@mayurajs/authz-http 0.0.0-stage → 1.2.0-rc.1

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/NOTICE

@@ -0,0 +1,8 @@
+Mayura
+Copyright 2026 The Mayura Authors
+
+This product includes software developed by the Mayura contributors.
+
+Third-party dependencies retain their own copyright and license terms. Exact
+resolved versions are recorded in pnpm-lock.yaml and reviewed by the release
+artifact and dependency qualification procedures.

package/README.md

@@ -1,3 +1,27 @@
-# Temporary Holding Version
+# `@mayurajs/authz-http`
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+An optional HTTP authorization policy adapter for Mayura's core contract. Implements the explicit
+`mayura.authorization.v1` protocol with pinned policy revisions, per-request correlation, strict bounded JSON,
+HTTPS transport, explicit `authz:http` permission and fail-closed receipts. No vendor SDK, automatic retries,
+redirects, cookies, implicit credentials, decision cache or network activity on construction.
+
+```ts
+import { createHttpAuthorizer } from '@mayurajs/authz-http';
+
+const authorizer = createHttpAuthorizer({
+  endpoint: 'https://policy.example/check', version: 'shop-v3',
+  permissions: { allow: ['authz:http', 'authz:evaluate'] },
+  timeoutMs: 750, limits: { timeoutMs: 1000 },
+});
+const scope = { principalId: 'alice', projectId: 'shop' };
+try { await authorizer.require(scope, 'read', { kind: 'thread', id: 'chat', scope }); }
+finally { await authorizer.flushAudit(); authorizer.close(); }
+```
+
+Optional `audit` settings and `authz:audit` forward to the core authorizer. Audit/OTel consumers receive one final core
+receipt, never credentials, raw provider payloads or exception text. `createHttpAuthorizationPolicy` instead returns a
+plain core-compatible policy with an explicit `close()`; pass it to `createAuthorizer` or the scoped server and close
+it separately when finished. Each check makes a fresh request; configure host rate limits for your service's cost.
+
+The full protocol, transport bounds, service authentication and server/audit wiring are documented in
+[HTTP authorization policies](../../docs/integrations/authz-http.md).

package/dist/index.d.ts

@@ -0,0 +1,53 @@
+import { type AuthorizationDecision, type AuthorizationPolicy, type AuthorizationRequest, type Authorizer, type AuthorizerOptions, type Permissions } from 'mayura';
+/** Versioned Mayura policy-decision protocol; this is not an OPA, Cedar, OpenFGA or other vendor wire format. */
+export declare const HTTP_AUTHORIZATION_PROTOCOL: 'mayura.authorization.v1';
+/** Exact POST envelope sent to the configured decision service. */
+export interface HttpAuthorizationRequest {
+    readonly protocol: typeof HTTP_AUTHORIZATION_PROTOCOL;
+    readonly requestId: string;
+    readonly policyVersion: string;
+    readonly request: AuthorizationRequest;
+}
+/** Exact HTTP 200 envelope required from the decision service. */
+export interface HttpAuthorizationResponse {
+    readonly protocol: typeof HTTP_AUTHORIZATION_PROTOCOL;
+    readonly requestId: string;
+    readonly decision: AuthorizationDecision;
+}
+export interface HttpAuthorizationPolicyOptions {
+    /** Exact trusted policy endpoint. HTTPS only, except explicitly enabled literal-loopback development URLs. */
+    readonly endpoint: string;
+    /** Pinned remote policy revision. Every decision must echo it exactly. */
+    readonly version: string;
+    /** Explicit authz:http admission. No remote request is made without it. */
+    readonly permissions?: Permissions;
+    /** Explicit fixed service credentials/headers. Never taken from a browser request or the environment. */
+    readonly headers?: Readonly<Record<string, string>>;
+    readonly fetch?: typeof globalThis.fetch;
+    readonly allowInsecureLoopback?: boolean;
+    /** Per-check transport deadline, default 1,000 ms; 1–30,000 ms. */
+    readonly timeoutMs?: number;
+    /** Outstanding transport tasks, default 32; 1–256. Ignored aborts retain capacity until actual settlement. */
+    readonly maxConcurrent?: number;
+    /** UTF-8 request bytes, default 8,192; 1,024–16,384. */
+    readonly maxRequestBytes?: number;
+    /** Decoded response bytes, default 2,048; 256–16,384. */
+    readonly maxResponseBytes?: number;
+}
+export interface HttpAuthorizationPolicy extends AuthorizationPolicy {
+    /** Abort admitted transport work and refuse future evaluation. No request cache is retained. */
+    close(): void;
+}
+export interface HttpAuthorizerOptions extends HttpAuthorizationPolicyOptions {
+    readonly audit?: AuthorizerOptions['audit'];
+    /** Core evaluation limits, separate from HTTP transport limits. */
+    readonly limits?: AuthorizerOptions['limits'];
+}
+/**
+ * Remote policy through the core contract. Only a correlated, pinned, strictly validated decision may allow. All
+ * transport/parse/status failures deny without provider diagnostics. No retries, redirects, cookies or implicit cache.
+ */
+export declare function createHttpAuthorizationPolicy(options: HttpAuthorizationPolicyOptions): HttpAuthorizationPolicy;
+/** Core enforcement and audit own the single decision receipt; closing also aborts the owned remote policy. */
+export declare function createHttpAuthorizer(options: HttpAuthorizerOptions): Authorizer;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,qBAAqB,EAAgC,KAAK,mBAAmB,EAAE,KAAK,oBAAoB,EAC7G,KAAK,UAAU,EAAE,KAAK,iBAAiB,EAAE,KAAK,WAAW,EAAE,MAAM,QAAQ,CAAC;AAE5E,iHAAiH;AACjH,eAAO,MAAM,2BAA2B,EAAG,yBAAkC,CAAC;AAC9E,mEAAmE;AACnE,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,QAAQ,EAAE,OAAO,2BAA2B,CAAC;IACtD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC;CACxC;AACD,kEAAkE;AAClE,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,QAAQ,EAAE,OAAO,2BAA2B,CAAC;IACtD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;CAC1C;AACD,MAAM,WAAW,8BAA8B;IAC7C,8GAA8G;IAC9G,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,0EAA0E;IAC1E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,2EAA2E;IAC3E,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC,yGAAyG;IACzG,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACpD,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IACzC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,CAAC;IACzC,mEAAmE;IACnE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,8GAA8G;IAC9G,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,wDAAwD;IACxD,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,yDAAyD;IACzD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AACD,MAAM,WAAW,uBAAwB,SAAQ,mBAAmB;IAClE,gGAAgG;IAChG,KAAK,IAAI,IAAI,CAAC;CACf;AACD,MAAM,WAAW,qBAAsB,SAAQ,8BAA8B;IAC3E,QAAQ,CAAC,KAAK,CAAC,EAAE,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC5C,mEAAmE;IACnE,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC;CAC/C;AAwCD;;;GAGG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,8BAA8B,GAAG,uBAAuB,CAuF9G;AACD,+GAA+G;AAC/G,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,qBAAqB,GAAG,UAAU,CAQ/E"}

package/dist/index.js

@@ -0,0 +1,244 @@
+import { authorizationRequest, createAuthorizer, jsonValue, MayuraError } from 'mayura';
+/** Versioned Mayura policy-decision protocol; this is not an OPA, Cedar, OpenFGA or other vendor wire format. */
+export const HTTP_AUTHORIZATION_PROTOCOL = 'mayura.authorization.v1';
+const identifier = /^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$/u;
+const denyReasons = ['no_match', 'explicit_deny', 'scope_mismatch', 'permission_denied', 'invalid_request', 'unavailable', 'cancelled', 'limit_exceeded'];
+function invalid() { throw new MayuraError('INVALID_CONFIG', 'HTTP authorization requires an explicit endpoint, policy version and bounded transport settings.'); }
+function bound(value, fallback, min, max) {
+    const result = value ?? fallback;
+    if (!Number.isSafeInteger(result) || result < min || result > max)
+        return invalid();
+    return result;
+}
+function endpoint(value, insecure) {
+    if (typeof value !== 'string' || value.length > 2048)
+        return invalid();
+    const url = new URL(value);
+    if (url.username || url.password || url.search || url.hash || !url.hostname
+        || (url.protocol !== 'https:' && !(insecure && url.protocol === 'http:' && ['127.0.0.1', '[::1]'].includes(url.hostname))))
+        return invalid();
+    return url.href;
+}
+/** Copy bounded fixed headers. Transport/security headers cannot override the adapter's request isolation. */
+function headers(input) {
+    const value = jsonValue(input ?? {}, { maxBytes: 8192, maxDepth: 1, maxNodes: 33 });
+    if (!value || typeof value !== 'object' || Array.isArray(value) || Object.keys(value).length > 16)
+        return invalid();
+    const result = new Headers({ 'content-type': 'application/json', accept: 'application/json' });
+    const seen = new Set();
+    for (const [key, entry] of Object.entries(value)) {
+        const name = key.toLowerCase();
+        if (!/^[a-z0-9!#$%&'*+.^_`|~-]{1,128}$/.test(name) || seen.has(name) || /^(?:sec-|proxy-)/.test(name)
+            || ['host', 'cookie', 'set-cookie', 'connection', 'content-length', 'content-type', 'accept', 'transfer-encoding', 'upgrade', 'te', 'trailer', 'origin', 'referer', 'user-agent', 'accept-encoding'].includes(name)
+            || typeof entry !== 'string' || !entry.length || /[^\x20-\x7e]/.test(entry))
+            return invalid();
+        seen.add(name);
+        result.set(name, entry);
+    }
+    return result;
+}
+function frame(text, requestId, version) {
+    const raw = jsonValue(JSON.parse(text), { maxBytes: 16_384, maxDepth: 3, maxNodes: 24 });
+    if (!raw || typeof raw !== 'object' || Array.isArray(raw) || Object.keys(raw).sort().join(',') !== 'decision,protocol,requestId'
+        || raw['protocol'] !== HTTP_AUTHORIZATION_PROTOCOL || raw['requestId'] !== requestId)
+        return null;
+    const decision = raw['decision'];
+    if (!decision || typeof decision !== 'object' || Array.isArray(decision) || Object.keys(decision).sort().join(',') !== 'effect,policyVersion,reason,ruleId'
+        || decision['policyVersion'] !== version || (decision['ruleId'] !== null && (typeof decision['ruleId'] !== 'string' || !identifier.test(decision['ruleId'])))
+        || typeof decision['reason'] !== 'string'
+        || (decision['effect'] === 'allow' ? decision['reason'] !== 'allowed' : decision['effect'] !== 'deny' || !denyReasons.includes(decision['reason'])))
+        return null;
+    return Object.freeze({ effect: decision['effect'], reason: decision['reason'], policyVersion: version, ruleId: decision['ruleId'] });
+}
+/**
+ * Remote policy through the core contract. Only a correlated, pinned, strictly validated decision may allow. All
+ * transport/parse/status failures deny without provider diagnostics. No retries, redirects, cookies or implicit cache.
+ */
+export function createHttpAuthorizationPolicy(options) {
+    let destination;
+    let fixedHeaders;
+    let transport;
+    let version;
+    let timeoutMs;
+    let maxConcurrent;
+    let maxRequestBytes;
+    let maxResponseBytes;
+    let admitted;
+    try {
+        if (!options || typeof options.version !== 'string' || !identifier.test(options.version)
+            || (options.allowInsecureLoopback !== undefined && typeof options.allowInsecureLoopback !== 'boolean'))
+            return invalid();
+        destination = endpoint(options.endpoint, options.allowInsecureLoopback === true);
+        fixedHeaders = headers(options.headers);
+        version = options.version;
+        transport = options.fetch ?? globalThis.fetch;
+        if (typeof transport !== 'function')
+            return invalid();
+        const grants = options.permissions?.allow ?? [];
+        if (!Array.isArray(grants) || grants.length > 4096 || grants.some(grant => typeof grant !== 'string' || !grant.length || grant.length > 256))
+            return invalid();
+        admitted = grants.includes('authz:http');
+        timeoutMs = bound(options.timeoutMs, 1000, 1, 30_000);
+        maxConcurrent = bound(options.maxConcurrent, 32, 1, 256);
+        maxRequestBytes = bound(options.maxRequestBytes, 8192, 1024, 16_384);
+        maxResponseBytes = bound(options.maxResponseBytes, 2048, 256, 16_384);
+    }
+    catch {
+        return invalid();
+    }
+    const active = new Set();
+    let closed = false;
+    const deny = (reason) => Object.freeze({ effect: 'deny', reason, policyVersion: version, ruleId: null });
+    const authorize = async (raw, context) => {
+        let request;
+        try {
+            // Exact root shape as well as nested validation: never serialize arbitrary caller fields.
+            const snapshot = jsonValue(raw, { maxBytes: 4096, maxDepth: 4, maxNodes: 32 });
+            if (!snapshot || typeof snapshot !== 'object' || Array.isArray(snapshot) || Object.keys(snapshot).sort().join(',') !== 'action,resource,subject')
+                return deny('invalid_request');
+            const data = snapshot;
+            request = authorizationRequest(data.subject, data.action, data.resource);
+            if (!(context?.signal instanceof AbortSignal))
+                return deny('invalid_request');
+        }
+        catch {
+            return deny('invalid_request');
+        }
+        if (closed || context.signal.aborted)
+            return deny('cancelled');
+        if (request.subject.principalId !== request.resource.scope.principalId || request.subject.projectId !== request.resource.scope.projectId)
+            return deny('scope_mismatch');
+        if (!admitted)
+            return deny('permission_denied');
+        if (active.size >= maxConcurrent)
+            return deny('limit_exceeded');
+        const requestId = crypto.randomUUID();
+        const envelope = { protocol: HTTP_AUTHORIZATION_PROTOCOL, requestId, policyVersion: version, request };
+        const payload = JSON.stringify(envelope);
+        if (new TextEncoder().encode(payload).byteLength > maxRequestBytes)
+            return deny('limit_exceeded');
+        const control = new AbortController();
+        const deadline = Date.now() + timeoutMs;
+        active.add(control);
+        return await new Promise(resolve => {
+            let finished = false;
+            let expired = false;
+            let timer;
+            const finish = (decision) => {
+                if (finished)
+                    return;
+                finished = true;
+                clearTimeout(timer);
+                context.signal.removeEventListener('abort', relay);
+                control.signal.removeEventListener('abort', aborted);
+                resolve(decision);
+            };
+            const relay = () => control.abort();
+            const aborted = () => finish(deny(expired ? 'unavailable' : 'cancelled'));
+            control.signal.addEventListener('abort', aborted, { once: true });
+            context.signal.addEventListener('abort', relay, { once: true });
+            timer = setTimeout(() => { expired = true; control.abort(); }, timeoutMs);
+            if (context.signal.aborted)
+                relay();
+            // The task is deliberately not raced internally: ignored fetch/read cancellation retains the transport slot.
+            const work = async () => {
+                if (control.signal.aborted)
+                    return deny(expired ? 'unavailable' : 'cancelled');
+                let response;
+                let reader;
+                let cancellation;
+                const cancelBody = () => {
+                    if (cancellation)
+                        return cancellation;
+                    try {
+                        if (reader)
+                            cancellation = reader.cancel().catch(() => { });
+                        else if (response?.body)
+                            cancellation = response.body.cancel().catch(() => { });
+                    }
+                    catch {
+                        cancellation = Promise.resolve();
+                    }
+                    return cancellation;
+                };
+                const stopBody = () => { void cancelBody(); };
+                control.signal.addEventListener('abort', stopBody, { once: true });
+                try {
+                    response = await transport(destination, { method: 'POST', headers: new Headers(fixedHeaders), body: payload,
+                        signal: control.signal, redirect: 'error', credentials: 'omit', cache: 'no-store', referrerPolicy: 'no-referrer' });
+                    if (control.signal.aborted || closed)
+                        return deny(expired ? 'unavailable' : 'cancelled');
+                    if (response.status !== 200 || response.redirected || (response.url && response.url !== destination)
+                        || !/^application\/json(?:\s*;|$)/i.test(response.headers.get('content-type') ?? '') || !response.body)
+                        return deny('unavailable');
+                    const length = response.headers.get('content-length');
+                    if (length !== null && (!/^[0-9]{1,9}$/.test(length) || Number(length) > maxResponseBytes))
+                        return deny('unavailable');
+                    reader = response.body.getReader();
+                    const chunks = [];
+                    let size = 0;
+                    for (;;) {
+                        if (control.signal.aborted)
+                            return deny(expired ? 'unavailable' : 'cancelled');
+                        const item = await reader.read();
+                        if (item.done)
+                            break;
+                        size += item.value.byteLength;
+                        if (size > maxResponseBytes)
+                            return deny('unavailable');
+                        if (item.value.byteLength)
+                            chunks.push(new Uint8Array(item.value));
+                    }
+                    const bytes = new Uint8Array(size);
+                    let offset = 0;
+                    for (const chunk of chunks) {
+                        bytes.set(chunk, offset);
+                        offset += chunk.byteLength;
+                    }
+                    const decision = frame(new TextDecoder('utf-8', { fatal: true }).decode(bytes), requestId, version);
+                    if (Date.now() >= deadline && !control.signal.aborted) {
+                        expired = true;
+                        control.abort();
+                    }
+                    return control.signal.aborted || closed ? deny(expired ? 'unavailable' : 'cancelled') : decision ?? deny('unavailable');
+                }
+                catch {
+                    return deny(control.signal.aborted ? expired ? 'unavailable' : 'cancelled' : 'unavailable');
+                }
+                finally {
+                    control.signal.removeEventListener('abort', stopBody);
+                    await cancelBody();
+                    if (reader)
+                        reader.releaseLock();
+                }
+            };
+            void Promise.resolve().then(work).then(result => {
+                active.delete(control);
+                // Cleanup and trusted transport callbacks can consume wall time while timers are unable to run.
+                if (Date.now() >= deadline && !control.signal.aborted) {
+                    expired = true;
+                    control.abort();
+                }
+                finish(control.signal.aborted || closed ? deny(expired ? 'unavailable' : 'cancelled') : result);
+            }, () => { active.delete(control); finish(deny('unavailable')); });
+        });
+    };
+    return Object.freeze({ version, authorize, close() { if (closed)
+            return; closed = true; for (const control of active)
+            control.abort(); } });
+}
+/** Core enforcement and audit own the single decision receipt; closing also aborts the owned remote policy. */
+export function createHttpAuthorizer(options) {
+    const policy = createHttpAuthorizationPolicy(options);
+    try {
+        const authorizer = createAuthorizer({ policy,
+            ...(options.permissions === undefined ? {} : { permissions: options.permissions }),
+            ...(options.audit === undefined ? {} : { audit: options.audit }), ...(options.limits === undefined ? {} : { limits: options.limits }) });
+        return Object.freeze({ ...authorizer, close() { authorizer.close(); policy.close(); } });
+    }
+    catch (error) {
+        policy.close();
+        throw error;
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,SAAS,EAAE,WAAW,EAEV,MAAM,QAAQ,CAAC;AAE5E,iHAAiH;AACjH,MAAM,CAAC,MAAM,2BAA2B,GAAG,yBAAkC,CAAC;AA2C9E,MAAM,UAAU,GAAG,uCAAuC,CAAC;AAC3D,MAAM,WAAW,GAAsB,CAAC,UAAU,EAAE,eAAe,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,aAAa,EAAE,WAAW,EAAE,gBAAgB,CAAC,CAAC;AAC7K,SAAS,OAAO,KAAY,MAAM,IAAI,WAAW,CAAC,gBAAgB,EAAE,kGAAkG,CAAC,CAAC,CAAC,CAAC;AAC1K,SAAS,KAAK,CAAC,KAAyB,EAAE,QAAgB,EAAE,GAAW,EAAE,GAAW;IAClF,MAAM,MAAM,GAAG,KAAK,IAAI,QAAQ,CAAC;IAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,GAAG,GAAG;QAAE,OAAO,OAAO,EAAE,CAAC;IAAC,OAAO,MAAM,CAAC;AACvI,CAAC;AACD,SAAS,QAAQ,CAAC,KAAa,EAAE,QAAiB;IAChD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI;QAAE,OAAO,OAAO,EAAE,CAAC;IACvE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ;WACtE,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,OAAO,EAAE,CAAC;IAC/I,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AACD,8GAA8G;AAC9G,SAAS,OAAO,CAAC,KAAgD;IAC/D,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;IACpF,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,OAAO,EAAE,CAAC;IACpH,MAAM,MAAM,GAAG,IAAI,OAAO,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC/F,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QAC/B,IAAI,CAAC,kCAAkC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;eAChG,CAAC,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,EAAE,gBAAgB,EAAE,cAAc,EAAE,QAAQ,EAAE,mBAAmB,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,iBAAiB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;eAChN,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,OAAO,EAAE,CAAC;QAChG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AACD,SAAS,KAAK,CAAC,IAAY,EAAE,SAAiB,EAAE,OAAe;IAC7D,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;IACzF,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,6BAA6B;WAC3H,GAAG,CAAC,UAAU,CAAC,KAAK,2BAA2B,IAAI,GAAG,CAAC,WAAW,CAAC,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACpG,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC;IACjC,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,oCAAoC;WACtJ,QAAQ,CAAC,eAAe,CAAC,KAAK,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,IAAI,IAAI,CAAC,OAAO,QAAQ,CAAC,QAAQ,CAAC,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;WAC1J,OAAO,QAAQ,CAAC,QAAQ,CAAC,KAAK,QAAQ;WACtC,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACnK,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAA0B,CAAC;AAChK,CAAC;AACD;;;GAGG;AACH,MAAM,UAAU,6BAA6B,CAAC,OAAuC;IACnF,IAAI,WAAmB,CAAC;IAAC,IAAI,YAAqB,CAAC;IAAC,IAAI,SAAkC,CAAC;IAAC,IAAI,OAAe,CAAC;IAChH,IAAI,SAAiB,CAAC;IAAC,IAAI,aAAqB,CAAC;IAAC,IAAI,eAAuB,CAAC;IAAC,IAAI,gBAAwB,CAAC;IAAC,IAAI,QAAiB,CAAC;IACnI,IAAI,CAAC;QACH,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;eACnF,CAAC,OAAO,CAAC,qBAAqB,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,qBAAqB,KAAK,SAAS,CAAC;YAAE,OAAO,OAAO,EAAE,CAAC;QAC3H,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,qBAAqB,KAAK,IAAI,CAAC,CAAC;QAAC,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QACrJ,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;QAAC,IAAI,OAAO,SAAS,KAAK,UAAU;YAAE,OAAO,OAAO,EAAE,CAAC;QACrG,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC;QAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC;YAAE,OAAO,OAAO,EAAE,CAAC;QAC/J,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QACzC,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;QAAC,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;QAChH,eAAe,GAAG,KAAK,CAAC,OAAO,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAAC,gBAAgB,GAAG,KAAK,CAAC,OAAO,CAAC,gBAAgB,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IAC9I,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,OAAO,EAAE,CAAC;IAAC,CAAC;IAC7B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAmB,CAAC;IAAC,IAAI,MAAM,GAAG,KAAK,CAAC;IAC9D,MAAM,IAAI,GAAG,CAAC,MAA+B,EAAyB,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IACzJ,MAAM,SAAS,GAAqC,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE;QACzE,IAAI,OAA6B,CAAC;QAClC,IAAI,CAAC;YACH,0FAA0F;YAC1F,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;YAC/E,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,yBAAyB;gBAAE,OAAO,IAAI,CAAC,iBAAiB,CAAC,CAAC;YACjL,MAAM,IAAI,GAAG,QAA2C,CAAC;YAAC,OAAO,GAAG,oBAAoB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YACnI,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,YAAY,WAAW,CAAC;gBAAE,OAAO,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAChF,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAAC,CAAC;QAC3C,IAAI,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,WAAW,CAAC,CAAC;QAC/D,IAAI,OAAO,CAAC,OAAO,CAAC,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC,SAAS,KAAK,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACxK,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAChD,IAAI,MAAM,CAAC,IAAI,IAAI,aAAa;YAAE,OAAO,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAChE,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QACtC,MAAM,QAAQ,GAA6B,EAAE,QAAQ,EAAE,2BAA2B,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;QACjI,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACzC,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,UAAU,GAAG,eAAe;YAAE,OAAO,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAClG,MAAM,OAAO,GAAG,IAAI,eAAe,EAAE,CAAC;QAAC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACpG,OAAO,MAAM,IAAI,OAAO,CAAwB,OAAO,CAAC,EAAE;YACxD,IAAI,QAAQ,GAAG,KAAK,CAAC;YAAC,IAAI,OAAO,GAAG,KAAK,CAAC;YAAC,IAAI,KAAgD,CAAC;YAChG,MAAM,MAAM,GAAG,CAAC,QAA+B,EAAE,EAAE;gBACjD,IAAI,QAAQ;oBAAE,OAAO;gBAAC,QAAQ,GAAG,IAAI,CAAC;gBAAC,YAAY,CAAC,KAAK,CAAC,CAAC;gBAC3D,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBAAC,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAC9H,CAAC,CAAC;YACF,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YAAC,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;YAC/G,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACnI,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;YAAC,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO;gBAAE,KAAK,EAAE,CAAC;YAC/G,6GAA6G;YAC7G,MAAM,IAAI,GAAG,KAAK,IAAoC,EAAE;gBACtD,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO;oBAAE,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;gBAC/E,IAAI,QAA8B,CAAC;gBAAC,IAAI,MAA2D,CAAC;gBACpG,IAAI,YAAuC,CAAC;gBAC5C,MAAM,UAAU,GAAG,GAA8B,EAAE;oBACjD,IAAI,YAAY;wBAAE,OAAO,YAAY,CAAC;oBACtC,IAAI,CAAC;wBAAC,IAAI,MAAM;4BAAE,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;6BAAM,IAAI,QAAQ,EAAE,IAAI;4BAAE,YAAY,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;oBAAC,CAAC;oBACnJ,MAAM,CAAC;wBAAC,YAAY,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;oBAAC,CAAC;oBAC3C,OAAO,YAAY,CAAC;gBACtB,CAAC,CAAC;gBACF,MAAM,QAAQ,GAAG,GAAG,EAAE,GAAG,KAAK,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC9C,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBACnE,IAAI,CAAC;oBACH,QAAQ,GAAG,MAAM,SAAS,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,OAAO,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,OAAO;wBACzG,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,aAAa,EAAE,CAAC,CAAC;oBACtH,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM;wBAAE,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;oBACzF,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,UAAU,IAAI,CAAC,QAAQ,CAAC,GAAG,IAAI,QAAQ,CAAC,GAAG,KAAK,WAAW,CAAC;2BAC/F,CAAC,+BAA+B,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI;wBAAE,OAAO,IAAI,CAAC,aAAa,CAAC,CAAC;oBACrI,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;oBACtD,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,gBAAgB,CAAC;wBAAE,OAAO,IAAI,CAAC,aAAa,CAAC,CAAC;oBACvH,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;oBAAC,MAAM,MAAM,GAAiB,EAAE,CAAC;oBAAC,IAAI,IAAI,GAAG,CAAC,CAAC;oBAClF,SAAS,CAAC;wBACR,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO;4BAAE,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;wBAC/E,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;wBAAC,IAAI,IAAI,CAAC,IAAI;4BAAE,MAAM;wBACvD,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;wBAAC,IAAI,IAAI,GAAG,gBAAgB;4BAAE,OAAO,IAAI,CAAC,aAAa,CAAC,CAAC;wBAAC,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU;4BAAE,MAAM,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;oBAC7J,CAAC;oBACD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;oBAAC,IAAI,MAAM,GAAG,CAAC,CAAC;oBACnD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;wBAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;wBAAC,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC;oBAAC,CAAC;oBACrF,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;oBACpG,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;wBAAC,OAAO,GAAG,IAAI,CAAC;wBAAC,OAAO,CAAC,KAAK,EAAE,CAAC;oBAAC,CAAC;oBAC3F,OAAO,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,IAAI,CAAC,aAAa,CAAC,CAAC;gBAC1H,CAAC;gBAAC,MAAM,CAAC;oBAAC,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;gBAAC,CAAC;wBAChG,CAAC;oBAAC,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;oBAAC,MAAM,UAAU,EAAE,CAAC;oBAAC,IAAI,MAAM;wBAAE,MAAM,CAAC,WAAW,EAAE,CAAC;gBAAC,CAAC;YAC1H,CAAC,CAAC;YACF,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;gBAC9C,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBACvB,gGAAgG;gBAChG,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBAAC,OAAO,GAAG,IAAI,CAAC;oBAAC,OAAO,CAAC,KAAK,EAAE,CAAC;gBAAC,CAAC;gBAC3F,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YAClG,CAAC,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACrE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,KAAK,IAAI,MAAM;YAAE,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,KAAK,MAAM,OAAO,IAAI,MAAM;YAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC9I,CAAC;AACD,+GAA+G;AAC/G,MAAM,UAAU,oBAAoB,CAAC,OAA8B;IACjE,MAAM,MAAM,GAAG,6BAA6B,CAAC,OAAO,CAAC,CAAC;IACtD,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,gBAAgB,CAAC,EAAE,MAAM;YAC1C,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;YAClF,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QAC3I,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,UAAU,EAAE,KAAK,KAAK,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC3F,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAAC,MAAM,KAAK,CAAC;IAAC,CAAC;AAClD,CAAC","sourcesContent":["import { authorizationRequest, createAuthorizer, jsonValue, MayuraError,\n  type AuthorizationDecision, type AuthorizationDenyReason, type AuthorizationPolicy, type AuthorizationRequest,\n  type Authorizer, type AuthorizerOptions, type Permissions } from 'mayura';\n\n/** Versioned Mayura policy-decision protocol; this is not an OPA, Cedar, OpenFGA or other vendor wire format. */\nexport const HTTP_AUTHORIZATION_PROTOCOL = 'mayura.authorization.v1' as const;\n/** Exact POST envelope sent to the configured decision service. */\nexport interface HttpAuthorizationRequest {\n  readonly protocol: typeof HTTP_AUTHORIZATION_PROTOCOL;\n  readonly requestId: string;\n  readonly policyVersion: string;\n  readonly request: AuthorizationRequest;\n}\n/** Exact HTTP 200 envelope required from the decision service. */\nexport interface HttpAuthorizationResponse {\n  readonly protocol: typeof HTTP_AUTHORIZATION_PROTOCOL;\n  readonly requestId: string;\n  readonly decision: AuthorizationDecision;\n}\nexport interface HttpAuthorizationPolicyOptions {\n  /** Exact trusted policy endpoint. HTTPS only, except explicitly enabled literal-loopback development URLs. */\n  readonly endpoint: string;\n  /** Pinned remote policy revision. Every decision must echo it exactly. */\n  readonly version: string;\n  /** Explicit authz:http admission. No remote request is made without it. */\n  readonly permissions?: Permissions;\n  /** Explicit fixed service credentials/headers. Never taken from a browser request or the environment. */\n  readonly headers?: Readonly<Record<string, string>>;\n  readonly fetch?: typeof globalThis.fetch;\n  readonly allowInsecureLoopback?: boolean;\n  /** Per-check transport deadline, default 1,000 ms; 1–30,000 ms. */\n  readonly timeoutMs?: number;\n  /** Outstanding transport tasks, default 32; 1–256. Ignored aborts retain capacity until actual settlement. */\n  readonly maxConcurrent?: number;\n  /** UTF-8 request bytes, default 8,192; 1,024–16,384. */\n  readonly maxRequestBytes?: number;\n  /** Decoded response bytes, default 2,048; 256–16,384. */\n  readonly maxResponseBytes?: number;\n}\nexport interface HttpAuthorizationPolicy extends AuthorizationPolicy {\n  /** Abort admitted transport work and refuse future evaluation. No request cache is retained. */\n  close(): void;\n}\nexport interface HttpAuthorizerOptions extends HttpAuthorizationPolicyOptions {\n  readonly audit?: AuthorizerOptions['audit'];\n  /** Core evaluation limits, separate from HTTP transport limits. */\n  readonly limits?: AuthorizerOptions['limits'];\n}\nconst identifier = /^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$/u;\nconst denyReasons: readonly string[] = ['no_match', 'explicit_deny', 'scope_mismatch', 'permission_denied', 'invalid_request', 'unavailable', 'cancelled', 'limit_exceeded'];\nfunction invalid(): never { throw new MayuraError('INVALID_CONFIG', 'HTTP authorization requires an explicit endpoint, policy version and bounded transport settings.'); }\nfunction bound(value: number | undefined, fallback: number, min: number, max: number): number {\n  const result = value ?? fallback; if (!Number.isSafeInteger(result) || result < min || result > max) return invalid(); return result;\n}\nfunction endpoint(value: string, insecure: boolean): string {\n  if (typeof value !== 'string' || value.length > 2048) return invalid();\n  const url = new URL(value);\n  if (url.username || url.password || url.search || url.hash || !url.hostname\n    || (url.protocol !== 'https:' && !(insecure && url.protocol === 'http:' && ['127.0.0.1', '[::1]'].includes(url.hostname)))) return invalid();\n  return url.href;\n}\n/** Copy bounded fixed headers. Transport/security headers cannot override the adapter's request isolation. */\nfunction headers(input: HttpAuthorizationPolicyOptions['headers']): Headers {\n  const value = jsonValue(input ?? {}, { maxBytes: 8192, maxDepth: 1, maxNodes: 33 });\n  if (!value || typeof value !== 'object' || Array.isArray(value) || Object.keys(value).length > 16) return invalid();\n  const result = new Headers({ 'content-type': 'application/json', accept: 'application/json' });\n  const seen = new Set<string>();\n  for (const [key, entry] of Object.entries(value)) {\n    const name = key.toLowerCase();\n    if (!/^[a-z0-9!#$%&'*+.^_`|~-]{1,128}$/.test(name) || seen.has(name) || /^(?:sec-|proxy-)/.test(name)\n      || ['host', 'cookie', 'set-cookie', 'connection', 'content-length', 'content-type', 'accept', 'transfer-encoding', 'upgrade', 'te', 'trailer', 'origin', 'referer', 'user-agent', 'accept-encoding'].includes(name)\n      || typeof entry !== 'string' || !entry.length || /[^\\x20-\\x7e]/.test(entry)) return invalid();\n    seen.add(name); result.set(name, entry);\n  }\n  return result;\n}\nfunction frame(text: string, requestId: string, version: string): AuthorizationDecision | null {\n  const raw = jsonValue(JSON.parse(text), { maxBytes: 16_384, maxDepth: 3, maxNodes: 24 });\n  if (!raw || typeof raw !== 'object' || Array.isArray(raw) || Object.keys(raw).sort().join(',') !== 'decision,protocol,requestId'\n    || raw['protocol'] !== HTTP_AUTHORIZATION_PROTOCOL || raw['requestId'] !== requestId) return null;\n  const decision = raw['decision'];\n  if (!decision || typeof decision !== 'object' || Array.isArray(decision) || Object.keys(decision).sort().join(',') !== 'effect,policyVersion,reason,ruleId'\n    || decision['policyVersion'] !== version || (decision['ruleId'] !== null && (typeof decision['ruleId'] !== 'string' || !identifier.test(decision['ruleId'])))\n    || typeof decision['reason'] !== 'string'\n    || (decision['effect'] === 'allow' ? decision['reason'] !== 'allowed' : decision['effect'] !== 'deny' || !denyReasons.includes(decision['reason']))) return null;\n  return Object.freeze({ effect: decision['effect'], reason: decision['reason'], policyVersion: version, ruleId: decision['ruleId'] }) as AuthorizationDecision;\n}\n/**\n * Remote policy through the core contract. Only a correlated, pinned, strictly validated decision may allow. All\n * transport/parse/status failures deny without provider diagnostics. No retries, redirects, cookies or implicit cache.\n */\nexport function createHttpAuthorizationPolicy(options: HttpAuthorizationPolicyOptions): HttpAuthorizationPolicy {\n  let destination: string; let fixedHeaders: Headers; let transport: typeof globalThis.fetch; let version: string;\n  let timeoutMs: number; let maxConcurrent: number; let maxRequestBytes: number; let maxResponseBytes: number; let admitted: boolean;\n  try {\n    if (!options || typeof options.version !== 'string' || !identifier.test(options.version)\n      || (options.allowInsecureLoopback !== undefined && typeof options.allowInsecureLoopback !== 'boolean')) return invalid();\n    destination = endpoint(options.endpoint, options.allowInsecureLoopback === true); fixedHeaders = headers(options.headers); version = options.version;\n    transport = options.fetch ?? globalThis.fetch; if (typeof transport !== 'function') return invalid();\n    const grants = options.permissions?.allow ?? [];\n    if (!Array.isArray(grants) || grants.length > 4096 || grants.some(grant => typeof grant !== 'string' || !grant.length || grant.length > 256)) return invalid();\n    admitted = grants.includes('authz:http');\n    timeoutMs = bound(options.timeoutMs, 1000, 1, 30_000); maxConcurrent = bound(options.maxConcurrent, 32, 1, 256);\n    maxRequestBytes = bound(options.maxRequestBytes, 8192, 1024, 16_384); maxResponseBytes = bound(options.maxResponseBytes, 2048, 256, 16_384);\n  } catch { return invalid(); }\n  const active = new Set<AbortController>(); let closed = false;\n  const deny = (reason: AuthorizationDenyReason): AuthorizationDecision => Object.freeze({ effect: 'deny', reason, policyVersion: version, ruleId: null });\n  const authorize: AuthorizationPolicy['authorize'] = async (raw, context) => {\n    let request: AuthorizationRequest;\n    try {\n      // Exact root shape as well as nested validation: never serialize arbitrary caller fields.\n      const snapshot = jsonValue(raw, { maxBytes: 4096, maxDepth: 4, maxNodes: 32 });\n      if (!snapshot || typeof snapshot !== 'object' || Array.isArray(snapshot) || Object.keys(snapshot).sort().join(',') !== 'action,resource,subject') return deny('invalid_request');\n      const data = snapshot as unknown as AuthorizationRequest; request = authorizationRequest(data.subject, data.action, data.resource);\n      if (!(context?.signal instanceof AbortSignal)) return deny('invalid_request');\n    } catch { return deny('invalid_request'); }\n    if (closed || context.signal.aborted) return deny('cancelled');\n    if (request.subject.principalId !== request.resource.scope.principalId || request.subject.projectId !== request.resource.scope.projectId) return deny('scope_mismatch');\n    if (!admitted) return deny('permission_denied');\n    if (active.size >= maxConcurrent) return deny('limit_exceeded');\n    const requestId = crypto.randomUUID();\n    const envelope: HttpAuthorizationRequest = { protocol: HTTP_AUTHORIZATION_PROTOCOL, requestId, policyVersion: version, request };\n    const payload = JSON.stringify(envelope);\n    if (new TextEncoder().encode(payload).byteLength > maxRequestBytes) return deny('limit_exceeded');\n    const control = new AbortController(); const deadline = Date.now() + timeoutMs; active.add(control);\n    return await new Promise<AuthorizationDecision>(resolve => {\n      let finished = false; let expired = false; let timer: ReturnType<typeof setTimeout> | undefined;\n      const finish = (decision: AuthorizationDecision) => {\n        if (finished) return; finished = true; clearTimeout(timer);\n        context.signal.removeEventListener('abort', relay); control.signal.removeEventListener('abort', aborted); resolve(decision);\n      };\n      const relay = () => control.abort(); const aborted = () => finish(deny(expired ? 'unavailable' : 'cancelled'));\n      control.signal.addEventListener('abort', aborted, { once: true }); context.signal.addEventListener('abort', relay, { once: true });\n      timer = setTimeout(() => { expired = true; control.abort(); }, timeoutMs); if (context.signal.aborted) relay();\n      // The task is deliberately not raced internally: ignored fetch/read cancellation retains the transport slot.\n      const work = async (): Promise<AuthorizationDecision> => {\n        if (control.signal.aborted) return deny(expired ? 'unavailable' : 'cancelled');\n        let response: Response | undefined; let reader: ReadableStreamDefaultReader<Uint8Array> | undefined;\n        let cancellation: Promise<void> | undefined;\n        const cancelBody = (): Promise<void> | undefined => {\n          if (cancellation) return cancellation;\n          try { if (reader) cancellation = reader.cancel().catch(() => {}); else if (response?.body) cancellation = response.body.cancel().catch(() => {}); }\n          catch { cancellation = Promise.resolve(); }\n          return cancellation;\n        };\n        const stopBody = () => { void cancelBody(); };\n        control.signal.addEventListener('abort', stopBody, { once: true });\n        try {\n          response = await transport(destination, { method: 'POST', headers: new Headers(fixedHeaders), body: payload,\n            signal: control.signal, redirect: 'error', credentials: 'omit', cache: 'no-store', referrerPolicy: 'no-referrer' });\n          if (control.signal.aborted || closed) return deny(expired ? 'unavailable' : 'cancelled');\n          if (response.status !== 200 || response.redirected || (response.url && response.url !== destination)\n            || !/^application\\/json(?:\\s*;|$)/i.test(response.headers.get('content-type') ?? '') || !response.body) return deny('unavailable');\n          const length = response.headers.get('content-length');\n          if (length !== null && (!/^[0-9]{1,9}$/.test(length) || Number(length) > maxResponseBytes)) return deny('unavailable');\n          reader = response.body.getReader(); const chunks: Uint8Array[] = []; let size = 0;\n          for (;;) {\n            if (control.signal.aborted) return deny(expired ? 'unavailable' : 'cancelled');\n            const item = await reader.read(); if (item.done) break;\n            size += item.value.byteLength; if (size > maxResponseBytes) return deny('unavailable'); if (item.value.byteLength) chunks.push(new Uint8Array(item.value));\n          }\n          const bytes = new Uint8Array(size); let offset = 0;\n          for (const chunk of chunks) { bytes.set(chunk, offset); offset += chunk.byteLength; }\n          const decision = frame(new TextDecoder('utf-8', { fatal: true }).decode(bytes), requestId, version);\n          if (Date.now() >= deadline && !control.signal.aborted) { expired = true; control.abort(); }\n          return control.signal.aborted || closed ? deny(expired ? 'unavailable' : 'cancelled') : decision ?? deny('unavailable');\n        } catch { return deny(control.signal.aborted ? expired ? 'unavailable' : 'cancelled' : 'unavailable'); }\n        finally { control.signal.removeEventListener('abort', stopBody); await cancelBody(); if (reader) reader.releaseLock(); }\n      };\n      void Promise.resolve().then(work).then(result => {\n        active.delete(control);\n        // Cleanup and trusted transport callbacks can consume wall time while timers are unable to run.\n        if (Date.now() >= deadline && !control.signal.aborted) { expired = true; control.abort(); }\n        finish(control.signal.aborted || closed ? deny(expired ? 'unavailable' : 'cancelled') : result);\n      }, () => { active.delete(control); finish(deny('unavailable')); });\n    });\n  };\n  return Object.freeze({ version, authorize, close() { if (closed) return; closed = true; for (const control of active) control.abort(); } });\n}\n/** Core enforcement and audit own the single decision receipt; closing also aborts the owned remote policy. */\nexport function createHttpAuthorizer(options: HttpAuthorizerOptions): Authorizer {\n  const policy = createHttpAuthorizationPolicy(options);\n  try {\n    const authorizer = createAuthorizer({ policy,\n      ...(options.permissions === undefined ? {} : { permissions: options.permissions }),\n      ...(options.audit === undefined ? {} : { audit: options.audit }), ...(options.limits === undefined ? {} : { limits: options.limits }) });\n    return Object.freeze({ ...authorizer, close() { authorizer.close(); policy.close(); } });\n  } catch (error) { policy.close(); throw error; }\n}\n"]}

package/package.json

@@ -1,6 +1,45 @@
 {
   "name": "@mayurajs/authz-http",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "1.2.0-rc.1",
+  "description": "Bounded HTTP authorization policies with scoped fail-closed decisions and core audit integration.",
+  "author": {
+    "name": "Aryabh",
+    "email": "dev@rokad.co"
+  },
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/KartikeyAI/mayura.git",
+    "directory": "extensions/authz-http"
+  },
+  "homepage": "https://github.com/KartikeyAI/mayura#readme",
+  "bugs": {
+    "url": "https://github.com/KartikeyAI/mayura/issues"
+  },
+  "type": "module",
+  "sideEffects": false,
+  "engines": {
+    "node": ">=22.12.0 <23 || >=24.14.1 <25"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "src/**/*.ts",
+    "README.md",
+    "LICENSE",
+    "NOTICE"
+  ],
+  "dependencies": {},
+  "peerDependencies": {
+    "mayura": "^1.2.0-rc.1"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  }
+}

package/src/index.ts

@@ -0,0 +1,189 @@
+import { authorizationRequest, createAuthorizer, jsonValue, MayuraError,
+  type AuthorizationDecision, type AuthorizationDenyReason, type AuthorizationPolicy, type AuthorizationRequest,
+  type Authorizer, type AuthorizerOptions, type Permissions } from 'mayura';
+
+/** Versioned Mayura policy-decision protocol; this is not an OPA, Cedar, OpenFGA or other vendor wire format. */
+export const HTTP_AUTHORIZATION_PROTOCOL = 'mayura.authorization.v1' as const;
+/** Exact POST envelope sent to the configured decision service. */
+export interface HttpAuthorizationRequest {
+  readonly protocol: typeof HTTP_AUTHORIZATION_PROTOCOL;
+  readonly requestId: string;
+  readonly policyVersion: string;
+  readonly request: AuthorizationRequest;
+}
+/** Exact HTTP 200 envelope required from the decision service. */
+export interface HttpAuthorizationResponse {
+  readonly protocol: typeof HTTP_AUTHORIZATION_PROTOCOL;
+  readonly requestId: string;
+  readonly decision: AuthorizationDecision;
+}
+export interface HttpAuthorizationPolicyOptions {
+  /** Exact trusted policy endpoint. HTTPS only, except explicitly enabled literal-loopback development URLs. */
+  readonly endpoint: string;
+  /** Pinned remote policy revision. Every decision must echo it exactly. */
+  readonly version: string;
+  /** Explicit authz:http admission. No remote request is made without it. */
+  readonly permissions?: Permissions;
+  /** Explicit fixed service credentials/headers. Never taken from a browser request or the environment. */
+  readonly headers?: Readonly<Record<string, string>>;
+  readonly fetch?: typeof globalThis.fetch;
+  readonly allowInsecureLoopback?: boolean;
+  /** Per-check transport deadline, default 1,000 ms; 1–30,000 ms. */
+  readonly timeoutMs?: number;
+  /** Outstanding transport tasks, default 32; 1–256. Ignored aborts retain capacity until actual settlement. */
+  readonly maxConcurrent?: number;
+  /** UTF-8 request bytes, default 8,192; 1,024–16,384. */
+  readonly maxRequestBytes?: number;
+  /** Decoded response bytes, default 2,048; 256–16,384. */
+  readonly maxResponseBytes?: number;
+}
+export interface HttpAuthorizationPolicy extends AuthorizationPolicy {
+  /** Abort admitted transport work and refuse future evaluation. No request cache is retained. */
+  close(): void;
+}
+export interface HttpAuthorizerOptions extends HttpAuthorizationPolicyOptions {
+  readonly audit?: AuthorizerOptions['audit'];
+  /** Core evaluation limits, separate from HTTP transport limits. */
+  readonly limits?: AuthorizerOptions['limits'];
+}
+const identifier = /^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$/u;
+const denyReasons: readonly string[] = ['no_match', 'explicit_deny', 'scope_mismatch', 'permission_denied', 'invalid_request', 'unavailable', 'cancelled', 'limit_exceeded'];
+function invalid(): never { throw new MayuraError('INVALID_CONFIG', 'HTTP authorization requires an explicit endpoint, policy version and bounded transport settings.'); }
+function bound(value: number | undefined, fallback: number, min: number, max: number): number {
+  const result = value ?? fallback; if (!Number.isSafeInteger(result) || result < min || result > max) return invalid(); return result;
+}
+function endpoint(value: string, insecure: boolean): string {
+  if (typeof value !== 'string' || value.length > 2048) return invalid();
+  const url = new URL(value);
+  if (url.username || url.password || url.search || url.hash || !url.hostname
+    || (url.protocol !== 'https:' && !(insecure && url.protocol === 'http:' && ['127.0.0.1', '[::1]'].includes(url.hostname)))) return invalid();
+  return url.href;
+}
+/** Copy bounded fixed headers. Transport/security headers cannot override the adapter's request isolation. */
+function headers(input: HttpAuthorizationPolicyOptions['headers']): Headers {
+  const value = jsonValue(input ?? {}, { maxBytes: 8192, maxDepth: 1, maxNodes: 33 });
+  if (!value || typeof value !== 'object' || Array.isArray(value) || Object.keys(value).length > 16) return invalid();
+  const result = new Headers({ 'content-type': 'application/json', accept: 'application/json' });
+  const seen = new Set<string>();
+  for (const [key, entry] of Object.entries(value)) {
+    const name = key.toLowerCase();
+    if (!/^[a-z0-9!#$%&'*+.^_`|~-]{1,128}$/.test(name) || seen.has(name) || /^(?:sec-|proxy-)/.test(name)
+      || ['host', 'cookie', 'set-cookie', 'connection', 'content-length', 'content-type', 'accept', 'transfer-encoding', 'upgrade', 'te', 'trailer', 'origin', 'referer', 'user-agent', 'accept-encoding'].includes(name)
+      || typeof entry !== 'string' || !entry.length || /[^\x20-\x7e]/.test(entry)) return invalid();
+    seen.add(name); result.set(name, entry);
+  }
+  return result;
+}
+function frame(text: string, requestId: string, version: string): AuthorizationDecision | null {
+  const raw = jsonValue(JSON.parse(text), { maxBytes: 16_384, maxDepth: 3, maxNodes: 24 });
+  if (!raw || typeof raw !== 'object' || Array.isArray(raw) || Object.keys(raw).sort().join(',') !== 'decision,protocol,requestId'
+    || raw['protocol'] !== HTTP_AUTHORIZATION_PROTOCOL || raw['requestId'] !== requestId) return null;
+  const decision = raw['decision'];
+  if (!decision || typeof decision !== 'object' || Array.isArray(decision) || Object.keys(decision).sort().join(',') !== 'effect,policyVersion,reason,ruleId'
+    || decision['policyVersion'] !== version || (decision['ruleId'] !== null && (typeof decision['ruleId'] !== 'string' || !identifier.test(decision['ruleId'])))
+    || typeof decision['reason'] !== 'string'
+    || (decision['effect'] === 'allow' ? decision['reason'] !== 'allowed' : decision['effect'] !== 'deny' || !denyReasons.includes(decision['reason']))) return null;
+  return Object.freeze({ effect: decision['effect'], reason: decision['reason'], policyVersion: version, ruleId: decision['ruleId'] }) as AuthorizationDecision;
+}
+/**
+ * Remote policy through the core contract. Only a correlated, pinned, strictly validated decision may allow. All
+ * transport/parse/status failures deny without provider diagnostics. No retries, redirects, cookies or implicit cache.
+ */
+export function createHttpAuthorizationPolicy(options: HttpAuthorizationPolicyOptions): HttpAuthorizationPolicy {
+  let destination: string; let fixedHeaders: Headers; let transport: typeof globalThis.fetch; let version: string;
+  let timeoutMs: number; let maxConcurrent: number; let maxRequestBytes: number; let maxResponseBytes: number; let admitted: boolean;
+  try {
+    if (!options || typeof options.version !== 'string' || !identifier.test(options.version)
+      || (options.allowInsecureLoopback !== undefined && typeof options.allowInsecureLoopback !== 'boolean')) return invalid();
+    destination = endpoint(options.endpoint, options.allowInsecureLoopback === true); fixedHeaders = headers(options.headers); version = options.version;
+    transport = options.fetch ?? globalThis.fetch; if (typeof transport !== 'function') return invalid();
+    const grants = options.permissions?.allow ?? [];
+    if (!Array.isArray(grants) || grants.length > 4096 || grants.some(grant => typeof grant !== 'string' || !grant.length || grant.length > 256)) return invalid();
+    admitted = grants.includes('authz:http');
+    timeoutMs = bound(options.timeoutMs, 1000, 1, 30_000); maxConcurrent = bound(options.maxConcurrent, 32, 1, 256);
+    maxRequestBytes = bound(options.maxRequestBytes, 8192, 1024, 16_384); maxResponseBytes = bound(options.maxResponseBytes, 2048, 256, 16_384);
+  } catch { return invalid(); }
+  const active = new Set<AbortController>(); let closed = false;
+  const deny = (reason: AuthorizationDenyReason): AuthorizationDecision => Object.freeze({ effect: 'deny', reason, policyVersion: version, ruleId: null });
+  const authorize: AuthorizationPolicy['authorize'] = async (raw, context) => {
+    let request: AuthorizationRequest;
+    try {
+      // Exact root shape as well as nested validation: never serialize arbitrary caller fields.
+      const snapshot = jsonValue(raw, { maxBytes: 4096, maxDepth: 4, maxNodes: 32 });
+      if (!snapshot || typeof snapshot !== 'object' || Array.isArray(snapshot) || Object.keys(snapshot).sort().join(',') !== 'action,resource,subject') return deny('invalid_request');
+      const data = snapshot as unknown as AuthorizationRequest; request = authorizationRequest(data.subject, data.action, data.resource);
+      if (!(context?.signal instanceof AbortSignal)) return deny('invalid_request');
+    } catch { return deny('invalid_request'); }
+    if (closed || context.signal.aborted) return deny('cancelled');
+    if (request.subject.principalId !== request.resource.scope.principalId || request.subject.projectId !== request.resource.scope.projectId) return deny('scope_mismatch');
+    if (!admitted) return deny('permission_denied');
+    if (active.size >= maxConcurrent) return deny('limit_exceeded');
+    const requestId = crypto.randomUUID();
+    const envelope: HttpAuthorizationRequest = { protocol: HTTP_AUTHORIZATION_PROTOCOL, requestId, policyVersion: version, request };
+    const payload = JSON.stringify(envelope);
+    if (new TextEncoder().encode(payload).byteLength > maxRequestBytes) return deny('limit_exceeded');
+    const control = new AbortController(); const deadline = Date.now() + timeoutMs; active.add(control);
+    return await new Promise<AuthorizationDecision>(resolve => {
+      let finished = false; let expired = false; let timer: ReturnType<typeof setTimeout> | undefined;
+      const finish = (decision: AuthorizationDecision) => {
+        if (finished) return; finished = true; clearTimeout(timer);
+        context.signal.removeEventListener('abort', relay); control.signal.removeEventListener('abort', aborted); resolve(decision);
+      };
+      const relay = () => control.abort(); const aborted = () => finish(deny(expired ? 'unavailable' : 'cancelled'));
+      control.signal.addEventListener('abort', aborted, { once: true }); context.signal.addEventListener('abort', relay, { once: true });
+      timer = setTimeout(() => { expired = true; control.abort(); }, timeoutMs); if (context.signal.aborted) relay();
+      // The task is deliberately not raced internally: ignored fetch/read cancellation retains the transport slot.
+      const work = async (): Promise<AuthorizationDecision> => {
+        if (control.signal.aborted) return deny(expired ? 'unavailable' : 'cancelled');
+        let response: Response | undefined; let reader: ReadableStreamDefaultReader<Uint8Array> | undefined;
+        let cancellation: Promise<void> | undefined;
+        const cancelBody = (): Promise<void> | undefined => {
+          if (cancellation) return cancellation;
+          try { if (reader) cancellation = reader.cancel().catch(() => {}); else if (response?.body) cancellation = response.body.cancel().catch(() => {}); }
+          catch { cancellation = Promise.resolve(); }
+          return cancellation;
+        };
+        const stopBody = () => { void cancelBody(); };
+        control.signal.addEventListener('abort', stopBody, { once: true });
+        try {
+          response = await transport(destination, { method: 'POST', headers: new Headers(fixedHeaders), body: payload,
+            signal: control.signal, redirect: 'error', credentials: 'omit', cache: 'no-store', referrerPolicy: 'no-referrer' });
+          if (control.signal.aborted || closed) return deny(expired ? 'unavailable' : 'cancelled');
+          if (response.status !== 200 || response.redirected || (response.url && response.url !== destination)
+            || !/^application\/json(?:\s*;|$)/i.test(response.headers.get('content-type') ?? '') || !response.body) return deny('unavailable');
+          const length = response.headers.get('content-length');
+          if (length !== null && (!/^[0-9]{1,9}$/.test(length) || Number(length) > maxResponseBytes)) return deny('unavailable');
+          reader = response.body.getReader(); const chunks: Uint8Array[] = []; let size = 0;
+          for (;;) {
+            if (control.signal.aborted) return deny(expired ? 'unavailable' : 'cancelled');
+            const item = await reader.read(); if (item.done) break;
+            size += item.value.byteLength; if (size > maxResponseBytes) return deny('unavailable'); if (item.value.byteLength) chunks.push(new Uint8Array(item.value));
+          }
+          const bytes = new Uint8Array(size); let offset = 0;
+          for (const chunk of chunks) { bytes.set(chunk, offset); offset += chunk.byteLength; }
+          const decision = frame(new TextDecoder('utf-8', { fatal: true }).decode(bytes), requestId, version);
+          if (Date.now() >= deadline && !control.signal.aborted) { expired = true; control.abort(); }
+          return control.signal.aborted || closed ? deny(expired ? 'unavailable' : 'cancelled') : decision ?? deny('unavailable');
+        } catch { return deny(control.signal.aborted ? expired ? 'unavailable' : 'cancelled' : 'unavailable'); }
+        finally { control.signal.removeEventListener('abort', stopBody); await cancelBody(); if (reader) reader.releaseLock(); }
+      };
+      void Promise.resolve().then(work).then(result => {
+        active.delete(control);
+        // Cleanup and trusted transport callbacks can consume wall time while timers are unable to run.
+        if (Date.now() >= deadline && !control.signal.aborted) { expired = true; control.abort(); }
+        finish(control.signal.aborted || closed ? deny(expired ? 'unavailable' : 'cancelled') : result);
+      }, () => { active.delete(control); finish(deny('unavailable')); });
+    });
+  };
+  return Object.freeze({ version, authorize, close() { if (closed) return; closed = true; for (const control of active) control.abort(); } });
+}
+/** Core enforcement and audit own the single decision receipt; closing also aborts the owned remote policy. */
+export function createHttpAuthorizer(options: HttpAuthorizerOptions): Authorizer {
+  const policy = createHttpAuthorizationPolicy(options);
+  try {
+    const authorizer = createAuthorizer({ policy,
+      ...(options.permissions === undefined ? {} : { permissions: options.permissions }),
+      ...(options.audit === undefined ? {} : { audit: options.audit }), ...(options.limits === undefined ? {} : { limits: options.limits }) });
+    return Object.freeze({ ...authorizer, close() { authorizer.close(); policy.close(); } });
+  } catch (error) { policy.close(); throw error; }
+}