@peac/protocol 0.13.3 → 0.14.0

package/dist/verify-local.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify-local.d.ts","sourceRoot":"","sources":["../src/verify-local.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,KAAK,sBAAsB,EAAE,KAAK,mBAAmB,EAAQ,MAAM,cAAc,CAAC;AAE3F,OAAO,EAGL,KAAK,YAAY,EAYlB,MAAM,cAAc,CAAC;AAYtB,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AA8B5D;;;;;;;GAOG;AACH,MAAM,MAAM,oBAAoB,GAC5B,qBAAqB,GACrB,kBAAkB,GAClB,wBAAwB,GACxB,WAAW,GACX,iBAAiB,GACjB,kBAAkB,GAClB,oBAAoB,GACpB,mBAAmB,GACnB,sBAAsB,GACtB,eAAe,GACf,yBAAyB,GACzB,4BAA4B,GAC5B,sBAAsB,GAEtB,oBAAoB,GACpB,qBAAqB,GACrB,mBAAmB,GACnB,oBAAoB,GACpB,oBAAoB,GAEpB,yBAAyB,GAEzB,4BAA4B,GAC5B,4BAA4B,GAC5B,YAAY,CAAC;AAEjB;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IAErB;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,sBAAsB,CAAC;IAEpC;;;;;;;;;;;OAWG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,EAAE;QACT,KAAK,CAAC,EAAE,OAAO,qBAAqB,EAAE,qBAAqB,CAAC;QAC5D,SAAS,CAAC,EAAE,OAAO,qBAAqB,EAAE,qBAAqB,EAAE,CAAC;KACnE,CAAC;CACH;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,6BAA6B;IAC7B,KAAK,EAAE,IAAI,CAAC;IACZ,yCAAyC;IACzC,OAAO,EAAE,SAAS,CAAC;IACnB,wCAAwC;IACxC,MAAM,EAAE,YAAY,CAAC;IACrB,oDAAoD;IACpD,GAAG,EAAE,MAAM,CAAC;IACZ,0BAA0B;IAC1B,WAAW,EAAE,KAAK,CAAC;IACnB,uEAAuE;IACvE,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC;;;;;;;;;;;OAWG;IACH,cAAc,EAAE,mBAAmB,CAAC;IAEpC;;;;;;;;;OASG;IACH,QAAQ,EAAE,OAAO,qBAAqB,EAAE,gBAAgB,CAAC;CAC1D;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,0BAA0B;IAC1B,KAAK,EAAE,KAAK,CAAC;IAEb,8DAA8D;IAC9D,IAAI,EAAE,oBAAoB,CAAC;IAE3B,mCAAmC;IACnC,OAAO,EAAE,MAAM,CAAC;IAEhB,+EAA+E;IAC/E,OAAO,CAAC,EAAE;QACR,mFAAmF;QACnF,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,+EAA+E;QAC/E,MAAM,CAAC,EAAE,aAAa,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAC1D;;;WAGG;QACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;QAC/B,oFAAoF;QACpF,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,mGAAmG;QACnG,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,0GAA0G;QAC1G,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,yDAAyD;QACzD,wBAAwB,CAAC,EAAE,MAAM,CAAC;QAClC,kEAAkE;QAClE,mCAAmC,CAAC,EAAE,MAAM,EAAE,CAAC;KAChD,CAAC;CACH;AAED;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG,kBAAkB,GAAG,kBAAkB,CAAC;AA6CxE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAsB,WAAW,CAC/B,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,UAAU,EACrB,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,iBAAiB,CAAC,CA6V5B;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,CAAC,EAAE,iBAAiB,GACnB,CAAC,IAAI,kBAAkB,GAAG;IAAE,OAAO,EAAE,SAAS,CAAA;CAAE,CAGlD;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,CAAC,EAAE,iBAAiB,GACnB,CAAC,IAAI,kBAAkB,GAAG;IAAE,OAAO,EAAE,SAAS,CAAA;CAAE,CAGlD;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,CAAC,EAAE,iBAAiB,GACnB,CAAC,IAAI,kBAAkB,GAAG;IAAE,OAAO,EAAE,SAAS,CAAA;CAAE,CAElD"}
+{"version":3,"file":"verify-local.d.ts","sourceRoot":"","sources":["../src/verify-local.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,KAAK,sBAAsB,EAAE,KAAK,mBAAmB,EAAQ,MAAM,cAAc,CAAC;AAE3F,OAAO,EAGL,KAAK,YAAY,EAYlB,MAAM,cAAc,CAAC;AAatB,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AA8B5D;;;;;;;GAOG;AACH,MAAM,MAAM,oBAAoB,GAC5B,qBAAqB,GACrB,kBAAkB,GAClB,wBAAwB,GACxB,WAAW,GACX,iBAAiB,GACjB,kBAAkB,GAClB,oBAAoB,GACpB,mBAAmB,GACnB,sBAAsB,GACtB,eAAe,GACf,yBAAyB,GACzB,4BAA4B,GAC5B,sBAAsB,GAEtB,oBAAoB,GACpB,qBAAqB,GACrB,mBAAmB,GACnB,oBAAoB,GACpB,oBAAoB,GAEpB,yBAAyB,GAEzB,4BAA4B,GAC5B,4BAA4B,GAC5B,YAAY,CAAC;AAEjB;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IAErB;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,sBAAsB,CAAC;IAEpC;;;;;;;;;;;OAWG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,EAAE;QACT,KAAK,CAAC,EAAE,OAAO,qBAAqB,EAAE,qBAAqB,CAAC;QAC5D,SAAS,CAAC,EAAE,OAAO,qBAAqB,EAAE,qBAAqB,EAAE,CAAC;KACnE,CAAC;CACH;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,6BAA6B;IAC7B,KAAK,EAAE,IAAI,CAAC;IACZ,yCAAyC;IACzC,OAAO,EAAE,SAAS,CAAC;IACnB,wCAAwC;IACxC,MAAM,EAAE,YAAY,CAAC;IACrB,oDAAoD;IACpD,GAAG,EAAE,MAAM,CAAC;IACZ,0BAA0B;IAC1B,WAAW,EAAE,KAAK,CAAC;IACnB,uEAAuE;IACvE,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC;;;;;;;;;;;OAWG;IACH,cAAc,EAAE,mBAAmB,CAAC;IAEpC;;;;;;;;;OASG;IACH,QAAQ,EAAE,OAAO,qBAAqB,EAAE,gBAAgB,CAAC;CAC1D;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,0BAA0B;IAC1B,KAAK,EAAE,KAAK,CAAC;IAEb,8DAA8D;IAC9D,IAAI,EAAE,oBAAoB,CAAC;IAE3B,mCAAmC;IACnC,OAAO,EAAE,MAAM,CAAC;IAEhB,+EAA+E;IAC/E,OAAO,CAAC,EAAE;QACR,mFAAmF;QACnF,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,+EAA+E;QAC/E,MAAM,CAAC,EAAE,aAAa,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAC1D;;;WAGG;QACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;QAC/B,oFAAoF;QACpF,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,mGAAmG;QACnG,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,0GAA0G;QAC1G,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,yDAAyD;QACzD,wBAAwB,CAAC,EAAE,MAAM,CAAC;QAClC,kEAAkE;QAClE,mCAAmC,CAAC,EAAE,MAAM,EAAE,CAAC;KAChD,CAAC;CACH;AAED;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG,kBAAkB,GAAG,kBAAkB,CAAC;AA6CxE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAsB,WAAW,CAC/B,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,UAAU,EACrB,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,iBAAiB,CAAC,CAmZ5B;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,CAAC,EAAE,iBAAiB,GACnB,CAAC,IAAI,kBAAkB,GAAG;IAAE,OAAO,EAAE,SAAS,CAAA;CAAE,CAGlD;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,CAAC,EAAE,iBAAiB,GACnB,CAAC,IAAI,kBAAkB,GAAG;IAAE,OAAO,EAAE,SAAS,CAAA;CAAE,CAGlD;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,CAAC,EAAE,iBAAiB,GACnB,CAAC,IAAI,kBAAkB,GAAG;IAAE,OAAO,EAAE,SAAS,CAAA;CAAE,CAElD"}

package/dist/verify-local.mjs

@@ -338,6 +338,112 @@ function validateExtensionBudgetInternal(extensions) {
   if (violations.length === 0) return ACCEPTED4;
   return { accepted: false, violations };
 }
+function validateSchemaParseInternal(payload) {
+  const pr = parseReceiptClaims(payload);
+  if (!pr.ok) {
+    return {
+      accepted: false,
+      errorCode: pr.error.code,
+      errorMessage: pr.error.message,
+      ...pr.error.issues !== void 0 && { errorIssues: pr.error.issues }
+    };
+  }
+  if (pr.wireVersion !== "0.2") {
+    return {
+      accepted: false,
+      errorCode: "E_UNSUPPORTED_WIRE_VERSION",
+      errorMessage: `Unsupported wire version: ${pr.wireVersion}`
+    };
+  }
+  return {
+    accepted: true,
+    claims: pr.claims,
+    wireVersion: "0.2",
+    warnings: pr.warnings
+  };
+}
+
+// src/_internal/record-core/validators/jose-typ-strictness.ts
+var ACCEPTED_NO_WARN = { accepted: true };
+var ACCEPTED_TYP_MISSING = {
+  accepted: true,
+  warnings: [{ code: "typ_missing" }]
+};
+var REJECTED_INVALID_FORMAT = {
+  accepted: false,
+  errorCode: "E_INVALID_FORMAT"
+};
+function validateJoseTypStrictnessInternal(typ, strictness) {
+  const present = typeof typ === "string" && typ.length > 0;
+  if (present) return ACCEPTED_NO_WARN;
+  if (strictness === "strict") return REJECTED_INVALID_FORMAT;
+  return ACCEPTED_TYP_MISSING;
+}
+
+// src/_internal/record-core/validators/iat-not-yet-valid.ts
+var ACCEPTED5 = { accepted: true };
+var REJECTED2 = {
+  accepted: false,
+  errorCode: "E_NOT_YET_VALID"
+};
+function validateIatNotYetValidInternal(iat, now, maxClockSkew) {
+  if (iat > now + maxClockSkew) return REJECTED2;
+  return ACCEPTED5;
+}
+function validatePolicyBindingInternal(receiptPolicyDigest, localPolicyDigest) {
+  if (receiptPolicyDigest === void 0 || localPolicyDigest === void 0) {
+    return { accepted: true, status: "unavailable" };
+  }
+  const status = verifyPolicyBinding(receiptPolicyDigest, localPolicyDigest);
+  if (status === "failed") {
+    return { accepted: false, errorCode: "E_POLICY_BINDING_FAILED", status };
+  }
+  return { accepted: true, status };
+}
+var ACCEPTED_EMPTY = {
+  accepted: true,
+  warnings: []
+};
+function escapeJsonPointer(token) {
+  return token.replace(/~/g, "~0").replace(/\//g, "~1");
+}
+function validateUnknownExtensionGrammarInternal(extensions) {
+  if (extensions === void 0) return ACCEPTED_EMPTY;
+  const keys = Object.keys(extensions);
+  if (keys.length === 0) return ACCEPTED_EMPTY;
+  const warnings = [];
+  for (const key of keys) {
+    if (!REGISTERED_EXTENSION_GROUP_KEYS.has(key) && isValidExtensionKey(key)) {
+      warnings.push({
+        code: "unknown_extension_preserved",
+        pointer: `/extensions/${escapeJsonPointer(key)}`
+      });
+    }
+  }
+  return { accepted: true, warnings };
+}
+var ACCEPTED_NO_WARN2 = { accepted: true };
+function validateTypeExtensionEnforcementInternal(kind, type, extensions, strictness) {
+  const result = checkTypeExtensionMapping(
+    kind,
+    type,
+    extensions,
+    TYPE_TO_EXTENSION_MAP,
+    REGISTERED_EXTENSION_GROUP_KEYS
+  );
+  if (result.status === "ok" || result.status === "skip") {
+    return ACCEPTED_NO_WARN2;
+  }
+  if (strictness === "strict") {
+    const errorCode = result.status === "missing" ? "E_EXTENSION_GROUP_REQUIRED" : "E_EXTENSION_GROUP_MISMATCH";
+    return { accepted: false, errorCode, pointer: "/type" };
+  }
+  const warningCode = result.status === "missing" ? "extension_group_missing" : "extension_group_mismatch";
+  return {
+    accepted: true,
+    warnings: [{ code: warningCode, pointer: "/type" }]
+  };
+}
 
 // src/_internal/record-core/bounded-validator.ts
 function runBoundedValidatorShadow(input) {
@@ -397,12 +503,139 @@ function runBoundedValidatorShadow(input) {
       violations.push({ layer: "extension-budget", code: v.code, path: v.path });
     }
   }
+  if (input.fullClaims !== void 0) {
+    const schemaRes = validateSchemaParseInternal(input.fullClaims);
+    if (!schemaRes.accepted && schemaRes.errorCode !== void 0) {
+      violations.push({ layer: "schema-parse", code: schemaRes.errorCode });
+    }
+  }
+  if (input.header !== void 0 && input.strictness !== void 0) {
+    const typRes = validateJoseTypStrictnessInternal(input.header.typ, input.strictness);
+    if (!typRes.accepted) {
+      violations.push({ layer: "jose-typ-strictness", code: typRes.errorCode });
+    } else if (typRes.warnings) {
+      for (const w of typRes.warnings) {
+        warnings.push({ layer: "jose-typ-strictness", code: w.code });
+      }
+    }
+  }
+  if (input.maxClockSkew !== void 0) {
+    const iatRes = validateIatNotYetValidInternal(input.claims.iat, input.now, input.maxClockSkew);
+    if (!iatRes.accepted && iatRes.errorCode !== void 0) {
+      violations.push({ layer: "iat-not-yet-valid", code: iatRes.errorCode });
+    }
+  }
+  if (input.receiptPolicyDigest !== void 0 && input.localPolicyDigest !== void 0) {
+    const policyRes = validatePolicyBindingInternal(
+      input.receiptPolicyDigest,
+      input.localPolicyDigest
+    );
+    if (!policyRes.accepted && policyRes.errorCode !== void 0) {
+      violations.push({ layer: "policy-binding", code: policyRes.errorCode });
+    }
+  }
+  const unknownExtRes = validateUnknownExtensionGrammarInternal(input.claims.extensions);
+  for (const w of unknownExtRes.warnings) {
+    warnings.push({
+      layer: "unknown-extension-grammar",
+      code: w.code,
+      path: w.pointer
+    });
+  }
+  if (input.strictness !== void 0) {
+    const enforceRes = validateTypeExtensionEnforcementInternal(
+      input.claims.kind,
+      input.claims.type,
+      input.claims.extensions,
+      input.strictness
+    );
+    if (!enforceRes.accepted) {
+      violations.push({
+        layer: "type-extension-enforcement",
+        code: enforceRes.errorCode,
+        path: enforceRes.pointer
+      });
+    } else if (enforceRes.warnings) {
+      for (const w of enforceRes.warnings) {
+        warnings.push({
+          layer: "type-extension-enforcement",
+          code: w.code,
+          path: w.pointer
+        });
+      }
+    }
+  }
   return {
     accepted: violations.length === 0,
     violations,
     warnings
   };
 }
+var MAX_SANITIZED_ISSUES = 25;
+function sanitizeIssues(issues) {
+  if (!Array.isArray(issues)) return void 0;
+  return issues.slice(0, MAX_SANITIZED_ISSUES).map((issue) => {
+    const candidate = issue;
+    const path = Array.isArray(candidate.path) ? candidate.path.map(
+      (segment) => typeof segment === "string" || typeof segment === "number" ? String(segment) : ""
+    ).join(".") : "";
+    const message = typeof candidate.message === "string" ? candidate.message : String(candidate.message ?? issue);
+    return { path, message };
+  });
+}
+function runBoundedValidationGate(input) {
+  return runVerifyLocal(input.payload);
+}
+function runVerifyLocal(payload) {
+  const kernelRes = validateKernelConstraints(payload);
+  if (!kernelRes.valid) {
+    const v = kernelRes.violations[0];
+    return {
+      ok: false,
+      code: "E_CONSTRAINT_VIOLATION",
+      message: `Kernel constraint violated: ${v.constraint} (actual: ${v.actual}, limit: ${v.limit})`
+    };
+  }
+  const schemaRes = validateSchemaParseInternal(payload);
+  if (!schemaRes.accepted) {
+    if (schemaRes.errorCode === "E_UNSUPPORTED_WIRE_VERSION") {
+      return {
+        ok: false,
+        code: "E_UNSUPPORTED_WIRE_VERSION",
+        message: "Wire 0.1 receipts are not supported. Re-issue as Wire 0.2 using issue()."
+      };
+    }
+    const sanitized = sanitizeIssues(schemaRes.errorIssues);
+    const details = {};
+    if (schemaRes.errorCode !== void 0) {
+      Object.assign(details, { parse_code: schemaRes.errorCode });
+    }
+    if (sanitized !== void 0) {
+      Object.assign(details, { issues: sanitized });
+    }
+    return {
+      ok: false,
+      code: "E_INVALID_FORMAT",
+      message: `Receipt schema validation failed: ${schemaRes.errorMessage ?? "unknown"}`,
+      ...Object.keys(details).length > 0 && { details }
+    };
+  }
+  if (schemaRes.wireVersion !== "0.2" || schemaRes.claims === void 0) {
+    return {
+      ok: false,
+      code: "E_UNSUPPORTED_WIRE_VERSION",
+      message: "Wire 0.1 receipts are not supported. Re-issue as Wire 0.2 using issue()."
+    };
+  }
+  return {
+    ok: true,
+    parsed: {
+      wireVersion: "0.2",
+      claims: schemaRes.claims,
+      parserWarnings: schemaRes.warnings ?? []
+    }
+  };
+}
 var SECRET_PATTERNS = [
   // Compact JWS / JWT (header.payload.signature with eyJ-prefixed header).
   /eyJ[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g,
@@ -682,7 +915,7 @@ function sanitizeParseIssues(issues) {
   }));
 }
 async function verifyLocal(jws, publicKey, options = {}) {
-  void readLegacyPathFlag(options);
+  const legacyPath = readLegacyPathFlag(options);
   const {
     issuer,
     subjectUri,
@@ -715,22 +948,56 @@ async function verifyLocal(jws, publicKey, options = {}) {
         message: "JWS typ header is absent; accepted in interop mode"
       });
     }
-    const constraintResult = validateKernelConstraints(result.payload);
-    if (!constraintResult.valid) {
-      const v = constraintResult.violations[0];
-      return {
-        valid: false,
-        code: "E_CONSTRAINT_VIOLATION",
-        message: `Kernel constraint violated: ${v.constraint} (actual: ${v.actual}, limit: ${v.limit})`
-      };
-    }
-    const pr = parseReceiptClaims(result.payload);
-    if (!pr.ok) {
-      return {
-        valid: false,
-        code: "E_INVALID_FORMAT",
-        message: `Receipt schema validation failed: ${pr.error.message}`,
-        details: { parse_code: pr.error.code, issues: sanitizeParseIssues(pr.error.issues) }
+    let pr;
+    if (legacyPath) {
+      const constraintResult = validateKernelConstraints(result.payload);
+      if (!constraintResult.valid) {
+        const v = constraintResult.violations[0];
+        return {
+          valid: false,
+          code: "E_CONSTRAINT_VIOLATION",
+          message: `Kernel constraint violated: ${v.constraint} (actual: ${v.actual}, limit: ${v.limit})`
+        };
+      }
+      const parsed = parseReceiptClaims(result.payload);
+      if (!parsed.ok) {
+        return {
+          valid: false,
+          code: "E_INVALID_FORMAT",
+          message: `Receipt schema validation failed: ${parsed.error.message}`,
+          details: {
+            parse_code: parsed.error.code,
+            issues: sanitizeParseIssues(parsed.error.issues)
+          }
+        };
+      }
+      pr = parsed;
+    } else {
+      const gateResult = runBoundedValidationGate({
+        surface: "verifyLocal",
+        payload: result.payload
+      });
+      if (!gateResult.ok) {
+        return {
+          valid: false,
+          code: gateResult.code,
+          message: gateResult.message,
+          ...gateResult.details !== void 0 && { details: gateResult.details }
+        };
+      }
+      const parsedFromGate = gateResult.parsed;
+      if (parsedFromGate === void 0) {
+        return {
+          valid: false,
+          code: "E_INTERNAL",
+          message: "Bounded validation gate accepted without surfacing parsed claims"
+        };
+      }
+      pr = {
+        ok: true,
+        wireVersion: parsedFromGate.wireVersion,
+        warnings: parsedFromGate.parserWarnings,
+        claims: parsedFromGate.claims
       };
     }
     if (pr.wireVersion === "0.2") {
@@ -847,7 +1114,7 @@ async function verifyLocal(jws, publicKey, options = {}) {
         ...callerBindings?.documents !== void 0 && callerBindings.documents.length > 0 && { documents: callerBindings.documents }
       };
       const sortedWarnings = sortWarnings(accumulatedWarnings);
-      if (isShadowEnabled(options)) {
+      if (legacyPath && isShadowEnabled(options)) {
         const headerSnapshot = { ...result.header };
         scheduleShadow({
           call: "verifyLocal",