@fabricorg/ports 0.3.0 → 0.5.0

package/dist/index.d.ts

@@ -133,6 +133,191 @@ declare function actorContextFromClaims(claims: ActorClaims, scope: {
     tenantId: string;
     spaceId: string;
 };
+/**
+ * A resolved piece of authored content.
+ *
+ * Content is copy and layout, never permission. A content system deciding what
+ * a screen says is expected; a content system deciding what a screen may reach
+ * is the failure this whole boundary exists to prevent, which is why nothing
+ * here carries a capability reference.
+ */
+interface ContentEntry {
+    key: string;
+    locale: string;
+    /** Opaque revision, stable for identical content. Use it for cache keys. */
+    revision: string;
+    value: JsonLike;
+}
+type JsonLike = string | number | boolean | null | JsonLike[] | {
+    [key: string]: JsonLike;
+};
+interface ContentQuery {
+    key: string;
+    locale: string;
+    /** Optional variant, for an experiment arm already enumerated in a release. */
+    variant?: string;
+}
+interface ContentPort {
+    /** Resolves to `null` when the key is not authored, rather than inventing a default. */
+    resolve(query: ContentQuery): Promise<ContentEntry | null>;
+}
+/**
+ * Money as an integer in the currency's minor unit.
+ *
+ * Never a float. A payment expressed as 10.1 is a payment that will eventually
+ * be off by a cent, and reconciling that costs more than the type ever did.
+ */
+interface MinorUnitAmount {
+    /** Integer in the minor unit: 1050 is USD 10.50. */
+    amount: number;
+    /** ISO 4217 alphabetic code. */
+    currency: string;
+}
+/**
+ * The outcome of asking a provider to move money.
+ *
+ * `ambiguous` is the one that matters and the one most interfaces omit. A
+ * timeout tells you nothing about whether the charge landed, and guessing is
+ * how a customer gets billed twice. It maps onto the platform's own
+ * `AdapterOutcomeKind`, so an ambiguous payment routes to reconciliation with
+ * durable evidence instead of being retried.
+ */
+type PaymentOutcome = "succeeded" | "failed" | "ambiguous";
+interface PaymentResult {
+    outcome: PaymentOutcome;
+    /** The provider's own identifier, for reconciliation. Required when known. */
+    providerReference?: string;
+    /** Provider-supplied reason, for evidence rather than for branching. */
+    reason?: string;
+}
+interface PaymentRequest {
+    /** Caller-stable key. The same key must never move money twice. */
+    idempotencyKey: string;
+    amount: MinorUnitAmount;
+}
+interface PaymentsPort {
+    charge(request: PaymentRequest): Promise<PaymentResult>;
+}
+/**
+ * A latency-critical read path, deliberately outside the governed pipeline.
+ *
+ * Search results are pointers, not authority. An identifier appearing in a
+ * result set says the index knows about it, never that this actor may read it,
+ * so anything the viewer then opens still goes through `ProjectionHost`.
+ */
+interface SearchHit {
+    /** Identifier a governed read can resolve. Never the record itself. */
+    id: string;
+    score: number;
+}
+interface SearchQuery {
+    text: string;
+    limit: number;
+    /** Narrowing the index can apply cheaply. Never a substitute for authorization. */
+    filters?: Record<string, string>;
+}
+interface SearchPort {
+    query(query: SearchQuery): Promise<{
+        hits: SearchHit[];
+        total: number;
+    }>;
+}
+/**
+ * An outbound record of something that already happened.
+ *
+ * A CRM is downstream of the governed pipeline, never upstream of it. It is
+ * told; it does not decide. Keeping this one-way is what stops a marketing
+ * system becoming a source of business truth.
+ */
+interface CustomerEvent {
+    /** Stable key so redelivery does not duplicate the record. */
+    eventId: string;
+    subjectId: string;
+    type: string;
+    occurredAt: string;
+    attributes?: Record<string, JsonLike>;
+}
+interface CustomerRecordPort {
+    record(event: CustomerEvent): Promise<void>;
+}
+/**
+ * A port, as a first-class thing rather than a name in a string.
+ *
+ * Fabric ships a handful of port definitions because they speak open standards
+ * and everyone needs them. It cannot ship the rest: an enterprise integrates
+ * hundreds of external systems, and a framework that requires a pull request
+ * for each one is not a framework. A vertical, a partner or a vendor defines
+ * its own port with {@link definePort} and every mechanism here applies to it
+ * unchanged — Fabric never learns what the system behind it is.
+ *
+ * The definition binds an id to the suite that certifies an adapter for it.
+ * That binding is the point: without it, "this port is satisfied" only ever
+ * meant "somebody registered something claiming to be it".
+ */
+interface PortDefinition<TPort, TFixtures = void> {
+    /**
+     * Namespaced identifier, for example `fabric.flags` or `acme.docusign`.
+     * Namespacing is required so a port defined outside this repository cannot
+     * collide with one defined inside it.
+     */
+    id: string;
+    /**
+     * Version of the port contract itself, not of any adapter.
+     *
+     * Bump it when the interface changes shape. Certification is recorded
+     * against a version, so raising it correctly invalidates every adapter
+     * certified against the old contract instead of silently carrying them
+     * forward.
+     */
+    version: string;
+    /** The open standard this port speaks, where one exists. */
+    standard?: {
+        name: string;
+        version?: string;
+    };
+    /** One-line statement of what an adapter behind this port is responsible for. */
+    description: string;
+    /** The suite every adapter must pass. */
+    checks(fixtures: TFixtures): readonly PortCheck<TPort>[];
+}
+/**
+ * Declare a port. Validates the definition itself, because a malformed port
+ * definition produces adapters that certify against nothing.
+ */
+declare function definePort<TPort, TFixtures = void>(definition: PortDefinition<TPort, TFixtures>): PortDefinition<TPort, TFixtures>;
+/**
+ * Confirm a port's suite can actually fail, and that its check ids are unique.
+ *
+ * A suite whose checks all pass against a deliberately broken adapter certifies
+ * nothing while looking rigorous, which is worse than having no suite at all.
+ * Run this against a stub that does the wrong thing when you author a port.
+ */
+declare function assertPortSuiteHasTeeth<TPort, TFixtures>(definition: PortDefinition<TPort, TFixtures>, fixtures: TFixtures, brokenAdapters: TPort | readonly TPort[]): Promise<void>;
+/** Evidence that an adapter passed a port's suite, and which contract it passed. */
+interface AdapterCertification {
+    portId: string;
+    /** Port contract version the adapter was certified against. */
+    portVersion: string;
+    checks: string[];
+    certifiedAt: string;
+}
+interface CertifiedAdapter extends RegisteredAdapter {
+    certification: AdapterCertification;
+}
+/**
+ * Run a port's suite against an adapter and record what it passed.
+ *
+ * Registration is a claim; certification is evidence. Deployment gates can then
+ * require the second rather than accepting the first.
+ */
+declare function certifyAdapter<TPort, TFixtures>(input: {
+    definition: PortDefinition<TPort, TFixtures>;
+    fixtures: TFixtures;
+    adapter: TPort;
+    vendor: string;
+    version?: string;
+    now?: Date;
+}): Promise<CertifiedAdapter>;
 interface PortRequirement {
     name: string;
     version?: string;
@@ -158,7 +343,7 @@ interface RegisteredAdapter {
         version?: string;
     };
 }
-type PortFindingCode = "unsatisfied_port" | "standard_not_spoken" | "version_mismatch";
+type PortFindingCode = "unsatisfied_port" | "standard_not_spoken" | "version_mismatch" | "uncertified_adapter" | "stale_certification";
 interface PortFinding {
     code: PortFindingCode;
     port: string;
@@ -179,10 +364,23 @@ interface PortValidationResult {
 declare function validatePortRequirements(input: {
     capability: PortRequiringCapability;
     adapters: readonly RegisteredAdapter[];
+    /**
+     * Port definitions in force. Supplying them checks that whatever
+     * certification is present was issued against the current contract version.
+     *
+     * They do not by themselves require certification to exist: pass
+     * `requireCertification` for that. Definitions alone catch a stale
+     * certification, not a missing one, and an adapter carrying none passes.
+     */
+    definitions?: readonly PortDefinition<never, never>[];
+    /** Require certification for every required port. Defaults to false. */
+    requireCertification?: boolean;
 }): PortValidationResult;
 declare function assertPortRequirementsSatisfied(input: {
     capability: PortRequiringCapability;
     adapters: readonly RegisteredAdapter[];
+    definitions?: readonly PortDefinition<never, never>[];
+    requireCertification?: boolean;
 }): void;
 interface PortCheck<TPort> {
     id: string;
@@ -208,6 +406,23 @@ declare function identityPortChecks(fixtures: {
     expected: Pick<ActorClaims, "subject" | "tenantId">;
     expiredCredential?: string;
 }): PortCheck<IdentityPort>[];
+/** The suite a content adapter must pass. */
+declare function contentPortChecks(fixtures: {
+    present: ContentQuery;
+    absentKey: string;
+}): PortCheck<ContentPort>[];
+/** The suite a payments adapter must pass. */
+declare function paymentsPortChecks(fixtures: {
+    request: PaymentRequest;
+}): PortCheck<PaymentsPort>[];
+/** The suite a search adapter must pass. */
+declare function searchPortChecks(fixtures: {
+    query: SearchQuery;
+}): PortCheck<SearchPort>[];
+/** The suite a customer-record adapter must pass. */
+declare function customerRecordPortChecks(fixtures: {
+    event: CustomerEvent;
+}): PortCheck<CustomerRecordPort>[];
 declare function designTokensPortChecks(theme: string): PortCheck<DesignTokensPort>[];
 /** Runs a contract suite and returns every failure, rather than stopping at the first. */
 declare function runPortContract<TPort>(port: TPort, checks: readonly PortCheck<TPort>[]): Promise<{
@@ -218,4 +433,4 @@ declare function runPortContract<TPort>(port: TPort, checks: readonly PortCheck<
     }>;
 }>;
 
-export { type ActorClaims, ActorScopeError, type ActorScopeRejection, type ActorSpaceCoverage, type DesignTokensPort, type DtcgGroup, type DtcgToken, type EvaluationContext, type FlagValue, type FlagsPort, IDENTITY_ACTOR_TYPES, type IdentityActorType, type IdentityPort, type PortCheck, type PortFinding, type PortFindingCode, type PortRequirement, type PortRequiringCapability, type PortValidationResult, type RegisteredAdapter, type ResolutionDetails, type ResolutionReason, type ResolvedToken, actorContextFromClaims, assertActorClaimsCoverScope, assertPortRequirementsSatisfied, designTokensPortChecks, flagsPortChecks, identityPortChecks, resolveDesignTokens, runPortContract, validatePortRequirements };
+export { type ActorClaims, ActorScopeError, type ActorScopeRejection, type ActorSpaceCoverage, type AdapterCertification, type CertifiedAdapter, type ContentEntry, type ContentPort, type ContentQuery, type CustomerEvent, type CustomerRecordPort, type DesignTokensPort, type DtcgGroup, type DtcgToken, type EvaluationContext, type FlagValue, type FlagsPort, IDENTITY_ACTOR_TYPES, type IdentityActorType, type IdentityPort, type JsonLike, type MinorUnitAmount, type PaymentOutcome, type PaymentRequest, type PaymentResult, type PaymentsPort, type PortCheck, type PortDefinition, type PortFinding, type PortFindingCode, type PortRequirement, type PortRequiringCapability, type PortValidationResult, type RegisteredAdapter, type ResolutionDetails, type ResolutionReason, type ResolvedToken, type SearchHit, type SearchPort, type SearchQuery, actorContextFromClaims, assertActorClaimsCoverScope, assertPortRequirementsSatisfied, assertPortSuiteHasTeeth, certifyAdapter, contentPortChecks, customerRecordPortChecks, definePort, designTokensPortChecks, flagsPortChecks, identityPortChecks, paymentsPortChecks, resolveDesignTokens, runPortContract, searchPortChecks, validatePortRequirements };

package/dist/index.js

@@ -1,353 +1,41 @@
-// index.ts
-var ALIAS = /^\{([^}]+)\}$/;
-var isToken = (value) => !!value && typeof value === "object" && !Array.isArray(value) && "$value" in value;
-var isGroup = (value) => !!value && typeof value === "object" && !Array.isArray(value) && !("$value" in value);
-function resolveDesignTokens(document) {
-  const flat = /* @__PURE__ */ new Map();
-  const walk = (node, path, inheritedType) => {
-    const groupType = typeof node.$type === "string" ? node.$type : inheritedType;
-    for (const [key, member] of Object.entries(node)) {
-      if (key.startsWith("$")) continue;
-      const next = [...path, key];
-      if (isToken(member)) {
-        flat.set(next.join("."), { token: member, type: member.$type ?? groupType });
-      } else if (isGroup(member)) {
-        walk(member, next, groupType);
-      }
-    }
-  };
-  walk(document, []);
-  const resolving = /* @__PURE__ */ new Set();
-  const resolved = /* @__PURE__ */ new Map();
-  const valueOf = (name) => {
-    if (resolved.has(name)) return resolved.get(name);
-    const entry = flat.get(name);
-    if (!entry) throw new Error(`Design token alias "{${name}}" does not resolve to a declared token.`);
-    if (resolving.has(name)) {
-      throw new Error(`Design token alias cycle: ${[...resolving, name].join(" -> ")}.`);
-    }
-    const raw = entry.token.$value;
-    if (typeof raw !== "string") {
-      resolved.set(name, raw);
-      return raw;
-    }
-    const alias = ALIAS.exec(raw.trim());
-    if (!alias) {
-      resolved.set(name, raw);
-      return raw;
-    }
-    resolving.add(name);
-    const target = valueOf(alias[1]);
-    resolving.delete(name);
-    resolved.set(name, target);
-    return target;
-  };
-  return [...flat.entries()].map(([name, entry]) => {
-    const value = valueOf(name);
-    return {
-      name,
-      value,
-      ...entry.type === void 0 ? {} : { type: entry.type },
-      ...entry.token.$description === void 0 ? {} : { description: entry.token.$description }
-    };
-  });
-}
-var IDENTITY_ACTOR_TYPES = [
-  "natural_person",
-  "agent",
-  "system",
-  "service_account",
-  "external_system",
-  "integration"
-];
-var ActorScopeError = class extends Error {
-  constructor(rejection, message) {
-    super(message);
-    this.rejection = rejection;
-  }
-  rejection;
-  name = "ActorScopeError";
-};
-function assertActorClaimsCoverScope(claims, scope, now = /* @__PURE__ */ new Date()) {
-  const currentTime = now.getTime();
-  if (Number.isNaN(currentTime)) {
-    throw new ActorScopeError("malformed_claims", "Actor scope was evaluated against an invalid clock.");
-  }
-  if (typeof claims.actorType !== "string" || !IDENTITY_ACTOR_TYPES.includes(claims.actorType)) {
-    throw new ActorScopeError("unknown_actor_type", `Actor type "${String(claims.actorType)}" is not a known actor kind.`);
-  }
-  if (typeof claims.subject !== "string" || claims.subject.length === 0) {
-    throw new ActorScopeError("malformed_claims", "Actor claims carry no subject.");
-  }
-  if (typeof claims.tenantId !== "string" || claims.tenantId.length === 0) {
-    throw new ActorScopeError("malformed_claims", "Actor claims carry no tenant.");
-  }
-  const issuedAt = parseRfc3339(claims.issuedAt);
-  const expiresAt = parseRfc3339(claims.expiresAt);
-  if (issuedAt === void 0 || expiresAt === void 0) {
-    throw new ActorScopeError("malformed_claims", "Actor claims carry an issuedAt or expiresAt that is not an RFC 3339 timestamp with an explicit offset.");
-  }
-  if (currentTime >= expiresAt) {
-    throw new ActorScopeError("expired", `Actor claims expired at ${claims.expiresAt}.`);
-  }
-  if (currentTime < issuedAt) {
-    throw new ActorScopeError("not_yet_valid", `Actor claims are not valid until ${claims.issuedAt}.`);
-  }
-  if (claims.tenantId !== scope.tenantId) {
-    throw new ActorScopeError(
-      "tenant_mismatch",
-      `Actor claims cover tenant "${claims.tenantId}" but the request targets "${scope.tenantId}".`
-    );
-  }
-  if (claims.spaceIds === "tenant-wide") return;
-  if (!Array.isArray(claims.spaceIds) || !claims.spaceIds.every((space) => typeof space === "string")) {
-    throw new ActorScopeError("malformed_claims", 'Actor claims spaceIds must be an array of strings or the literal "tenant-wide".');
-  }
-  if (!claims.spaceIds.includes(scope.spaceId)) {
-    throw new ActorScopeError(
-      "space_not_covered",
-      `Actor claims do not cover space "${scope.spaceId}".`
-    );
-  }
-}
-var RFC3339 = /^\d{4}-\d{2}-\d{2}[Tt]\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:[Zz]|[+-]\d{2}:\d{2})$/;
-function parseRfc3339(value) {
-  if (typeof value !== "string" || !RFC3339.test(value)) return void 0;
-  const parsed = Date.parse(value);
-  return Number.isNaN(parsed) ? void 0 : parsed;
-}
-function actorContextFromClaims(claims, scope, now = /* @__PURE__ */ new Date()) {
-  assertActorClaimsCoverScope(claims, scope, now);
-  return {
-    actorId: claims.subject,
-    actorType: claims.actorType,
-    tenantId: claims.tenantId,
-    spaceId: scope.spaceId
-  };
-}
-function validatePortRequirements(input) {
-  const findings = [];
-  for (const requirement of input.capability.requirements?.ports ?? []) {
-    const candidates = input.adapters.filter((adapter) => adapter.port === requirement.name);
-    if (candidates.length === 0) {
-      findings.push({
-        code: "unsatisfied_port",
-        port: requirement.name,
-        message: `capability "${input.capability.namespace}" requires port "${requirement.name}" and no adapter is registered for it`
-      });
-      continue;
-    }
-    if (requirement.standard) {
-      const speaking = candidates.filter((adapter) => adapter.standard?.name === requirement.standard.name);
-      if (speaking.length === 0) {
-        findings.push({
-          code: "standard_not_spoken",
-          port: requirement.name,
-          message: `port "${requirement.name}" must speak "${requirement.standard.name}"; registered adapters are ${candidates.map((adapter) => `${adapter.vendor}(${adapter.standard?.name ?? "no standard"})`).join(", ")}`
-        });
-        continue;
-      }
-    }
-    if (requirement.version && !candidates.some((adapter) => adapter.version === requirement.version)) {
-      findings.push({
-        code: "version_mismatch",
-        port: requirement.name,
-        message: `port "${requirement.name}" requires version "${requirement.version}"; registered adapters are ${candidates.map((adapter) => `${adapter.vendor}@${adapter.version ?? "unversioned"}`).join(", ")}`
-      });
-    }
-  }
-  return { valid: findings.length === 0, findings };
-}
-function assertPortRequirementsSatisfied(input) {
-  const result = validatePortRequirements(input);
-  if (result.valid) return;
-  throw new Error([
-    `Port requirements for "${input.capability.namespace}" are not satisfied:`,
-    ...result.findings.map((finding) => `  - ${finding.message}`)
-  ].join("\n"));
-}
-var PortContractFailure = class extends Error {
-  name = "PortContractFailure";
-};
-function expect(condition, message) {
-  if (!condition) throw new PortContractFailure(message);
-}
-function flagsPortChecks() {
-  const unknownKey = "fabric.contract.definitely-not-configured";
-  return [
-    {
-      id: "flags.default-on-unknown-key",
-      title: "an unknown flag resolves to the supplied default rather than throwing",
-      async run(port) {
-        const result = await port.resolveBoolean(unknownKey, true);
-        expect(result.value === true, `an unknown flag returned ${String(result.value)} instead of the supplied default`);
-        expect(
-          result.reason === "DEFAULT" || result.reason === "ERROR",
-          `an unknown flag resolved with reason "${result.reason}"; a default or error was expected`
-        );
-      }
-    },
-    {
-      id: "flags.default-is-typed",
-      title: "each typed resolver returns its own type",
-      async run(port) {
-        expect(typeof (await port.resolveBoolean(unknownKey, false)).value === "boolean", "resolveBoolean did not return a boolean");
-        expect(typeof (await port.resolveString(unknownKey, "fallback")).value === "string", "resolveString did not return a string");
-        expect(typeof (await port.resolveNumber(unknownKey, 42)).value === "number", "resolveNumber did not return a number");
-      }
-    },
-    {
-      id: "flags.evaluation-is-pure",
-      title: "the same key and context resolve the same way twice",
-      async run(port) {
-        const context = { targetingKey: "fabric-contract-subject" };
-        const first = await port.resolveString(unknownKey, "fallback", context);
-        const second = await port.resolveString(unknownKey, "fallback", context);
-        expect(first.value === second.value, `the same evaluation returned "${first.value}" then "${second.value}"`);
-      }
-    },
-    {
-      id: "flags.tolerates-absent-context",
-      title: "evaluation without a context does not throw",
-      async run(port) {
-        await port.resolveBoolean(unknownKey, false);
-      }
-    }
-  ];
-}
-function identityPortChecks(fixtures) {
-  const checks = [
-    {
-      id: "identity.rejects-garbage",
-      title: "an unverifiable credential resolves to null rather than partial claims",
-      async run(port) {
-        const result = await port.verify("not-a-credential");
-        expect(result === null, "an unverifiable credential resolved to claims instead of null");
-      }
-    },
-    {
-      id: "identity.rejects-empty",
-      title: "an empty credential resolves to null",
-      async run(port) {
-        expect(await port.verify("") === null, "an empty credential resolved to claims");
-      }
-    },
-    {
-      id: "identity.resolves-valid",
-      title: "a valid credential resolves to the expected subject and tenant",
-      async run(port) {
-        const claims = await port.verify(fixtures.validCredential);
-        expect(claims !== null, "a valid credential failed to verify");
-        expect(claims?.subject === fixtures.expected.subject, `subject was "${claims?.subject}"`);
-        expect(claims?.tenantId === fixtures.expected.tenantId, `tenantId was "${claims?.tenantId}"`);
-      }
-    },
-    {
-      id: "identity.claims-are-complete",
-      title: "resolved claims carry every field the platform derives actor context from",
-      async run(port) {
-        const claims = await port.verify(fixtures.validCredential);
-        expect(claims !== null, "a valid credential failed to verify");
-        if (!claims) return;
-        expect(IDENTITY_ACTOR_TYPES.includes(claims.actorType), `actorType "${claims.actorType}" is not a known actor kind`);
-        expect(typeof claims.issuer === "string" && claims.issuer.length > 0, "claims carry no issuer");
-        expect(!Number.isNaN(Date.parse(claims.issuedAt)), "issuedAt is not a parseable timestamp");
-        expect(!Number.isNaN(Date.parse(claims.expiresAt)), "expiresAt is not a parseable timestamp");
-        expect(
-          claims.spaceIds === "tenant-wide" || Array.isArray(claims.spaceIds),
-          'spaceIds must be an explicit list or the literal "tenant-wide"'
-        );
-      }
-    },
-    {
-      id: "identity.carries-no-credential-material",
-      title: "resolved claims never echo the credential back",
-      async run(port) {
-        const claims = await port.verify(fixtures.validCredential);
-        if (!claims) return;
-        const serialized = JSON.stringify(claims);
-        expect(
-          !serialized.includes(fixtures.validCredential),
-          "resolved claims contain the presented credential; claims must carry an opaque reference instead"
-        );
-      }
-    },
-    {
-      id: "identity.verification-is-stable",
-      title: "the same credential resolves the same subject twice",
-      async run(port) {
-        const first = await port.verify(fixtures.validCredential);
-        const second = await port.verify(fixtures.validCredential);
-        expect(first?.subject === second?.subject, "the same credential resolved to two different subjects");
-      }
-    }
-  ];
-  if (fixtures.expiredCredential !== void 0) {
-    checks.push({
-      id: "identity.rejects-expired",
-      title: "an expired credential resolves to null rather than stale claims",
-      async run(port) {
-        const expiredCredential = fixtures.expiredCredential;
-        expect(await port.verify(expiredCredential) === null, "an expired credential still resolved to claims");
-      }
-    });
-  }
-  return checks;
-}
-function designTokensPortChecks(theme) {
-  return [
-    {
-      id: "tokens.theme-resolves",
-      title: "a known theme resolves to at least one token",
-      async run(port) {
-        const tokens = await port.resolve(theme);
-        expect(Array.isArray(tokens) && tokens.length > 0, `theme "${theme}" resolved to no tokens`);
-      }
-    },
-    {
-      id: "tokens.no-unresolved-aliases",
-      title: "no resolved token still carries an alias",
-      async run(port) {
-        for (const token of await port.resolve(theme)) {
-          expect(
-            typeof token.value !== "string" || !ALIAS.test(token.value.trim()),
-            `token "${token.name}" resolved to the unfollowed alias ${String(token.value)}`
-          );
-        }
-      }
-    },
-    {
-      id: "tokens.names-are-unique",
-      title: "token names are unique within a theme",
-      async run(port) {
-        const names = (await port.resolve(theme)).map((token) => token.name);
-        expect(new Set(names).size === names.length, "the theme resolved duplicate token names");
-      }
-    }
-  ];
-}
-async function runPortContract(port, checks) {
-  const failures = [];
-  for (const check of checks) {
-    try {
-      await check.run(port);
-    } catch (error) {
-      failures.push({ id: check.id, message: error instanceof Error ? error.message : String(error) });
-    }
-  }
-  return { passed: failures.length === 0, failures };
-}
+import {
+  ActorScopeError,
+  IDENTITY_ACTOR_TYPES,
+  actorContextFromClaims,
+  assertActorClaimsCoverScope,
+  assertPortRequirementsSatisfied,
+  assertPortSuiteHasTeeth,
+  certifyAdapter,
+  contentPortChecks,
+  customerRecordPortChecks,
+  definePort,
+  designTokensPortChecks,
+  flagsPortChecks,
+  identityPortChecks,
+  paymentsPortChecks,
+  resolveDesignTokens,
+  runPortContract,
+  searchPortChecks,
+  validatePortRequirements
+} from "./chunk-HQF57NML.js";
 export {
   ActorScopeError,
   IDENTITY_ACTOR_TYPES,
   actorContextFromClaims,
   assertActorClaimsCoverScope,
   assertPortRequirementsSatisfied,
+  assertPortSuiteHasTeeth,
+  certifyAdapter,
+  contentPortChecks,
+  customerRecordPortChecks,
+  definePort,
   designTokensPortChecks,
   flagsPortChecks,
   identityPortChecks,
+  paymentsPortChecks,
   resolveDesignTokens,
   runPortContract,
+  searchPortChecks,
   validatePortRequirements
 };
 //# sourceMappingURL=index.js.map