@peac/protocol 0.12.1 → 0.12.2

package/dist/index.mjs

@@ -2,9 +2,9 @@ import { uuidv7 } from 'uuidv7';
 import { sign, signWire02, decode, verify, jcsHash, sha256Hex, computeJwkThumbprint, jwkToPublicKeyBytes, base64urlDecode } from '@peac/crypto';
 export { base64urlDecode, base64urlEncode, computeJwkThumbprint, generateKeypair, jwkToPublicKeyBytes, sha256Bytes, sha256Hex, verify } from '@peac/crypto';
 import { ZodError } from 'zod';
-import { isValidPurposeToken, isCanonicalPurpose, isValidPurposeReason, isValidWorkflowContext, createWorkflowContextInvalidError, hasValidDagSemantics, createWorkflowDagInvalidError, WORKFLOW_EXTENSION_KEY, validateKernelConstraints, createConstraintViolationError, ReceiptClaims, createEvidenceNotJsonError, validateSubjectSnapshot, isCanonicalIss, Wire02ClaimsSchema, PEAC_ISSUER_CONFIG_MAX_BYTES, validateRevokedKeys, PEAC_ISSUER_CONFIG_PATH, PEAC_POLICY_MAX_BYTES, PEAC_POLICY_PATH, PEAC_POLICY_FALLBACK_PATH, WARNING_TYP_MISSING, parseReceiptClaims, checkOccurredAtSkew, REGISTERED_RECEIPT_TYPES, WARNING_TYPE_UNREGISTERED, REGISTERED_EXTENSION_GROUP_KEYS, isValidExtensionKey, WARNING_UNKNOWN_EXTENSION, verifyPolicyBinding, sortWarnings, PEAC_RECEIPT_HEADER, PEAC_PURPOSE_HEADER, parsePurposeHeader, PEAC_PURPOSE_APPLIED_HEADER, PEAC_PURPOSE_REASON_HEADER } from '@peac/schema';
+import { isValidPurposeToken, isCanonicalPurpose, isValidPurposeReason, isValidWorkflowContext, createWorkflowContextInvalidError, hasValidDagSemantics, createWorkflowDagInvalidError, WORKFLOW_EXTENSION_KEY, validateKernelConstraints, createConstraintViolationError, ReceiptClaims, createEvidenceNotJsonError, validateSubjectSnapshot, isCanonicalIss, Wire02ClaimsSchema, PEAC_ISSUER_CONFIG_MAX_BYTES, validateRevokedKeys, PEAC_ISSUER_CONFIG_PATH, PEAC_POLICY_MAX_BYTES, PEAC_POLICY_PATH, PEAC_POLICY_FALLBACK_PATH, WARNING_TYP_MISSING, parseReceiptClaims, checkOccurredAtSkew, REGISTERED_RECEIPT_TYPES, WARNING_TYPE_UNREGISTERED, REGISTERED_EXTENSION_GROUP_KEYS, isValidExtensionKey, WARNING_UNKNOWN_EXTENSION, WARNING_EXTENSION_GROUP_MISSING, WARNING_EXTENSION_GROUP_MISMATCH, verifyPolicyBinding, sortWarnings, PEAC_RECEIPT_HEADER, PEAC_PURPOSE_HEADER, parsePurposeHeader, PEAC_PURPOSE_APPLIED_HEADER, PEAC_PURPOSE_REASON_HEADER } from '@peac/schema';
 import { createHash } from 'crypto';
-import { VERIFIER_LIMITS, VERIFIER_NETWORK, HASH, VERIFIER_POLICY_VERSION, VERIFICATION_REPORT_VERSION, WIRE_TYPE } from '@peac/kernel';
+import { VERIFIER_LIMITS, VERIFIER_NETWORK, TYPE_TO_EXTENSION_MAP, HASH, VERIFIER_POLICY_VERSION, VERIFICATION_REPORT_VERSION, WIRE_TYPE } from '@peac/kernel';
 
 // src/issue.ts
 function fireTelemetryHook(fn, input) {
@@ -1392,6 +1392,35 @@ async function verifyReceipt(optionsOrJws) {
     };
   }
 }
+
+// src/type-extension-check.ts
+function checkTypeExtensionMapping(kind, type, extensions, typeToExtensionMap, registeredExtensionGroupKeys) {
+  if (kind === "challenge") {
+    return { status: "skip" };
+  }
+  const expectedGroup = typeToExtensionMap.get(type);
+  if (expectedGroup === void 0) {
+    return { status: "skip" };
+  }
+  if (extensions !== void 0 && Object.prototype.hasOwnProperty.call(extensions, expectedGroup)) {
+    return { status: "ok" };
+  }
+  const presentRegistered = [];
+  if (extensions !== void 0) {
+    for (const key of Object.keys(extensions)) {
+      if (key !== expectedGroup && registeredExtensionGroupKeys.has(key)) {
+        presentRegistered.push(key);
+      }
+    }
+  }
+  return {
+    status: presentRegistered.length > 0 ? "mismatch" : "missing",
+    expected_extension_group: expectedGroup,
+    present_registered_extension_groups: presentRegistered
+  };
+}
+
+// src/verify-local.ts
 function isCryptoError(err) {
   return err !== null && typeof err === "object" && "name" in err && err.name === "CryptoError" && "code" in err && typeof err.code === "string" && err.code.startsWith("CRYPTO_") && "message" in err && typeof err.message === "string";
 }
@@ -1518,6 +1547,34 @@ async function verifyLocal(jws, publicKey, options = {}) {
           }
         }
       }
+      const typeExtCheck = checkTypeExtensionMapping(
+        claims.kind,
+        claims.type,
+        claims.extensions,
+        TYPE_TO_EXTENSION_MAP,
+        REGISTERED_EXTENSION_GROUP_KEYS
+      );
+      if (typeExtCheck.status === "missing" || typeExtCheck.status === "mismatch") {
+        const warningCode = typeExtCheck.status === "missing" ? WARNING_EXTENSION_GROUP_MISSING : WARNING_EXTENSION_GROUP_MISMATCH;
+        const errorCode = typeExtCheck.status === "missing" ? "E_EXTENSION_GROUP_REQUIRED" : "E_EXTENSION_GROUP_MISMATCH";
+        if (strictness === "strict") {
+          return {
+            valid: false,
+            code: errorCode,
+            message: `Type "${claims.type}" expects extension group "${typeExtCheck.expected_extension_group}" but it is ${typeExtCheck.status === "mismatch" ? "replaced by a different registered group" : "absent"}`,
+            details: {
+              type: claims.type,
+              expected_extension_group: typeExtCheck.expected_extension_group,
+              present_registered_extension_groups: typeExtCheck.present_registered_extension_groups
+            }
+          };
+        }
+        accumulatedWarnings.push({
+          code: warningCode,
+          message: `Type "${claims.type}" expects extension group "${typeExtCheck.expected_extension_group}"`,
+          pointer: "/type"
+        });
+      }
       if (policyDigest !== void 0 && !HASH.pattern.test(policyDigest)) {
         return {
           valid: false,
@@ -1854,7 +1911,7 @@ var VerificationReportBuilder = class {
       reason,
       severity: reasonCodeToSeverity(reason),
       receipt_type: options?.receiptType ?? WIRE_TYPE,
-      // Wire 0.1: always 'unavailable' (DD-49). Wire 0.2 will set this via options.
+      // Wire 0.1: always 'unavailable'. Wire 0.2 will set this via options.
       policy_binding: "unavailable",
       ...options?.issuer && { issuer: options.issuer },
       ...options?.kid && { kid: options.kid }