@peac/schema 0.10.13 → 0.11.0

package/dist/index.d.ts

@@ -11,6 +11,8 @@ export * from './normalize';
 export * from './purpose';
 export * from './agent-identity';
 export * from './attribution';
+export { KERNEL_CONSTRAINTS, validateKernelConstraints } from './constraints';
+export type { KernelConstraintKey, ConstraintViolation, ConstraintValidationResult, } from './constraints';
 export { JsonPrimitiveSchema, JsonValueSchema, JsonObjectSchema, JsonArraySchema, JSON_EVIDENCE_LIMITS, assertJsonSafeIterative, } from './json';
 export type { JsonSafetyResult } from './json';
 export type { JsonEvidenceLimits as UNSAFE_JsonEvidenceLimits } from './json';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B,cAAc,UAAU,CAAC;AACzB,cAAc,aAAa,CAAC;AAC5B,cAAc,WAAW,CAAC;AAC1B,cAAc,kBAAkB,CAAC;AACjC,cAAc,eAAe,CAAC;AAG9B,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,gBAAgB,EAChB,eAAe,EAEf,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,QAAQ,CAAC;AAChB,YAAY,EAAE,gBAAgB,EAAE,MAAM,QAAQ,CAAC;AAI/C,YAAY,EAAE,kBAAkB,IAAI,yBAAyB,EAAE,MAAM,QAAQ,CAAC;AAG9E,cAAc,aAAa,CAAC;AAC5B,cAAc,SAAS,CAAC;AAGxB,OAAO,EACL,iBAAiB,EACjB,UAAU,EACV,SAAS,EACT,mBAAmB,EACnB,aAAa,EAAE,wCAAwC;AACvD,OAAO,IAAI,aAAa,EACxB,cAAc,IAAI,oBAAoB,EACtC,aAAa,IAAI,mBAAmB,EAEpC,oBAAoB,EACpB,0BAA0B,EAC1B,qBAAqB,EACrB,iBAAiB,EACjB,kBAAkB,EAElB,kBAAkB,EAClB,qBAAqB,EACrB,oBAAoB,EAEpB,iBAAiB,EACjB,oBAAoB,EACpB,4BAA4B,EAE5B,iBAAiB,EACjB,gBAAgB,EAEhB,kBAAkB,EAClB,sBAAsB,EACtB,mBAAmB,EAEnB,uBAAuB,EAEvB,gBAAgB,GACjB,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAGhF,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,2BAA2B,EAC3B,8BAA8B,EAC9B,qBAAqB,EACrB,2BAA2B,EAE3B,mBAAmB,EACnB,aAAa,EACb,aAAa,EAEb,gCAAgC,EAChC,0BAA0B,EAC1B,8BAA8B,EAC9B,uBAAuB,EACvB,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,WAAW,EACX,WAAW,EACX,cAAc,EACd,UAAU,EACV,qBAAqB,EACrB,wBAAwB,EACxB,eAAe,EACf,qBAAqB,EACrB,oCAAoC,GACrC,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,EACjB,sBAAsB,EACtB,oBAAoB,EACpB,uBAAuB,EACvB,yBAAyB,EACzB,4BAA4B,EAE5B,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAEhB,mBAAmB,EACnB,yBAAyB,EACzB,8BAA8B,EAC9B,wBAAwB,EACxB,4BAA4B,EAC5B,oBAAoB,EACpB,wBAAwB,EACxB,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,eAAe,CAAC;AACvB,YAAY,EACV,aAAa,EACb,YAAY,EACZ,WAAW,EACX,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,EACvB,kCAAkC,GACnC,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,uBAAuB,EACvB,wBAAwB,EACxB,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,iBAAiB,EACjB,uBAAuB,EACvB,mBAAmB,EACnB,oBAAoB,EACpB,iBAAiB,EACjB,qBAAqB,EACrB,wBAAwB,EAExB,YAAY,EACZ,cAAc,EACd,aAAa,EACb,oBAAoB,EACpB,qBAAqB,EACrB,cAAc,EACd,eAAe,EACf,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EAEjB,0BAA0B,EAC1B,yBAAyB,EACzB,oBAAoB,EACpB,yBAAyB,EACzB,sBAAsB,EACtB,wBAAwB,EACxB,sBAAsB,EACtB,eAAe,EACf,eAAe,EACf,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,WAAW,CAAC;AACnB,YAAY,EACV,SAAS,EACT,WAAW,EACX,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,EACd,YAAY,EACZ,cAAc,EACd,eAAe,EACf,WAAW,EACX,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,WAAW,EACX,eAAe,EACf,kBAAkB,EAClB,8BAA8B,GAC/B,MAAM,WAAW,CAAC;AAGnB,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,oBAAoB,EACpB,4BAA4B,EAC5B,qBAAqB,EACrB,0BAA0B,EAC1B,6BAA6B,EAC7B,gCAAgC,EAEhC,sBAAsB,EACtB,qBAAqB,EACrB,iBAAiB,EACjB,wBAAwB,EACxB,eAAe,EACf,mBAAmB,EACnB,eAAe,EAEf,gBAAgB,EAChB,YAAY,EACZ,uBAAuB,EACvB,8BAA8B,EAC9B,sBAAsB,EACtB,kCAAkC,EAClC,4BAA4B,EAC5B,wBAAwB,EACxB,oBAAoB,EACpB,qBAAqB,EACrB,gCAAgC,GACjC,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,UAAU,EACV,MAAM,EACN,cAAc,EACd,sBAAsB,EACtB,eAAe,EACf,oBAAoB,EACpB,uBAAuB,EACvB,0BAA0B,EAC1B,wBAAwB,EACxB,2BAA2B,GAC5B,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,eAAe,EACf,YAAY,EACZ,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,oBAAoB,EACpB,YAAY,EACZ,mBAAmB,EACnB,UAAU,EACV,UAAU,EACV,4BAA4B,EAE5B,yBAAyB,EACzB,qBAAqB,EACrB,qBAAqB,EACrB,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,sBAAsB,EACtB,kBAAkB,EAClB,mBAAmB,EACnB,qBAAqB,EACrB,oBAAoB,EAEpB,mBAAmB,EACnB,0BAA0B,EAC1B,2BAA2B,EAC3B,0BAA0B,EAE1B,eAAe,EACf,oBAAoB,EACpB,iBAAiB,EAEjB,cAAc,EACd,cAAc,EACd,cAAc,EAEd,iBAAiB,EAEjB,yBAAyB,GAC1B,MAAM,eAAe,CAAC;AACvB,YAAY,EACV,SAAS,EACT,MAAM,EACN,UAAU,EACV,QAAQ,EACR,UAAU,EACV,cAAc,EACd,YAAY,EACZ,MAAM,EACN,cAAc,EACd,aAAa,EACb,IAAI,EACJ,sBAAsB,EACtB,eAAe,EACf,iBAAiB,EACjB,2BAA2B,EAC3B,sBAAsB,EACtB,WAAW,EACX,uBAAuB,GACxB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,sBAAsB,EACtB,4BAA4B,EAC5B,0BAA0B,EAE1B,yBAAyB,EACzB,cAAc,EACd,kBAAkB,EAElB,wBAAwB,EACxB,8BAA8B,EAC9B,4BAA4B,EAC5B,2BAA2B,EAC3B,gBAAgB,EAChB,sBAAsB,EACtB,sBAAsB,EACtB,4BAA4B,EAC5B,0BAA0B,GAC3B,MAAM,eAAe,CAAC;AACvB,YAAY,EACV,YAAY,EACZ,gBAAgB,EAChB,gBAAgB,EAChB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,eAAe,CAAC;AAGvB,YAAY,EACV,YAAY,EACZ,WAAW,EACX,aAAa,EACb,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,GAChB,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,+BAA+B,EAC/B,2BAA2B,EAC3B,8BAA8B,EAE9B,wBAAwB,EACxB,0BAA0B,EAC1B,kBAAkB,EAElB,gCAAgC,EAChC,0BAA0B,EAC1B,iCAAiC,EACjC,2BAA2B,EAC3B,8BAA8B,EAC9B,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,yBAAyB,EACzB,qBAAqB,EACrB,wBAAwB,EACxB,2BAA2B,EAC3B,8BAA8B,GAC/B,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,YAAY,EACV,kBAAkB,EAClB,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,cAAc,EACd,mBAAmB,GACpB,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B,cAAc,UAAU,CAAC;AACzB,cAAc,aAAa,CAAC;AAC5B,cAAc,WAAW,CAAC;AAC1B,cAAc,kBAAkB,CAAC;AACjC,cAAc,eAAe,CAAC;AAG9B,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAC9E,YAAY,EACV,mBAAmB,EACnB,mBAAmB,EACnB,0BAA0B,GAC3B,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,gBAAgB,EAChB,eAAe,EAEf,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,QAAQ,CAAC;AAChB,YAAY,EAAE,gBAAgB,EAAE,MAAM,QAAQ,CAAC;AAI/C,YAAY,EAAE,kBAAkB,IAAI,yBAAyB,EAAE,MAAM,QAAQ,CAAC;AAG9E,cAAc,aAAa,CAAC;AAC5B,cAAc,SAAS,CAAC;AAGxB,OAAO,EACL,iBAAiB,EACjB,UAAU,EACV,SAAS,EACT,mBAAmB,EACnB,aAAa,EAAE,wCAAwC;AACvD,OAAO,IAAI,aAAa,EACxB,cAAc,IAAI,oBAAoB,EACtC,aAAa,IAAI,mBAAmB,EAEpC,oBAAoB,EACpB,0BAA0B,EAC1B,qBAAqB,EACrB,iBAAiB,EACjB,kBAAkB,EAElB,kBAAkB,EAClB,qBAAqB,EACrB,oBAAoB,EAEpB,iBAAiB,EACjB,oBAAoB,EACpB,4BAA4B,EAE5B,iBAAiB,EACjB,gBAAgB,EAEhB,kBAAkB,EAClB,sBAAsB,EACtB,mBAAmB,EAEnB,uBAAuB,EAEvB,gBAAgB,GACjB,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAGhF,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,2BAA2B,EAC3B,8BAA8B,EAC9B,qBAAqB,EACrB,2BAA2B,EAE3B,mBAAmB,EACnB,aAAa,EACb,aAAa,EAEb,gCAAgC,EAChC,0BAA0B,EAC1B,8BAA8B,EAC9B,uBAAuB,EACvB,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,WAAW,EACX,WAAW,EACX,cAAc,EACd,UAAU,EACV,qBAAqB,EACrB,wBAAwB,EACxB,eAAe,EACf,qBAAqB,EACrB,oCAAoC,GACrC,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,EACjB,sBAAsB,EACtB,oBAAoB,EACpB,uBAAuB,EACvB,yBAAyB,EACzB,4BAA4B,EAE5B,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAEhB,mBAAmB,EACnB,yBAAyB,EACzB,8BAA8B,EAC9B,wBAAwB,EACxB,4BAA4B,EAC5B,oBAAoB,EACpB,wBAAwB,EACxB,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,eAAe,CAAC;AACvB,YAAY,EACV,aAAa,EACb,YAAY,EACZ,WAAW,EACX,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,EACvB,kCAAkC,GACnC,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,uBAAuB,EACvB,wBAAwB,EACxB,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,iBAAiB,EACjB,uBAAuB,EACvB,mBAAmB,EACnB,oBAAoB,EACpB,iBAAiB,EACjB,qBAAqB,EACrB,wBAAwB,EAExB,YAAY,EACZ,cAAc,EACd,aAAa,EACb,oBAAoB,EACpB,qBAAqB,EACrB,cAAc,EACd,eAAe,EACf,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EAEjB,0BAA0B,EAC1B,yBAAyB,EACzB,oBAAoB,EACpB,yBAAyB,EACzB,sBAAsB,EACtB,wBAAwB,EACxB,sBAAsB,EACtB,eAAe,EACf,eAAe,EACf,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,WAAW,CAAC;AACnB,YAAY,EACV,SAAS,EACT,WAAW,EACX,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,EACd,YAAY,EACZ,cAAc,EACd,eAAe,EACf,WAAW,EACX,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,WAAW,EACX,eAAe,EACf,kBAAkB,EAClB,8BAA8B,GAC/B,MAAM,WAAW,CAAC;AAGnB,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,oBAAoB,EACpB,4BAA4B,EAC5B,qBAAqB,EACrB,0BAA0B,EAC1B,6BAA6B,EAC7B,gCAAgC,EAEhC,sBAAsB,EACtB,qBAAqB,EACrB,iBAAiB,EACjB,wBAAwB,EACxB,eAAe,EACf,mBAAmB,EACnB,eAAe,EAEf,gBAAgB,EAChB,YAAY,EACZ,uBAAuB,EACvB,8BAA8B,EAC9B,sBAAsB,EACtB,kCAAkC,EAClC,4BAA4B,EAC5B,wBAAwB,EACxB,oBAAoB,EACpB,qBAAqB,EACrB,gCAAgC,GACjC,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,UAAU,EACV,MAAM,EACN,cAAc,EACd,sBAAsB,EACtB,eAAe,EACf,oBAAoB,EACpB,uBAAuB,EACvB,0BAA0B,EAC1B,wBAAwB,EACxB,2BAA2B,GAC5B,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,eAAe,EACf,YAAY,EACZ,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,oBAAoB,EACpB,YAAY,EACZ,mBAAmB,EACnB,UAAU,EACV,UAAU,EACV,4BAA4B,EAE5B,yBAAyB,EACzB,qBAAqB,EACrB,qBAAqB,EACrB,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,sBAAsB,EACtB,kBAAkB,EAClB,mBAAmB,EACnB,qBAAqB,EACrB,oBAAoB,EAEpB,mBAAmB,EACnB,0BAA0B,EAC1B,2BAA2B,EAC3B,0BAA0B,EAE1B,eAAe,EACf,oBAAoB,EACpB,iBAAiB,EAEjB,cAAc,EACd,cAAc,EACd,cAAc,EAEd,iBAAiB,EAEjB,yBAAyB,GAC1B,MAAM,eAAe,CAAC;AACvB,YAAY,EACV,SAAS,EACT,MAAM,EACN,UAAU,EACV,QAAQ,EACR,UAAU,EACV,cAAc,EACd,YAAY,EACZ,MAAM,EACN,cAAc,EACd,aAAa,EACb,IAAI,EACJ,sBAAsB,EACtB,eAAe,EACf,iBAAiB,EACjB,2BAA2B,EAC3B,sBAAsB,EACtB,WAAW,EACX,uBAAuB,GACxB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,sBAAsB,EACtB,4BAA4B,EAC5B,0BAA0B,EAE1B,yBAAyB,EACzB,cAAc,EACd,kBAAkB,EAElB,wBAAwB,EACxB,8BAA8B,EAC9B,4BAA4B,EAC5B,2BAA2B,EAC3B,gBAAgB,EAChB,sBAAsB,EACtB,sBAAsB,EACtB,4BAA4B,EAC5B,0BAA0B,GAC3B,MAAM,eAAe,CAAC;AACvB,YAAY,EACV,YAAY,EACZ,gBAAgB,EAChB,gBAAgB,EAChB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,eAAe,CAAC;AAGvB,YAAY,EACV,YAAY,EACZ,WAAW,EACX,aAAa,EACb,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,GAChB,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,+BAA+B,EAC/B,2BAA2B,EAC3B,8BAA8B,EAE9B,wBAAwB,EACxB,0BAA0B,EAC1B,kBAAkB,EAElB,gCAAgC,EAChC,0BAA0B,EAC1B,iCAAiC,EACjC,2BAA2B,EAC3B,8BAA8B,EAC9B,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,yBAAyB,EACzB,qBAAqB,EACrB,wBAAwB,EACxB,2BAA2B,EAC3B,8BAA8B,GAC/B,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,YAAY,EACV,kBAAkB,EAClB,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,cAAc,EACd,mBAAmB,GACpB,MAAM,kBAAkB,CAAC"}

package/dist/index.mjs

@@ -32,7 +32,9 @@ var ERROR_CODES = {
   E_WORKFLOW_STEP_ID_INVALID: "E_WORKFLOW_STEP_ID_INVALID",
   E_WORKFLOW_PARENT_NOT_FOUND: "E_WORKFLOW_PARENT_NOT_FOUND",
   E_WORKFLOW_SUMMARY_INVALID: "E_WORKFLOW_SUMMARY_INVALID",
-  E_WORKFLOW_CYCLE_DETECTED: "E_WORKFLOW_CYCLE_DETECTED"
+  E_WORKFLOW_CYCLE_DETECTED: "E_WORKFLOW_CYCLE_DETECTED",
+  // Constraint errors (400, DD-121)
+  E_CONSTRAINT_VIOLATION: "E_CONSTRAINT_VIOLATION"
 };
 function createPEACError(code, category, severity, retryable, options) {
   return {
@@ -72,6 +74,16 @@ function createWorkflowDagInvalidError(reason) {
     details: { reason, message: messages[reason] }
   });
 }
+function createConstraintViolationError(violations) {
+  const first = violations[0];
+  const summary = violations.map((v) => `${v.constraint} (actual: ${v.actual}, limit: ${v.limit})`).join("; ");
+  return createPEACError(ERROR_CODES.E_CONSTRAINT_VIOLATION, "validation", "error", false, {
+    http_status: 400,
+    pointer: first?.path,
+    remediation: "Reduce receipt claims size to stay within kernel constraints",
+    details: { message: `Kernel constraint violated: ${summary}`, violations }
+  });
+}
 
 // src/normalize.ts
 function normalizePayment(payment) {
@@ -276,6 +288,106 @@ function determinePurposeReason(context) {
 function hasUnknownPurposeTokens(tokens) {
   return tokens.some((token) => !isCanonicalPurpose(token));
 }
+
+// src/constraints.ts
+var KERNEL_CONSTRAINTS = {
+  /** Maximum nesting depth for JSON evidence */
+  MAX_NESTED_DEPTH: 32,
+  /** Maximum array length in evidence */
+  MAX_ARRAY_LENGTH: 1e4,
+  /** Maximum object keys in a single object */
+  MAX_OBJECT_KEYS: 1e3,
+  /** Maximum string length in code units (JS .length). Matches assertJsonSafeIterative. */
+  MAX_STRING_LENGTH: 65536,
+  /** Maximum total nodes to visit during traversal */
+  MAX_TOTAL_NODES: 1e5,
+  /** Temporal validity clock skew tolerance in seconds (DD-8) */
+  CLOCK_SKEW_SECONDS: 60
+};
+function validateKernelConstraints(claims) {
+  const violations = [];
+  if (claims === null || claims === void 0 || typeof claims !== "object") {
+    return { valid: true, violations };
+  }
+  let totalNodes = 0;
+  const stack = [
+    { value: claims, depth: 0, path: "" }
+  ];
+  while (stack.length > 0) {
+    const item = stack.pop();
+    totalNodes++;
+    if (totalNodes > KERNEL_CONSTRAINTS.MAX_TOTAL_NODES) {
+      violations.push({
+        constraint: "MAX_TOTAL_NODES",
+        actual: totalNodes,
+        limit: KERNEL_CONSTRAINTS.MAX_TOTAL_NODES,
+        path: item.path
+      });
+      break;
+    }
+    if (item.depth > KERNEL_CONSTRAINTS.MAX_NESTED_DEPTH) {
+      violations.push({
+        constraint: "MAX_NESTED_DEPTH",
+        actual: item.depth,
+        limit: KERNEL_CONSTRAINTS.MAX_NESTED_DEPTH,
+        path: item.path
+      });
+      continue;
+    }
+    if (item.value === null || typeof item.value !== "object") {
+      if (typeof item.value === "string") {
+        if (item.value.length > KERNEL_CONSTRAINTS.MAX_STRING_LENGTH) {
+          violations.push({
+            constraint: "MAX_STRING_LENGTH",
+            actual: item.value.length,
+            limit: KERNEL_CONSTRAINTS.MAX_STRING_LENGTH,
+            path: item.path
+          });
+        }
+      }
+      continue;
+    }
+    if (Array.isArray(item.value)) {
+      if (item.value.length > KERNEL_CONSTRAINTS.MAX_ARRAY_LENGTH) {
+        violations.push({
+          constraint: "MAX_ARRAY_LENGTH",
+          actual: item.value.length,
+          limit: KERNEL_CONSTRAINTS.MAX_ARRAY_LENGTH,
+          path: item.path
+        });
+      }
+      for (let i = item.value.length - 1; i >= 0; i--) {
+        stack.push({
+          value: item.value[i],
+          depth: item.depth + 1,
+          path: `${item.path}[${i}]`
+        });
+      }
+      continue;
+    }
+    const keys = Object.keys(item.value);
+    if (keys.length > KERNEL_CONSTRAINTS.MAX_OBJECT_KEYS) {
+      violations.push({
+        constraint: "MAX_OBJECT_KEYS",
+        actual: keys.length,
+        limit: KERNEL_CONSTRAINTS.MAX_OBJECT_KEYS,
+        path: item.path
+      });
+    }
+    for (let i = keys.length - 1; i >= 0; i--) {
+      const key = keys[i];
+      const childPath = item.path ? `${item.path}.${key}` : key;
+      stack.push({
+        value: item.value[key],
+        depth: item.depth + 1,
+        path: childPath
+      });
+    }
+  }
+  return { valid: violations.length === 0, violations };
+}
+
+// src/json.ts
 function isPlainObject(value) {
   if (value === null || typeof value !== "object") {
     return false;
@@ -294,25 +406,25 @@ var JsonValueSchema = z.lazy(
     z.array(JsonValueSchema),
     // Plain object check then record validation
     PlainObjectSchema.transform((obj) => obj).pipe(
-      z.record(JsonValueSchema)
+      z.record(z.string(), JsonValueSchema)
     )
   ])
 );
 var JsonObjectSchema = PlainObjectSchema.transform(
   (obj) => obj
-).pipe(z.record(JsonValueSchema));
+).pipe(z.record(z.string(), JsonValueSchema));
 var JsonArraySchema = z.array(JsonValueSchema);
 var JSON_EVIDENCE_LIMITS = {
   /** Maximum nesting depth (default: 32) */
-  maxDepth: 32,
+  maxDepth: KERNEL_CONSTRAINTS.MAX_NESTED_DEPTH,
   /** Maximum array length (default: 10,000) */
-  maxArrayLength: 1e4,
+  maxArrayLength: KERNEL_CONSTRAINTS.MAX_ARRAY_LENGTH,
   /** Maximum object keys (default: 1,000) */
-  maxObjectKeys: 1e3,
-  /** Maximum string length in bytes (default: 65,536 = 64KB) */
-  maxStringLength: 65536,
+  maxObjectKeys: KERNEL_CONSTRAINTS.MAX_OBJECT_KEYS,
+  /** Maximum string length in code units (default: 65,536) */
+  maxStringLength: KERNEL_CONSTRAINTS.MAX_STRING_LENGTH,
   /** Maximum total nodes to visit (default: 100,000) */
-  maxTotalNodes: 1e5
+  maxTotalNodes: KERNEL_CONSTRAINTS.MAX_TOTAL_NODES
 };
 function assertJsonSafeIterative(value, limits = {}) {
   const maxDepth = limits.maxDepth ?? JSON_EVIDENCE_LIMITS.maxDepth;
@@ -1877,7 +1989,7 @@ var InteractionEvidenceV01BaseSchema = z.object({
   /** References to related evidence */
   refs: RefsSchema.optional(),
   /** Platform-specific extensions (MUST be namespaced) */
-  extensions: z.record(z.unknown()).optional()
+  extensions: z.record(z.string(), z.unknown()).optional()
 }).strict();
 var InteractionEvidenceV01Schema = InteractionEvidenceV01BaseSchema.superRefine(
   (ev, ctx) => {
@@ -2573,6 +2685,6 @@ function parseReceiptClaims(input, _opts) {
   };
 }
 
-export { AGENT_IDENTITY_TYPE, AIPREFSnapshot as AIPREFSnapshotSchema, ATTESTATION_LIMITS, ATTESTATION_RECEIPT_TYPE, ATTRIBUTION_LIMITS, ATTRIBUTION_TYPE, ATTRIBUTION_USAGES, AgentIdentityAttestationSchema, AgentIdentityEvidenceSchema, AgentIdentityVerifiedSchema, AgentProofSchema, AttestationExtensionsSchema, AttestationReceiptClaimsSchema, AttestationSchema, AttributionAttestationSchema, AttributionEvidenceSchema, AttributionSourceSchema, AttributionUsageSchema, BindingDetailsSchema, CANONICAL_DIGEST_ALGS, CANONICAL_PURPOSES, CONTRIBUTION_TYPES, CONTROL_TYPES, CREDIT_METHODS, CanonicalPurposeSchema, ContactMethodSchema, ContentHashSchema, ContributionObligationSchema, ContributionTypeSchema, ControlBlockSchema, ControlDecisionSchema, ControlLicensingModeSchema, ControlPurposeSchema, ControlStepSchema, ControlTypeSchema, CreditMethodSchema, CreditObligationSchema, DERIVATION_TYPES, DIGEST_SIZE_CONSTANTS, DIGEST_VALUE_PATTERN, DISPUTE_GROUNDS_CODES, DISPUTE_LIMITS, DISPUTE_OUTCOMES, DISPUTE_STATES, DISPUTE_TARGET_TYPES, DISPUTE_TRANSITIONS, DISPUTE_TYPE, DISPUTE_TYPES, DerivationTypeSchema, DigestAlgSchema, DigestSchema, DisputeAttestationSchema, DisputeContactSchema, DisputeEvidenceSchema, DisputeGroundsCodeSchema, DisputeGroundsSchema, DisputeIdSchema, DisputeOutcomeSchema, DisputeResolutionSchema, DisputeStateSchema, DisputeTargetTypeSchema, DisputeTypeSchema, DocumentRefSchema, ERROR_CATEGORIES_CANONICAL, ERROR_CODES, EXTENSION_KEY_PATTERN, ExecutorSchema, Extensions, ExtensionsSchema, HashAlgorithmSchema, HashEncodingSchema, INTERACTION_EXTENSION_KEY, INTERACTION_LIMITS, INTERNAL_PURPOSE_UNDECLARED, IdentityBindingSchema, InteractionEvidenceV01Schema, JSON_EVIDENCE_LIMITS, JWSHeader, JsonArraySchema, JsonObjectSchema, JsonPrimitiveSchema, JsonValueSchema, KIND_FORMAT_PATTERN, KindSchema, MAX_PURPOSE_TOKENS_PER_REQUEST, MAX_PURPOSE_TOKEN_LENGTH, MIDDLEWARE_INTERACTION_KEY, MinimalInteractionBindingSchema, NormalizedPayment, OBLIGATIONS_EXTENSION_KEY, ORCHESTRATION_FRAMEWORKS, ObligationsExtensionSchema, OrchestrationFrameworkSchema, PEAC_ALG, PEAC_DISCOVERY_MAX_BYTES, PEAC_DISCOVERY_PATH, PEAC_ISSUER_CONFIG_MAX_BYTES, PEAC_ISSUER_CONFIG_PATH, PEAC_ISSUER_CONFIG_VERSION, PEAC_POLICY_FALLBACK_PATH, PEAC_POLICY_MAX_BYTES, PEAC_POLICY_PATH, PEAC_PURPOSE_APPLIED_HEADER, PEAC_PURPOSE_HEADER, PEAC_PURPOSE_REASON_HEADER, PEAC_RECEIPT_HEADER, PEAC_RECEIPT_SCHEMA_URL, PEAC_WIRE_TYP, POLICY_DECISIONS, PROOF_METHODS, PURPOSE_REASONS, PURPOSE_TOKEN_REGEX, PayloadRefSchema, PaymentEvidenceSchema, PaymentRoutingSchema, PaymentSplitSchema, PolicyContextSchema, ProofMethodSchema, PurposeReasonSchema, PurposeTokenSchema, REDACTION_MODES, REMEDIATION_TYPES, RESERVED_KIND_PREFIXES, RESULT_STATUSES, ReceiptClaims, ReceiptClaimsSchema, RefsSchema, RemediationSchema, RemediationTypeSchema, ResourceTargetSchema, ResultSchema, STEP_ID_PATTERN, StepIdSchema, SubjectProfileSchema, SubjectProfileSnapshotSchema, Subject as SubjectSchema, SubjectTypeSchema, TERMINAL_STATES, ToolTargetSchema, VerifyRequest as VerifyRequestSchema, WELL_KNOWN_KINDS, WORKFLOW_EXTENSION_KEY, WORKFLOW_ID_PATTERN, WORKFLOW_LIMITS, WORKFLOW_STATUSES, WORKFLOW_SUMMARY_TYPE, WorkflowContextSchema, WorkflowErrorContextSchema, WorkflowIdSchema, WorkflowStatusSchema, WorkflowSummaryAttestationSchema, WorkflowSummaryEvidenceSchema, assertJsonSafeIterative, canTransitionTo, computeTotalWeight, createAgentIdentityAttestation, createAttestationReceiptClaims, createAttributionAttestation, createContributionObligation, createCreditObligation, createDisputeAttestation, createEvidenceNotJsonError, createInteractionEvidence, createObligationsExtension, createPEACError, createReceiptView, createStepId, createWorkflowContext, createWorkflowContextInvalidError, createWorkflowDagInvalidError, createWorkflowId, createWorkflowSummaryAttestation, deriveKnownPurposes, detectCycleInSources, determinePurposeReason, extractObligationsExtension, getInteraction, getValidTransitions, hasInteraction, hasUnknownPurposeTokens, hasValidDagSemantics, isAgentIdentityAttestation, isAttestationExpired, isAttestationNotYetValid, isAttestationOnly, isAttestationReceiptClaims, isAttributionAttestation, isAttributionExpired, isAttributionNotYetValid, isCanonicalPurpose, isContributionRequired, isCreditRequired, isDigestTruncated, isDisputeAttestation, isDisputeExpired, isDisputeNotYetValid, isLegacyPurpose, isMinimalInteractionBinding, isPaymentReceipt, isReservedKindPrefix, isTerminalState, isTerminalWorkflowStatus, isUndeclaredPurpose, isValidDisputeAttestation, isValidInteractionEvidence, isValidPurposeReason, isValidPurposeToken, isValidWorkflowContext, isWellKnownKind, isWorkflowSummaryAttestation, mapLegacyToCanonical, normalizePurposeToken, normalizeToCanonicalOrPreserve, parsePurposeHeader, parseReceiptClaims, setInteraction, toCoreClaims, transitionDisputeState, validateAgentIdentityAttestation, validateAttestationReceiptClaims, validateAttributionAttestation, validateAttributionSource, validateContentHash, validateContributionObligation, validateCreditObligation, validateDisputeAttestation, validateDisputeContact, validateDisputeResolution, validateEvidence, validateIdentityBinding, validateInteraction, validateInteractionEvidence, validateInteractionOrdered, validateMinimalInteractionBinding, validateObligationsExtension, validatePurposeTokens, validateSubjectSnapshot, validateWorkflowContext, validateWorkflowContextOrdered, validateWorkflowSummaryAttestation };
+export { AGENT_IDENTITY_TYPE, AIPREFSnapshot as AIPREFSnapshotSchema, ATTESTATION_LIMITS, ATTESTATION_RECEIPT_TYPE, ATTRIBUTION_LIMITS, ATTRIBUTION_TYPE, ATTRIBUTION_USAGES, AgentIdentityAttestationSchema, AgentIdentityEvidenceSchema, AgentIdentityVerifiedSchema, AgentProofSchema, AttestationExtensionsSchema, AttestationReceiptClaimsSchema, AttestationSchema, AttributionAttestationSchema, AttributionEvidenceSchema, AttributionSourceSchema, AttributionUsageSchema, BindingDetailsSchema, CANONICAL_DIGEST_ALGS, CANONICAL_PURPOSES, CONTRIBUTION_TYPES, CONTROL_TYPES, CREDIT_METHODS, CanonicalPurposeSchema, ContactMethodSchema, ContentHashSchema, ContributionObligationSchema, ContributionTypeSchema, ControlBlockSchema, ControlDecisionSchema, ControlLicensingModeSchema, ControlPurposeSchema, ControlStepSchema, ControlTypeSchema, CreditMethodSchema, CreditObligationSchema, DERIVATION_TYPES, DIGEST_SIZE_CONSTANTS, DIGEST_VALUE_PATTERN, DISPUTE_GROUNDS_CODES, DISPUTE_LIMITS, DISPUTE_OUTCOMES, DISPUTE_STATES, DISPUTE_TARGET_TYPES, DISPUTE_TRANSITIONS, DISPUTE_TYPE, DISPUTE_TYPES, DerivationTypeSchema, DigestAlgSchema, DigestSchema, DisputeAttestationSchema, DisputeContactSchema, DisputeEvidenceSchema, DisputeGroundsCodeSchema, DisputeGroundsSchema, DisputeIdSchema, DisputeOutcomeSchema, DisputeResolutionSchema, DisputeStateSchema, DisputeTargetTypeSchema, DisputeTypeSchema, DocumentRefSchema, ERROR_CATEGORIES_CANONICAL, ERROR_CODES, EXTENSION_KEY_PATTERN, ExecutorSchema, Extensions, ExtensionsSchema, HashAlgorithmSchema, HashEncodingSchema, INTERACTION_EXTENSION_KEY, INTERACTION_LIMITS, INTERNAL_PURPOSE_UNDECLARED, IdentityBindingSchema, InteractionEvidenceV01Schema, JSON_EVIDENCE_LIMITS, JWSHeader, JsonArraySchema, JsonObjectSchema, JsonPrimitiveSchema, JsonValueSchema, KERNEL_CONSTRAINTS, KIND_FORMAT_PATTERN, KindSchema, MAX_PURPOSE_TOKENS_PER_REQUEST, MAX_PURPOSE_TOKEN_LENGTH, MIDDLEWARE_INTERACTION_KEY, MinimalInteractionBindingSchema, NormalizedPayment, OBLIGATIONS_EXTENSION_KEY, ORCHESTRATION_FRAMEWORKS, ObligationsExtensionSchema, OrchestrationFrameworkSchema, PEAC_ALG, PEAC_DISCOVERY_MAX_BYTES, PEAC_DISCOVERY_PATH, PEAC_ISSUER_CONFIG_MAX_BYTES, PEAC_ISSUER_CONFIG_PATH, PEAC_ISSUER_CONFIG_VERSION, PEAC_POLICY_FALLBACK_PATH, PEAC_POLICY_MAX_BYTES, PEAC_POLICY_PATH, PEAC_PURPOSE_APPLIED_HEADER, PEAC_PURPOSE_HEADER, PEAC_PURPOSE_REASON_HEADER, PEAC_RECEIPT_HEADER, PEAC_RECEIPT_SCHEMA_URL, PEAC_WIRE_TYP, POLICY_DECISIONS, PROOF_METHODS, PURPOSE_REASONS, PURPOSE_TOKEN_REGEX, PayloadRefSchema, PaymentEvidenceSchema, PaymentRoutingSchema, PaymentSplitSchema, PolicyContextSchema, ProofMethodSchema, PurposeReasonSchema, PurposeTokenSchema, REDACTION_MODES, REMEDIATION_TYPES, RESERVED_KIND_PREFIXES, RESULT_STATUSES, ReceiptClaims, ReceiptClaimsSchema, RefsSchema, RemediationSchema, RemediationTypeSchema, ResourceTargetSchema, ResultSchema, STEP_ID_PATTERN, StepIdSchema, SubjectProfileSchema, SubjectProfileSnapshotSchema, Subject as SubjectSchema, SubjectTypeSchema, TERMINAL_STATES, ToolTargetSchema, VerifyRequest as VerifyRequestSchema, WELL_KNOWN_KINDS, WORKFLOW_EXTENSION_KEY, WORKFLOW_ID_PATTERN, WORKFLOW_LIMITS, WORKFLOW_STATUSES, WORKFLOW_SUMMARY_TYPE, WorkflowContextSchema, WorkflowErrorContextSchema, WorkflowIdSchema, WorkflowStatusSchema, WorkflowSummaryAttestationSchema, WorkflowSummaryEvidenceSchema, assertJsonSafeIterative, canTransitionTo, computeTotalWeight, createAgentIdentityAttestation, createAttestationReceiptClaims, createAttributionAttestation, createConstraintViolationError, createContributionObligation, createCreditObligation, createDisputeAttestation, createEvidenceNotJsonError, createInteractionEvidence, createObligationsExtension, createPEACError, createReceiptView, createStepId, createWorkflowContext, createWorkflowContextInvalidError, createWorkflowDagInvalidError, createWorkflowId, createWorkflowSummaryAttestation, deriveKnownPurposes, detectCycleInSources, determinePurposeReason, extractObligationsExtension, getInteraction, getValidTransitions, hasInteraction, hasUnknownPurposeTokens, hasValidDagSemantics, isAgentIdentityAttestation, isAttestationExpired, isAttestationNotYetValid, isAttestationOnly, isAttestationReceiptClaims, isAttributionAttestation, isAttributionExpired, isAttributionNotYetValid, isCanonicalPurpose, isContributionRequired, isCreditRequired, isDigestTruncated, isDisputeAttestation, isDisputeExpired, isDisputeNotYetValid, isLegacyPurpose, isMinimalInteractionBinding, isPaymentReceipt, isReservedKindPrefix, isTerminalState, isTerminalWorkflowStatus, isUndeclaredPurpose, isValidDisputeAttestation, isValidInteractionEvidence, isValidPurposeReason, isValidPurposeToken, isValidWorkflowContext, isWellKnownKind, isWorkflowSummaryAttestation, mapLegacyToCanonical, normalizePurposeToken, normalizeToCanonicalOrPreserve, parsePurposeHeader, parseReceiptClaims, setInteraction, toCoreClaims, transitionDisputeState, validateAgentIdentityAttestation, validateAttestationReceiptClaims, validateAttributionAttestation, validateAttributionSource, validateContentHash, validateContributionObligation, validateCreditObligation, validateDisputeAttestation, validateDisputeContact, validateDisputeResolution, validateEvidence, validateIdentityBinding, validateInteraction, validateInteractionEvidence, validateInteractionOrdered, validateKernelConstraints, validateMinimalInteractionBinding, validateObligationsExtension, validatePurposeTokens, validateSubjectSnapshot, validateWorkflowContext, validateWorkflowContextOrdered, validateWorkflowSummaryAttestation };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map