@fabricorg/ports 0.2.0 → 0.4.0

package/CHANGELOG.md

@@ -1,5 +1,171 @@
 # @fabricorg/ports
 
+## 0.4.0
+
+### Minor Changes
+
+- 8ce5e06: Derive release grants from what an actor holds, and complete the port catalog.
+
+  `deriveAuthorizationGrants` turns usage contracts plus an actor's permissions, entitlements and
+  feature flags into an `SduiAuthorizationGrants`. A shell that answers "what may this actor see" from
+  its own configuration, while grants are hand-maintained elsewhere and enforcement happens in a third
+  place, produces three sources that must agree with nothing forcing them to. Deriving them makes
+  navigation a projection of the same declarations. It is navigation-shaped rather than enforcement:
+  the Host still re-checks authority at execution and `ProjectionHost` still authorizes every query.
+  Withheld capabilities are returned with the requirement that was missing, so an absent entry is
+  explainable.
+
+  `ContentPort`, `PaymentsPort`, `SearchPort` and `CustomerRecordPort` join flags, design tokens and
+  identity, each with the suite an adapter must pass. The suites encode what each port class actually
+  gets wrong: content inventing a default for an unauthored key or carrying a capability reference,
+  money expressed as a float or an idempotency key that moves it twice, search hits mistaken for
+  authorization rather than pointers a governed read still resolves, and redelivery duplicating a
+  customer record. `PaymentOutcome` includes `ambiguous`, which maps onto the platform's existing
+  adapter outcomes so an uncertain charge reconciles instead of being retried.
+
+- 9a5b18a: Close what a fifth review found, including a regression the previous fix introduced.
+
+  **Ambiguity fired on legal documents.** Counting every declared view made publishing a view at two
+  versions a hard failure, and view versioning is a first-class pattern: the platform and the usage
+  contract both key a view on `name@version`. It also failed a release over a capability that release
+  never touched. Ambiguity is now reported for _granted_ references only, where a versionless reference
+  genuinely cannot pick between two versions, and a contract supplied twice gets its own finding
+  instead of making every one of its views look ambiguous.
+
+  **A failed replay is `unknown`, not `refused`.** `failed` is reachable after adapter steps succeeded
+  and the domain transaction committed, so telling an operator the action was definitely refused could
+  be as wrong as telling them it was applied. Only policy blocks and validation failures are decided
+  before any effect. A replay adapter that returns nothing is surfaced rather than counted as applied,
+  which was the one line the previous rewrite left untouched.
+
+  **`parked` and `expired` carry their records**, and reconciliation carries the invocation id. Bare
+  counts left nobody able to say which action needs approving or whose work was dropped, and external
+  reconciliation needs the id the type exists to enable.
+
+  Settled-failure classification gained the superseded-action-version case and dropped two it had
+  wrong: a future-dated capture comes good as clocks correct, and a gateway missing its replay window
+  is a deployment mistake somebody will fix. Discarding either would destroy work.
+
+  **`assertPortSuiteHasTeeth` takes a set of broken adapters.** Requiring one stub to trip every check
+  was unsatisfiable for any suite with a fixture-liveness guard, since the guard bites on the
+  complement of what it guards, and two reference ports could not pass their own suites. Port ids now
+  permit a hyphen in the first segment, so a port can be defined for every name a manifest can declare,
+  and `certifyAdapter` validates its definition rather than issuing evidence the gate reports as
+  missing.
+
+- 9b2e55b: Close what a fourth review found: each earlier fix closed one instance of a class and left its
+  siblings.
+
+  **Replay disposition is now exhaustive over `ActionStatus`.** The previous fix enumerated the two
+  statuses that looked like refusals, so `failed`, `validation_failed` and `waiting_for_approval` fell
+  through and were deleted from the queue and reported to the operator as applied — the same bug the
+  fix set out to kill, one layer in. Any returned outcome now means the platform holds the invocation,
+  so the capture leaves the queue either way; what differs is whether a person needs to hear about it.
+  An undeterminable adapter outcome is reported as `unknown` rather than `refused`, because the effect
+  may well have happened. `isSettledReplayFailure` learned the refusals the sibling commit introduced,
+  including a capture rejected for age, which can never come good.
+
+  **A replay without `capturedAt` is refused.** It was reachable only through an untyped cast, so
+  omitting it skipped the age check entirely and stamped receipt time into durable capture evidence.
+
+  **A capability can name a namespaced port.** `definePort` required a dot and the manifest validator
+  forbade one, so no real capability could name a defined port and the certification gate was
+  unreachable. Certification is also checked structurally rather than by the presence of a property, so
+  a hand-written claim no longer satisfies the gate that exists to demand evidence, and a port
+  requirement narrows its candidates as each constraint is applied.
+
+  **`assertPortSuiteHasTeeth` names every vacuous check** rather than returning on the first one that
+  bites, and a reference port is actually run through it. The payments control asserts its result, so
+  an adapter that never charges no longer certifies. The capability-reference grammar matches the
+  platform's own view-name rule instead of being stricter than it, and ambiguity is counted by
+  occurrence across views and intents rather than by comparing names within one contract.
+
+- 0d1f6f6: Close what a third independent review found, including two defects introduced by the previous fix.
+
+  **Offline replay counted refusals as successes.** `PlatformHost` reports a refused capture by
+  _returning_ `reconciliation_required` with the reason, not by throwing, so the queue took its success
+  branch, deleted the capture and reported it applied. The reconciliation path was unreachable. Replay
+  now reads the returned outcome. The already-applied branch is removed entirely: a repeated key
+  returns the original invocation without complaint, and an idempotency _conflict_ means the key was
+  reused for a materially different command, so that capture was never applied and is kept rather than
+  discarded.
+
+  **`deriveAuthorizationGrants` defaulted open and reached the signed artifact.** Requirements are
+  optional metadata, so a capability declaring none granted everything to an actor holding nothing.
+  Grants are also carried onto a release unexamined and promotion signs a route for each, so a surplus
+  grant became a signed route to a capability the screen never renders. Undeclared requirements now
+  withhold by default, and `document` scopes the result to references the screen actually binds.
+
+  Several conformance checks could not fail: a search suite passed an adapter returning nothing, a
+  payments suite passed a double-charger that omitted a provider reference, an identity suite certified
+  timestamps the scope check then rejected on every request, an MFE probe could be refused for an
+  unrelated reason, and a channel check accepted any exception as a refusal. Each now proves what it
+  claims. Promotion configuration rejects anything reading like a key rather than two spellings,
+  rejects unknown fields, and constrains the application name that decides the default output path.
+
+### Patch Changes
+
+- a598fb9: Close the remaining review findings.
+
+  **One capability-reference grammar.** `sdui-release` accepted any name after the namespace while
+  `sdui-composer` rejected `/`, so a view named `orders/reports/daily` produced a release that validated
+  and then died at promotion with nothing wrong upstream to point at. Both now share
+  `parseCapabilityRef`, tightened to lowercase path segments matching what the platform permits for a
+  view name. Two views in one contract that reduce to the same reference are reported as
+  `ambiguous_capability_reference` at validation rather than surfacing as an ambiguous route later.
+
+  **A bounded replay window.** A client-supplied `capturedAt` had no lower bound. Deferring it to the
+  Host looked safe and was not: the Host checks staleness only when the capture-authority adapter
+  supplies an `expiresAt`, and skips the execution-time expiry check entirely for actions governed at
+  capture. A gateway that accepts replay must now declare `maxOfflineReplayAgeMs`, and the instant must
+  be RFC 3339 with an explicit offset.
+
+  **One token-set grammar.** `document.tokenSet` accepted names and versions that `supportedTokenSets`
+  rejected, while validation treats the two fields as interchangeable.
+
+  **Port requirements narrow as they are checked.** A requirement for a standard _and_ a version could
+  be satisfied by two different adapters covering one constraint each. `requirement.standard.version`
+  was declared and never read.
+
+## 0.3.0
+
+### Minor Changes
+
+- 89982ba: Add `IdentityPort`, the OAuth2/OIDC-shaped seam a gateway implements to turn a presented credential
+  into verified `ActorClaims`. Every governed action, projection decision, grant and audit record
+  derives from actor context, which until now the platform accepted on trust from its caller.
+
+  `assertActorClaimsCoverScope` enforces the half that verification does not: a credential proves who
+  the caller is, never that they may act in the tenant and space a request names. It refuses expired,
+  not-yet-valid, unparseable, cross-tenant and out-of-space claims, and `actorContextFromClaims`
+  derives submission fields only from claims that passed. Space coverage is spelled `"tenant-wide"`
+  rather than left absent, so claims that simply omit coverage can never be read as covering
+  everything. `identityPortChecks` is the suite an adapter must pass, including that resolved claims
+  never echo credential material back.
+
+### Patch Changes
+
+- 6f5471b: Close the gaps an independent review found in the grant, remote and identity work.
+
+  A capability reference object was treated as a leaf, so a granted reference could shield ungranted
+  ones parked beside it on the same object; sibling keys are now walked. Prop recursion is depth
+  bounded, so cyclic programmatic input reports a finding instead of exhausting the stack. Federated
+  remotes now compare their exposed-module mapping, not only entry and integrity, and the locked remote
+  is carried onto the promoted release so two releases differing only in their remote cannot share a
+  digest. Pack lookup matches full pack identity rather than namespace and name alone, and a stored
+  lockfile that declares one pack or capability twice is rejected rather than resolved by first match.
+
+  Grant digests omit `variants` and `fragments` when absent, so a release that declares neither digests
+  exactly as it did before those fields existed and previously promoted releases keep verifying.
+  Variants are hashed in id order, so reordering the same set no longer churns the digest. Fragment
+  grants written as a `{ __proto__: … }` object literal are rejected, because that sets the prototype
+  rather than creating the entry and the narrowing would silently disappear.
+
+  `assertActorClaimsCoverScope` no longer fails open: an invalid clock is rejected instead of making
+  every temporal comparison false, timestamps must be RFC 3339 with an explicit offset so a credential
+  cannot expire at different instants on different hosts, and `spaceIds` must be an array of strings so
+  a bare string cannot reach substring matching where `"space_10"` would cover `"space_1"`.
+
 ## 0.2.0
 
 ### Minor Changes

package/README.md

@@ -10,7 +10,23 @@ pnpm add @fabricorg/ports
 
 ## Where a standard exists, the port speaks it
 
-`FlagsPort` is structurally compatible with an OpenFeature provider's evaluation surface, so an OpenFeature provider is a thin adapter rather than a translation layer. `DesignTokensPort` consumes W3C DTCG documents, so a design tool is one exporter among any.
+`FlagsPort` is structurally compatible with an OpenFeature provider's evaluation surface, so an OpenFeature provider is a thin adapter rather than a translation layer. `DesignTokensPort` consumes W3C DTCG documents, so a design tool is one exporter among any. `IdentityPort` is OAuth2/OIDC-shaped, so a gateway that already validates JWTs implements it without a second identity model.
+
+## Identity is where the platform stops trusting its caller
+
+Every governed action, projection decision, grant and audit record derives from actor context. `IdentityPort.verify` turns a presented credential into `ActorClaims`, and returns `null` for anything it cannot positively verify rather than partially trusted claims.
+
+```ts
+import { actorContextFromClaims } from "@fabricorg/ports";
+
+const claims = await identity.verify(credential);
+if (!claims) throw new Error("unauthenticated");
+
+// Refuses expired, not-yet-valid, cross-tenant and out-of-space claims.
+const actor = actorContextFromClaims(claims, { tenantId, spaceId });
+```
+
+Verification proves who the caller is. `assertActorClaimsCoverScope` enforces the half it does not: that they may act in the tenant and space this request names. A credential valid for one tenant replayed against another is refused there, not later. Space coverage is spelled `"tenant-wide"` rather than left absent, so claims that simply omit coverage can never be read as covering everything.
 
 Nothing here imports a vendor SDK. A port is a shape; an adapter is anything that satisfies it.
 

package/dist/catalog.cjs

@@ -0,0 +1,457 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// catalog.ts
+var catalog_exports = {};
+__export(catalog_exports, {
+  CONTENT_PORT: () => CONTENT_PORT,
+  CUSTOMER_RECORD_PORT: () => CUSTOMER_RECORD_PORT,
+  DESIGN_TOKENS_PORT: () => DESIGN_TOKENS_PORT,
+  FLAGS_PORT: () => FLAGS_PORT,
+  IDENTITY_PORT: () => IDENTITY_PORT,
+  PAYMENTS_PORT: () => PAYMENTS_PORT,
+  REFERENCE_PORTS: () => REFERENCE_PORTS,
+  SEARCH_PORT: () => SEARCH_PORT
+});
+module.exports = __toCommonJS(catalog_exports);
+
+// index.ts
+var ALIAS = /^\{([^}]+)\}$/;
+var IDENTITY_ACTOR_TYPES = [
+  "natural_person",
+  "agent",
+  "system",
+  "service_account",
+  "external_system",
+  "integration"
+];
+var RFC3339 = /^\d{4}-\d{2}-\d{2}[Tt]\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:[Zz]|[+-]\d{2}:\d{2})$/;
+var PORT_ID = /^[a-z][a-z0-9-]*(?:\.[a-z][a-z0-9-]*)+$/;
+function definePort(definition) {
+  if (!PORT_ID.test(definition.id)) {
+    throw new Error(`Port id "${definition.id}" must be namespaced lowercase, for example "acme.docusign".`);
+  }
+  if (!/^\d+\.\d+\.\d+$/.test(definition.version)) {
+    throw new Error(`Port "${definition.id}" version must be a semver version.`);
+  }
+  if (!definition.description.trim()) {
+    throw new Error(`Port "${definition.id}" must describe what an adapter behind it is responsible for.`);
+  }
+  if (typeof definition.checks !== "function") {
+    throw new Error(`Port "${definition.id}" must supply a conformance suite.`);
+  }
+  return definition;
+}
+var PortContractFailure = class extends Error {
+  name = "PortContractFailure";
+};
+function expect(condition, message) {
+  if (!condition) throw new PortContractFailure(message);
+}
+function flagsPortChecks() {
+  const unknownKey = "fabric.contract.definitely-not-configured";
+  return [
+    {
+      id: "flags.default-on-unknown-key",
+      title: "an unknown flag resolves to the supplied default rather than throwing",
+      async run(port) {
+        const result = await port.resolveBoolean(unknownKey, true);
+        expect(result.value === true, `an unknown flag returned ${String(result.value)} instead of the supplied default`);
+        expect(
+          result.reason === "DEFAULT" || result.reason === "ERROR",
+          `an unknown flag resolved with reason "${result.reason}"; a default or error was expected`
+        );
+      }
+    },
+    {
+      id: "flags.default-is-typed",
+      title: "each typed resolver returns its own type",
+      async run(port) {
+        expect(typeof (await port.resolveBoolean(unknownKey, false)).value === "boolean", "resolveBoolean did not return a boolean");
+        expect(typeof (await port.resolveString(unknownKey, "fallback")).value === "string", "resolveString did not return a string");
+        expect(typeof (await port.resolveNumber(unknownKey, 42)).value === "number", "resolveNumber did not return a number");
+      }
+    },
+    {
+      id: "flags.evaluation-is-pure",
+      title: "the same key and context resolve the same way twice",
+      async run(port) {
+        const context = { targetingKey: "fabric-contract-subject" };
+        const first = await port.resolveString(unknownKey, "fallback", context);
+        const second = await port.resolveString(unknownKey, "fallback", context);
+        expect(first.value === second.value, `the same evaluation returned "${first.value}" then "${second.value}"`);
+      }
+    },
+    {
+      id: "flags.tolerates-absent-context",
+      title: "evaluation without a context does not throw",
+      async run(port) {
+        await port.resolveBoolean(unknownKey, false);
+      }
+    }
+  ];
+}
+function identityPortChecks(fixtures) {
+  const checks = [
+    {
+      id: "identity.rejects-garbage",
+      title: "an unverifiable credential resolves to null rather than partial claims",
+      async run(port) {
+        const result = await port.verify("not-a-credential");
+        expect(result === null, "an unverifiable credential resolved to claims instead of null");
+      }
+    },
+    {
+      id: "identity.rejects-empty",
+      title: "an empty credential resolves to null",
+      async run(port) {
+        expect(await port.verify("") === null, "an empty credential resolved to claims");
+      }
+    },
+    {
+      id: "identity.resolves-valid",
+      title: "a valid credential resolves to the expected subject and tenant",
+      async run(port) {
+        const claims = await port.verify(fixtures.validCredential);
+        expect(claims !== null, "a valid credential failed to verify");
+        expect(claims?.subject === fixtures.expected.subject, `subject was "${claims?.subject}"`);
+        expect(claims?.tenantId === fixtures.expected.tenantId, `tenantId was "${claims?.tenantId}"`);
+      }
+    },
+    {
+      id: "identity.claims-are-complete",
+      title: "resolved claims carry every field the platform derives actor context from",
+      async run(port) {
+        const claims = await port.verify(fixtures.validCredential);
+        expect(claims !== null, "a valid credential failed to verify");
+        if (!claims) return;
+        expect(IDENTITY_ACTOR_TYPES.includes(claims.actorType), `actorType "${claims.actorType}" is not a known actor kind`);
+        expect(typeof claims.issuer === "string" && claims.issuer.length > 0, "claims carry no issuer");
+        expect(RFC3339.test(claims.issuedAt), `issuedAt "${claims.issuedAt}" is not RFC 3339 with an explicit offset`);
+        expect(RFC3339.test(claims.expiresAt), `expiresAt "${claims.expiresAt}" is not RFC 3339 with an explicit offset`);
+        expect(typeof claims.tenantId === "string" && claims.tenantId.length > 0, "claims carry no tenant");
+        expect(
+          claims.spaceIds === "tenant-wide" || Array.isArray(claims.spaceIds),
+          'spaceIds must be an explicit list or the literal "tenant-wide"'
+        );
+      }
+    },
+    {
+      id: "identity.carries-no-credential-material",
+      title: "resolved claims never echo the credential back",
+      async run(port) {
+        const claims = await port.verify(fixtures.validCredential);
+        expect(claims !== null, "a valid credential failed to verify, so this check proved nothing");
+        if (!claims) return;
+        const serialized = JSON.stringify(claims);
+        expect(
+          !serialized.includes(fixtures.validCredential),
+          "resolved claims contain the presented credential; claims must carry an opaque reference instead"
+        );
+      }
+    },
+    {
+      id: "identity.verification-is-stable",
+      title: "the same credential resolves the same subject twice",
+      async run(port) {
+        const first = await port.verify(fixtures.validCredential);
+        const second = await port.verify(fixtures.validCredential);
+        expect(first?.subject === second?.subject, "the same credential resolved to two different subjects");
+      }
+    }
+  ];
+  if (fixtures.expiredCredential !== void 0) {
+    checks.push({
+      id: "identity.rejects-expired",
+      title: "an expired credential resolves to null rather than stale claims",
+      async run(port) {
+        const expiredCredential = fixtures.expiredCredential;
+        expect(await port.verify(expiredCredential) === null, "an expired credential still resolved to claims");
+      }
+    });
+  }
+  return checks;
+}
+function contentPortChecks(fixtures) {
+  return [
+    {
+      id: "content.missing-resolves-null",
+      title: "an unauthored key resolves to null rather than an invented default",
+      async run(port) {
+        const result = await port.resolve({ ...fixtures.present, key: fixtures.absentKey });
+        expect(result === null, "an unauthored key resolved to content instead of null");
+      }
+    },
+    {
+      id: "content.revision-is-stable",
+      title: "identical content resolves the same revision twice",
+      async run(port) {
+        const first = await port.resolve(fixtures.present);
+        const second = await port.resolve(fixtures.present);
+        expect(first !== null && second !== null, "the fixture key is not authored");
+        expect(first?.revision === second?.revision, "the same content reported two revisions, so it cannot be cached");
+      }
+    },
+    {
+      id: "content.carries-no-capability-reference",
+      title: "authored content never carries a capability reference",
+      async run(port) {
+        const result = await port.resolve(fixtures.present);
+        expect(
+          !JSON.stringify(result ?? {}).includes("capability://"),
+          "content carried a capability reference; what a screen may reach is decided by a release, not by an author"
+        );
+      }
+    }
+  ];
+}
+function paymentsPortChecks(fixtures) {
+  return [
+    {
+      id: "payments.rejects-non-integer-amount",
+      title: "a fractional minor-unit amount is refused rather than rounded",
+      async run(port) {
+        let refused = false;
+        try {
+          await port.charge({ ...fixtures.request, amount: { ...fixtures.request.amount, amount: 10.5 } });
+        } catch {
+          refused = true;
+        }
+        expect(refused, "a fractional minor-unit amount was accepted; money is an integer or it drifts");
+        const control = await port.charge({
+          ...fixtures.request,
+          idempotencyKey: `${fixtures.request.idempotencyKey}:integer-probe`
+        });
+        expect(
+          control.outcome === "succeeded",
+          `the fixture charge resolved "${control.outcome}"; a suite run against an adapter that never succeeds certifies nothing`
+        );
+      }
+    },
+    {
+      id: "payments.requires-idempotency-key",
+      title: "a charge without a stable key is refused",
+      async run(port) {
+        let refused = false;
+        try {
+          await port.charge({ ...fixtures.request, idempotencyKey: "" });
+        } catch {
+          refused = true;
+        }
+        expect(refused, "a charge with no idempotency key was accepted; a retry would move money twice");
+      }
+    },
+    {
+      id: "payments.same-key-moves-money-once",
+      title: "the same idempotency key resolves to the same provider reference",
+      async run(port) {
+        const first = await port.charge(fixtures.request);
+        const second = await port.charge(fixtures.request);
+        expect(
+          first.outcome === second.outcome,
+          `the same key produced "${first.outcome}" then "${second.outcome}"`
+        );
+        expect(
+          first.outcome !== "succeeded" || first.providerReference !== void 0,
+          "a succeeded charge carried no provider reference, so a retry cannot be told from a second charge"
+        );
+        expect(
+          first.providerReference === second.providerReference,
+          "the same key produced two provider references, so a retry charged twice"
+        );
+      }
+    },
+    {
+      id: "payments.outcome-is-declared",
+      title: "an outcome is one of the three the platform can act on",
+      async run(port) {
+        const result = await port.charge(fixtures.request);
+        expect(
+          result.outcome === "succeeded" || result.outcome === "failed" || result.outcome === "ambiguous",
+          `outcome "${result.outcome}" is not one the platform can reconcile`
+        );
+      }
+    }
+  ];
+}
+function searchPortChecks(fixtures) {
+  return [
+    {
+      id: "search.fixture-returns-hits",
+      title: "the fixture query matches something, so the checks below are not vacuous",
+      async run(port) {
+        const result = await port.query(fixtures.query);
+        expect(
+          result.hits.length > 0,
+          "the fixture query returned nothing, so every check below passes without exercising the adapter"
+        );
+      }
+    },
+    {
+      id: "search.respects-limit",
+      title: "a result set never exceeds the requested limit",
+      async run(port) {
+        const result = await port.query({ ...fixtures.query, limit: 1 });
+        expect(result.hits.length <= 1, `returned ${result.hits.length} hits for a limit of 1`);
+      }
+    },
+    {
+      id: "search.returns-identifiers-not-records",
+      title: "a hit carries an identifier a governed read can resolve, not the record",
+      async run(port) {
+        const result = await port.query(fixtures.query);
+        for (const hit of result.hits) {
+          expect(typeof hit.id === "string" && hit.id.length > 0, "a hit carried no identifier");
+          expect(
+            Object.keys(hit).every((key) => key === "id" || key === "score"),
+            "a hit carried record fields; search results are pointers, and reading one still goes through ProjectionHost"
+          );
+        }
+      }
+    }
+  ];
+}
+function customerRecordPortChecks(fixtures) {
+  return [
+    {
+      // This proves redelivery does not *fail*. Whether it duplicates is not
+      // observable through this port, which has no read side by design, so
+      // the suite says what it can and does not imply more.
+      id: "crm.redelivery-does-not-fail",
+      title: "recording the same event twice is not an error",
+      async run(port) {
+        await port.record(fixtures.event);
+        await port.record(fixtures.event);
+      }
+    },
+    {
+      id: "crm.rejects-unidentified-event",
+      title: "an event with no stable id is refused",
+      async run(port) {
+        let refused = false;
+        try {
+          await port.record({ ...fixtures.event, eventId: "" });
+        } catch {
+          refused = true;
+        }
+        expect(refused, "an event with no id was accepted; redelivery would duplicate the record");
+      }
+    }
+  ];
+}
+function designTokensPortChecks(theme) {
+  return [
+    {
+      id: "tokens.theme-resolves",
+      title: "a known theme resolves to at least one token",
+      async run(port) {
+        const tokens = await port.resolve(theme);
+        expect(Array.isArray(tokens) && tokens.length > 0, `theme "${theme}" resolved to no tokens`);
+      }
+    },
+    {
+      id: "tokens.no-unresolved-aliases",
+      title: "no resolved token still carries an alias",
+      async run(port) {
+        for (const token of await port.resolve(theme)) {
+          expect(
+            typeof token.value !== "string" || !ALIAS.test(token.value.trim()),
+            `token "${token.name}" resolved to the unfollowed alias ${String(token.value)}`
+          );
+        }
+      }
+    },
+    {
+      id: "tokens.names-are-unique",
+      title: "token names are unique within a theme",
+      async run(port) {
+        const names = (await port.resolve(theme)).map((token) => token.name);
+        expect(new Set(names).size === names.length, "the theme resolved duplicate token names");
+      }
+    }
+  ];
+}
+
+// catalog.ts
+var FLAGS_PORT = definePort({
+  id: "fabric.flags",
+  version: "1.0.0",
+  standard: { name: "OpenFeature" },
+  description: "Resolves a typed flag for an evaluation context, defaulting rather than throwing.",
+  checks: () => flagsPortChecks()
+});
+var DESIGN_TOKENS_PORT = definePort({
+  id: "fabric.design-tokens",
+  version: "1.0.0",
+  standard: { name: "W3C DTCG" },
+  description: "Resolves a DTCG token document into flat, renderer-neutral values.",
+  checks: (fixtures) => designTokensPortChecks(fixtures)
+});
+var IDENTITY_PORT = definePort({
+  id: "fabric.identity",
+  version: "1.0.0",
+  standard: { name: "OAuth 2.0 / OIDC" },
+  description: "Verifies a presented credential into actor claims, or resolves it to null.",
+  checks: (fixtures) => identityPortChecks(fixtures)
+});
+var CONTENT_PORT = definePort({
+  id: "fabric.content",
+  version: "1.0.0",
+  description: "Resolves authored copy and layout, never authority.",
+  checks: (fixtures) => contentPortChecks(fixtures)
+});
+var PAYMENTS_PORT = definePort({
+  id: "fabric.payments",
+  version: "1.0.0",
+  description: "Moves money once per idempotency key, and admits when the outcome is unknown.",
+  checks: (fixtures) => paymentsPortChecks(fixtures)
+});
+var SEARCH_PORT = definePort({
+  id: "fabric.search",
+  version: "1.0.0",
+  description: "Returns identifiers a governed read can resolve, never records.",
+  checks: (fixtures) => searchPortChecks(fixtures)
+});
+var CUSTOMER_RECORD_PORT = definePort({
+  id: "fabric.customer-record",
+  version: "1.0.0",
+  description: "Records outbound events idempotently. Told, never asked.",
+  checks: (fixtures) => customerRecordPortChecks(fixtures)
+});
+var REFERENCE_PORTS = [
+  FLAGS_PORT,
+  DESIGN_TOKENS_PORT,
+  IDENTITY_PORT,
+  CONTENT_PORT,
+  PAYMENTS_PORT,
+  SEARCH_PORT,
+  CUSTOMER_RECORD_PORT
+];
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  CONTENT_PORT,
+  CUSTOMER_RECORD_PORT,
+  DESIGN_TOKENS_PORT,
+  FLAGS_PORT,
+  IDENTITY_PORT,
+  PAYMENTS_PORT,
+  REFERENCE_PORTS,
+  SEARCH_PORT
+});
+//# sourceMappingURL=catalog.cjs.map