@appport/sdk 1.0.1

package/node_modules/@appport/core/dist/authorization-grant.d.ts

@@ -0,0 +1,107 @@
+/**
+ * Durable Authorization Grants and Revocation (PR41 / F5)
+ *
+ * Authorization is a durable authority relationship, not a fact about a
+ * process. A grant records that one consumer incarnation may use one
+ * capability from one provider; revoking it makes that relationship
+ * non-authoritative for every later execution boundary.
+ *
+ * REVOCATION LINEARIZATION POINT
+ * ------------------------------
+ * A revocation becomes authoritative the moment the durable authorization
+ * record commits in the authority store. Everything after that commit — a new
+ * binding, a materialization, a durable state commit, a successful ledger
+ * completion — must observe the revocation. Nothing before it is retroactively
+ * invalidated.
+ *
+ * IN-FLIGHT SEMANTICS
+ * -------------------
+ * Revocation does not terminate a WASM instance that is already running.
+ * It invalidates the authority the execution depends on, so the execution
+ * cannot produce a durable effect (state commit or successful ledger record)
+ * attributable to the revoked relationship. See
+ * `docs/architecture/authorization-revocation.md`.
+ */
+import type { AuthorizationPolicy, CapabilityBindingContext } from "./binding.js";
+/** The semantic participants of an authorization relationship. */
+export interface AuthorizationSubject {
+    readonly consumerId: string;
+    readonly providerId: string;
+    readonly capabilityName: string;
+    readonly capabilityVersion: number;
+}
+export type AuthorizationGrantStatus = "granted" | "revoked";
+/**
+ * A durable authorization grant.
+ *
+ * `grantId` identifies one authorization incarnation. Re-authorizing a subject
+ * after revocation produces a new incarnation with a new `grantId`; it never
+ * resurrects the revoked one.
+ */
+export interface AuthorizationGrant extends AuthorizationSubject {
+    readonly grantId: string;
+    readonly incarnation: number;
+    readonly status: AuthorizationGrantStatus;
+    readonly grantedAt: string;
+    readonly revokedAt?: string;
+    readonly reason?: string;
+}
+/**
+ * Durable authorization authority.
+ *
+ * Implementations must be durable and observable across processes: the store
+ * is the linearization point for authorization and revocation.
+ */
+export interface AuthorizationGrantStore {
+    /** Issue a new authorization incarnation for a subject. */
+    grant(subject: AuthorizationSubject): Promise<AuthorizationGrant>;
+    /** Revoke the current authorization incarnation for a subject. */
+    revoke(subject: AuthorizationSubject, reason?: string): Promise<AuthorizationGrant>;
+    /** The current authorization record for a subject, granted or revoked. */
+    find(subject: AuthorizationSubject): Promise<AuthorizationGrant | undefined>;
+    /** The grant with this exact incarnation identity, if it is still current. */
+    get(grantId: string): Promise<AuthorizationGrant | undefined>;
+    /** All current authorization records. */
+    list(): Promise<readonly AuthorizationGrant[]>;
+}
+/** Deterministic subject identity used to key authorization records. */
+export declare function authorizationSubjectKey(subject: AuthorizationSubject): string;
+/** Deterministic authorization incarnation identity. */
+export declare function authorizationGrantId(subject: AuthorizationSubject, incarnation: number): string;
+/**
+ * Compute the next durable authorization record for a subject.
+ *
+ * Shared by every store implementation so incarnation semantics cannot drift
+ * between the in-memory and durable authorities.
+ */
+export declare function nextAuthorizationGrant(subject: AuthorizationSubject, current: AuthorizationGrant | undefined, transition: {
+    readonly status: AuthorizationGrantStatus;
+    readonly at: string;
+    readonly reason?: string;
+}): AuthorizationGrant;
+/** In-memory authorization authority for unit tests and local runtimes. */
+export declare class MemoryAuthorizationGrantStore implements AuthorizationGrantStore {
+    #private;
+    grant(subject: AuthorizationSubject): Promise<AuthorizationGrant>;
+    revoke(subject: AuthorizationSubject, reason?: string): Promise<AuthorizationGrant>;
+    find(subject: AuthorizationSubject): Promise<AuthorizationGrant | undefined>;
+    get(grantId: string): Promise<AuthorizationGrant | undefined>;
+    list(): Promise<readonly AuthorizationGrant[]>;
+}
+/** The authorization subject a binding context describes. */
+export declare function authorizationSubjectOf(context: CapabilityBindingContext): AuthorizationSubject;
+/**
+ * Assert that an authorization incarnation is still the authoritative one.
+ *
+ * Reads durable authority, so it observes revocations committed by any process.
+ */
+export declare function assertAuthorizationGrantAuthoritative(store: AuthorizationGrantStore, subject: AuthorizationSubject, grantId: string): Promise<void>;
+/**
+ * Authorization policy backed by durable authorization authority.
+ *
+ * The policy authorizes only subjects holding an active durable grant, and
+ * attaches that grant's incarnation identity to the authorization it returns so
+ * every later execution boundary revalidates it against durable authority.
+ */
+export declare function durableAuthorizationPolicy(store: AuthorizationGrantStore): AuthorizationPolicy;
+//# sourceMappingURL=authorization-grant.d.ts.map

package/node_modules/@appport/core/dist/authorization-grant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-grant.d.ts","sourceRoot":"","sources":["../src/authorization-grant.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGH,OAAO,KAAK,EAAc,mBAAmB,EAAuB,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAEnH,kEAAkE;AAClE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC;AAED,MAAM,MAAM,wBAAwB,GAAG,SAAS,GAAG,SAAS,CAAC;AAE7D;;;;;;GAMG;AACH,MAAM,WAAW,kBAAmB,SAAQ,oBAAoB;IAC9D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;IAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,2DAA2D;IAC3D,KAAK,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAElE,kEAAkE;IAClE,MAAM,CAAC,OAAO,EAAE,oBAAoB,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAEpF,0EAA0E;IAC1E,IAAI,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAAC;IAE7E,8EAA8E;IAC9E,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAAC;IAE9D,yCAAyC;IACzC,IAAI,IAAI,OAAO,CAAC,SAAS,kBAAkB,EAAE,CAAC,CAAC;CAChD;AAED,wEAAwE;AACxE,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,oBAAoB,GAAG,MAAM,CAE7E;AAED,wDAAwD;AACxD,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAE/F;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,oBAAoB,EAC7B,OAAO,EAAE,kBAAkB,GAAG,SAAS,EACvC,UAAU,EAAE;IAAE,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GACvG,kBAAkB,CAgBpB;AAED,2EAA2E;AAC3E,qBAAa,6BAA8B,YAAW,uBAAuB;;IAGrE,KAAK,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAOjE,MAAM,CAAC,OAAO,EAAE,oBAAoB,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAOnF,IAAI,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC;IAI5E,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC;IAI7D,IAAI,IAAI,OAAO,CAAC,SAAS,kBAAkB,EAAE,CAAC;CAGrD;AAED,6DAA6D;AAC7D,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,wBAAwB,GAAG,oBAAoB,CAO9F;AAED;;;;GAIG;AACH,wBAAsB,qCAAqC,CACzD,KAAK,EAAE,uBAAuB,EAC9B,OAAO,EAAE,oBAAoB,EAC7B,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC,CAQf;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,uBAAuB,GAAG,mBAAmB,CAqB9F"}

package/node_modules/@appport/core/dist/authorization-grant.js

@@ -0,0 +1,131 @@
+/**
+ * Durable Authorization Grants and Revocation (PR41 / F5)
+ *
+ * Authorization is a durable authority relationship, not a fact about a
+ * process. A grant records that one consumer incarnation may use one
+ * capability from one provider; revoking it makes that relationship
+ * non-authoritative for every later execution boundary.
+ *
+ * REVOCATION LINEARIZATION POINT
+ * ------------------------------
+ * A revocation becomes authoritative the moment the durable authorization
+ * record commits in the authority store. Everything after that commit — a new
+ * binding, a materialization, a durable state commit, a successful ledger
+ * completion — must observe the revocation. Nothing before it is retroactively
+ * invalidated.
+ *
+ * IN-FLIGHT SEMANTICS
+ * -------------------
+ * Revocation does not terminate a WASM instance that is already running.
+ * It invalidates the authority the execution depends on, so the execution
+ * cannot produce a durable effect (state commit or successful ledger record)
+ * attributable to the revoked relationship. See
+ * `docs/architecture/authorization-revocation.md`.
+ */
+import { attestAuthorization } from "./authority-attestation.js";
+/** Deterministic subject identity used to key authorization records. */
+export function authorizationSubjectKey(subject) {
+    return `${subject.consumerId}::${subject.providerId}::${subject.capabilityName}@${subject.capabilityVersion}`;
+}
+/** Deterministic authorization incarnation identity. */
+export function authorizationGrantId(subject, incarnation) {
+    return `grant_${authorizationSubjectKey(subject)}#${incarnation}`;
+}
+/**
+ * Compute the next durable authorization record for a subject.
+ *
+ * Shared by every store implementation so incarnation semantics cannot drift
+ * between the in-memory and durable authorities.
+ */
+export function nextAuthorizationGrant(subject, current, transition) {
+    if (transition.status === "revoked") {
+        if (!current || current.status !== "granted") {
+            throw new Error(`Cannot revoke authorization "${authorizationSubjectKey(subject)}": no active grant`);
+        }
+        return { ...current, status: "revoked", revokedAt: transition.at, ...(transition.reason ? { reason: transition.reason } : {}) };
+    }
+    const incarnation = (current?.incarnation ?? 0) + 1;
+    return {
+        ...subject,
+        grantId: authorizationGrantId(subject, incarnation),
+        incarnation,
+        status: "granted",
+        grantedAt: transition.at
+    };
+}
+/** In-memory authorization authority for unit tests and local runtimes. */
+export class MemoryAuthorizationGrantStore {
+    #grants = new Map();
+    async grant(subject) {
+        const key = authorizationSubjectKey(subject);
+        const grant = nextAuthorizationGrant(subject, this.#grants.get(key), { status: "granted", at: new Date().toISOString() });
+        this.#grants.set(key, grant);
+        return grant;
+    }
+    async revoke(subject, reason) {
+        const key = authorizationSubjectKey(subject);
+        const revoked = nextAuthorizationGrant(subject, this.#grants.get(key), { status: "revoked", at: new Date().toISOString(), reason });
+        this.#grants.set(key, revoked);
+        return revoked;
+    }
+    async find(subject) {
+        return this.#grants.get(authorizationSubjectKey(subject));
+    }
+    async get(grantId) {
+        return [...this.#grants.values()].find((grant) => grant.grantId === grantId);
+    }
+    async list() {
+        return [...this.#grants.values()].sort((a, b) => a.grantId.localeCompare(b.grantId));
+    }
+}
+/** The authorization subject a binding context describes. */
+export function authorizationSubjectOf(context) {
+    return {
+        consumerId: context.consumer.id,
+        providerId: context.provider.id,
+        capabilityName: context.capabilityName,
+        capabilityVersion: context.capabilityVersion
+    };
+}
+/**
+ * Assert that an authorization incarnation is still the authoritative one.
+ *
+ * Reads durable authority, so it observes revocations committed by any process.
+ */
+export async function assertAuthorizationGrantAuthoritative(store, subject, grantId) {
+    const current = await store.find(subject);
+    if (!current || current.grantId !== grantId) {
+        throw new Error(`Authorization grant "${grantId}" has been superseded and is no longer authoritative`);
+    }
+    if (current.status !== "granted") {
+        throw new Error(`Authorization grant "${grantId}" has been revoked and is no longer authoritative`);
+    }
+}
+/**
+ * Authorization policy backed by durable authorization authority.
+ *
+ * The policy authorizes only subjects holding an active durable grant, and
+ * attaches that grant's incarnation identity to the authorization it returns so
+ * every later execution boundary revalidates it against durable authority.
+ */
+export function durableAuthorizationPolicy(store) {
+    return {
+        async evaluate(context) {
+            const subject = authorizationSubjectOf(context);
+            const grant = await store.find(subject);
+            if (!grant || grant.status !== "granted") {
+                return {
+                    kind: "denied",
+                    reason: "policy_denied",
+                    message: grant
+                        ? `Authorization for "${authorizationSubjectKey(subject)}" was revoked`
+                        : `No authorization has been granted for "${authorizationSubjectKey(subject)}"`
+                };
+            }
+            const authorization = { kind: "authorized", grantedScopes: [`${subject.capabilityName}@${subject.capabilityVersion}`] };
+            attestAuthorization(authorization, () => assertAuthorizationGrantAuthoritative(store, subject, grant.grantId));
+            return authorization;
+        }
+    };
+}
+//# sourceMappingURL=authorization-grant.js.map

package/node_modules/@appport/core/dist/authorization-grant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-grant.js","sourceRoot":"","sources":["../src/authorization-grant.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAoDjE,wEAAwE;AACxE,MAAM,UAAU,uBAAuB,CAAC,OAA6B;IACnE,OAAO,GAAG,OAAO,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU,KAAK,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;AAChH,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,oBAAoB,CAAC,OAA6B,EAAE,WAAmB;IACrF,OAAO,SAAS,uBAAuB,CAAC,OAAO,CAAC,IAAI,WAAW,EAAE,CAAC;AACpE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAA6B,EAC7B,OAAuC,EACvC,UAAwG;IAExG,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACpC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,gCAAgC,uBAAuB,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;QACxG,CAAC;QACD,OAAO,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAClI,CAAC;IAED,MAAM,WAAW,GAAG,CAAC,OAAO,EAAE,WAAW,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACpD,OAAO;QACL,GAAG,OAAO;QACV,OAAO,EAAE,oBAAoB,CAAC,OAAO,EAAE,WAAW,CAAC;QACnD,WAAW;QACX,MAAM,EAAE,SAAS;QACjB,SAAS,EAAE,UAAU,CAAC,EAAE;KACzB,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,MAAM,OAAO,6BAA6B;IAC/B,OAAO,GAAG,IAAI,GAAG,EAA8B,CAAC;IAEzD,KAAK,CAAC,KAAK,CAAC,OAA6B;QACvC,MAAM,GAAG,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,KAAK,GAAG,sBAAsB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAC1H,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC7B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAA6B,EAAE,MAAe;QACzD,MAAM,GAAG,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,sBAAsB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACpI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC/B,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAA6B;QACtC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,OAAe;QACvB,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;IAC/E,CAAC;IAED,KAAK,CAAC,IAAI;QACR,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACvF,CAAC;CACF;AAED,6DAA6D;AAC7D,MAAM,UAAU,sBAAsB,CAAC,OAAiC;IACtE,OAAO;QACL,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE;QAC/B,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE;QAC/B,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;KAC7C,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qCAAqC,CACzD,KAA8B,EAC9B,OAA6B,EAC7B,OAAe;IAEf,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,wBAAwB,OAAO,sDAAsD,CAAC,CAAC;IACzG,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,wBAAwB,OAAO,mDAAmD,CAAC,CAAC;IACtG,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAA8B;IACvE,OAAO;QACL,KAAK,CAAC,QAAQ,CAAC,OAAiC;YAC9C,MAAM,OAAO,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;YAChD,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAExC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzC,OAAO;oBACL,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,eAAe;oBACvB,OAAO,EAAE,KAAK;wBACZ,CAAC,CAAC,sBAAsB,uBAAuB,CAAC,OAAO,CAAC,eAAe;wBACvE,CAAC,CAAC,0CAA0C,uBAAuB,CAAC,OAAO,CAAC,GAAG;iBAClF,CAAC;YACJ,CAAC;YAED,MAAM,aAAa,GAAe,EAAE,IAAI,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC,GAAG,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC,EAAE,CAAC;YACpI,mBAAmB,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,qCAAqC,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAC/G,OAAO,aAAa,CAAC;QACvB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/node_modules/@appport/core/dist/binding.d.ts

@@ -0,0 +1,294 @@
+/**
+ * Authorization-Aware Capability Binding (PR23)
+ *
+ * Builds on PR22's deterministic dependency resolver to introduce a clean
+ * authorization boundary: resolved requirements are evaluated for authorization,
+ * and only authorized requirements produce bindings.
+ *
+ * Key architectural invariant:
+ * DISCOVER → COMPATIBLE → RESOLVED → AUTHORIZED → BOUND → [STOP, don't invoke]
+ *
+ * Authorization is a policy-driven decision applied to resolved requirements only.
+ * Unresolved and ambiguous requirements bypass authorization entirely.
+ */
+import type { ApplicationState } from "./state.js";
+import type { ResolvedRequirement, UnresolvedRequirement, AmbiguousRequirement } from "./resolver.js";
+/**
+ * Capability Binding Context: the semantic participants in an authorization decision.
+ *
+ * Captures consumer identity, provider identity, and capability information
+ * sufficient for authorization policy evaluation.
+ *
+ * CRITICAL: This is NOT a runtime context. It contains no:
+ * - Handlers
+ * - Functions
+ * - Closures
+ * - Runtime objects
+ * - Credentials
+ * - Secrets
+ * - Database handles
+ * - Process IDs
+ */
+export interface CapabilityBindingContext {
+    /** The consumer application requiring the capability. */
+    readonly consumer: ApplicationState;
+    /** The provider application offering the capability. */
+    readonly provider: ApplicationState;
+    /** The capability name (e.g., "invoice.create"). */
+    readonly capabilityName: string;
+    /** The capability version being consumed. */
+    readonly capabilityVersion: number;
+    /** Optional scopes/permissions the consumer requests. */
+    readonly requestedScopes?: readonly string[];
+    /** Optional consumer profile/role for policy evaluation. */
+    readonly consumerProfile?: {
+        readonly role?: string;
+        readonly tags?: readonly string[];
+    };
+}
+/**
+ * Explicit authorization decision result.
+ *
+ * Authorization must not collapse to a boolean. Denials must be diagnosable.
+ */
+export type AuthorizationResult = Authorized | Denied;
+/**
+ * Authorized: the binding is permitted.
+ */
+export interface Authorized {
+    readonly kind: "authorized";
+    /** Effective scopes/permissions granted to the consumer for this capability. */
+    readonly grantedScopes?: readonly string[];
+}
+/**
+ * Denied: the binding is not permitted.
+ *
+ * Reasons must be explicit so observability systems can understand why
+ * authorization failed.
+ */
+export interface Denied {
+    readonly kind: "denied";
+    /** High-level denial reason code. */
+    readonly reason: "consumer_not_trusted" | "capability_not_permitted" | "scope_not_permitted" | "provider_not_authorized" | "policy_denied" | "other";
+    /** Detailed explanation for diagnostics. */
+    readonly message: string;
+}
+/**
+ * Authorized Capability Binding: the metadata relationship between
+ * consumer, provider, and capability after successful authorization.
+ *
+ * This is NOT an invocation credential or execution handle.
+ * It is the semantic relationship: "this consumer is authorized to use this capability from this provider."
+ *
+ * Binding is:
+ * - Deterministic: same inputs produce same binding
+ * - Immutable: binding is data, not state
+ * - Side-effect free: creating a binding executes nothing
+ * - Identifiable: bindings can be uniquely identified by their participants
+ *
+ * CRITICAL: This contains no:
+ * - Handlers
+ * - Functions
+ * - Closures
+ * - Runtime objects
+ * - Credentials
+ * - Secrets
+ * - Process IDs
+ * - Timestamps (use resolution context if needed)
+ */
+export interface AuthorizedCapabilityBinding {
+    /** The consumer application. */
+    readonly consumer: ApplicationState;
+    /** The resolved requirement that triggered binding. */
+    readonly requirement: ResolvedRequirement["requirement"];
+    /** The provider application. */
+    readonly provider: ApplicationState;
+    /** The consumed capability. */
+    readonly capability: {
+        readonly name: string;
+        readonly version: number;
+    };
+    /** The authorization result that permitted the binding. */
+    readonly authorization: Authorized;
+    /** Optional binding identity: deterministically derived from participants. */
+    readonly bindingId?: string;
+}
+/** Throws unless the exact binding object was issued by CapabilityBinder. */
+export declare function assertIssuedAuthorizedBinding(binding: AuthorizedCapabilityBinding): void;
+/**
+ * Authorization Policy: injectable decision logic for capability binding.
+ *
+ * Policies evaluate whether a consumer is permitted to use a provider's capability.
+ *
+ * Policies must be:
+ * - Side-effect free: no DB calls, network, or mutations
+ * - Deterministic: same context produces same result
+ * - Efficient: authorization blocks binding, so policy must be fast
+ * - Stateless: receive all needed context as parameters
+ *
+ * Policies should reuse the canonical AppPort authorization semantics
+ * (from @appport/authorization) rather than inventing new ones.
+ */
+export interface AuthorizationPolicy {
+    /**
+     * Evaluate whether a binding is authorized.
+     *
+     * Returns Authorized if permitted, or Denied with explicit reason if not.
+     *
+     * Must not:
+     * - Execute application code
+     * - Invoke providers
+     * - Mutate state
+     * - Make network calls
+     * - Access runtime objects
+     */
+    evaluate(context: CapabilityBindingContext): AuthorizationResult | Promise<AuthorizationResult>;
+}
+/**
+ * Full binding result for a single resolved requirement.
+ */
+export type BindingResult = AuthorizedBindingResult | DeniedBindingResult;
+/**
+ * Binding result: requirement was resolved and authorized.
+ */
+export interface AuthorizedBindingResult {
+    readonly kind: "authorized";
+    readonly binding: AuthorizedCapabilityBinding;
+}
+/**
+ * Binding result: requirement was resolved but authorization failed.
+ */
+export interface DeniedBindingResult {
+    readonly kind: "denied";
+    readonly requirement: ResolvedRequirement["requirement"];
+    readonly provider: ApplicationState;
+    readonly authorization: Denied;
+}
+/**
+ * Binding result: requirement was not resolved.
+ *
+ * Unresolved and ambiguous requirements bypass authorization entirely.
+ * There is nothing to authorize when resolution fails.
+ */
+export type UnboundResult = UnresolvedRequirement | AmbiguousRequirement;
+/**
+ * Application binding result: complete binding state for an application's requirements.
+ *
+ * Preserves the distinction between:
+ * - AUTHORIZED: resolved and authorized
+ * - DENIED: resolved but authorization failed
+ * - UNRESOLVED: no compatible provider found
+ * - AMBIGUOUS: multiple equally-valid providers
+ */
+export interface ApplicationBindingResult {
+    readonly application: ApplicationState;
+    /** Authorized bindings. */
+    readonly authorized: readonly AuthorizedCapabilityBinding[];
+    /** Denied bindings (resolved but not authorized). */
+    readonly denied: readonly DeniedBindingResult[];
+    /** Unresolved requirements. */
+    readonly unresolved: readonly UnresolvedRequirement[];
+    /** Ambiguous requirements. */
+    readonly ambiguous: readonly AmbiguousRequirement[];
+    /** All results in order. */
+    readonly results: readonly (BindingResult | UnboundResult)[];
+}
+/**
+ * Default Authorization Policy: permits all authorized consumers.
+ *
+ * This policy checks the consumer's authorization profile against the capability's
+ * authorization requirements. It reuses the canonical AppPort permission semantics.
+ *
+ * For simple use cases and testing, this is often sufficient.
+ * For complex policies (trust services, scope-aware rules, etc.), provide a custom policy.
+ */
+export declare function defaultAuthorizationPolicy(): AuthorizationPolicy;
+/**
+ * Allow-all Authorization Policy: permits every binding.
+ *
+ * Appropriate for local single-user runtimes and tests.
+ * Never appropriate for multi-principal deployments.
+ */
+export declare function allowAllAuthorizationPolicy(): AuthorizationPolicy;
+/**
+ * Permission-based Authorization Policy: consumer must have required permissions.
+ *
+ * Reuses the canonical @appport/authorization permission semantics.
+ * A consumer has a set of granted permissions. A capability declares required permissions.
+ * The consumer must have all required permissions.
+ *
+ * Supports wildcard permissions (e.g., "documents.*" matches "documents.read").
+ */
+export declare function permissionAuthorizationPolicy(options: {
+    /** Resolve permissions for a consumer. */
+    resolvePermissions: (consumer: ApplicationState, provider: ApplicationState) => readonly string[] | Promise<readonly string[]>;
+}): AuthorizationPolicy;
+/**
+ * Deterministic Binding Identity
+ *
+ * Generates a deterministic identifier for a binding based on its semantic participants.
+ * Used to detect when the same binding would be created multiple times.
+ *
+ * Binding identity is deterministically derived from:
+ * - Consumer application ID
+ * - Requirement name
+ * - Provider application ID
+ * - Capability name + version
+ *
+ * Does NOT use:
+ * - Object identity
+ * - Process ID
+ * - Timestamp
+ * - Random UUID
+ * - Handler identity
+ */
+export declare function computeBindingId(binding: {
+    consumer: ApplicationState;
+    requirement: ResolvedRequirement["requirement"];
+    provider: ApplicationState;
+    capabilityName: string;
+    capabilityVersion: number;
+}): string;
+/**
+ * Capability Binder: Orchestrates authorization-aware capability binding.
+ *
+ * Flow:
+ * 1. Accept resolution results from ApplicationDependencyResolver
+ * 2. For each resolved requirement, evaluate authorization policy
+ * 3. Produce authorized bindings or explicit denials
+ * 4. Preserve unresolved/ambiguous as-is (they bypass authorization)
+ *
+ * The binder is:
+ * - Policy-driven: authorization logic is injected
+ * - Side-effect free: no DB, handlers, or runtime invocation
+ * - Deterministic: same input produces same binding
+ * - Stateless: receives all context as parameters
+ */
+export declare class CapabilityBinder {
+    #private;
+    constructor(policy?: AuthorizationPolicy);
+    /**
+     * Bind a single resolved requirement.
+     *
+     * Returns either an authorized binding or an explicit denial.
+     *
+     * Precondition: result must be a resolved requirement.
+     * This binder does not handle unresolved/ambiguous requirements.
+     */
+    bindResolution(consumer: ApplicationState, result: ResolvedRequirement): Promise<BindingResult>;
+    /**
+     * Bind all resolvable requirements for an application.
+     *
+     * Accepts the results from ApplicationDependencyResolver and produces
+     * a complete application binding result.
+     *
+     * Flow for each requirement:
+     * - resolved → evaluate authorization → authorized binding or explicit denial
+     * - unresolved → pass through as-is (nothing to authorize)
+     * - ambiguous → pass through as-is (nothing to authorize)
+     *
+     * Returns a complete ApplicationBindingResult preserving all states.
+     */
+    bindApplication(consumer: ApplicationState, resolutionResults: readonly (ResolvedRequirement | UnresolvedRequirement | AmbiguousRequirement)[]): Promise<ApplicationBindingResult>;
+}
+//# sourceMappingURL=binding.d.ts.map

package/node_modules/@appport/core/dist/binding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"binding.d.ts","sourceRoot":"","sources":["../src/binding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,KAAK,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAGtG;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,wBAAwB;IACvC,yDAAyD;IACzD,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IAEpC,wDAAwD;IACxD,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IAEpC,oDAAoD;IACpD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAEhC,6CAA6C;IAC7C,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IAEnC,yDAAyD;IACzD,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAE7C,4DAA4D;IAC5D,QAAQ,CAAC,eAAe,CAAC,EAAE;QACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;KACnC,CAAC;CACH;AAED;;;;GAIG;AACH,MAAM,MAAM,mBAAmB,GAAG,UAAU,GAAG,MAAM,CAAC;AAEtD;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAE5B,gFAAgF;IAChF,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5C;AAED;;;;;GAKG;AACH,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAExB,qCAAqC;IACrC,QAAQ,CAAC,MAAM,EAAE,sBAAsB,GAAG,0BAA0B,GAAG,qBAAqB,GAAG,yBAAyB,GAAG,eAAe,GAAG,OAAO,CAAC;IAErJ,4CAA4C;IAC5C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,WAAW,2BAA2B;IAC1C,gCAAgC;IAChC,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IAEpC,uDAAuD;IACvD,QAAQ,CAAC,WAAW,EAAE,mBAAmB,CAAC,aAAa,CAAC,CAAC;IAEzD,gCAAgC;IAChC,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IAEpC,+BAA+B;IAC/B,QAAQ,CAAC,UAAU,EAAE;QACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;KAC1B,CAAC;IAEF,2DAA2D;IAC3D,QAAQ,CAAC,aAAa,EAAE,UAAU,CAAC;IAEnC,8EAA8E;IAC9E,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAOD,6EAA6E;AAC7E,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,2BAA2B,GAAG,IAAI,CAIxF;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,OAAO,EAAE,wBAAwB,GAAG,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;CACjG;AAED;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG,uBAAuB,GAAG,mBAAmB,CAAC;AAE1E;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,2BAA2B,CAAC;CAC/C;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,mBAAmB,CAAC,aAAa,CAAC,CAAC;IACzD,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG,qBAAqB,GAAG,oBAAoB,CAAC;AAEzE;;;;;;;;GAQG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IAEvC,2BAA2B;IAC3B,QAAQ,CAAC,UAAU,EAAE,SAAS,2BAA2B,EAAE,CAAC;IAE5D,qDAAqD;IACrD,QAAQ,CAAC,MAAM,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAEhD,+BAA+B;IAC/B,QAAQ,CAAC,UAAU,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAEtD,8BAA8B;IAC9B,QAAQ,CAAC,SAAS,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAEpD,4BAA4B;IAC5B,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,aAAa,GAAG,aAAa,CAAC,EAAE,CAAC;CAC9D;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,IAAI,mBAAmB,CAShE;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,IAAI,mBAAmB,CAMjE;AAED;;;;;;;;GAQG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAAE;IACrD,0CAA0C;IAC1C,kBAAkB,EAAE,CAAC,QAAQ,EAAE,gBAAgB,EAAE,QAAQ,EAAE,gBAAgB,KAAK,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;CAChI,GAAG,mBAAmB,CAkBtB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE;IACxC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,WAAW,EAAE,mBAAmB,CAAC,aAAa,CAAC,CAAC;IAChD,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,EAAE,MAAM,CAAC;CAC3B,GAAG,MAAM,CAQT;AA0BD;;;;;;;;;;;;;;GAcG;AACH,qBAAa,gBAAgB;;gBAGf,MAAM,GAAE,mBAAkD;IAItE;;;;;;;OAOG;IACG,cAAc,CAAC,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,aAAa,CAAC;IAyDrG;;;;;;;;;;;;OAYG;IACG,eAAe,CAAC,QAAQ,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,SAAS,CAAC,mBAAmB,GAAG,qBAAqB,GAAG,oBAAoB,CAAC,EAAE,GAAG,OAAO,CAAC,wBAAwB,CAAC;CAsCzL"}