
Product
Socket for ClickUp Is Now Available
Create ClickUp tasks from Socket alerts, automate ticketing with custom rules, and keep alert and task status synchronized.
@peac/schema
Advanced tools
PEAC protocol schemas: Zod validators, TypeScript types, and pure validation functions for signed interaction receipts. No I/O.
pnpm add @peac/schema
@peac/schema is Layer 1 of the PEAC protocol stack. It provides Zod schemas for all receipt claim types (both the legacy peac-receipt/0.1 wire format and the current stable Interaction Record format), typed extension group accessors, evidence validation with DoS protection, and pure utility functions such as computeReceiptRef(). It depends only on @peac/kernel and Zod, performs no I/O, and has no side effects.
import { parseReceiptClaims } from '@peac/schema';
const result = parseReceiptClaims(decodedPayload);
if (result.ok) {
console.log(result.variant); // 'commerce' | 'attestation' | 'wire-02'
console.log(result.wireVersion); // '0.1' | '0.2'
console.log(result.claims.iss); // validated issuer
console.log(result.warnings); // VerificationWarning[]
}
import { Wire02ClaimsSchema, getCommerceExtension, getAccessExtension } from '@peac/schema';
const claims = Wire02ClaimsSchema.parse(decoded);
const commerce = getCommerceExtension(claims.ext);
if (commerce) {
console.log(commerce.rail); // e.g. 'stripe'
console.log(commerce.amount_minor); // string, e.g. '1999'
console.log(commerce.cur); // e.g. 'USD'
}
const access = getAccessExtension(claims.ext);
if (access) {
console.log(access.resource); // accessed resource URI
}
import { computeReceiptRef } from '@peac/schema';
const ref = await computeReceiptRef(compactJws);
// 'sha256:a1b2c3...' (deterministic, requires WebCrypto)
import { validateEvidence } from '@peac/schema';
const result = validateEvidence(evidenceObject);
if (!result.valid) {
console.log(result.error); // validation failure details
}
import { validateCarrierConstraints, CARRIER_TRANSPORT_LIMITS } from '@peac/schema';
import type { PeacEvidenceCarrier, CarrierMeta } from '@peac/kernel';
const carrier: PeacEvidenceCarrier = {
receipt_jws: jws,
receipt_ref: ref,
};
const meta: CarrierMeta = {
transport: 'mcp',
format: 'embed',
max_size: CARRIER_TRANSPORT_LIMITS.mcp,
};
const result = validateCarrierConstraints(carrier, meta);
// result.valid: boolean, result.violations: string[]
@peac/kernel (Layer 0): Types and constants that schemas validate against@peac/crypto (Layer 2): Signing and verification using validated claims@peac/protocol (Layer 3): High-level issuance and verification built on these schemas@peac/mappings-* and @peac/adapter-* (Layer 4): Transport-specific carrier validation and external system mappingIf you are building an AI agent or MCP server that issues or verifies signed interaction receipts, you typically will not use @peac/schema directly. Start with @peac/mcp-server for a ready-to-use MCP tool server, or use @peac/protocol for programmatic receipt issuance and verification. Reach for @peac/schema when you need fine-grained control over claim parsing, extension group access, or carrier validation in a custom integration.
Operators deploying PEAC infrastructure can use @peac/schema to validate receipt claims at ingestion boundaries, enforce kernel constraints with validateKernelConstraints(), and verify carrier size limits per transport before forwarding evidence across services.
Apache-2.0
PEAC Protocol is an open source project stewarded by Originary and community contributors.
FAQs
PEAC Protocol JSON schemas, OpenAPI specs, and TypeScript types
We found that @peac/schema demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Product
Create ClickUp tasks from Socket alerts, automate ticketing with custom rules, and keep alert and task status synchronized.

Product
Create and manage Asana tasks directly from Socket alerts, with manual task creation, automated ticketing rules, and two-way sync.

Security News
Open VSX has removed three extension IDs from its malicious-extension list as the legitimate publishers they impersonated move to claim the names for themselves.