Provisioning Lifecycle Profile

pnpm add @peac/schema @peac/protocol

import { issue } from '@peac/protocol';
import { generateKeypair } from '@peac/crypto';
import { validateProvisioningLifecycle } from '@peac/schema';

const { privateKey } = await generateKeypair();

// Build the provisioning lifecycle extension object
const provisioningExtension = {
  event_kind: 'provisioning-credential-observed',
  sub_event: 'issued',
  provider_ref: 'urn:provider:acme-vault:v1', // opaque ref, no raw IDs
  storage_surface: {
    kind: 'external_secret_store',
    provider_ref: 'urn:vault:acme:prod',
    surface_ref: 'urn:vault:acme:prod:slot:api-key-42',
    material_redaction: 'never_capture', // never_capture | redacted_capture | hashed_capture
  },
  observed_at: new Date().toISOString(),
};

// Validate before issuing; fails closed on credential material
const validation = validateProvisioningLifecycle(provisioningExtension);
if (!validation.success) {
  throw new Error(validation.error.issues[0].message);
}

// Issue the signed Wire 0.2 record
const { jws } = await issue({
  iss: 'https://platform.example.com',
  kind: 'evidence',
  type: 'org.peacprotocol/provisioning-credential-observed',
  sub: 'agent:ci-runner:prod',
  pillars: ['provenance', 'compliance'],
  extensions: {
    'org.peacprotocol/provisioning-lifecycle': provisioningExtension,
  },
  privateKey,
  kid: 'peac-2026-03',
});

// jws is a portable signed Wire 0.2 record

inline_credential_blocked    token_material_blocked
forbidden_key_name           field_too_large
replacement_character_in_string  structure_too_deep
structure_too_large          opaque_ref_grammar_violation
invalid_storage_surface      invalid_material_redaction
invalid_event_kind           invalid_sub_event
invalid_scheme_id            invalid_amount_minor
invalid_observed_at          invalid_retrieved_at
invalid_expires_at           invalid_currency
unrecognized_field           missing_required_field
invalid_utf8 (fixture-loader only)