present_registered_extension_groups: typeExtCheck.present_registered_extension_groups
+            }
+          };
+        }
+        accumulatedWarnings.push({
+          code: warningCode,
+          message: `Type "${claims.type}" expects extension group "${typeExtCheck.expected_extension_group}"`,
+          pointer: "/type"
+        });
+      }
       if (policyDigest !== void 0 && !kernel.HASH.pattern.test(policyDigest)) {
         return {
           valid: false,
@@ -1855,7 +1912,7 @@ var VerificationReportBuilder = class {
       reason,
       severity: reasonCodeToSeverity(reason),
       receipt_type: options?.receiptType ?? kernel.WIRE_TYPE,
-      // Wire 0.1: always 'unavailable' (DD-49). Wire 0.2 will set this via options.
+      // Wire 0.1: always 'unavailable'. Wire 0.2 will set this via options.
       policy_binding: "unavailable",
       ...options?.issuer && { issuer: options.issuer },
       ...options?.kid && { kid: options.kid }