@peac/protocol 0.13.0 → 0.13.2

package/dist/_internal/record-core/bounded-validator.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Bounded observation subset: composition aggregator.
+ *
+ * INTERNAL ONLY. Composes the six proven layer validators introduced
+ * across this PR (kernel constraints; type-extension mapping; JOSE
+ * header hardening; issuer form; occurred_at temporal skew;
+ * extension byte budget) into a single aggregated result. The
+ * canonical-truth sanity test, layer-isolated parity tests, and
+ * differential same-path proof have already established that each
+ * underlying validator is byte-equal with the existing canonical
+ * surface for the layer it covers.
+ *
+ * NOT WIRED. This module is NOT called from issue.ts, verify-local.ts,
+ * or any runtime path in v0.13.1. It exists as a composition example
+ * so PR D can wire the inert shadow-call hook to a real bounded
+ * pipeline behind an internal feature flag without re-deriving the
+ * composition shape.
+ *
+ * NOT FULL VALIDATION. The bounded subset deliberately EXCLUDES:
+ *   - full Wire 0.2 schema parsing (parseReceiptClaims; the canonical
+ *     parse continues to drive the runtime path)
+ *   - signature verification and full JWS decode (decodeWire02;
+ *     @peac/crypto remains canonical)
+ *   - iat-not-yet-valid temporal check (lives inline at
+ *     verify-local.ts:454 with no helper to import)
+ *   - typ_missing strictness handling
+ *   - policy binding verification
+ *   - unknown_extension key grammar / plain-JSON guard / typed
+ *     extension schema parse (only the byte-budget portion of
+ *     validateKnownExtensions is in scope)
+ *   - any control-plane behavior (issuer resolver, JWKS fetch, etc.)
+ *
+ * Public-facing wording for this module: "bounded observation subset",
+ * never "complete validator" or "primary validator".
+ */
+/** Minimal claims shape required by the bounded subset. */
+export interface BoundedClaimsInput {
+    readonly kind: string;
+    readonly type: string;
+    readonly iss: unknown;
+    readonly iat: number;
+    readonly occurred_at?: string;
+    readonly extensions?: Record<string, unknown>;
+}
+/** Optional JOSE header (from the JWS protected header). */
+export type BoundedHeaderInput = Record<string, unknown> | undefined;
+/** Aggregated input to the bounded observation subset. */
+export interface BoundedValidationInput {
+    readonly claims: BoundedClaimsInput;
+    readonly header?: BoundedHeaderInput;
+    /** Fixed Unix-second clock for temporal evaluation; required. */
+    readonly now: number;
+}
+/**
+ * Layer tag identifies which underlying validator emitted each entry.
+ * Useful for downstream filtering (e.g., a future shadow-mode reporter
+ * that ignores warning-class entries from one layer but not another).
+ */
+export type BoundedLayer = 'kernel-constraints' | 'type-extension-mapping' | 'jose-header-hardening' | 'issuer-form' | 'temporal' | 'extension-budget';
+export interface BoundedViolation {
+    readonly layer: BoundedLayer;
+    readonly code: string;
+    readonly path?: string;
+}
+export interface BoundedWarning {
+    readonly layer: BoundedLayer;
+    readonly code: string;
+    readonly path?: string;
+}
+export interface BoundedValidationResult {
+    /** True iff every in-scope layer accepted the input. */
+    readonly accepted: boolean;
+    readonly violations: readonly BoundedViolation[];
+    readonly warnings: readonly BoundedWarning[];
+}
+/**
+ * Run the bounded observation subset. Composes the six layer
+ * validators in a stable order; aggregates violations and warnings
+ * with explicit layer tags; never throws. Pure: same input always
+ * yields the same result.
+ */
+export declare function runBoundedValidatorShadow(input: BoundedValidationInput): BoundedValidationResult;
+//# sourceMappingURL=bounded-validator.d.ts.map

package/dist/_internal/record-core/bounded-validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bounded-validator.d.ts","sourceRoot":"","sources":["../../../src/_internal/record-core/bounded-validator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAcH,2DAA2D;AAC3D,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/C;AAED,4DAA4D;AAC5D,MAAM,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;AAErE,0DAA0D;AAC1D,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,kBAAkB,CAAC;IACrC,iEAAiE;IACjE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,MAAM,MAAM,YAAY,GACpB,oBAAoB,GACpB,wBAAwB,GACxB,uBAAuB,GACvB,aAAa,GACb,UAAU,GACV,kBAAkB,CAAC;AAEvB,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,uBAAuB;IACtC,wDAAwD;IACxD,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,SAAS,gBAAgB,EAAE,CAAC;IACjD,QAAQ,CAAC,QAAQ,EAAE,SAAS,cAAc,EAAE,CAAC;CAC9C;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,sBAAsB,GAAG,uBAAuB,CA8EhG"}

package/dist/_internal/record-core/codec/index.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Internal codec registry.
+ *
+ * @internal
+ *
+ * v0.13.1 ships exactly one codec: jws-jwt. Future codecs (e.g.,
+ * cose-sign1 per RFC 9052) register here. COSE/CBOR is hook-only in
+ * v0.13.1; no implementation.
+ */
+import { CodecError, type CodecHeader, type RecordCodec } from './types.js';
+import { defaultCodec } from './jws-jwt.js';
+/**
+ * Internal codec registry lookup. v0.13.1 has only `jws-jwt` registered;
+ * any other name throws `CodecError('CODEC_UNKNOWN', ...)`.
+ *
+ * @internal
+ */
+export declare function getCodec(name: string): RecordCodec;
+/**
+ * Test-only registry view. Returns the registry's keys snapshot.
+ *
+ * @internal
+ */
+export declare function _registeredCodecNames(): readonly string[];
+export { defaultCodec, CodecError };
+export type { CodecHeader, RecordCodec };
+//# sourceMappingURL=index.d.ts.map

package/dist/_internal/record-core/codec/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/_internal/record-core/codec/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,UAAU,EAAE,KAAK,WAAW,EAAE,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AAC5E,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAK5C;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAMlD;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,IAAI,SAAS,MAAM,EAAE,CAEzD;AAED,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC;AACpC,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC"}

package/dist/_internal/record-core/codec/jws-jwt.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Default codec: pure pass-through to @peac/crypto.signWire02 / verify.
+ *
+ * @internal
+ *
+ * Byte-identical encode output to signWire02 is guaranteed by the
+ * golden-vector test (codec-jws-jwt-byte-identical.test.ts). Decode
+ * returns the underlying cryptoVerify result unchanged.
+ *
+ * peekHeader is structural-only: it requires typ + alg presence and a
+ * structurally valid compact JWS, but does NOT enforce policy on
+ * unsupported alg, crit, zip, or b64:false. Those rejections are
+ * downstream responsibilities (kernel constraints, JOSE hardening).
+ *
+ * The canonical implementation lives here. Tests import via relative
+ * paths from packages/protocol/__tests__/_internal/.
+ */
+import { type RecordCodec } from './types.js';
+/**
+ * Default codec instance. Internal-only.
+ *
+ * @internal
+ */
+export declare const defaultCodec: RecordCodec;
+//# sourceMappingURL=jws-jwt.d.ts.map

package/dist/_internal/record-core/codec/jws-jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jws-jwt.d.ts","sourceRoot":"","sources":["../../../../src/_internal/record-core/codec/jws-jwt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAQH,OAAO,EAAgC,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AA+E5E;;;;GAIG;AACH,eAAO,MAAM,YAAY,EAAE,WAA+B,CAAC"}

package/dist/_internal/record-core/codec/types.d.ts

@@ -0,0 +1,80 @@
+/**
+ * Internal codec strategy types.
+ *
+ * @internal
+ *
+ * These types MUST NOT be re-exported from packages/protocol/src/index.ts.
+ * The dist-leak gate (Tier 2) asserts that these names never appear in
+ * @peac/protocol's public root declaration (dist/index.d.ts) or any
+ * subpath in @peac/protocol/package.json `exports`.
+ *
+ * The canonical implementation of these types lives at
+ * packages/protocol/src/_internal/record-core/codec/jws-jwt.ts and is
+ * imported via RELATIVE paths from issue.ts / verify-local.ts.
+ */
+import type { VerifyResult } from '@peac/crypto';
+/**
+ * Header view returned by codec.peekHeader().
+ *
+ * @internal
+ */
+export interface CodecHeader {
+    /** JOSE typ value. Required at peek time; not defaulted. */
+    readonly typ: string;
+    /** Algorithm identifier. JWS string (e.g., 'EdDSA'). */
+    readonly alg: string;
+    /** Key identifier (when present). */
+    readonly kid?: string;
+    /** Full raw protected-header object for downstream policy inspection. */
+    readonly raw: Readonly<Record<string, unknown>>;
+}
+/**
+ * Codec error with a structured code.
+ *
+ * @internal
+ */
+export declare class CodecError extends Error {
+    readonly code: string;
+    constructor(code: string, message: string);
+}
+/**
+ * Internal codec strategy. v0.13.1 ships exactly one implementation:
+ * jws-jwt. Signature mirrors @peac/crypto.signWire02 / verify exactly;
+ * concrete Uint8Array keys (Ed25519 at this layer); parametric only on
+ * the optional payload type T of VerifyResult<T>. Future codecs with
+ * different key shapes register a different interface; they MAY NOT
+ * shoehorn into this interface via parametric generics.
+ *
+ * @internal
+ */
+export interface RecordCodec {
+    /** Codec name. Used for registry lookup. */
+    readonly name: string;
+    /**
+     * Sign and serialize. Pure pass-through to the underlying signer; never
+     * accepts a typ override (the signer hardcodes typ per the wire format).
+     */
+    encode(payload: unknown, privateKey: Uint8Array, kid: string): Promise<string>;
+    /**
+     * Verify and decode. Returns the underlying crypto verifier's result
+     * unchanged. Throws structured CodecError on malformed input;
+     * propagates the underlying CryptoError on signature mismatch.
+     */
+    decode<T = unknown>(serialized: string, publicKey: Uint8Array): Promise<VerifyResult<T>>;
+    /**
+     * Header-only decode. Structural strictness only: throws CodecError on
+     * missing typ, missing alg, malformed protected header JSON, or
+     * malformed compact JWS (must be exactly three non-empty
+     * dot-separated segments). Does NOT enforce policy on crit / zip /
+     * b64 / unsupported alg; those rejections are downstream JOSE-hardening
+     * responsibilities and are surfaced via the raw header for inspection.
+     *
+     * Note: this codec is JWS/JWT string-based. The `serialized` parameter
+     * is typed as `string` for that reason. Future codecs that operate on
+     * binary inputs (e.g., COSE/CBOR over `Uint8Array`) MUST register a
+     * different interface; do not generalize this one to imply binary
+     * support that the JWS codec does not provide.
+     */
+    peekHeader(serialized: string): CodecHeader;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/_internal/record-core/codec/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/_internal/record-core/codec/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEjD;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,4DAA4D;IAC5D,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,wDAAwD;IACxD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,qCAAqC;IACrC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,yEAAyE;IACzE,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACjD;AAED;;;;GAIG;AACH,qBAAa,UAAW,SAAQ,KAAK;aAEjB,IAAI,EAAE,MAAM;gBAAZ,IAAI,EAAE,MAAM,EAC5B,OAAO,EAAE,MAAM;CAKlB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,WAAW;IAC1B,4CAA4C;IAC5C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB;;;OAGG;IACH,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAE/E;;;;OAIG;IACH,MAAM,CAAC,CAAC,GAAG,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;IAEzF;;;;;;;;;;;;;OAaG;IACH,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,WAAW,CAAC;CAC7C"}

package/dist/_internal/record-core/index.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Internal record-core barrel.
+ *
+ * @internal
+ *
+ * NOT re-exported from packages/protocol/src/index.ts. Internal callers
+ * inside @peac/protocol use relative imports either to this barrel or
+ * (for narrower targeting) directly to the sub-modules.
+ */
+export { defaultCodec, getCodec, _registeredCodecNames, CodecError } from './codec/index.js';
+export type { CodecHeader, RecordCodec } from './codec/index.js';
+export { normalize } from './normalize.js';
+export type { InternalMigrationClass } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/_internal/record-core/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/_internal/record-core/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,qBAAqB,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC7F,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,YAAY,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC"}

package/dist/_internal/record-core/normalize.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Record-claim normalization (INERT in v0.13.1).
+ *
+ * @internal
+ *
+ * v0.13.1 contract: this function MUST be a no-op identity passthrough.
+ * It returns the SAME object reference passed in. Tests assert this via
+ * `expect(normalize(claims)).toBe(claims)` (Vitest `toBe` uses
+ * `Object.is` - referential identity, NOT deep equality).
+ *
+ * Do NOT add default expansion, key reordering, wire-version tagging, or
+ * any claim mutation in v0.13.1. The live issue() / verifyLocal() path
+ * does not route through normalize() in this release; the function exists
+ * as a named hook future releases can wire into the live path AFTER the
+ * byte-identical parity corpus proves zero divergence.
+ */
+import type { Wire02Claims } from '@peac/schema';
+/**
+ * INERT identity passthrough. Returns the same object reference.
+ *
+ * @internal
+ */
+export declare function normalize(claims: Wire02Claims): Wire02Claims;
+//# sourceMappingURL=normalize.d.ts.map

package/dist/_internal/record-core/normalize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"normalize.d.ts","sourceRoot":"","sources":["../../../src/_internal/record-core/normalize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEjD;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,YAAY,GAAG,YAAY,CAE5D"}

package/dist/_internal/record-core/shadow-hook.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Inert shadow-call boundary for the bounded validator foundation.
+ *
+ * INTERNAL ONLY. This module is the call-site placeholder that PR D
+ * will wire to the bounded validator pipeline behind an internal
+ * feature flag. In v0.13.1 the boundary is INERT by construction:
+ *
+ *   - the only declared mode is `'disabled'`
+ *   - the function body is a single early return on `'disabled'`
+ *   - it imports no bounded validators (zero runtime weight at
+ *     verify-local.ts cold-start, even though the call site exists)
+ *   - it never throws into verifyLocal()
+ *   - it never mutates the input claims object
+ *   - it never logs
+ *   - it never reads environment variables
+ *   - it never affects the canonical verify-local result
+ *
+ * The function returns `undefined` for every call. The call site in
+ * verify-local.ts ignores the return value and never awaits any work.
+ *
+ * NOT re-exported from packages/protocol/src/index.ts. Public surface
+ * is byte-stable. PR D may extend the input shape when wiring the
+ * actual flag plumbing; that is a future-internal change, not a
+ * public API change.
+ */
+/**
+ * The only declared shadow validation mode. Adding new modes requires
+ * a deliberate future change in PR D where the actual flag is wired.
+ */
+export type ShadowValidationMode = 'disabled';
+/**
+ * Input shape for the shadow-call boundary. `claims` is intentionally
+ * `unknown` so callers may pass parsed Wire 0.2 claims without a
+ * coupling to the schema's exported type from this internal helper.
+ */
+export interface ShadowValidationInput {
+    readonly mode: ShadowValidationMode;
+    readonly claims: unknown;
+}
+/**
+ * Inert shadow-call hook. Always returns `undefined`. The signature
+ * is stable enough for PR D to extend (e.g., adding a `header` or
+ * `now` field) without breaking the disabled-default contract.
+ */
+export declare function maybeRunShadowValidation(input: ShadowValidationInput): undefined;
+//# sourceMappingURL=shadow-hook.d.ts.map

package/dist/_internal/record-core/shadow-hook.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shadow-hook.d.ts","sourceRoot":"","sources":["../../../src/_internal/record-core/shadow-hook.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG,UAAU,CAAC;AAE9C;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,qBAAqB,GAAG,SAAS,CAGhF"}

package/dist/_internal/record-core/types.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Local internal type union for the record-core internal modules.
+ *
+ * @internal
+ *
+ * If protocol internals need a migration-class literal in the future,
+ * define it here. Importing the equivalent type from a workspace-private
+ * package is forbidden by the protocol-private-imports tooling test (which
+ * walks packages/protocol/src/** for forbidden import specifiers).
+ *
+ * v0.13.1 has no live consumer for this type; it exists as the named
+ * landing point for a future inline definition.
+ */
+export type InternalMigrationClass = 'exact' | 'derived' | 'lossy' | 'impossible';
+//# sourceMappingURL=types.d.ts.map

package/dist/_internal/record-core/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/_internal/record-core/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,MAAM,MAAM,sBAAsB,GAAG,OAAO,GAAG,SAAS,GAAG,OAAO,GAAG,YAAY,CAAC"}

package/dist/_internal/record-core/validators/extension-budget.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Bounded internal extension-budget validator.
+ *
+ * INTERNAL ONLY. This is the parity-observed counterpart of the
+ * byte-budget portion (steps 4 + 5) of validateKnownExtensions in
+ * @peac/schema/src/wire-02-extensions/validation.ts. Both sides import
+ * EXTENSION_BUDGET from @peac/kernel; behavioral parity is proven
+ * byte-equal by the parity tests, not by code copy.
+ *
+ * Existing canonical validateKnownExtensions in @peac/schema remains
+ * canonical. This module is observational only; it is NOT re-exported
+ * from packages/protocol/src/index.ts and is NOT wired into runtime
+ * paths (issue.ts, verify-local.ts) in v0.13.1.
+ *
+ * SCOPE (deliberately narrow):
+ *   - byte-budget enforcement on the extensions record only
+ *   - the other three steps in validateKnownExtensions (key grammar,
+ *     plain-JSON guard, typed extension schema parse) are NOT in
+ *     scope here; they belong to other parity work and would require
+ *     their own validators
+ *
+ * Measurement basis (must mirror canonical exactly):
+ *   - bytes = TextEncoder.encode(JSON.stringify(value)).byteLength
+ *     (UTF-8 byte length of ECMAScript JSON.stringify output)
+ *   - serialization failure (circular references, BigInt, etc.) yields
+ *     Infinity, which the comparison treats as over-budget
+ *
+ * Order of checks (must mirror canonical exactly):
+ *   1. Total: jsonUtf8ByteLength(extensions) > maxTotalBytes
+ *      -> violation at path '/extensions'; EARLY STOP (no per-group)
+ *   2. Per-group, in Object.keys(extensions) iteration order:
+ *      jsonUtf8ByteLength(extensions[key]) > maxGroupBytes
+ *      -> violation at path '/extensions/<escaped-key>'
+ *
+ * Comparison uses '>' (strictly greater than), so values exactly equal
+ * to the limit are accepted.
+ */
+export interface ExtensionBudgetViolation {
+    readonly code: string;
+    readonly path: string;
+}
+export interface ExtensionBudgetResult {
+    readonly accepted: boolean;
+    readonly violations: readonly ExtensionBudgetViolation[];
+}
+export declare function validateExtensionBudgetInternal(extensions: Record<string, unknown> | undefined): ExtensionBudgetResult;
+//# sourceMappingURL=extension-budget.d.ts.map

package/dist/_internal/record-core/validators/extension-budget.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"extension-budget.d.ts","sourceRoot":"","sources":["../../../../src/_internal/record-core/validators/extension-budget.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAIH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,SAAS,wBAAwB,EAAE,CAAC;CAC1D;AAyBD,wBAAgB,+BAA+B,CAC7C,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAC9C,qBAAqB,CA0BvB"}

package/dist/_internal/record-core/validators/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Internal validator barrel for the bounded shadow-mode validator foundation.
+ *
+ * INTERNAL ONLY. Not re-exported from packages/protocol/src/index.ts.
+ */
+export type { ParityVerdict, ParityError, ParityWarning } from './types.js';
+export { validateKernelConstraintsInternal } from './kernel-constraints.js';
+export { validateTypeExtensionMappingInternal, type TypeExtensionMappingInput, type TypeExtensionMappingWarning, } from './type-extension-mapping.js';
+export { validateJoseHardeningInternal, type JoseHardeningInput, type JoseHardeningResult, } from './jose-hardening.js';
+export { validateIssuerFormInternal, type IssuerFormResult } from './issuer-form.js';
+export { validateTemporalInternal, type TemporalResult, type TemporalWarning } from './temporal.js';
+export { validateExtensionBudgetInternal, type ExtensionBudgetResult, type ExtensionBudgetViolation, } from './extension-budget.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/_internal/record-core/validators/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/_internal/record-core/validators/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC5E,OAAO,EAAE,iCAAiC,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,EACL,oCAAoC,EACpC,KAAK,yBAAyB,EAC9B,KAAK,2BAA2B,GACjC,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,6BAA6B,EAC7B,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,GACzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,0BAA0B,EAAE,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACrF,OAAO,EAAE,wBAAwB,EAAE,KAAK,cAAc,EAAE,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AACpG,OAAO,EACL,+BAA+B,EAC/B,KAAK,qBAAqB,EAC1B,KAAK,wBAAwB,GAC9B,MAAM,uBAAuB,CAAC"}

package/dist/_internal/record-core/validators/issuer-form.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Bounded internal issuer-form validator.
+ *
+ * INTERNAL ONLY. This is the parity-observed counterpart of
+ * @peac/schema.isCanonicalIss (referenced by Wire 0.2's CanonicalIssSchema
+ * and by issue.ts pre-sign validation). Both implementations consume the
+ * same ISS_CANONICAL.maxLength constant from @peac/kernel and apply the
+ * same accept/reject rules in the same order; behavioral parity is proven
+ * byte-equal by the parity tests, not by code copy.
+ *
+ * Existing canonical isCanonicalIss in @peac/schema remains canonical.
+ * This module is observational only; it is NOT re-exported from
+ * packages/protocol/src/index.ts and is NOT wired into runtime paths
+ * (issue.ts, verify-local.ts) in v0.13.1.
+ *
+ * Scope (must mirror isCanonicalIss in packages/schema/src/wire-02-envelope.ts):
+ *
+ *   1. Type and length:
+ *      - Non-string iss -> rejected
+ *      - Empty string -> rejected
+ *      - Length > ISS_CANONICAL.maxLength (2048) -> rejected
+ *
+ *   2. did: branch (checked before URL parsing because did: is a valid
+ *      URL scheme in some parsers):
+ *      - Pattern: ^did:[a-z0-9]+:[^#?/]+$
+ *      - Method: lowercase letters and digits only, non-empty
+ *      - Method-specific-id: non-empty, no '/', '?', or '#'
+ *
+ *   3. https:// branch (URL-constructor based):
+ *      - new URL(iss) must succeed
+ *      - url.protocol === 'https:'
+ *      - Non-empty url.hostname
+ *      - No userinfo (url.username and url.password both empty)
+ *      - iss must equal the canonical reconstructed origin
+ *        ('https://${url.host}'). This rejects:
+ *          - uppercase host (URL spec lowercases hostname)
+ *          - explicit default port (:443 is dropped from url.host)
+ *          - trailing slash, path, query, fragment, userinfo
+ *          - raw Unicode hostname (URL emits punycode in url.host)
+ *
+ *   4. All other schemes -> rejected with E_ISS_NOT_CANONICAL.
+ */
+/**
+ * Normalized result. accepted=true means iss is in canonical form.
+ * accepted=false carries the canonical error code E_ISS_NOT_CANONICAL.
+ *
+ * The canonical surface emits a single error code for any rejection;
+ * no path field is attached, so the comparison is on (accepted, errorCode)
+ * only.
+ */
+export type IssuerFormResult = {
+    readonly accepted: true;
+} | {
+    readonly accepted: false;
+    readonly errorCode: string;
+};
+export declare function validateIssuerFormInternal(iss: unknown): IssuerFormResult;
+//# sourceMappingURL=issuer-form.d.ts.map

package/dist/_internal/record-core/validators/issuer-form.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"issuer-form.d.ts","sourceRoot":"","sources":["../../../../src/_internal/record-core/validators/issuer-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAIH;;;;;;;GAOG;AACH,MAAM,MAAM,gBAAgB,GACxB;IAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAA;CAAE,GAC3B;IAAE,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAQ7D,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,OAAO,GAAG,gBAAgB,CAyBzE"}

package/dist/_internal/record-core/validators/jose-hardening.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Bounded internal JOSE header hardening validator.
+ *
+ * INTERNAL ONLY. This is the parity-observed counterpart of
+ * @peac/crypto.validateWire02Header. Both implementations consume the
+ * same JOSE protected-header object and apply the same five hardening
+ * checks in the same order; behavioral parity is proven byte-equal by
+ * the parity tests, not by code copy.
+ *
+ * Existing canonical hardening in @peac/crypto remains canonical. This
+ * module is observational only; it is NOT re-exported from
+ * packages/protocol/src/index.ts and is NOT wired into runtime paths
+ * (issue.ts, verify-local.ts, peekHeader) in v0.13.1.
+ *
+ * Scope (must mirror validateWire02Header in packages/crypto/src/jws.ts):
+ *
+ *   1. kid presence and length:
+ *      - missing kid (undefined / non-string / empty) -> CRYPTO_JWS_MISSING_KID
+ *      - kid length > 256 chars -> CRYPTO_JWS_MISSING_KID
+ *
+ *   2. embedded key material (jwk, x5c, x5u, jku):
+ *      - any of the four set -> CRYPTO_JWS_EMBEDDED_KEY
+ *
+ *   3. crit header:
+ *      - any value (including null / empty array) -> CRYPTO_JWS_CRIT_REJECTED
+ *
+ *   4. b64: false (RFC 7797 unencoded payload):
+ *      - the only rejected value is the boolean false; other values pass through
+ *      - rejection -> CRYPTO_JWS_B64_REJECTED
+ *
+ *   5. zip header:
+ *      - any value -> CRYPTO_JWS_ZIP_REJECTED
+ *
+ * Out of scope for this module (mirroring validateWire02Header exactly):
+ *   - alg validation (lives in buildHeader, not validateWire02Header)
+ *   - typ validation (lives in buildHeader)
+ *   - signature verification
+ *   - compact-JWS shape / size checks
+ *
+ * Order is significant: the canonical function returns the FIRST
+ * matching violation per call (it throws on the first hit). The
+ * internal validator emits the same first-hit code.
+ */
+/** Header input shape (matches the parsed JOSE protected header). */
+export type JoseHardeningInput = Record<string, unknown>;
+/**
+ * Normalized result. accepted=true means the header passes all five
+ * hardening checks. accepted=false carries the canonical CryptoError
+ * code emitted by the corresponding canonical check.
+ */
+export type JoseHardeningResult = {
+    readonly accepted: true;
+} | {
+    readonly accepted: false;
+    readonly errorCode: string;
+};
+export declare function validateJoseHardeningInternal(header: JoseHardeningInput): JoseHardeningResult;
+//# sourceMappingURL=jose-hardening.d.ts.map

package/dist/_internal/record-core/validators/jose-hardening.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jose-hardening.d.ts","sourceRoot":"","sources":["../../../../src/_internal/record-core/validators/jose-hardening.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAEH,qEAAqE;AACrE,MAAM,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEzD;;;;GAIG;AACH,MAAM,MAAM,mBAAmB,GAC3B;IAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAA;CAAE,GAC3B;IAAE,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAU7D,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,kBAAkB,GAAG,mBAAmB,CAqC7F"}

package/dist/_internal/record-core/validators/kernel-constraints.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Bounded internal kernel-constraints validator.
+ *
+ * INTERNAL ONLY. This is the parity-observed counterpart of
+ * @peac/schema.validateKernelConstraints; both implementations consume
+ * the same KERNEL_CONSTRAINTS constants from @peac/kernel and emit the
+ * same ConstraintValidationResult shape. The differential parity test
+ * asserts byte-identical equality between the two on every eligible
+ * fixture; any divergence is stop-the-line.
+ *
+ * Existing validation in @peac/schema remains canonical. This module
+ * is observational only; it is NOT re-exported from
+ * packages/protocol/src/index.ts and is NOT wired into runtime paths
+ * (issue.ts, verify-local.ts) in v0.13.1.
+ *
+ * Implementation invariants (must mirror @peac/schema/src/constraints.ts
+ * verbatim; any drift fails the parity test):
+ *   - iterative stack-based traversal (stack-safe; no recursion)
+ *   - every value (primitives, arrays, objects) is pushed and counted as
+ *     a node when popped
+ *   - total-nodes check evaluated FIRST per pop; over-limit pushes the
+ *     violation with the current totalNodes count and breaks (preserves
+ *     first-violation semantics)
+ *   - depth check evaluated SECOND per pop; over-limit pushes a
+ *     violation and continues (no-op for primitives, prevents deeper
+ *     descent for containers)
+ *   - string-length check (primitives only) uses .length (code units)
+ *   - array-length and object-key-count checks pushed BEFORE descending
+ *     into children
+ *   - children pushed in reverse index/key order so traversal visits
+ *     them in original order (LIFO)
+ *   - empty path for root; bracket notation for arrays (`a[0]`); dot
+ *     notation for object keys (`a.b`)
+ *   - returns { valid: violations.length === 0, violations }
+ *   - never throws
+ *   - assumes acyclic input
+ */
+import type { ConstraintValidationResult } from '@peac/schema';
+/**
+ * Validate claims against structural kernel constraints. Mirrors the
+ * canonical implementation in @peac/schema for parity.
+ *
+ * Distinct exported name (validateKernelConstraintsInternal) to avoid
+ * collision with the canonical @peac/schema export when both are
+ * imported into the same parity test file.
+ */
+export declare function validateKernelConstraintsInternal(claims: unknown): ConstraintValidationResult;
+//# sourceMappingURL=kernel-constraints.d.ts.map

package/dist/_internal/record-core/validators/kernel-constraints.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kernel-constraints.d.ts","sourceRoot":"","sources":["../../../../src/_internal/record-core/validators/kernel-constraints.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAGH,OAAO,KAAK,EAAE,0BAA0B,EAAuB,MAAM,cAAc,CAAC;AAEpF;;;;;;;GAOG;AACH,wBAAgB,iCAAiC,CAAC,MAAM,EAAE,OAAO,GAAG,0BAA0B,CA0F7F"}