@peac/protocol 0.13.4 → 0.14.0

package/dist/issue.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"issue.d.ts","sourceRoot":"","sources":["../src/issue.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAaH,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3E,OAAO,EACL,iBAAiB,EAEjB,sBAAsB,EAOtB,KAAK,SAAS,EACd,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAKlB,KAAK,eAAe,EAQrB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAkC,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEpF;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,4BAA4B;IAC5B,GAAG,EAAE,MAAM,CAAC;IAEZ,yCAAyC;IACzC,GAAG,EAAE,MAAM,CAAC;IAEZ,uCAAuC;IACvC,GAAG,EAAE,MAAM,CAAC;IAEZ,yCAAyC;IACzC,GAAG,EAAE,MAAM,CAAC;IAEZ,8BAA8B;IAC9B,IAAI,EAAE,MAAM,CAAC;IAEb,sCAAsC;IACtC,SAAS,EAAE,MAAM,CAAC;IAElB,4FAA4F;IAC5F,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,0DAA0D;IAC1D,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAEtB,4DAA4D;IAC5D,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,uCAAuC;IACvC,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB,oFAAoF;IACpF,QAAQ,CAAC,EAAE,SAAS,CAAC;IAErB,iCAAiC;IACjC,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB,wCAAwC;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEnC,6BAA6B;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,4BAA4B;IAC5B,GAAG,CAAC,EAAE,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAE/B,gDAAgD;IAChD,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,iEAAiE;IACjE,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IAE1C;;;;;OAKG;IACH,OAAO,CAAC,EAAE,YAAY,GAAG,YAAY,EAAE,CAAC;IAExC;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAEpC;;;;OAIG;IACH,cAAc,CAAC,EAAE,aAAa,CAAC;IAE/B;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,eAAe,CAAC;IAEnC,qCAAqC;IACrC,UAAU,EAAE,UAAU,CAAC;IAEvB,kCAAkC;IAClC,GAAG,EAAE,MAAM,CAAC;IAEZ,iDAAiD;IACjD,SAAS,CAAC,EAAE,aAAa,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,gCAAgC;IAChC,GAAG,EAAE,MAAM,CAAC;IAEZ,+CAA+C;IAC/C,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;CAC3C;AAED;;;;GAIG;AACH,qBAAa,UAAW,SAAQ,KAAK;IACnC,+BAA+B;IAC/B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;gBAElB,SAAS,EAAE,SAAS;CAMjC;AAED;;;;;;;;;GASG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,WAAW,CAAC,CAmLnF;AAED;;;;;;;GAOG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CAG3E;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,KAAK,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,WAAW,CAAC,CAE7E;AAMD;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAC;IAEZ,iDAAiD;IACjD,IAAI,EAAE,UAAU,GAAG,WAAW,CAAC;IAE/B;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb,qCAAqC;IACrC,UAAU,EAAE,UAAU,CAAC;IAEvB,sDAAsD;IACtD,GAAG,EAAE,MAAM,CAAC;IAEZ;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,oDAAoD;IACpD,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,OAAO,CAAC,EAAE,cAAc,EAAE,CAAC;IAE3B;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,wDAAwD;IACxD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B;;;OAGG;IACH,MAAM,CAAC,EAAE,WAAW,CAAC;IAErB,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC;AAED;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,kBAAkB,CAAC;AAE9C;;;;;;;;;;;;;GAaG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,WAAW,CAAC,CAwFnF"}
+{"version":3,"file":"issue.d.ts","sourceRoot":"","sources":["../src/issue.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAcH,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3E,OAAO,EACL,iBAAiB,EAEjB,sBAAsB,EAOtB,KAAK,SAAS,EACd,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAKlB,KAAK,eAAe,EAQrB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAkC,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEpF;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,4BAA4B;IAC5B,GAAG,EAAE,MAAM,CAAC;IAEZ,yCAAyC;IACzC,GAAG,EAAE,MAAM,CAAC;IAEZ,uCAAuC;IACvC,GAAG,EAAE,MAAM,CAAC;IAEZ,yCAAyC;IACzC,GAAG,EAAE,MAAM,CAAC;IAEZ,8BAA8B;IAC9B,IAAI,EAAE,MAAM,CAAC;IAEb,sCAAsC;IACtC,SAAS,EAAE,MAAM,CAAC;IAElB,4FAA4F;IAC5F,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,0DAA0D;IAC1D,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAEtB,4DAA4D;IAC5D,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,uCAAuC;IACvC,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB,oFAAoF;IACpF,QAAQ,CAAC,EAAE,SAAS,CAAC;IAErB,iCAAiC;IACjC,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB,wCAAwC;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEnC,6BAA6B;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,4BAA4B;IAC5B,GAAG,CAAC,EAAE,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAE/B,gDAAgD;IAChD,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,iEAAiE;IACjE,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IAE1C;;;;;OAKG;IACH,OAAO,CAAC,EAAE,YAAY,GAAG,YAAY,EAAE,CAAC;IAExC;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAEpC;;;;OAIG;IACH,cAAc,CAAC,EAAE,aAAa,CAAC;IAE/B;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,eAAe,CAAC;IAEnC,qCAAqC;IACrC,UAAU,EAAE,UAAU,CAAC;IAEvB,kCAAkC;IAClC,GAAG,EAAE,MAAM,CAAC;IAEZ,iDAAiD;IACjD,SAAS,CAAC,EAAE,aAAa,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,gCAAgC;IAChC,GAAG,EAAE,MAAM,CAAC;IAEZ,+CAA+C;IAC/C,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;CAC3C;AAED;;;;GAIG;AACH,qBAAa,UAAW,SAAQ,KAAK;IACnC,+BAA+B;IAC/B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;gBAElB,SAAS,EAAE,SAAS;CAMjC;AAED;;;;;;;;;GASG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,WAAW,CAAC,CAmLnF;AAED;;;;;;;GAOG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CAG3E;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,KAAK,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,WAAW,CAAC,CAE7E;AAMD;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAC;IAEZ,iDAAiD;IACjD,IAAI,EAAE,UAAU,GAAG,WAAW,CAAC;IAE/B;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb,qCAAqC;IACrC,UAAU,EAAE,UAAU,CAAC;IAEvB,sDAAsD;IACtD,GAAG,EAAE,MAAM,CAAC;IAEZ;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,oDAAoD;IACpD,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,OAAO,CAAC,EAAE,cAAc,EAAE,CAAC;IAE3B;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,wDAAwD;IACxD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B;;;OAGG;IACH,MAAM,CAAC,EAAE,WAAW,CAAC;IAErB,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC;AAED;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,kBAAkB,CAAC;AAE9C;;;;;;;;;;;;;GAaG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,WAAW,CAAC,CAkHnF"}

package/dist/verify-local.cjs

@@ -343,12 +343,26 @@ function validateExtensionBudgetInternal(extensions) {
 function validateSchemaParseInternal(payload) {
   const pr = schema.parseReceiptClaims(payload);
   if (!pr.ok) {
-    return { accepted: false, errorCode: pr.error.code };
+    return {
+      accepted: false,
+      errorCode: pr.error.code,
+      errorMessage: pr.error.message,
+      ...pr.error.issues !== void 0 && { errorIssues: pr.error.issues }
+    };
   }
   if (pr.wireVersion !== "0.2") {
-    return { accepted: false, errorCode: "E_UNSUPPORTED_WIRE_VERSION" };
+    return {
+      accepted: false,
+      errorCode: "E_UNSUPPORTED_WIRE_VERSION",
+      errorMessage: `Unsupported wire version: ${pr.wireVersion}`
+    };
   }
-  return { accepted: true, claims: pr.claims };
+  return {
+    accepted: true,
+    claims: pr.claims,
+    wireVersion: "0.2",
+    warnings: pr.warnings
+  };
 }
 
 // src/_internal/record-core/validators/jose-typ-strictness.ts
@@ -559,6 +573,71 @@ function runBoundedValidatorShadow(input) {
     warnings
   };
 }
+var MAX_SANITIZED_ISSUES = 25;
+function sanitizeIssues(issues) {
+  if (!Array.isArray(issues)) return void 0;
+  return issues.slice(0, MAX_SANITIZED_ISSUES).map((issue) => {
+    const candidate = issue;
+    const path = Array.isArray(candidate.path) ? candidate.path.map(
+      (segment) => typeof segment === "string" || typeof segment === "number" ? String(segment) : ""
+    ).join(".") : "";
+    const message = typeof candidate.message === "string" ? candidate.message : String(candidate.message ?? issue);
+    return { path, message };
+  });
+}
+function runBoundedValidationGate(input) {
+  return runVerifyLocal(input.payload);
+}
+function runVerifyLocal(payload) {
+  const kernelRes = schema.validateKernelConstraints(payload);
+  if (!kernelRes.valid) {
+    const v = kernelRes.violations[0];
+    return {
+      ok: false,
+      code: "E_CONSTRAINT_VIOLATION",
+      message: `Kernel constraint violated: ${v.constraint} (actual: ${v.actual}, limit: ${v.limit})`
+    };
+  }
+  const schemaRes = validateSchemaParseInternal(payload);
+  if (!schemaRes.accepted) {
+    if (schemaRes.errorCode === "E_UNSUPPORTED_WIRE_VERSION") {
+      return {
+        ok: false,
+        code: "E_UNSUPPORTED_WIRE_VERSION",
+        message: "Wire 0.1 receipts are not supported. Re-issue as Wire 0.2 using issue()."
+      };
+    }
+    const sanitized = sanitizeIssues(schemaRes.errorIssues);
+    const details = {};
+    if (schemaRes.errorCode !== void 0) {
+      Object.assign(details, { parse_code: schemaRes.errorCode });
+    }
+    if (sanitized !== void 0) {
+      Object.assign(details, { issues: sanitized });
+    }
+    return {
+      ok: false,
+      code: "E_INVALID_FORMAT",
+      message: `Receipt schema validation failed: ${schemaRes.errorMessage ?? "unknown"}`,
+      ...Object.keys(details).length > 0 && { details }
+    };
+  }
+  if (schemaRes.wireVersion !== "0.2" || schemaRes.claims === void 0) {
+    return {
+      ok: false,
+      code: "E_UNSUPPORTED_WIRE_VERSION",
+      message: "Wire 0.1 receipts are not supported. Re-issue as Wire 0.2 using issue()."
+    };
+  }
+  return {
+    ok: true,
+    parsed: {
+      wireVersion: "0.2",
+      claims: schemaRes.claims,
+      parserWarnings: schemaRes.warnings ?? []
+    }
+  };
+}
 var SECRET_PATTERNS = [
   // Compact JWS / JWT (header.payload.signature with eyJ-prefixed header).
   /eyJ[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g,
@@ -838,7 +917,7 @@ function sanitizeParseIssues(issues) {
   }));
 }
 async function verifyLocal(jws, publicKey, options = {}) {
-  void readLegacyPathFlag(options);
+  const legacyPath = readLegacyPathFlag(options);
   const {
     issuer,
     subjectUri,
@@ -871,22 +950,56 @@ async function verifyLocal(jws, publicKey, options = {}) {
         message: "JWS typ header is absent; accepted in interop mode"
       });
     }
-    const constraintResult = schema.validateKernelConstraints(result.payload);
-    if (!constraintResult.valid) {
-      const v = constraintResult.violations[0];
-      return {
-        valid: false,
-        code: "E_CONSTRAINT_VIOLATION",
-        message: `Kernel constraint violated: ${v.constraint} (actual: ${v.actual}, limit: ${v.limit})`
-      };
-    }
-    const pr = schema.parseReceiptClaims(result.payload);
-    if (!pr.ok) {
-      return {
-        valid: false,
-        code: "E_INVALID_FORMAT",
-        message: `Receipt schema validation failed: ${pr.error.message}`,
-        details: { parse_code: pr.error.code, issues: sanitizeParseIssues(pr.error.issues) }
+    let pr;
+    if (legacyPath) {
+      const constraintResult = schema.validateKernelConstraints(result.payload);
+      if (!constraintResult.valid) {
+        const v = constraintResult.violations[0];
+        return {
+          valid: false,
+          code: "E_CONSTRAINT_VIOLATION",
+          message: `Kernel constraint violated: ${v.constraint} (actual: ${v.actual}, limit: ${v.limit})`
+        };
+      }
+      const parsed = schema.parseReceiptClaims(result.payload);
+      if (!parsed.ok) {
+        return {
+          valid: false,
+          code: "E_INVALID_FORMAT",
+          message: `Receipt schema validation failed: ${parsed.error.message}`,
+          details: {
+            parse_code: parsed.error.code,
+            issues: sanitizeParseIssues(parsed.error.issues)
+          }
+        };
+      }
+      pr = parsed;
+    } else {
+      const gateResult = runBoundedValidationGate({
+        surface: "verifyLocal",
+        payload: result.payload
+      });
+      if (!gateResult.ok) {
+        return {
+          valid: false,
+          code: gateResult.code,
+          message: gateResult.message,
+          ...gateResult.details !== void 0 && { details: gateResult.details }
+        };
+      }
+      const parsedFromGate = gateResult.parsed;
+      if (parsedFromGate === void 0) {
+        return {
+          valid: false,
+          code: "E_INTERNAL",
+          message: "Bounded validation gate accepted without surfacing parsed claims"
+        };
+      }
+      pr = {
+        ok: true,
+        wireVersion: parsedFromGate.wireVersion,
+        warnings: parsedFromGate.parserWarnings,
+        claims: parsedFromGate.claims
       };
     }
     if (pr.wireVersion === "0.2") {
@@ -1003,7 +1116,7 @@ async function verifyLocal(jws, publicKey, options = {}) {
         ...callerBindings?.documents !== void 0 && callerBindings.documents.length > 0 && { documents: callerBindings.documents }
       };
       const sortedWarnings = schema.sortWarnings(accumulatedWarnings);
-      if (isShadowEnabled(options)) {
+      if (legacyPath && isShadowEnabled(options)) {
         const headerSnapshot = { ...result.header };
         scheduleShadow({
           call: "verifyLocal",