@appport/sdk 1.1.17 → 1.1.19

package/vendor/@appport/core/dist/authorization-grant.d.ts

@@ -1,107 +0,0 @@
-/**
- * Durable Authorization Grants and Revocation (PR41 / F5)
- *
- * Authorization is a durable authority relationship, not a fact about a
- * process. A grant records that one consumer incarnation may use one
- * capability from one provider; revoking it makes that relationship
- * non-authoritative for every later execution boundary.
- *
- * REVOCATION LINEARIZATION POINT
- * ------------------------------
- * A revocation becomes authoritative the moment the durable authorization
- * record commits in the authority store. Everything after that commit — a new
- * binding, a materialization, a durable state commit, a successful ledger
- * completion — must observe the revocation. Nothing before it is retroactively
- * invalidated.
- *
- * IN-FLIGHT SEMANTICS
- * -------------------
- * Revocation does not terminate a WASM instance that is already running.
- * It invalidates the authority the execution depends on, so the execution
- * cannot produce a durable effect (state commit or successful ledger record)
- * attributable to the revoked relationship. See
- * `docs/architecture/authorization-revocation.md`.
- */
-import type { AuthorizationPolicy, CapabilityBindingContext } from "./binding.js";
-/** The semantic participants of an authorization relationship. */
-export interface AuthorizationSubject {
-    readonly consumerId: string;
-    readonly providerId: string;
-    readonly capabilityName: string;
-    readonly capabilityVersion: number;
-}
-export type AuthorizationGrantStatus = "granted" | "revoked";
-/**
- * A durable authorization grant.
- *
- * `grantId` identifies one authorization incarnation. Re-authorizing a subject
- * after revocation produces a new incarnation with a new `grantId`; it never
- * resurrects the revoked one.
- */
-export interface AuthorizationGrant extends AuthorizationSubject {
-    readonly grantId: string;
-    readonly incarnation: number;
-    readonly status: AuthorizationGrantStatus;
-    readonly grantedAt: string;
-    readonly revokedAt?: string;
-    readonly reason?: string;
-}
-/**
- * Durable authorization authority.
- *
- * Implementations must be durable and observable across processes: the store
- * is the linearization point for authorization and revocation.
- */
-export interface AuthorizationGrantStore {
-    /** Issue a new authorization incarnation for a subject. */
-    grant(subject: AuthorizationSubject): Promise<AuthorizationGrant>;
-    /** Revoke the current authorization incarnation for a subject. */
-    revoke(subject: AuthorizationSubject, reason?: string): Promise<AuthorizationGrant>;
-    /** The current authorization record for a subject, granted or revoked. */
-    find(subject: AuthorizationSubject): Promise<AuthorizationGrant | undefined>;
-    /** The grant with this exact incarnation identity, if it is still current. */
-    get(grantId: string): Promise<AuthorizationGrant | undefined>;
-    /** All current authorization records. */
-    list(): Promise<readonly AuthorizationGrant[]>;
-}
-/** Deterministic subject identity used to key authorization records. */
-export declare function authorizationSubjectKey(subject: AuthorizationSubject): string;
-/** Deterministic authorization incarnation identity. */
-export declare function authorizationGrantId(subject: AuthorizationSubject, incarnation: number): string;
-/**
- * Compute the next durable authorization record for a subject.
- *
- * Shared by every store implementation so incarnation semantics cannot drift
- * between the in-memory and durable authorities.
- */
-export declare function nextAuthorizationGrant(subject: AuthorizationSubject, current: AuthorizationGrant | undefined, transition: {
-    readonly status: AuthorizationGrantStatus;
-    readonly at: string;
-    readonly reason?: string;
-}): AuthorizationGrant;
-/** In-memory authorization authority for unit tests and local runtimes. */
-export declare class MemoryAuthorizationGrantStore implements AuthorizationGrantStore {
-    #private;
-    grant(subject: AuthorizationSubject): Promise<AuthorizationGrant>;
-    revoke(subject: AuthorizationSubject, reason?: string): Promise<AuthorizationGrant>;
-    find(subject: AuthorizationSubject): Promise<AuthorizationGrant | undefined>;
-    get(grantId: string): Promise<AuthorizationGrant | undefined>;
-    list(): Promise<readonly AuthorizationGrant[]>;
-}
-/** The authorization subject a binding context describes. */
-export declare function authorizationSubjectOf(context: CapabilityBindingContext): AuthorizationSubject;
-/**
- * Assert that an authorization incarnation is still the authoritative one.
- *
- * Reads durable authority, so it observes revocations committed by any process.
- */
-export declare function assertAuthorizationGrantAuthoritative(store: AuthorizationGrantStore, subject: AuthorizationSubject, grantId: string): Promise<void>;
-/**
- * Authorization policy backed by durable authorization authority.
- *
- * The policy authorizes only subjects holding an active durable grant, and
- * attaches that grant's incarnation identity to the authorization it returns so
- * every later execution boundary revalidates it against durable authority.
- */
-export declare function durableAuthorizationPolicy(store: AuthorizationGrantStore): AuthorizationPolicy;
-//# sourceMappingURL=authorization-grant.d.ts.map

package/vendor/@appport/core/dist/authorization-grant.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"authorization-grant.d.ts","sourceRoot":"","sources":["../src/authorization-grant.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGH,OAAO,KAAK,EAAc,mBAAmB,EAAuB,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAEnH,kEAAkE;AAClE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC;AAED,MAAM,MAAM,wBAAwB,GAAG,SAAS,GAAG,SAAS,CAAC;AAE7D;;;;;;GAMG;AACH,MAAM,WAAW,kBAAmB,SAAQ,oBAAoB;IAC9D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;IAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,2DAA2D;IAC3D,KAAK,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAElE,kEAAkE;IAClE,MAAM,CAAC,OAAO,EAAE,oBAAoB,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAEpF,0EAA0E;IAC1E,IAAI,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAAC;IAE7E,8EAA8E;IAC9E,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAAC;IAE9D,yCAAyC;IACzC,IAAI,IAAI,OAAO,CAAC,SAAS,kBAAkB,EAAE,CAAC,CAAC;CAChD;AAED,wEAAwE;AACxE,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,oBAAoB,GAAG,MAAM,CAE7E;AAED,wDAAwD;AACxD,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAE/F;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,oBAAoB,EAC7B,OAAO,EAAE,kBAAkB,GAAG,SAAS,EACvC,UAAU,EAAE;IAAE,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GACvG,kBAAkB,CAgBpB;AAED,2EAA2E;AAC3E,qBAAa,6BAA8B,YAAW,uBAAuB;;IAGrE,KAAK,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAOjE,MAAM,CAAC,OAAO,EAAE,oBAAoB,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAOnF,IAAI,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC;IAI5E,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC;IAI7D,IAAI,IAAI,OAAO,CAAC,SAAS,kBAAkB,EAAE,CAAC;CAGrD;AAED,6DAA6D;AAC7D,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,wBAAwB,GAAG,oBAAoB,CAO9F;AAED;;;;GAIG;AACH,wBAAsB,qCAAqC,CACzD,KAAK,EAAE,uBAAuB,EAC9B,OAAO,EAAE,oBAAoB,EAC7B,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC,CAQf;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,uBAAuB,GAAG,mBAAmB,CAqB9F"}

package/vendor/@appport/core/dist/authorization-grant.js

@@ -1,131 +0,0 @@
-/**
- * Durable Authorization Grants and Revocation (PR41 / F5)
- *
- * Authorization is a durable authority relationship, not a fact about a
- * process. A grant records that one consumer incarnation may use one
- * capability from one provider; revoking it makes that relationship
- * non-authoritative for every later execution boundary.
- *
- * REVOCATION LINEARIZATION POINT
- * ------------------------------
- * A revocation becomes authoritative the moment the durable authorization
- * record commits in the authority store. Everything after that commit — a new
- * binding, a materialization, a durable state commit, a successful ledger
- * completion — must observe the revocation. Nothing before it is retroactively
- * invalidated.
- *
- * IN-FLIGHT SEMANTICS
- * -------------------
- * Revocation does not terminate a WASM instance that is already running.
- * It invalidates the authority the execution depends on, so the execution
- * cannot produce a durable effect (state commit or successful ledger record)
- * attributable to the revoked relationship. See
- * `docs/architecture/authorization-revocation.md`.
- */
-import { attestAuthorization } from "./authority-attestation.js";
-/** Deterministic subject identity used to key authorization records. */
-export function authorizationSubjectKey(subject) {
-    return `${subject.consumerId}::${subject.providerId}::${subject.capabilityName}@${subject.capabilityVersion}`;
-}
-/** Deterministic authorization incarnation identity. */
-export function authorizationGrantId(subject, incarnation) {
-    return `grant_${authorizationSubjectKey(subject)}#${incarnation}`;
-}
-/**
- * Compute the next durable authorization record for a subject.
- *
- * Shared by every store implementation so incarnation semantics cannot drift
- * between the in-memory and durable authorities.
- */
-export function nextAuthorizationGrant(subject, current, transition) {
-    if (transition.status === "revoked") {
-        if (!current || current.status !== "granted") {
-            throw new Error(`Cannot revoke authorization "${authorizationSubjectKey(subject)}": no active grant`);
-        }
-        return { ...current, status: "revoked", revokedAt: transition.at, ...(transition.reason ? { reason: transition.reason } : {}) };
-    }
-    const incarnation = (current?.incarnation ?? 0) + 1;
-    return {
-        ...subject,
-        grantId: authorizationGrantId(subject, incarnation),
-        incarnation,
-        status: "granted",
-        grantedAt: transition.at
-    };
-}
-/** In-memory authorization authority for unit tests and local runtimes. */
-export class MemoryAuthorizationGrantStore {
-    #grants = new Map();
-    async grant(subject) {
-        const key = authorizationSubjectKey(subject);
-        const grant = nextAuthorizationGrant(subject, this.#grants.get(key), { status: "granted", at: new Date().toISOString() });
-        this.#grants.set(key, grant);
-        return grant;
-    }
-    async revoke(subject, reason) {
-        const key = authorizationSubjectKey(subject);
-        const revoked = nextAuthorizationGrant(subject, this.#grants.get(key), { status: "revoked", at: new Date().toISOString(), reason });
-        this.#grants.set(key, revoked);
-        return revoked;
-    }
-    async find(subject) {
-        return this.#grants.get(authorizationSubjectKey(subject));
-    }
-    async get(grantId) {
-        return [...this.#grants.values()].find((grant) => grant.grantId === grantId);
-    }
-    async list() {
-        return [...this.#grants.values()].sort((a, b) => a.grantId.localeCompare(b.grantId));
-    }
-}
-/** The authorization subject a binding context describes. */
-export function authorizationSubjectOf(context) {
-    return {
-        consumerId: context.consumer.id,
-        providerId: context.provider.id,
-        capabilityName: context.capabilityName,
-        capabilityVersion: context.capabilityVersion
-    };
-}
-/**
- * Assert that an authorization incarnation is still the authoritative one.
- *
- * Reads durable authority, so it observes revocations committed by any process.
- */
-export async function assertAuthorizationGrantAuthoritative(store, subject, grantId) {
-    const current = await store.find(subject);
-    if (!current || current.grantId !== grantId) {
-        throw new Error(`Authorization grant "${grantId}" has been superseded and is no longer authoritative`);
-    }
-    if (current.status !== "granted") {
-        throw new Error(`Authorization grant "${grantId}" has been revoked and is no longer authoritative`);
-    }
-}
-/**
- * Authorization policy backed by durable authorization authority.
- *
- * The policy authorizes only subjects holding an active durable grant, and
- * attaches that grant's incarnation identity to the authorization it returns so
- * every later execution boundary revalidates it against durable authority.
- */
-export function durableAuthorizationPolicy(store) {
-    return {
-        async evaluate(context) {
-            const subject = authorizationSubjectOf(context);
-            const grant = await store.find(subject);
-            if (!grant || grant.status !== "granted") {
-                return {
-                    kind: "denied",
-                    reason: "policy_denied",
-                    message: grant
-                        ? `Authorization for "${authorizationSubjectKey(subject)}" was revoked`
-                        : `No authorization has been granted for "${authorizationSubjectKey(subject)}"`
-                };
-            }
-            const authorization = { kind: "authorized", grantedScopes: [`${subject.capabilityName}@${subject.capabilityVersion}`] };
-            attestAuthorization(authorization, () => assertAuthorizationGrantAuthoritative(store, subject, grant.grantId));
-            return authorization;
-        }
-    };
-}
-//# sourceMappingURL=authorization-grant.js.map

package/vendor/@appport/core/dist/authorization-grant.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"authorization-grant.js","sourceRoot":"","sources":["../src/authorization-grant.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAoDjE,wEAAwE;AACxE,MAAM,UAAU,uBAAuB,CAAC,OAA6B;IACnE,OAAO,GAAG,OAAO,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU,KAAK,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;AAChH,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,oBAAoB,CAAC,OAA6B,EAAE,WAAmB;IACrF,OAAO,SAAS,uBAAuB,CAAC,OAAO,CAAC,IAAI,WAAW,EAAE,CAAC;AACpE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAA6B,EAC7B,OAAuC,EACvC,UAAwG;IAExG,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACpC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,gCAAgC,uBAAuB,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;QACxG,CAAC;QACD,OAAO,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAClI,CAAC;IAED,MAAM,WAAW,GAAG,CAAC,OAAO,EAAE,WAAW,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACpD,OAAO;QACL,GAAG,OAAO;QACV,OAAO,EAAE,oBAAoB,CAAC,OAAO,EAAE,WAAW,CAAC;QACnD,WAAW;QACX,MAAM,EAAE,SAAS;QACjB,SAAS,EAAE,UAAU,CAAC,EAAE;KACzB,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,MAAM,OAAO,6BAA6B;IAC/B,OAAO,GAAG,IAAI,GAAG,EAA8B,CAAC;IAEzD,KAAK,CAAC,KAAK,CAAC,OAA6B;QACvC,MAAM,GAAG,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,KAAK,GAAG,sBAAsB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAC1H,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC7B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAA6B,EAAE,MAAe;QACzD,MAAM,GAAG,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,sBAAsB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACpI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC/B,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAA6B;QACtC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,OAAe;QACvB,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;IAC/E,CAAC;IAED,KAAK,CAAC,IAAI;QACR,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACvF,CAAC;CACF;AAED,6DAA6D;AAC7D,MAAM,UAAU,sBAAsB,CAAC,OAAiC;IACtE,OAAO;QACL,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE;QAC/B,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE;QAC/B,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;KAC7C,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qCAAqC,CACzD,KAA8B,EAC9B,OAA6B,EAC7B,OAAe;IAEf,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,wBAAwB,OAAO,sDAAsD,CAAC,CAAC;IACzG,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,wBAAwB,OAAO,mDAAmD,CAAC,CAAC;IACtG,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAA8B;IACvE,OAAO;QACL,KAAK,CAAC,QAAQ,CAAC,OAAiC;YAC9C,MAAM,OAAO,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;YAChD,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAExC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzC,OAAO;oBACL,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,eAAe;oBACvB,OAAO,EAAE,KAAK;wBACZ,CAAC,CAAC,sBAAsB,uBAAuB,CAAC,OAAO,CAAC,eAAe;wBACvE,CAAC,CAAC,0CAA0C,uBAAuB,CAAC,OAAO,CAAC,GAAG;iBAClF,CAAC;YACJ,CAAC;YAED,MAAM,aAAa,GAAe,EAAE,IAAI,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC,GAAG,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC,EAAE,CAAC;YACpI,mBAAmB,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,qCAAqC,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAC/G,OAAO,aAAa,CAAC;QACvB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/vendor/@appport/core/dist/binding.d.ts

@@ -1,294 +0,0 @@
-/**
- * Authorization-Aware Capability Binding (PR23)
- *
- * Builds on PR22's deterministic dependency resolver to introduce a clean
- * authorization boundary: resolved requirements are evaluated for authorization,
- * and only authorized requirements produce bindings.
- *
- * Key architectural invariant:
- * DISCOVER → COMPATIBLE → RESOLVED → AUTHORIZED → BOUND → [STOP, don't invoke]
- *
- * Authorization is a policy-driven decision applied to resolved requirements only.
- * Unresolved and ambiguous requirements bypass authorization entirely.
- */
-import type { ApplicationState } from "./state.js";
-import type { ResolvedRequirement, UnresolvedRequirement, AmbiguousRequirement } from "./resolver.js";
-/**
- * Capability Binding Context: the semantic participants in an authorization decision.
- *
- * Captures consumer identity, provider identity, and capability information
- * sufficient for authorization policy evaluation.
- *
- * CRITICAL: This is NOT a runtime context. It contains no:
- * - Handlers
- * - Functions
- * - Closures
- * - Runtime objects
- * - Credentials
- * - Secrets
- * - Database handles
- * - Process IDs
- */
-export interface CapabilityBindingContext {
-    /** The consumer application requiring the capability. */
-    readonly consumer: ApplicationState;
-    /** The provider application offering the capability. */
-    readonly provider: ApplicationState;
-    /** The capability name (e.g., "invoice.create"). */
-    readonly capabilityName: string;
-    /** The capability version being consumed. */
-    readonly capabilityVersion: number;
-    /** Optional scopes/permissions the consumer requests. */
-    readonly requestedScopes?: readonly string[];
-    /** Optional consumer profile/role for policy evaluation. */
-    readonly consumerProfile?: {
-        readonly role?: string;
-        readonly tags?: readonly string[];
-    };
-}
-/**
- * Explicit authorization decision result.
- *
- * Authorization must not collapse to a boolean. Denials must be diagnosable.
- */
-export type AuthorizationResult = Authorized | Denied;
-/**
- * Authorized: the binding is permitted.
- */
-export interface Authorized {
-    readonly kind: "authorized";
-    /** Effective scopes/permissions granted to the consumer for this capability. */
-    readonly grantedScopes?: readonly string[];
-}
-/**
- * Denied: the binding is not permitted.
- *
- * Reasons must be explicit so observability systems can understand why
- * authorization failed.
- */
-export interface Denied {
-    readonly kind: "denied";
-    /** High-level denial reason code. */
-    readonly reason: "consumer_not_trusted" | "capability_not_permitted" | "scope_not_permitted" | "provider_not_authorized" | "policy_denied" | "other";
-    /** Detailed explanation for diagnostics. */
-    readonly message: string;
-}
-/**
- * Authorized Capability Binding: the metadata relationship between
- * consumer, provider, and capability after successful authorization.
- *
- * This is NOT an invocation credential or execution handle.
- * It is the semantic relationship: "this consumer is authorized to use this capability from this provider."
- *
- * Binding is:
- * - Deterministic: same inputs produce same binding
- * - Immutable: binding is data, not state
- * - Side-effect free: creating a binding executes nothing
- * - Identifiable: bindings can be uniquely identified by their participants
- *
- * CRITICAL: This contains no:
- * - Handlers
- * - Functions
- * - Closures
- * - Runtime objects
- * - Credentials
- * - Secrets
- * - Process IDs
- * - Timestamps (use resolution context if needed)
- */
-export interface AuthorizedCapabilityBinding {
-    /** The consumer application. */
-    readonly consumer: ApplicationState;
-    /** The resolved requirement that triggered binding. */
-    readonly requirement: ResolvedRequirement["requirement"];
-    /** The provider application. */
-    readonly provider: ApplicationState;
-    /** The consumed capability. */
-    readonly capability: {
-        readonly name: string;
-        readonly version: number;
-    };
-    /** The authorization result that permitted the binding. */
-    readonly authorization: Authorized;
-    /** Optional binding identity: deterministically derived from participants. */
-    readonly bindingId?: string;
-}
-/** Throws unless the exact binding object was issued by CapabilityBinder. */
-export declare function assertIssuedAuthorizedBinding(binding: AuthorizedCapabilityBinding): void;
-/**
- * Authorization Policy: injectable decision logic for capability binding.
- *
- * Policies evaluate whether a consumer is permitted to use a provider's capability.
- *
- * Policies must be:
- * - Side-effect free: no DB calls, network, or mutations
- * - Deterministic: same context produces same result
- * - Efficient: authorization blocks binding, so policy must be fast
- * - Stateless: receive all needed context as parameters
- *
- * Policies should reuse the canonical AppPort authorization semantics
- * (from @appport/authorization) rather than inventing new ones.
- */
-export interface AuthorizationPolicy {
-    /**
-     * Evaluate whether a binding is authorized.
-     *
-     * Returns Authorized if permitted, or Denied with explicit reason if not.
-     *
-     * Must not:
-     * - Execute application code
-     * - Invoke providers
-     * - Mutate state
-     * - Make network calls
-     * - Access runtime objects
-     */
-    evaluate(context: CapabilityBindingContext): AuthorizationResult | Promise<AuthorizationResult>;
-}
-/**
- * Full binding result for a single resolved requirement.
- */
-export type BindingResult = AuthorizedBindingResult | DeniedBindingResult;
-/**
- * Binding result: requirement was resolved and authorized.
- */
-export interface AuthorizedBindingResult {
-    readonly kind: "authorized";
-    readonly binding: AuthorizedCapabilityBinding;
-}
-/**
- * Binding result: requirement was resolved but authorization failed.
- */
-export interface DeniedBindingResult {
-    readonly kind: "denied";
-    readonly requirement: ResolvedRequirement["requirement"];
-    readonly provider: ApplicationState;
-    readonly authorization: Denied;
-}
-/**
- * Binding result: requirement was not resolved.
- *
- * Unresolved and ambiguous requirements bypass authorization entirely.
- * There is nothing to authorize when resolution fails.
- */
-export type UnboundResult = UnresolvedRequirement | AmbiguousRequirement;
-/**
- * Application binding result: complete binding state for an application's requirements.
- *
- * Preserves the distinction between:
- * - AUTHORIZED: resolved and authorized
- * - DENIED: resolved but authorization failed
- * - UNRESOLVED: no compatible provider found
- * - AMBIGUOUS: multiple equally-valid providers
- */
-export interface ApplicationBindingResult {
-    readonly application: ApplicationState;
-    /** Authorized bindings. */
-    readonly authorized: readonly AuthorizedCapabilityBinding[];
-    /** Denied bindings (resolved but not authorized). */
-    readonly denied: readonly DeniedBindingResult[];
-    /** Unresolved requirements. */
-    readonly unresolved: readonly UnresolvedRequirement[];
-    /** Ambiguous requirements. */
-    readonly ambiguous: readonly AmbiguousRequirement[];
-    /** All results in order. */
-    readonly results: readonly (BindingResult | UnboundResult)[];
-}
-/**
- * Default Authorization Policy: permits all authorized consumers.
- *
- * This policy checks the consumer's authorization profile against the capability's
- * authorization requirements. It reuses the canonical AppPort permission semantics.
- *
- * For simple use cases and testing, this is often sufficient.
- * For complex policies (trust services, scope-aware rules, etc.), provide a custom policy.
- */
-export declare function defaultAuthorizationPolicy(): AuthorizationPolicy;
-/**
- * Allow-all Authorization Policy: permits every binding.
- *
- * Appropriate for local single-user runtimes and tests.
- * Never appropriate for multi-principal deployments.
- */
-export declare function allowAllAuthorizationPolicy(): AuthorizationPolicy;
-/**
- * Permission-based Authorization Policy: consumer must have required permissions.
- *
- * Reuses the canonical @appport/authorization permission semantics.
- * A consumer has a set of granted permissions. A capability declares required permissions.
- * The consumer must have all required permissions.
- *
- * Supports wildcard permissions (e.g., "documents.*" matches "documents.read").
- */
-export declare function permissionAuthorizationPolicy(options: {
-    /** Resolve permissions for a consumer. */
-    resolvePermissions: (consumer: ApplicationState, provider: ApplicationState) => readonly string[] | Promise<readonly string[]>;
-}): AuthorizationPolicy;
-/**
- * Deterministic Binding Identity
- *
- * Generates a deterministic identifier for a binding based on its semantic participants.
- * Used to detect when the same binding would be created multiple times.
- *
- * Binding identity is deterministically derived from:
- * - Consumer application ID
- * - Requirement name
- * - Provider application ID
- * - Capability name + version
- *
- * Does NOT use:
- * - Object identity
- * - Process ID
- * - Timestamp
- * - Random UUID
- * - Handler identity
- */
-export declare function computeBindingId(binding: {
-    consumer: ApplicationState;
-    requirement: ResolvedRequirement["requirement"];
-    provider: ApplicationState;
-    capabilityName: string;
-    capabilityVersion: number;
-}): string;
-/**
- * Capability Binder: Orchestrates authorization-aware capability binding.
- *
- * Flow:
- * 1. Accept resolution results from ApplicationDependencyResolver
- * 2. For each resolved requirement, evaluate authorization policy
- * 3. Produce authorized bindings or explicit denials
- * 4. Preserve unresolved/ambiguous as-is (they bypass authorization)
- *
- * The binder is:
- * - Policy-driven: authorization logic is injected
- * - Side-effect free: no DB, handlers, or runtime invocation
- * - Deterministic: same input produces same binding
- * - Stateless: receives all context as parameters
- */
-export declare class CapabilityBinder {
-    #private;
-    constructor(policy?: AuthorizationPolicy);
-    /**
-     * Bind a single resolved requirement.
-     *
-     * Returns either an authorized binding or an explicit denial.
-     *
-     * Precondition: result must be a resolved requirement.
-     * This binder does not handle unresolved/ambiguous requirements.
-     */
-    bindResolution(consumer: ApplicationState, result: ResolvedRequirement): Promise<BindingResult>;
-    /**
-     * Bind all resolvable requirements for an application.
-     *
-     * Accepts the results from ApplicationDependencyResolver and produces
-     * a complete application binding result.
-     *
-     * Flow for each requirement:
-     * - resolved → evaluate authorization → authorized binding or explicit denial
-     * - unresolved → pass through as-is (nothing to authorize)
-     * - ambiguous → pass through as-is (nothing to authorize)
-     *
-     * Returns a complete ApplicationBindingResult preserving all states.
-     */
-    bindApplication(consumer: ApplicationState, resolutionResults: readonly (ResolvedRequirement | UnresolvedRequirement | AmbiguousRequirement)[]): Promise<ApplicationBindingResult>;
-}
-//# sourceMappingURL=binding.d.ts.map

package/vendor/@appport/core/dist/binding.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"binding.d.ts","sourceRoot":"","sources":["../src/binding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,KAAK,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAGtG;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,wBAAwB;IACvC,yDAAyD;IACzD,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IAEpC,wDAAwD;IACxD,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IAEpC,oDAAoD;IACpD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAEhC,6CAA6C;IAC7C,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IAEnC,yDAAyD;IACzD,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAE7C,4DAA4D;IAC5D,QAAQ,CAAC,eAAe,CAAC,EAAE;QACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;KACnC,CAAC;CACH;AAED;;;;GAIG;AACH,MAAM,MAAM,mBAAmB,GAAG,UAAU,GAAG,MAAM,CAAC;AAEtD;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAE5B,gFAAgF;IAChF,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5C;AAED;;;;;GAKG;AACH,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAExB,qCAAqC;IACrC,QAAQ,CAAC,MAAM,EAAE,sBAAsB,GAAG,0BAA0B,GAAG,qBAAqB,GAAG,yBAAyB,GAAG,eAAe,GAAG,OAAO,CAAC;IAErJ,4CAA4C;IAC5C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,WAAW,2BAA2B;IAC1C,gCAAgC;IAChC,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IAEpC,uDAAuD;IACvD,QAAQ,CAAC,WAAW,EAAE,mBAAmB,CAAC,aAAa,CAAC,CAAC;IAEzD,gCAAgC;IAChC,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IAEpC,+BAA+B;IAC/B,QAAQ,CAAC,UAAU,EAAE;QACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;KAC1B,CAAC;IAEF,2DAA2D;IAC3D,QAAQ,CAAC,aAAa,EAAE,UAAU,CAAC;IAEnC,8EAA8E;IAC9E,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAOD,6EAA6E;AAC7E,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,2BAA2B,GAAG,IAAI,CAIxF;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,OAAO,EAAE,wBAAwB,GAAG,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;CACjG;AAED;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG,uBAAuB,GAAG,mBAAmB,CAAC;AAE1E;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,2BAA2B,CAAC;CAC/C;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,mBAAmB,CAAC,aAAa,CAAC,CAAC;IACzD,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG,qBAAqB,GAAG,oBAAoB,CAAC;AAEzE;;;;;;;;GAQG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IAEvC,2BAA2B;IAC3B,QAAQ,CAAC,UAAU,EAAE,SAAS,2BAA2B,EAAE,CAAC;IAE5D,qDAAqD;IACrD,QAAQ,CAAC,MAAM,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAEhD,+BAA+B;IAC/B,QAAQ,CAAC,UAAU,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAEtD,8BAA8B;IAC9B,QAAQ,CAAC,SAAS,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAEpD,4BAA4B;IAC5B,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,aAAa,GAAG,aAAa,CAAC,EAAE,CAAC;CAC9D;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,IAAI,mBAAmB,CAShE;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,IAAI,mBAAmB,CAMjE;AAED;;;;;;;;GAQG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAAE;IACrD,0CAA0C;IAC1C,kBAAkB,EAAE,CAAC,QAAQ,EAAE,gBAAgB,EAAE,QAAQ,EAAE,gBAAgB,KAAK,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;CAChI,GAAG,mBAAmB,CAkBtB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE;IACxC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,WAAW,EAAE,mBAAmB,CAAC,aAAa,CAAC,CAAC;IAChD,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,EAAE,MAAM,CAAC;CAC3B,GAAG,MAAM,CAQT;AA0BD;;;;;;;;;;;;;;GAcG;AACH,qBAAa,gBAAgB;;gBAGf,MAAM,GAAE,mBAAkD;IAItE;;;;;;;OAOG;IACG,cAAc,CAAC,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,aAAa,CAAC;IAyDrG;;;;;;;;;;;;OAYG;IACG,eAAe,CAAC,QAAQ,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,SAAS,CAAC,mBAAmB,GAAG,qBAAqB,GAAG,oBAAoB,CAAC,EAAE,GAAG,OAAO,CAAC,wBAAwB,CAAC;CAsCzL"}