@peac/protocol 0.13.4 → 0.14.0

package/dist/_internal/record-core/validation-gate.d.ts

@@ -0,0 +1,102 @@
+/**
+ * Production-facing bounded validation gate.
+ *
+ * INTERNAL ONLY. Not re-exported from `packages/protocol/src/index.ts`.
+ *
+ * The gate is the only production wrapper for the bounded validation
+ * path. The pre-existing `runBoundedValidatorShadow` from
+ * `bounded-validator.ts` remains the entry point for shadow / corpus
+ * / parity-harness consumers and is not the primary admission path
+ * for the protocol entry points; the production-wrapper boundary is
+ * enforced by `tests/tooling/production-gate-boundary.test.ts`.
+ *
+ * The gate is entrypoint-aware: callers identify themselves with a
+ * `surface` discriminator, and the gate applies a per-surface
+ * production projection allowlist. Layers in the bounded validator's
+ * broader composition that fall outside the allowlist for a given
+ * surface stay available to shadow / parity tests through
+ * `runBoundedValidatorShadow` but are not surfaced as production
+ * failure or production warning here.
+ *
+ * Allowlist for surface 'issueWire02':
+ *   - schema-parse only.
+ *
+ * Allowlist for surface 'verifyLocal':
+ *   - kernel-constraints (via canonical `validateKernelConstraints`).
+ *   - schema-parse (via the extended `validateSchemaParseInternal`).
+ *
+ * Out of scope here (kept inline-canonical on both branches by the
+ * caller): caller-option-bearing checks (issuer mismatch, subjectUri
+ * mismatch, policyDigest format), strictness routing for missing typ,
+ * iat-not-yet-valid, occurred_at temporal, type-extension warnings,
+ * type-extension enforcement, policy-binding compute, bindings
+ * construction, sortWarnings.
+ *
+ * The canonical materializer (claim encoding, JWS signing, JWS
+ * decoding, result-shape construction) is shared between the
+ * bounded-default and rollback branches and is not touched by the
+ * gate.
+ */
+import type { VerificationWarning } from '@peac/kernel';
+import type { Wire02Claims } from '@peac/schema';
+/**
+ * Discriminator identifying which protocol entry point invoked the
+ * gate. Drives the production projection allowlist. Adding a third
+ * surface requires a deliberate plan amendment, not an unannounced
+ * source change.
+ */
+export type GateSurface = 'issueWire02' | 'verifyLocal';
+/** Sanitized parse-issue projection surfaced on rejection. */
+export interface SanitizedParseIssue {
+    readonly path: string;
+    readonly message: string;
+}
+/** Parsed-claims projection surfaced on `verifyLocal` acceptance. */
+export interface ValidationGateParsed {
+    readonly wireVersion: '0.2';
+    readonly claims: Wire02Claims;
+    readonly parserWarnings: readonly VerificationWarning[];
+}
+/** Failure-detail projection. Smaller than the bounded layer set. */
+export interface ValidationGateFailureDetails {
+    readonly parse_code?: string;
+    readonly issues?: readonly SanitizedParseIssue[];
+}
+/** Successful gate result. */
+export interface ValidationGateSuccess {
+    readonly ok: true;
+    readonly parsed?: ValidationGateParsed;
+}
+/** Failed gate result. */
+export interface ValidationGateFailure {
+    readonly ok: false;
+    readonly code: string;
+    readonly message: string;
+    readonly details?: ValidationGateFailureDetails;
+}
+export type ValidationGateResult = ValidationGateSuccess | ValidationGateFailure;
+/** Inputs to the gate. Only `surface` and `payload` are required. */
+export interface ValidationGateInput {
+    readonly surface: GateSurface;
+    /**
+     * Full claims object. For surface 'issueWire02' this is the just-
+     * constructed `Wire02Claims` cast to a plain record (the same
+     * object that today flows through `Wire02ClaimsSchema.safeParse`).
+     * For surface 'verifyLocal' this is the decoded JWS payload (the
+     * same object that today flows through `validateKernelConstraints`
+     * and `parseReceiptClaims`).
+     */
+    readonly payload: unknown;
+}
+/**
+ * Run the production projection of the bounded validation path.
+ *
+ * Behavior is byte-equivalent to the inline canonical sequences at
+ * `issue.ts` and `verify-local.ts` for every input on the covered
+ * runtime matrix. Any cross-branch divergence on JWS bytes, result
+ * shape, error code, warning order, thrown error class, success /
+ * failure classification, or observable default behavior is a
+ * validation-equivalence regression.
+ */
+export declare function runBoundedValidationGate(input: ValidationGateInput): ValidationGateResult;
+//# sourceMappingURL=validation-gate.d.ts.map

package/dist/_internal/record-core/validation-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation-gate.d.ts","sourceRoot":"","sources":["../../../src/_internal/record-core/validation-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAGH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAGjD;;;;;GAKG;AACH,MAAM,MAAM,WAAW,GAAG,aAAa,GAAG,aAAa,CAAC;AAExD,8DAA8D;AAC9D,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,qEAAqE;AACrE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,cAAc,EAAE,SAAS,mBAAmB,EAAE,CAAC;CACzD;AAED,qEAAqE;AACrE,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;CAClD;AAED,8BAA8B;AAC9B,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,MAAM,CAAC,EAAE,oBAAoB,CAAC;CACxC;AAED,0BAA0B;AAC1B,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,4BAA4B,CAAC;CACjD;AAED,MAAM,MAAM,oBAAoB,GAAG,qBAAqB,GAAG,qBAAqB,CAAC;AAEjF,qEAAqE;AACrE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B;;;;;;;OAOG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAwBD;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,mBAAmB,GAAG,oBAAoB,CAKzF"}

package/dist/_internal/record-core/validators/schema-parse.d.ts

@@ -1,42 +1,72 @@
 /**
- * Bounded internal schema-parse validator (canonical-composed).
+ * Bounded internal schema-parse validator.
  *
  * INTERNAL ONLY. Thin wrapper around the canonical
- * `parseReceiptClaims` from `@peac/schema`, projecting the canonical
- * result into the bounded validator's normalized shape. The wrapper
- * has no decision logic of its own: it delegates the parse, then
- * surfaces the canonical accept/reject and the canonical error code.
+ * `parseReceiptClaims` from `@peac/schema`. Projects the canonical
+ * accept/reject signal plus the full canonical projection (parsed
+ * claims, parser warnings, canonical error triple) so production
+ * callers can reproduce the canonical surface byte-equally without
+ * re-invoking `parseReceiptClaims`.
  *
- * This is observational equivalence by construction, not a divergent
- * parser. The layer boundary allows an alternate implementation
- * without changing callers; the input/output shape is stable enough
- * for a drop-in replacement should rigorous cross-implementation
- * parity beyond observational evidence be required.
- *
- * Module is observational only; not re-exported from
- * `packages/protocol/src/index.ts` and not wired into the public
- * runtime path.
+ * Module is internal-only; not re-exported from
+ * `packages/protocol/src/index.ts`.
  *
  * SCOPE:
  *   - Run `parseReceiptClaims(payload)` and surface its accept/reject.
- *   - On rejection, surface `pr.error.code` (canonical parse-error code)
- *     so the candidate's error taxonomy matches the canonical's.
- *   - On acceptance, no warnings are surfaced from this layer; parser
- *     warnings (e.g., `type_unregistered`, `unknown_extension_preserved`)
- *     are emitted by the canonical parser and consumed at higher layers
- *     (verifyLocal warning aggregation).
+ *   - On acceptance: surface `wireVersion`, parsed `claims`, and
+ *     parser `warnings` (e.g., `type_unregistered`,
+ *     `unknown_extension_preserved`). Higher-layer aggregation merges
+ *     these into the caller's warning array.
+ *   - On rejection: surface the canonical error triple
+ *     (`errorCode`, `errorMessage`, `errorIssues`) so callers can
+ *     project the canonical `details: { parse_code, issues }` and
+ *     `message: 'Receipt schema validation failed: <message>'`
+ *     surface byte-equally.
  */
+import type { ZodError } from 'zod';
+import type { VerificationWarning } from '@peac/kernel';
 import type { Wire02Claims } from '@peac/schema';
 export interface SchemaParseResult {
     readonly accepted: boolean;
+    /**
+     * Canonical parse-error code from `parseReceiptClaims` when the
+     * parse rejects. Mirrors `pr.error.code`.
+     */
     readonly errorCode?: string;
+    /**
+     * Canonical parse-error message from `parseReceiptClaims` when the
+     * parse rejects. Mirrors `pr.error.message`. Required for callers
+     * that reproduce the canonical surface message
+     * `Receipt schema validation failed: <message>` byte-equally.
+     */
+    readonly errorMessage?: string;
+    /**
+     * Canonical parse-error issues from `parseReceiptClaims` when the
+     * parse rejects. Mirrors `pr.error.issues`. Callers downstream
+     * apply their own bounded sanitization (path-join, length cap)
+     * before surfacing on a public verifier-result `details` payload.
+     */
+    readonly errorIssues?: ZodError['issues'];
     /**
      * Parsed Wire 0.2 claims when accepted. Internal-only; does not
-     * appear on any emitted record or public surface. Callers that need
-     * a typed view of the parsed claims read this field; callers that
-     * only need the accept/reject signal ignore it.
+     * appear on any emitted record or public surface.
      */
     readonly claims?: Wire02Claims;
+    /**
+     * Wire version surfaced from `parseReceiptClaims` on acceptance.
+     * The bounded surface only admits `'0.2'`; Wire 0.1 acceptance from
+     * the canonical parser is rejected at this layer with
+     * `E_UNSUPPORTED_WIRE_VERSION` because the bounded composition is
+     * keyed on Wire 0.2 claim shapes.
+     */
+    readonly wireVersion?: '0.2';
+    /**
+     * Parser warnings surfaced on acceptance. Mirrors `pr.warnings` for
+     * Wire 0.2 acceptance. Callers that aggregate into a single
+     * canonical warning array merge this list at the canonical-equivalent
+     * flow position before the canonical sort.
+     */
+    readonly warnings?: readonly VerificationWarning[];
 }
 export declare function validateSchemaParseInternal(payload: unknown): SchemaParseResult;
 //# sourceMappingURL=schema-parse.d.ts.map

package/dist/_internal/record-core/validators/schema-parse.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema-parse.d.ts","sourceRoot":"","sources":["../../../../src/_internal/record-core/validators/schema-parse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEjD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,OAAO,GAAG,iBAAiB,CAS/E"}
+{"version":3,"file":"schema-parse.d.ts","sourceRoot":"","sources":["../../../../src/_internal/record-core/validators/schema-parse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,KAAK,CAAC;AACpC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAExD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEjD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC1C;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,KAAK,CAAC;IAC7B;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;CACpD;AAED,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,OAAO,GAAG,iBAAiB,CAuB/E"}

package/dist/index.cjs

@@ -314,12 +314,26 @@ function validateExtensionBudgetInternal(extensions) {
 function validateSchemaParseInternal(payload) {
   const pr = schema.parseReceiptClaims(payload);
   if (!pr.ok) {
-    return { accepted: false, errorCode: pr.error.code };
+    return {
+      accepted: false,
+      errorCode: pr.error.code,
+      errorMessage: pr.error.message,
+      ...pr.error.issues !== void 0 && { errorIssues: pr.error.issues }
+    };
   }
   if (pr.wireVersion !== "0.2") {
-    return { accepted: false, errorCode: "E_UNSUPPORTED_WIRE_VERSION" };
+    return {
+      accepted: false,
+      errorCode: "E_UNSUPPORTED_WIRE_VERSION",
+      errorMessage: `Unsupported wire version: ${pr.wireVersion}`
+    };
   }
-  return { accepted: true, claims: pr.claims };
+  return {
+    accepted: true,
+    claims: pr.claims,
+    wireVersion: "0.2",
+    warnings: pr.warnings
+  };
 }
 
 // src/_internal/record-core/validators/jose-typ-strictness.ts
@@ -559,6 +573,86 @@ function runBoundedValidatorShadow(input) {
     warnings
   };
 }
+var MAX_SANITIZED_ISSUES = 25;
+function sanitizeIssues(issues) {
+  if (!Array.isArray(issues)) return void 0;
+  return issues.slice(0, MAX_SANITIZED_ISSUES).map((issue2) => {
+    const candidate = issue2;
+    const path = Array.isArray(candidate.path) ? candidate.path.map(
+      (segment) => typeof segment === "string" || typeof segment === "number" ? String(segment) : ""
+    ).join(".") : "";
+    const message = typeof candidate.message === "string" ? candidate.message : String(candidate.message ?? issue2);
+    return { path, message };
+  });
+}
+function runBoundedValidationGate(input) {
+  if (input.surface === "issueWire02") {
+    return runIssueWire02(input.payload);
+  }
+  return runVerifyLocal(input.payload);
+}
+function runIssueWire02(payload) {
+  const schemaRes = validateSchemaParseInternal(payload);
+  if (!schemaRes.accepted) {
+    const firstIssueMessage = schemaRes.errorIssues?.[0]?.message;
+    return {
+      ok: false,
+      code: "E_INVALID_FORMAT",
+      message: `Wire 0.2 claims schema validation failed: ${firstIssueMessage ?? "unknown"}`
+    };
+  }
+  return { ok: true };
+}
+function runVerifyLocal(payload) {
+  const kernelRes = schema.validateKernelConstraints(payload);
+  if (!kernelRes.valid) {
+    const v = kernelRes.violations[0];
+    return {
+      ok: false,
+      code: "E_CONSTRAINT_VIOLATION",
+      message: `Kernel constraint violated: ${v.constraint} (actual: ${v.actual}, limit: ${v.limit})`
+    };
+  }
+  const schemaRes = validateSchemaParseInternal(payload);
+  if (!schemaRes.accepted) {
+    if (schemaRes.errorCode === "E_UNSUPPORTED_WIRE_VERSION") {
+      return {
+        ok: false,
+        code: "E_UNSUPPORTED_WIRE_VERSION",
+        message: "Wire 0.1 receipts are not supported. Re-issue as Wire 0.2 using issue()."
+      };
+    }
+    const sanitized = sanitizeIssues(schemaRes.errorIssues);
+    const details = {};
+    if (schemaRes.errorCode !== void 0) {
+      Object.assign(details, { parse_code: schemaRes.errorCode });
+    }
+    if (sanitized !== void 0) {
+      Object.assign(details, { issues: sanitized });
+    }
+    return {
+      ok: false,
+      code: "E_INVALID_FORMAT",
+      message: `Receipt schema validation failed: ${schemaRes.errorMessage ?? "unknown"}`,
+      ...Object.keys(details).length > 0 && { details }
+    };
+  }
+  if (schemaRes.wireVersion !== "0.2" || schemaRes.claims === void 0) {
+    return {
+      ok: false,
+      code: "E_UNSUPPORTED_WIRE_VERSION",
+      message: "Wire 0.1 receipts are not supported. Re-issue as Wire 0.2 using issue()."
+    };
+  }
+  return {
+    ok: true,
+    parsed: {
+      wireVersion: "0.2",
+      claims: schemaRes.claims,
+      parserWarnings: schemaRes.warnings ?? []
+    }
+  };
+}
 var SECRET_PATTERNS = [
   // Compact JWS / JWT (header.payload.signature with eyJ-prefixed header).
   /eyJ[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g,
@@ -996,7 +1090,7 @@ async function issue(options) {
   return issueWire02(options);
 }
 async function issueWire02(options) {
-  void readLegacyPathFlag(options);
+  const legacyPath = readLegacyPathFlag(options);
   if (!schema.isCanonicalIss(options.iss)) {
     throw new IssueError({
       code: "E_ISS_NOT_CANONICAL",
@@ -1025,22 +1119,39 @@ async function issueWire02(options) {
     ...options.policy !== void 0 && { policy: options.policy },
     ...options.extensions !== void 0 && { extensions: options.extensions }
   };
-  const parseResult = schema.Wire02ClaimsSchema.safeParse(claims);
-  if (!parseResult.success) {
-    const firstIssue = parseResult.error.issues[0];
-    throw new IssueError({
-      code: "E_INVALID_FORMAT",
-      category: "validation",
-      severity: "error",
-      retryable: false,
-      http_status: 400,
-      details: {
-        message: `Wire 0.2 claims schema validation failed: ${firstIssue?.message ?? "unknown"}`
-      }
+  if (legacyPath) {
+    const parseResult = schema.Wire02ClaimsSchema.safeParse(claims);
+    if (!parseResult.success) {
+      const firstIssue = parseResult.error.issues[0];
+      throw new IssueError({
+        code: "E_INVALID_FORMAT",
+        category: "validation",
+        severity: "error",
+        retryable: false,
+        http_status: 400,
+        details: {
+          message: `Wire 0.2 claims schema validation failed: ${firstIssue?.message ?? "unknown"}`
+        }
+      });
+    }
+  } else {
+    const gateResult = runBoundedValidationGate({
+      surface: "issueWire02",
+      payload: claims
     });
+    if (!gateResult.ok) {
+      throw new IssueError({
+        code: gateResult.code,
+        category: "validation",
+        severity: "error",
+        retryable: false,
+        http_status: 400,
+        details: { message: gateResult.message }
+      });
+    }
   }
   const jws = await defaultCodec.encode(claims, options.privateKey, options.kid);
-  if (isShadowEnabled(options)) {
+  if (legacyPath && isShadowEnabled(options)) {
     scheduleShadow({
       call: "issue",
       realResult: realObservationForIssue(),
@@ -2277,7 +2388,7 @@ function sanitizeParseIssues(issues) {
   }));
 }
 async function verifyLocal(jws, publicKey, options = {}) {
-  void readLegacyPathFlag(options);
+  const legacyPath = readLegacyPathFlag(options);
   const {
     issuer,
     subjectUri,
@@ -2310,22 +2421,56 @@ async function verifyLocal(jws, publicKey, options = {}) {
         message: "JWS typ header is absent; accepted in interop mode"
       });
     }
-    const constraintResult = schema.validateKernelConstraints(result.payload);
-    if (!constraintResult.valid) {
-      const v = constraintResult.violations[0];
-      return {
-        valid: false,
-        code: "E_CONSTRAINT_VIOLATION",
-        message: `Kernel constraint violated: ${v.constraint} (actual: ${v.actual}, limit: ${v.limit})`
-      };
-    }
-    const pr = schema.parseReceiptClaims(result.payload);
-    if (!pr.ok) {
-      return {
-        valid: false,
-        code: "E_INVALID_FORMAT",
-        message: `Receipt schema validation failed: ${pr.error.message}`,
-        details: { parse_code: pr.error.code, issues: sanitizeParseIssues(pr.error.issues) }
+    let pr;
+    if (legacyPath) {
+      const constraintResult = schema.validateKernelConstraints(result.payload);
+      if (!constraintResult.valid) {
+        const v = constraintResult.violations[0];
+        return {
+          valid: false,
+          code: "E_CONSTRAINT_VIOLATION",
+          message: `Kernel constraint violated: ${v.constraint} (actual: ${v.actual}, limit: ${v.limit})`
+        };
+      }
+      const parsed = schema.parseReceiptClaims(result.payload);
+      if (!parsed.ok) {
+        return {
+          valid: false,
+          code: "E_INVALID_FORMAT",
+          message: `Receipt schema validation failed: ${parsed.error.message}`,
+          details: {
+            parse_code: parsed.error.code,
+            issues: sanitizeParseIssues(parsed.error.issues)
+          }
+        };
+      }
+      pr = parsed;
+    } else {
+      const gateResult = runBoundedValidationGate({
+        surface: "verifyLocal",
+        payload: result.payload
+      });
+      if (!gateResult.ok) {
+        return {
+          valid: false,
+          code: gateResult.code,
+          message: gateResult.message,
+          ...gateResult.details !== void 0 && { details: gateResult.details }
+        };
+      }
+      const parsedFromGate = gateResult.parsed;
+      if (parsedFromGate === void 0) {
+        return {
+          valid: false,
+          code: "E_INTERNAL",
+          message: "Bounded validation gate accepted without surfacing parsed claims"
+        };
+      }
+      pr = {
+        ok: true,
+        wireVersion: parsedFromGate.wireVersion,
+        warnings: parsedFromGate.parserWarnings,
+        claims: parsedFromGate.claims
       };
     }
     if (pr.wireVersion === "0.2") {
@@ -2442,7 +2587,7 @@ async function verifyLocal(jws, publicKey, options = {}) {
         ...callerBindings?.documents !== void 0 && callerBindings.documents.length > 0 && { documents: callerBindings.documents }
       };
       const sortedWarnings = schema.sortWarnings(accumulatedWarnings);
-      if (isShadowEnabled(options)) {
+      if (legacyPath && isShadowEnabled(options)) {
         const headerSnapshot = { ...result.header };
         scheduleShadow({
           call: "verifyLocal",