@mayurajs/authz-oso 0.0.0-stage → 1.2.0-rc.0

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/NOTICE

@@ -0,0 +1,8 @@
+Mayura
+Copyright 2026 The Mayura Authors
+
+This product includes software developed by the Mayura contributors.
+
+Third-party dependencies retain their own copyright and license terms. Exact
+resolved versions are recorded in pnpm-lock.yaml and reviewed by the release
+artifact and dependency qualification procedures.

package/README.md

@@ -1,3 +1,24 @@
-# Temporary Holding Version
+# @mayurajs/authz-oso
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Native Oso Cloud single-check authorization through Mayura's core policy, enforcement and audit contract. Uses
+web-standard Fetch and depends only on the `mayura` peer. Explicit endpoint/environment credentials, exact mappings,
+full-scope typed IDs, bounded deadlines/bytes/concurrency and no automatic retries or allow cache.
+
+See [the integration guide](../../docs/integrations/authz-oso.md) for installation, configuration, fact provisioning,
+revision/consistency limits, lifecycle, server wiring and OpenTelemetry audit reuse.
+
+This slice targets Oso Cloud centralized HTTP checks, not the embedded Oso library or local SQL authorization.
+There are no context facts, policy/fact writes, automatic synchronization or ambient credential lookups. The host
+owns deployed policy/data and supplies the environment identity/revision assertions; the native boolean result does
+not attest them. Configure readiness outside the adapter.
+
+## Primary references
+
+Reviewed 2026-10-20. No SDK or live-service authorization requests were performed.
+
+- [Official native authorization API, request and response](https://www.osohq.com/docs/api-reference/check-api/post-authorize)
+- [Authorization enforcement patterns](https://www.osohq.com/docs/develop/enforce/authorize-requests)
+- [Fact provisioning](https://www.osohq.com/docs/develop/facts/overview)
+- [Service SDK authorization checks](https://www.osohq.com/docs/reference/sdks/authorization-checks)
+
+Offline regression tests are authored. Tests and all validation remain deferred.

package/dist/index.d.ts

@@ -0,0 +1,54 @@
+import { type AuthorizationPolicy, type AuthorizationRequest, type AuthorizationResourceKind, type Authorizer, type AuthorizerOptions, type Permissions } from 'mayura';
+import { type OsoTransportOptions } from './transport.js';
+export type { OsoTransportOptions } from './transport.js';
+/** Exact trusted Mayura resource/action to native Oso resource type/action mapping. No inferred grants. */
+export interface OsoAuthorizationMapping {
+    readonly kind: AuthorizationResourceKind;
+    readonly action: string;
+    readonly resourceType: string;
+    readonly osoAction: string;
+}
+/** Native Oso Cloud single authorization input. Facts, variables and policy overrides are deliberately absent. */
+export interface OsoAuthorizationInput {
+    readonly actor_type: string;
+    readonly actor_id: string;
+    readonly action: string;
+    readonly resource_type: string;
+    readonly resource_id: string;
+}
+export interface OsoAuthorizationPolicyOptions extends OsoTransportOptions {
+    /** Explicit service base URL, optionally with a fixed reverse-proxy prefix. Appends /api/authorize. */
+    readonly apiUrl: string;
+    /** Fixed environment credential; never read from an incoming request or ambient environment. */
+    readonly apiKey: string;
+    /** Host assertion of credential/environment identity. Native check results cannot attest this value. */
+    readonly environmentId: string;
+    /** Host deployment revision, not a native policy pin. Update with policy/data semantics changes. */
+    readonly version: string;
+    /** Stable application namespace; changing it requires separate fact provisioning. */
+    readonly namespace: string;
+    /** Actor type declared by the host's deployed Polar policy. */
+    readonly actorType: string;
+    readonly mappings: readonly OsoAuthorizationMapping[];
+    /** authz:oso admits provider I/O; core evaluation/audit retain their separate grants. */
+    readonly permissions?: Permissions;
+}
+export interface OsoAuthorizationPolicy extends AuthorizationPolicy {
+    /** Pure fact-provisioning helper. Unmapped actions return null; malformed or mismatched scope throws fixed errors. */
+    input(request: AuthorizationRequest): OsoAuthorizationInput | null;
+    /** Refuse new work and cancel admitted transport. Never writes facts, policies or tool results. */
+    close(): void;
+}
+export interface OsoAuthorizerOptions extends OsoAuthorizationPolicyOptions {
+    readonly audit?: AuthorizerOptions['audit'];
+    readonly limits?: AuthorizerOptions['limits'];
+}
+/**
+ * Read-only native Oso Cloud checks with full verified principal/project/namespace encoded in both typed IDs.
+ * The host deploys Polar and provisions facts separately; requests cannot inject facts, queries or policy source.
+ * Configuration fingerprints describe host deployment identity, not an attested service revision or data watermark.
+ */
+export declare function createOsoAuthorizationPolicy(options: OsoAuthorizationPolicyOptions): OsoAuthorizationPolicy;
+/** Core enforcement/audit own the final receipt; closing also shuts down the policy transport. */
+export declare function createOsoAuthorizer(options: OsoAuthorizerOptions): Authorizer;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACqD,KAAK,mBAAmB,EAAE,KAAK,oBAAoB,EAC7G,KAAK,yBAAyB,EAAE,KAAK,UAAU,EAAE,KAAK,iBAAiB,EAAE,KAAK,WAAW,EAAE,MAAM,QAAQ,CAAC;AAE5G,OAAO,EAAsB,KAAK,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC9E,YAAY,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAE1D,2GAA2G;AAC3G,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,IAAI,EAAE,yBAAyB,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAClE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC3D;AACD,kHAAkH;AAClH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAChF,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9D;AACD,MAAM,WAAW,6BAA8B,SAAQ,mBAAmB;IACxE,uGAAuG;IACvG,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,gGAAgG;IAChG,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,wGAAwG;IACxG,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,oGAAoG;IACpG,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,qFAAqF;IACrF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,+DAA+D;IAC/D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,SAAS,uBAAuB,EAAE,CAAC;IACtD,yFAAyF;IACzF,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;CACpC;AACD,MAAM,WAAW,sBAAuB,SAAQ,mBAAmB;IACjE,sHAAsH;IACtH,KAAK,CAAC,OAAO,EAAE,oBAAoB,GAAG,qBAAqB,GAAG,IAAI,CAAC;IACnE,mGAAmG;IACnG,KAAK,IAAI,IAAI,CAAC;CACf;AACD,MAAM,WAAW,oBAAqB,SAAQ,6BAA6B;IACzE,QAAQ,CAAC,KAAK,CAAC,EAAE,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC;CAC5F;AAoBD;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,6BAA6B,GAAG,sBAAsB,CAqD3G;AACD,kGAAkG;AAClG,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,oBAAoB,GAAG,UAAU,CAO7E"}

package/dist/index.js

@@ -0,0 +1,134 @@
+import { AUTHORIZATION_RESOURCE_KINDS, authorizationRequest, createAuthorizer, freezeJson, jsonValue, MayuraError } from 'mayura';
+import { sha256Hex } from 'mayura/core/host';
+import { createOsoTransport } from './transport.js';
+const identifier = /^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$/u;
+const action = /^[a-z][a-z0-9_.:-]{0,127}$/u;
+const nativeType = /^[A-Z][A-Za-z0-9_]{0,127}$/u;
+const nativeAction = /^[a-z][a-z0-9_-]{0,127}$/u;
+const key = (kind, action) => JSON.stringify([kind, action]);
+function invalid() { throw new MayuraError('INVALID_CONFIG', 'Oso authorization requires explicit service/environment settings, scoped mappings and bounded transport.'); }
+function capture(raw) {
+    const snapshot = jsonValue(raw, { maxBytes: 4096, maxDepth: 4, maxNodes: 32 });
+    if (!snapshot || typeof snapshot !== 'object' || Array.isArray(snapshot) || Object.keys(snapshot).sort().join(',') !== 'action,resource,subject') {
+        throw new MayuraError('INVALID_INPUT', 'Invalid scoped authorization request.');
+    }
+    const data = snapshot;
+    return authorizationRequest(data.subject, data.action, data.resource);
+}
+function canonical(value) {
+    if (value === null || typeof value !== 'object')
+        return JSON.stringify(value);
+    if (Array.isArray(value))
+        return `[${value.map(canonical).join(',')}]`;
+    const record = value;
+    return `{${Object.keys(record).sort().map(name => `${JSON.stringify(name)}:${canonical(record[name])}`).join(',')}}`;
+}
+/**
+ * Read-only native Oso Cloud checks with full verified principal/project/namespace encoded in both typed IDs.
+ * The host deploys Polar and provisions facts separately; requests cannot inject facts, queries or policy source.
+ * Configuration fingerprints describe host deployment identity, not an attested service revision or data watermark.
+ */
+export function createOsoAuthorizationPolicy(options) {
+    let namespace;
+    let actorType;
+    let version;
+    let admitted;
+    let mappings;
+    let transport;
+    try {
+        if (!options || [options.version, options.namespace, options.environmentId].some(value => typeof value !== 'string' || !identifier.test(value))
+            || typeof options.actorType !== 'string' || !nativeType.test(options.actorType)
+            || typeof options.apiUrl !== 'string' || options.apiUrl.length > 2048
+            || (options.allowInsecureLoopback !== undefined && typeof options.allowInsecureLoopback !== 'boolean'))
+            return invalid();
+        const base = new URL(options.apiUrl);
+        if (base.username || base.password || base.search || base.hash || !base.hostname
+            || (base.protocol !== 'https:' && !(options.allowInsecureLoopback === true && base.protocol === 'http:' && ['127.0.0.1', '[::1]'].includes(base.hostname))))
+            return invalid();
+        base.pathname = `${base.pathname.replace(/\/+$/, '')}/api/authorize`;
+        const endpoint = base.href;
+        const captured = jsonValue(options.mappings, { maxBytes: 65_536, maxDepth: 2, maxNodes: 2561 });
+        if (!Array.isArray(captured) || captured.length < 1 || captured.length > 512)
+            return invalid();
+        const mapped = new Map();
+        for (const raw of captured) {
+            if (!raw || typeof raw !== 'object' || Array.isArray(raw) || Object.keys(raw).sort().join(',') !== 'action,kind,osoAction,resourceType'
+                || !AUTHORIZATION_RESOURCE_KINDS.includes(raw['kind']) || typeof raw['action'] !== 'string' || !action.test(raw['action'])
+                || typeof raw['resourceType'] !== 'string' || !nativeType.test(raw['resourceType']) || typeof raw['osoAction'] !== 'string' || !nativeAction.test(raw['osoAction']))
+                return invalid();
+            const binding = freezeJson(raw);
+            const name = key(binding.kind, binding.action);
+            if (mapped.has(name))
+                return invalid();
+            mapped.set(name, binding);
+        }
+        const grants = jsonValue(options.permissions?.allow ?? [], { maxBytes: 1_048_576, maxDepth: 1, maxNodes: 4097 });
+        if (!Array.isArray(grants) || grants.length > 4096 || grants.some(grant => typeof grant !== 'string' || !grant.length || grant.length > 256))
+            return invalid();
+        admitted = grants.includes('authz:oso');
+        namespace = options.namespace;
+        actorType = options.actorType;
+        mappings = mapped;
+        version = `oso:${sha256Hex(canonical({ protocol: 'mayura.oso.v1', endpoint, environmentId: options.environmentId,
+            revision: options.version, namespace, actorType, mappings: [...mapped.values()].sort((a, b) => key(a.kind, a.action) < key(b.kind, b.action) ? -1 : 1) }))}`;
+        transport = createOsoTransport(endpoint, options.apiKey, options);
+    }
+    catch {
+        return invalid();
+    }
+    let closed = false;
+    const deny = (reason) => Object.freeze({ effect: 'deny', reason, policyVersion: version, ruleId: null });
+    const input = raw => {
+        const request = capture(raw);
+        const scope = request.subject;
+        if (scope.principalId !== request.resource.scope.principalId || scope.projectId !== request.resource.scope.projectId) {
+            throw new MayuraError('INVALID_INPUT', 'The authorization resource does not belong to the verified scope.');
+        }
+        const binding = mappings.get(key(request.resource.kind, request.action));
+        if (!binding)
+            return null;
+        const identity = (domain, values) => sha256Hex(JSON.stringify([domain, namespace, scope.projectId, scope.principalId, ...values]));
+        return Object.freeze({ actor_type: actorType, actor_id: identity('mayura.oso.actor.v1', []), action: binding.osoAction,
+            resource_type: binding.resourceType, resource_id: identity('mayura.oso.resource.v1', [request.resource.kind, request.resource.id]) });
+    };
+    const authorize = async (raw, context) => {
+        let request;
+        try {
+            request = capture(raw);
+            if (!(context?.signal instanceof AbortSignal))
+                return deny('invalid_request');
+        }
+        catch {
+            return deny('invalid_request');
+        }
+        if (closed || context.signal.aborted)
+            return deny('cancelled');
+        if (request.subject.principalId !== request.resource.scope.principalId || request.subject.projectId !== request.resource.scope.projectId)
+            return deny('scope_mismatch');
+        if (!admitted)
+            return deny('permission_denied');
+        const mapped = input(request);
+        if (!mapped)
+            return deny('no_match');
+        const result = await transport.check(mapped, context.signal);
+        if (closed || context.signal.aborted)
+            return deny('cancelled');
+        return result === true ? Object.freeze({ effect: 'allow', reason: 'allowed', policyVersion: version, ruleId: null }) : deny(result === false ? 'no_match' : result);
+    };
+    return Object.freeze({ version, input, authorize, close() { if (closed)
+            return; closed = true; transport.close(); } });
+}
+/** Core enforcement/audit own the final receipt; closing also shuts down the policy transport. */
+export function createOsoAuthorizer(options) {
+    const policy = createOsoAuthorizationPolicy(options);
+    try {
+        const authorizer = createAuthorizer({ policy, ...(options.permissions === undefined ? {} : { permissions: options.permissions }),
+            ...(options.audit === undefined ? {} : { audit: options.audit }), ...(options.limits === undefined ? {} : { limits: options.limits }) });
+        return Object.freeze({ ...authorizer, close() { authorizer.close(); policy.close(); } });
+    }
+    catch (error) {
+        policy.close();
+        throw error;
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAEpB,MAAM,QAAQ,CAAC;AAC5G,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAA4B,MAAM,gBAAgB,CAAC;AAuC9E,MAAM,UAAU,GAAG,uCAAuC,CAAC;AAC3D,MAAM,MAAM,GAAG,6BAA6B,CAAC;AAC7C,MAAM,UAAU,GAAG,6BAA6B,CAAC;AACjD,MAAM,YAAY,GAAG,2BAA2B,CAAC;AACjD,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,MAAc,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;AAC7E,SAAS,OAAO,KAAY,MAAM,IAAI,WAAW,CAAC,gBAAgB,EAAE,0GAA0G,CAAC,CAAC,CAAC,CAAC;AAClL,SAAS,OAAO,CAAC,GAAyB;IACxC,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;IAC/E,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,yBAAyB,EAAE,CAAC;QACjJ,MAAM,IAAI,WAAW,CAAC,eAAe,EAAE,uCAAuC,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,IAAI,GAAG,QAA2C,CAAC;IAAC,OAAO,oBAAoB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;AAClI,CAAC;AACD,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9E,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACvE,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AACvH,CAAC;AACD;;;;GAIG;AACH,MAAM,UAAU,4BAA4B,CAAC,OAAsC;IACjF,IAAI,SAAiB,CAAC;IAAC,IAAI,SAAiB,CAAC;IAAC,IAAI,OAAe,CAAC;IAAC,IAAI,QAAiB,CAAC;IACzF,IAAI,QAAsD,CAAC;IAAC,IAAI,SAAgD,CAAC;IACjH,IAAI,CAAC;QACH,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;eAC1I,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;eAC5E,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI;eAClE,CAAC,OAAO,CAAC,qBAAqB,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,qBAAqB,KAAK,SAAS,CAAC;YAAE,OAAO,OAAO,EAAE,CAAC;QAC3H,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ;eAC3E,CAAC,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,qBAAqB,KAAK,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,OAAO,OAAO,EAAE,CAAC;QAChL,IAAI,CAAC,QAAQ,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,gBAAgB,CAAC;QAAC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC;QACjG,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAChG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG;YAAE,OAAO,OAAO,EAAE,CAAC;QAC/F,MAAM,MAAM,GAAG,IAAI,GAAG,EAAmC,CAAC;QAC1D,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;YAC3B,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,oCAAoC;mBAClI,CAAC,4BAA4B,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAA8B,CAAC,IAAI,OAAO,GAAG,CAAC,QAAQ,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;mBACpJ,OAAO,GAAG,CAAC,cAAc,CAAC,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,IAAI,OAAO,GAAG,CAAC,WAAW,CAAC,KAAK,QAAQ,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBAAE,OAAO,OAAO,EAAE,CAAC;YACxL,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAuC,CAAC;YAAC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YACtH,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,OAAO,OAAO,EAAE,CAAC;YAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACjH,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC;YAAE,OAAO,OAAO,EAAE,CAAC;QAC/J,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QAAC,QAAQ,GAAG,MAAM,CAAC;QACzH,OAAO,GAAG,OAAO,SAAS,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,eAAe,EAAE,QAAQ,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa;YAC9G,QAAQ,EAAE,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QAC/J,SAAS,GAAG,kBAAkB,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,OAAO,EAAE,CAAC;IAAC,CAAC;IAC7B,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,MAAM,IAAI,GAAG,CAAC,MAA+B,EAAyB,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IACzJ,MAAM,KAAK,GAAoC,GAAG,CAAC,EAAE;QACnD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAAC,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC;QAC5D,IAAI,KAAK,CAAC,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,SAAS,KAAK,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;YACrH,MAAM,IAAI,WAAW,CAAC,eAAe,EAAE,mEAAmE,CAAC,CAAC;QAC9G,CAAC;QACD,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QAAC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QACpG,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,MAAyB,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,WAAW,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QAC9J,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,qBAAqB,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,SAAS;YACpH,aAAa,EAAE,OAAO,CAAC,YAAY,EAAE,WAAW,EAAE,QAAQ,CAAC,wBAAwB,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1I,CAAC,CAAC;IACF,MAAM,SAAS,GAAqC,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE;QACzE,IAAI,OAA6B,CAAC;QAClC,IAAI,CAAC;YAAC,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;YAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,YAAY,WAAW,CAAC;gBAAE,OAAO,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAAC,CAAC;QACxJ,IAAI,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,WAAW,CAAC,CAAC;QAC/D,IAAI,OAAO,CAAC,OAAO,CAAC,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC,SAAS,KAAK,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACxK,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;QAAC,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAC7D,IAAI,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,WAAW,CAAC,CAAC;QAC/D,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACtK,CAAC,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,KAAK,IAAI,MAAM;YAAE,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACzH,CAAC;AACD,kGAAkG;AAClG,MAAM,UAAU,mBAAmB,CAAC,OAA6B;IAC/D,MAAM,MAAM,GAAG,4BAA4B,CAAC,OAAO,CAAC,CAAC;IACrD,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,gBAAgB,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;YAC9H,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QAC3I,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,UAAU,EAAE,KAAK,KAAK,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC3F,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAAC,MAAM,KAAK,CAAC;IAAC,CAAC;AAClD,CAAC","sourcesContent":["import { AUTHORIZATION_RESOURCE_KINDS, authorizationRequest, createAuthorizer, freezeJson, jsonValue, MayuraError,\n  type AuthorizationDecision, type AuthorizationDenyReason, type AuthorizationPolicy, type AuthorizationRequest,\n  type AuthorizationResourceKind, type Authorizer, type AuthorizerOptions, type Permissions } from 'mayura';\nimport { sha256Hex } from 'mayura/core/host';\nimport { createOsoTransport, type OsoTransportOptions } from './transport.js';\nexport type { OsoTransportOptions } from './transport.js';\n\n/** Exact trusted Mayura resource/action to native Oso resource type/action mapping. No inferred grants. */\nexport interface OsoAuthorizationMapping {\n  readonly kind: AuthorizationResourceKind; readonly action: string;\n  readonly resourceType: string; readonly osoAction: string;\n}\n/** Native Oso Cloud single authorization input. Facts, variables and policy overrides are deliberately absent. */\nexport interface OsoAuthorizationInput {\n  readonly actor_type: string; readonly actor_id: string; readonly action: string;\n  readonly resource_type: string; readonly resource_id: string;\n}\nexport interface OsoAuthorizationPolicyOptions extends OsoTransportOptions {\n  /** Explicit service base URL, optionally with a fixed reverse-proxy prefix. Appends /api/authorize. */\n  readonly apiUrl: string;\n  /** Fixed environment credential; never read from an incoming request or ambient environment. */\n  readonly apiKey: string;\n  /** Host assertion of credential/environment identity. Native check results cannot attest this value. */\n  readonly environmentId: string;\n  /** Host deployment revision, not a native policy pin. Update with policy/data semantics changes. */\n  readonly version: string;\n  /** Stable application namespace; changing it requires separate fact provisioning. */\n  readonly namespace: string;\n  /** Actor type declared by the host's deployed Polar policy. */\n  readonly actorType: string;\n  readonly mappings: readonly OsoAuthorizationMapping[];\n  /** authz:oso admits provider I/O; core evaluation/audit retain their separate grants. */\n  readonly permissions?: Permissions;\n}\nexport interface OsoAuthorizationPolicy extends AuthorizationPolicy {\n  /** Pure fact-provisioning helper. Unmapped actions return null; malformed or mismatched scope throws fixed errors. */\n  input(request: AuthorizationRequest): OsoAuthorizationInput | null;\n  /** Refuse new work and cancel admitted transport. Never writes facts, policies or tool results. */\n  close(): void;\n}\nexport interface OsoAuthorizerOptions extends OsoAuthorizationPolicyOptions {\n  readonly audit?: AuthorizerOptions['audit']; readonly limits?: AuthorizerOptions['limits'];\n}\nconst identifier = /^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$/u;\nconst action = /^[a-z][a-z0-9_.:-]{0,127}$/u;\nconst nativeType = /^[A-Z][A-Za-z0-9_]{0,127}$/u;\nconst nativeAction = /^[a-z][a-z0-9_-]{0,127}$/u;\nconst key = (kind: string, action: string) => JSON.stringify([kind, action]);\nfunction invalid(): never { throw new MayuraError('INVALID_CONFIG', 'Oso authorization requires explicit service/environment settings, scoped mappings and bounded transport.'); }\nfunction capture(raw: AuthorizationRequest): AuthorizationRequest {\n  const snapshot = jsonValue(raw, { maxBytes: 4096, maxDepth: 4, maxNodes: 32 });\n  if (!snapshot || typeof snapshot !== 'object' || Array.isArray(snapshot) || Object.keys(snapshot).sort().join(',') !== 'action,resource,subject') {\n    throw new MayuraError('INVALID_INPUT', 'Invalid scoped authorization request.');\n  }\n  const data = snapshot as unknown as AuthorizationRequest; return authorizationRequest(data.subject, data.action, data.resource);\n}\nfunction canonical(value: unknown): string {\n  if (value === null || typeof value !== 'object') return JSON.stringify(value);\n  if (Array.isArray(value)) return `[${value.map(canonical).join(',')}]`;\n  const record = value as Record<string, unknown>;\n  return `{${Object.keys(record).sort().map(name => `${JSON.stringify(name)}:${canonical(record[name])}`).join(',')}}`;\n}\n/**\n * Read-only native Oso Cloud checks with full verified principal/project/namespace encoded in both typed IDs.\n * The host deploys Polar and provisions facts separately; requests cannot inject facts, queries or policy source.\n * Configuration fingerprints describe host deployment identity, not an attested service revision or data watermark.\n */\nexport function createOsoAuthorizationPolicy(options: OsoAuthorizationPolicyOptions): OsoAuthorizationPolicy {\n  let namespace: string; let actorType: string; let version: string; let admitted: boolean;\n  let mappings: ReadonlyMap<string, OsoAuthorizationMapping>; let transport: ReturnType<typeof createOsoTransport>;\n  try {\n    if (!options || [options.version, options.namespace, options.environmentId].some(value => typeof value !== 'string' || !identifier.test(value))\n      || typeof options.actorType !== 'string' || !nativeType.test(options.actorType)\n      || typeof options.apiUrl !== 'string' || options.apiUrl.length > 2048\n      || (options.allowInsecureLoopback !== undefined && typeof options.allowInsecureLoopback !== 'boolean')) return invalid();\n    const base = new URL(options.apiUrl);\n    if (base.username || base.password || base.search || base.hash || !base.hostname\n      || (base.protocol !== 'https:' && !(options.allowInsecureLoopback === true && base.protocol === 'http:' && ['127.0.0.1', '[::1]'].includes(base.hostname)))) return invalid();\n    base.pathname = `${base.pathname.replace(/\\/+$/, '')}/api/authorize`; const endpoint = base.href;\n    const captured = jsonValue(options.mappings, { maxBytes: 65_536, maxDepth: 2, maxNodes: 2561 });\n    if (!Array.isArray(captured) || captured.length < 1 || captured.length > 512) return invalid();\n    const mapped = new Map<string, OsoAuthorizationMapping>();\n    for (const raw of captured) {\n      if (!raw || typeof raw !== 'object' || Array.isArray(raw) || Object.keys(raw).sort().join(',') !== 'action,kind,osoAction,resourceType'\n        || !AUTHORIZATION_RESOURCE_KINDS.includes(raw['kind'] as AuthorizationResourceKind) || typeof raw['action'] !== 'string' || !action.test(raw['action'])\n        || typeof raw['resourceType'] !== 'string' || !nativeType.test(raw['resourceType']) || typeof raw['osoAction'] !== 'string' || !nativeAction.test(raw['osoAction'])) return invalid();\n      const binding = freezeJson(raw) as unknown as OsoAuthorizationMapping; const name = key(binding.kind, binding.action);\n      if (mapped.has(name)) return invalid(); mapped.set(name, binding);\n    }\n    const grants = jsonValue(options.permissions?.allow ?? [], { maxBytes: 1_048_576, maxDepth: 1, maxNodes: 4097 });\n    if (!Array.isArray(grants) || grants.length > 4096 || grants.some(grant => typeof grant !== 'string' || !grant.length || grant.length > 256)) return invalid();\n    admitted = grants.includes('authz:oso'); namespace = options.namespace; actorType = options.actorType; mappings = mapped;\n    version = `oso:${sha256Hex(canonical({ protocol: 'mayura.oso.v1', endpoint, environmentId: options.environmentId,\n      revision: options.version, namespace, actorType, mappings: [...mapped.values()].sort((a, b) => key(a.kind, a.action) < key(b.kind, b.action) ? -1 : 1) }))}`;\n    transport = createOsoTransport(endpoint, options.apiKey, options);\n  } catch { return invalid(); }\n  let closed = false;\n  const deny = (reason: AuthorizationDenyReason): AuthorizationDecision => Object.freeze({ effect: 'deny', reason, policyVersion: version, ruleId: null });\n  const input: OsoAuthorizationPolicy['input'] = raw => {\n    const request = capture(raw); const scope = request.subject;\n    if (scope.principalId !== request.resource.scope.principalId || scope.projectId !== request.resource.scope.projectId) {\n      throw new MayuraError('INVALID_INPUT', 'The authorization resource does not belong to the verified scope.');\n    }\n    const binding = mappings.get(key(request.resource.kind, request.action)); if (!binding) return null;\n    const identity = (domain: string, values: readonly string[]) => sha256Hex(JSON.stringify([domain, namespace, scope.projectId, scope.principalId, ...values]));\n    return Object.freeze({ actor_type: actorType, actor_id: identity('mayura.oso.actor.v1', []), action: binding.osoAction,\n      resource_type: binding.resourceType, resource_id: identity('mayura.oso.resource.v1', [request.resource.kind, request.resource.id]) });\n  };\n  const authorize: AuthorizationPolicy['authorize'] = async (raw, context) => {\n    let request: AuthorizationRequest;\n    try { request = capture(raw); if (!(context?.signal instanceof AbortSignal)) return deny('invalid_request'); } catch { return deny('invalid_request'); }\n    if (closed || context.signal.aborted) return deny('cancelled');\n    if (request.subject.principalId !== request.resource.scope.principalId || request.subject.projectId !== request.resource.scope.projectId) return deny('scope_mismatch');\n    if (!admitted) return deny('permission_denied');\n    const mapped = input(request); if (!mapped) return deny('no_match');\n    const result = await transport.check(mapped, context.signal);\n    if (closed || context.signal.aborted) return deny('cancelled');\n    return result === true ? Object.freeze({ effect: 'allow', reason: 'allowed', policyVersion: version, ruleId: null }) : deny(result === false ? 'no_match' : result);\n  };\n  return Object.freeze({ version, input, authorize, close() { if (closed) return; closed = true; transport.close(); } });\n}\n/** Core enforcement/audit own the final receipt; closing also shuts down the policy transport. */\nexport function createOsoAuthorizer(options: OsoAuthorizerOptions): Authorizer {\n  const policy = createOsoAuthorizationPolicy(options);\n  try {\n    const authorizer = createAuthorizer({ policy, ...(options.permissions === undefined ? {} : { permissions: options.permissions }),\n      ...(options.audit === undefined ? {} : { audit: options.audit }), ...(options.limits === undefined ? {} : { limits: options.limits }) });\n    return Object.freeze({ ...authorizer, close() { authorizer.close(); policy.close(); } });\n  } catch (error) { policy.close(); throw error; }\n}\n"]}

package/dist/transport.d.ts

@@ -0,0 +1,22 @@
+import { type AuthorizationDenyReason } from 'mayura';
+import type { OsoAuthorizationInput } from './index.js';
+/** Web-standard, explicit-service transport settings. Credentials never come from an incoming request. */
+export interface OsoTransportOptions {
+    readonly fetch?: typeof globalThis.fetch;
+    /** Development exception for literal 127.0.0.1 / ::1, not a hostname or production endpoint. */
+    readonly allowInsecureLoopback?: boolean;
+    /** Per-check wall-clock deadline, default 1000 ms; 1–30000. */
+    readonly timeoutMs?: number;
+    /** Outstanding I/O tasks, default 32; 1–256. Ignored aborts retain their slots. */
+    readonly maxConcurrent?: number;
+    /** UTF-8 request bytes, default 8192; 1024–16384. */
+    readonly maxRequestBytes?: number;
+    /** Decoded response bytes, default 2048; 256–16384. */
+    readonly maxResponseBytes?: number;
+}
+/** One native Oso Cloud /api/authorize check per evaluation. No automatic retry, redirects, cookies, discovery or local decision cache. */
+export declare function createOsoTransport(destination: string, apiKey: string, options: OsoTransportOptions): Readonly<{
+    check: (input: OsoAuthorizationInput, signal: AbortSignal) => Promise<boolean | AuthorizationDenyReason>;
+    close(): void;
+}>;
+//# sourceMappingURL=transport.d.ts.map

package/dist/transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport.d.ts","sourceRoot":"","sources":["../src/transport.ts"],"names":[],"mappings":"AAAA,OAAO,EAA0B,KAAK,uBAAuB,EAAE,MAAM,QAAQ,CAAC;AAC9E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAExD,0GAA0G;AAC1G,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IACzC,gGAAgG;IAChG,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,CAAC;IACzC,+DAA+D;IAC/D,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,mFAAmF;IACnF,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,qDAAqD;IACrD,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,uDAAuD;IACvD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAiBD,2IAA2I;AAC3I,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB;mBAOtE,qBAAqB,UAAU,WAAW,KAAG,OAAO,mCAAQ;;GAyDzF"}

package/dist/transport.js

@@ -0,0 +1,152 @@
+import { jsonValue, MayuraError } from 'mayura';
+function invalid() { throw new MayuraError('INVALID_CONFIG', 'Invalid bounded Oso Cloud transport configuration.'); }
+function bound(value, fallback, min, max) {
+    const result = value ?? fallback;
+    if (!Number.isSafeInteger(result) || result < min || result > max)
+        return invalid();
+    return result;
+}
+/** Explicit environment credential; never forwarded from a user request or discovered from the environment. */
+function headers(apiKey) {
+    if (typeof apiKey !== 'string' || !/^[A-Za-z0-9._~+\/-]{1,4096}={0,2}$/u.test(apiKey))
+        return invalid();
+    return new Headers({ 'content-type': 'application/json', accept: 'application/json', authorization: `Bearer ${apiKey}` });
+}
+/** Only the native single-check boolean response is admitted. Ambiguous/duplicate fields cannot allow. */
+function allowed(text) {
+    const raw = jsonValue(JSON.parse(text), { maxBytes: 16_384, maxDepth: 1, maxNodes: 2 });
+    if (!raw || typeof raw !== 'object' || Array.isArray(raw) || Object.keys(raw).join(',') !== 'allowed' || typeof raw['allowed'] !== 'boolean'
+        || !/^\s*\{\s*"allowed"\s*:\s*(?:true|false)\s*\}\s*$/u.test(text))
+        return null;
+    return raw['allowed'];
+}
+/** One native Oso Cloud /api/authorize check per evaluation. No automatic retry, redirects, cookies, discovery or local decision cache. */
+export function createOsoTransport(destination, apiKey, options) {
+    const fixedHeaders = headers(apiKey);
+    const transport = options.fetch ?? globalThis.fetch;
+    if (typeof transport !== 'function')
+        return invalid();
+    const timeoutMs = bound(options.timeoutMs, 1000, 1, 30_000);
+    const maxConcurrent = bound(options.maxConcurrent, 32, 1, 256);
+    const maxRequestBytes = bound(options.maxRequestBytes, 8192, 1024, 16_384);
+    const maxResponseBytes = bound(options.maxResponseBytes, 2048, 256, 16_384);
+    const active = new Set();
+    let closed = false;
+    const check = async (input, signal) => {
+        if (closed || signal.aborted)
+            return 'cancelled';
+        if (active.size >= maxConcurrent)
+            return 'limit_exceeded';
+        const payload = JSON.stringify(input);
+        if (new TextEncoder().encode(payload).byteLength > maxRequestBytes)
+            return 'limit_exceeded';
+        const control = new AbortController();
+        const deadline = Date.now() + timeoutMs;
+        active.add(control);
+        return await new Promise(resolve => {
+            let finished = false;
+            let expired = false;
+            let timer;
+            const finish = (result) => {
+                if (finished)
+                    return;
+                finished = true;
+                clearTimeout(timer);
+                signal.removeEventListener('abort', relay);
+                control.signal.removeEventListener('abort', aborted);
+                resolve(result);
+            };
+            const relay = () => control.abort();
+            const aborted = () => finish(expired ? 'unavailable' : 'cancelled');
+            control.signal.addEventListener('abort', aborted, { once: true });
+            signal.addEventListener('abort', relay, { once: true });
+            timer = setTimeout(() => { expired = true; control.abort(); }, timeoutMs);
+            if (signal.aborted)
+                relay();
+            // The observed decision can finish early. The I/O slot remains held until fetch/read/cancellation really settles.
+            const work = async () => {
+                if (control.signal.aborted)
+                    return expired ? 'unavailable' : 'cancelled';
+                let response;
+                let reader;
+                let cancellation;
+                const cancelBody = () => {
+                    if (cancellation)
+                        return cancellation;
+                    try {
+                        if (reader)
+                            cancellation = reader.cancel().catch(() => { });
+                        else if (response?.body)
+                            cancellation = response.body.cancel().catch(() => { });
+                    }
+                    catch {
+                        cancellation = Promise.resolve();
+                    }
+                    return cancellation;
+                };
+                const stopBody = () => { void cancelBody(); };
+                control.signal.addEventListener('abort', stopBody, { once: true });
+                try {
+                    response = await transport(destination, { method: 'POST', headers: new Headers(fixedHeaders), body: payload,
+                        signal: control.signal, redirect: 'error', credentials: 'omit', cache: 'no-store', referrerPolicy: 'no-referrer' });
+                    if (control.signal.aborted || closed)
+                        return expired ? 'unavailable' : 'cancelled';
+                    if (response.status !== 200 || response.redirected || (response.url && response.url !== destination)
+                        || !/^application\/json(?:\s*;|$)/i.test(response.headers.get('content-type') ?? '') || !response.body)
+                        return 'unavailable';
+                    const length = response.headers.get('content-length');
+                    if (length !== null && (!/^[0-9]{1,9}$/.test(length) || Number(length) > maxResponseBytes))
+                        return 'unavailable';
+                    reader = response.body.getReader();
+                    const chunks = [];
+                    let size = 0;
+                    for (;;) {
+                        if (control.signal.aborted)
+                            return expired ? 'unavailable' : 'cancelled';
+                        const item = await reader.read();
+                        if (item.done)
+                            break;
+                        size += item.value.byteLength;
+                        if (size > maxResponseBytes)
+                            return 'unavailable';
+                        if (item.value.byteLength)
+                            chunks.push(new Uint8Array(item.value));
+                    }
+                    const bytes = new Uint8Array(size);
+                    let offset = 0;
+                    for (const chunk of chunks) {
+                        bytes.set(chunk, offset);
+                        offset += chunk.byteLength;
+                    }
+                    const decision = allowed(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+                    if (Date.now() >= deadline && !control.signal.aborted) {
+                        expired = true;
+                        control.abort();
+                    }
+                    return control.signal.aborted || closed ? expired ? 'unavailable' : 'cancelled' : decision ?? 'unavailable';
+                }
+                catch {
+                    return control.signal.aborted ? expired ? 'unavailable' : 'cancelled' : 'unavailable';
+                }
+                finally {
+                    control.signal.removeEventListener('abort', stopBody);
+                    await cancelBody();
+                    if (reader)
+                        reader.releaseLock();
+                }
+            };
+            void Promise.resolve().then(work).then(result => {
+                active.delete(control);
+                if (Date.now() >= deadline && !control.signal.aborted) {
+                    expired = true;
+                    control.abort();
+                }
+                finish(control.signal.aborted || closed ? expired ? 'unavailable' : 'cancelled' : result);
+            }, () => { active.delete(control); finish('unavailable'); });
+        });
+    };
+    return Object.freeze({ check, close() { if (closed)
+            return; closed = true; for (const controller of active)
+            controller.abort(); } });
+}
+//# sourceMappingURL=transport.js.map

package/dist/transport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport.js","sourceRoot":"","sources":["../src/transport.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,WAAW,EAAgC,MAAM,QAAQ,CAAC;AAiB9E,SAAS,OAAO,KAAY,MAAM,IAAI,WAAW,CAAC,gBAAgB,EAAE,oDAAoD,CAAC,CAAC,CAAC,CAAC;AAC5H,SAAS,KAAK,CAAC,KAAyB,EAAE,QAAgB,EAAE,GAAW,EAAE,GAAW;IAClF,MAAM,MAAM,GAAG,KAAK,IAAI,QAAQ,CAAC;IAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,GAAG,GAAG;QAAE,OAAO,OAAO,EAAE,CAAC;IAAC,OAAO,MAAM,CAAC;AACvI,CAAC;AACD,+GAA+G;AAC/G,SAAS,OAAO,CAAC,MAAc;IAC7B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,qCAAqC,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,OAAO,EAAE,CAAC;IACxG,OAAO,IAAI,OAAO,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE,CAAC,CAAC;AAC5H,CAAC;AACD,0GAA0G;AAC1G,SAAS,OAAO,CAAC,IAAY;IAC3B,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;IACxF,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,SAAS,CAAC,KAAK,SAAS;WACvI,CAAC,mDAAmD,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAClF,OAAO,GAAG,CAAC,SAAS,CAAC,CAAC;AACxB,CAAC;AACD,2IAA2I;AAC3I,MAAM,UAAU,kBAAkB,CAAC,WAAmB,EAAE,MAAc,EAAE,OAA4B;IAClG,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAAC,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IAC1F,IAAI,OAAO,SAAS,KAAK,UAAU;QAAE,OAAO,OAAO,EAAE,CAAC;IACtD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;IAAC,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;IAC5H,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IAAC,MAAM,gBAAgB,GAAG,KAAK,CAAC,OAAO,CAAC,gBAAgB,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IACxJ,MAAM,MAAM,GAAG,IAAI,GAAG,EAAmB,CAAC;IAAC,IAAI,MAAM,GAAG,KAAK,CAAC;IAE9D,MAAM,KAAK,GAAG,KAAK,EAAE,KAA4B,EAAE,MAAmB,EAAmB,EAAE;QACzF,IAAI,MAAM,IAAI,MAAM,CAAC,OAAO;YAAE,OAAO,WAAW,CAAC;QACjD,IAAI,MAAM,CAAC,IAAI,IAAI,aAAa;YAAE,OAAO,gBAAgB,CAAC;QAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,UAAU,GAAG,eAAe;YAAE,OAAO,gBAAgB,CAAC;QAC5F,MAAM,OAAO,GAAG,IAAI,eAAe,EAAE,CAAC;QAAC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACpG,OAAO,MAAM,IAAI,OAAO,CAAS,OAAO,CAAC,EAAE;YACzC,IAAI,QAAQ,GAAG,KAAK,CAAC;YAAC,IAAI,OAAO,GAAG,KAAK,CAAC;YAAC,IAAI,KAAgD,CAAC;YAChG,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,EAAE;gBAChC,IAAI,QAAQ;oBAAE,OAAO;gBAAC,QAAQ,GAAG,IAAI,CAAC;gBAAC,YAAY,CAAC,KAAK,CAAC,CAAC;gBAC3D,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBAAC,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACpH,CAAC,CAAC;YACF,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YAAC,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;YACzG,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3H,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;YAAC,IAAI,MAAM,CAAC,OAAO;gBAAE,KAAK,EAAE,CAAC;YACvG,kHAAkH;YAClH,MAAM,IAAI,GAAG,KAAK,IAAqB,EAAE;gBACvC,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO;oBAAE,OAAO,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC;gBACzE,IAAI,QAA8B,CAAC;gBAAC,IAAI,MAA2D,CAAC;gBACpG,IAAI,YAAuC,CAAC;gBAC5C,MAAM,UAAU,GAAG,GAA8B,EAAE;oBACjD,IAAI,YAAY;wBAAE,OAAO,YAAY,CAAC;oBACtC,IAAI,CAAC;wBAAC,IAAI,MAAM;4BAAE,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;6BAAM,IAAI,QAAQ,EAAE,IAAI;4BAAE,YAAY,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;oBAAC,CAAC;oBACnJ,MAAM,CAAC;wBAAC,YAAY,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;oBAAC,CAAC;oBAC3C,OAAO,YAAY,CAAC;gBACtB,CAAC,CAAC;gBACF,MAAM,QAAQ,GAAG,GAAG,EAAE,GAAG,KAAK,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC;gBAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBAClH,IAAI,CAAC;oBACH,QAAQ,GAAG,MAAM,SAAS,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,OAAO,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,OAAO;wBACzG,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,aAAa,EAAE,CAAC,CAAC;oBACtH,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM;wBAAE,OAAO,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC;oBACnF,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,UAAU,IAAI,CAAC,QAAQ,CAAC,GAAG,IAAI,QAAQ,CAAC,GAAG,KAAK,WAAW,CAAC;2BAC/F,CAAC,+BAA+B,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI;wBAAE,OAAO,aAAa,CAAC;oBAC/H,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;oBACtD,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,gBAAgB,CAAC;wBAAE,OAAO,aAAa,CAAC;oBACjH,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;oBAAC,MAAM,MAAM,GAAiB,EAAE,CAAC;oBAAC,IAAI,IAAI,GAAG,CAAC,CAAC;oBAClF,SAAS,CAAC;wBACR,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO;4BAAE,OAAO,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC;wBACzE,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;wBAAC,IAAI,IAAI,CAAC,IAAI;4BAAE,MAAM;wBACvD,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;wBAAC,IAAI,IAAI,GAAG,gBAAgB;4BAAE,OAAO,aAAa,CAAC;wBACjF,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU;4BAAE,MAAM,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;oBACrE,CAAC;oBACD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;oBAAC,IAAI,MAAM,GAAG,CAAC,CAAC;oBAAC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;wBAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;wBAAC,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC;oBAAC,CAAC;oBACzI,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;oBAClF,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;wBAAC,OAAO,GAAG,IAAI,CAAC;wBAAC,OAAO,CAAC,KAAK,EAAE,CAAC;oBAAC,CAAC;oBAC3F,OAAO,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,IAAI,aAAa,CAAC;gBAC9G,CAAC;gBAAC,MAAM,CAAC;oBAAC,OAAO,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC;gBAAC,CAAC;wBAC1F,CAAC;oBAAC,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;oBAAC,MAAM,UAAU,EAAE,CAAC;oBAAC,IAAI,MAAM;wBAAE,MAAM,CAAC,WAAW,EAAE,CAAC;gBAAC,CAAC;YAC1H,CAAC,CAAC;YACF,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;gBAC9C,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBACvB,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBAAC,OAAO,GAAG,IAAI,CAAC;oBAAC,OAAO,CAAC,KAAK,EAAE,CAAC;gBAAC,CAAC;gBAC3F,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YAC5F,CAAC,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/D,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,KAAK,IAAI,MAAM;YAAE,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,KAAK,MAAM,UAAU,IAAI,MAAM;YAAE,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACvI,CAAC","sourcesContent":["import { jsonValue, MayuraError, type AuthorizationDenyReason } from 'mayura';\nimport type { OsoAuthorizationInput } from './index.js';\n\n/** Web-standard, explicit-service transport settings. Credentials never come from an incoming request. */\nexport interface OsoTransportOptions {\n  readonly fetch?: typeof globalThis.fetch;\n  /** Development exception for literal 127.0.0.1 / ::1, not a hostname or production endpoint. */\n  readonly allowInsecureLoopback?: boolean;\n  /** Per-check wall-clock deadline, default 1000 ms; 1–30000. */\n  readonly timeoutMs?: number;\n  /** Outstanding I/O tasks, default 32; 1–256. Ignored aborts retain their slots. */\n  readonly maxConcurrent?: number;\n  /** UTF-8 request bytes, default 8192; 1024–16384. */\n  readonly maxRequestBytes?: number;\n  /** Decoded response bytes, default 2048; 256–16384. */\n  readonly maxResponseBytes?: number;\n}\nfunction invalid(): never { throw new MayuraError('INVALID_CONFIG', 'Invalid bounded Oso Cloud transport configuration.'); }\nfunction bound(value: number | undefined, fallback: number, min: number, max: number): number {\n  const result = value ?? fallback; if (!Number.isSafeInteger(result) || result < min || result > max) return invalid(); return result;\n}\n/** Explicit environment credential; never forwarded from a user request or discovered from the environment. */\nfunction headers(apiKey: string): Headers {\n  if (typeof apiKey !== 'string' || !/^[A-Za-z0-9._~+\\/-]{1,4096}={0,2}$/u.test(apiKey)) return invalid();\n  return new Headers({ 'content-type': 'application/json', accept: 'application/json', authorization: `Bearer ${apiKey}` });\n}\n/** Only the native single-check boolean response is admitted. Ambiguous/duplicate fields cannot allow. */\nfunction allowed(text: string): boolean | null {\n  const raw = jsonValue(JSON.parse(text), { maxBytes: 16_384, maxDepth: 1, maxNodes: 2 });\n  if (!raw || typeof raw !== 'object' || Array.isArray(raw) || Object.keys(raw).join(',') !== 'allowed' || typeof raw['allowed'] !== 'boolean'\n    || !/^\\s*\\{\\s*\"allowed\"\\s*:\\s*(?:true|false)\\s*\\}\\s*$/u.test(text)) return null;\n  return raw['allowed'];\n}\n/** One native Oso Cloud /api/authorize check per evaluation. No automatic retry, redirects, cookies, discovery or local decision cache. */\nexport function createOsoTransport(destination: string, apiKey: string, options: OsoTransportOptions) {\n  const fixedHeaders = headers(apiKey); const transport = options.fetch ?? globalThis.fetch;\n  if (typeof transport !== 'function') return invalid();\n  const timeoutMs = bound(options.timeoutMs, 1000, 1, 30_000); const maxConcurrent = bound(options.maxConcurrent, 32, 1, 256);\n  const maxRequestBytes = bound(options.maxRequestBytes, 8192, 1024, 16_384); const maxResponseBytes = bound(options.maxResponseBytes, 2048, 256, 16_384);\n  const active = new Set<AbortController>(); let closed = false;\n  type Result = boolean | AuthorizationDenyReason;\n  const check = async (input: OsoAuthorizationInput, signal: AbortSignal): Promise<Result> => {\n    if (closed || signal.aborted) return 'cancelled';\n    if (active.size >= maxConcurrent) return 'limit_exceeded';\n    const payload = JSON.stringify(input);\n    if (new TextEncoder().encode(payload).byteLength > maxRequestBytes) return 'limit_exceeded';\n    const control = new AbortController(); const deadline = Date.now() + timeoutMs; active.add(control);\n    return await new Promise<Result>(resolve => {\n      let finished = false; let expired = false; let timer: ReturnType<typeof setTimeout> | undefined;\n      const finish = (result: Result) => {\n        if (finished) return; finished = true; clearTimeout(timer);\n        signal.removeEventListener('abort', relay); control.signal.removeEventListener('abort', aborted); resolve(result);\n      };\n      const relay = () => control.abort(); const aborted = () => finish(expired ? 'unavailable' : 'cancelled');\n      control.signal.addEventListener('abort', aborted, { once: true }); signal.addEventListener('abort', relay, { once: true });\n      timer = setTimeout(() => { expired = true; control.abort(); }, timeoutMs); if (signal.aborted) relay();\n      // The observed decision can finish early. The I/O slot remains held until fetch/read/cancellation really settles.\n      const work = async (): Promise<Result> => {\n        if (control.signal.aborted) return expired ? 'unavailable' : 'cancelled';\n        let response: Response | undefined; let reader: ReadableStreamDefaultReader<Uint8Array> | undefined;\n        let cancellation: Promise<void> | undefined;\n        const cancelBody = (): Promise<void> | undefined => {\n          if (cancellation) return cancellation;\n          try { if (reader) cancellation = reader.cancel().catch(() => {}); else if (response?.body) cancellation = response.body.cancel().catch(() => {}); }\n          catch { cancellation = Promise.resolve(); }\n          return cancellation;\n        };\n        const stopBody = () => { void cancelBody(); }; control.signal.addEventListener('abort', stopBody, { once: true });\n        try {\n          response = await transport(destination, { method: 'POST', headers: new Headers(fixedHeaders), body: payload,\n            signal: control.signal, redirect: 'error', credentials: 'omit', cache: 'no-store', referrerPolicy: 'no-referrer' });\n          if (control.signal.aborted || closed) return expired ? 'unavailable' : 'cancelled';\n          if (response.status !== 200 || response.redirected || (response.url && response.url !== destination)\n            || !/^application\\/json(?:\\s*;|$)/i.test(response.headers.get('content-type') ?? '') || !response.body) return 'unavailable';\n          const length = response.headers.get('content-length');\n          if (length !== null && (!/^[0-9]{1,9}$/.test(length) || Number(length) > maxResponseBytes)) return 'unavailable';\n          reader = response.body.getReader(); const chunks: Uint8Array[] = []; let size = 0;\n          for (;;) {\n            if (control.signal.aborted) return expired ? 'unavailable' : 'cancelled';\n            const item = await reader.read(); if (item.done) break;\n            size += item.value.byteLength; if (size > maxResponseBytes) return 'unavailable';\n            if (item.value.byteLength) chunks.push(new Uint8Array(item.value));\n          }\n          const bytes = new Uint8Array(size); let offset = 0; for (const chunk of chunks) { bytes.set(chunk, offset); offset += chunk.byteLength; }\n          const decision = allowed(new TextDecoder('utf-8', { fatal: true }).decode(bytes));\n          if (Date.now() >= deadline && !control.signal.aborted) { expired = true; control.abort(); }\n          return control.signal.aborted || closed ? expired ? 'unavailable' : 'cancelled' : decision ?? 'unavailable';\n        } catch { return control.signal.aborted ? expired ? 'unavailable' : 'cancelled' : 'unavailable'; }\n        finally { control.signal.removeEventListener('abort', stopBody); await cancelBody(); if (reader) reader.releaseLock(); }\n      };\n      void Promise.resolve().then(work).then(result => {\n        active.delete(control);\n        if (Date.now() >= deadline && !control.signal.aborted) { expired = true; control.abort(); }\n        finish(control.signal.aborted || closed ? expired ? 'unavailable' : 'cancelled' : result);\n      }, () => { active.delete(control); finish('unavailable'); });\n    });\n  };\n  return Object.freeze({ check, close() { if (closed) return; closed = true; for (const controller of active) controller.abort(); } });\n}\n"]}

package/package.json

@@ -1,6 +1,45 @@
 {
   "name": "@mayurajs/authz-oso",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "1.2.0-rc.0",
+  "description": "Scoped Oso Cloud authorization checks with bounded transport and shared core audit integration.",
+  "author": {
+    "name": "Aryabh",
+    "email": "dev@rokad.co"
+  },
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/KartikeyAI/mayura.git",
+    "directory": "extensions/authz-oso"
+  },
+  "homepage": "https://github.com/KartikeyAI/mayura#readme",
+  "bugs": {
+    "url": "https://github.com/KartikeyAI/mayura/issues"
+  },
+  "type": "module",
+  "sideEffects": false,
+  "engines": {
+    "node": ">=22.12.0 <23 || >=24.14.1 <25"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "src/**/*.ts",
+    "README.md",
+    "LICENSE",
+    "NOTICE"
+  ],
+  "dependencies": {},
+  "peerDependencies": {
+    "mayura": "^1.2.0-rc.0"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  }
+}

package/src/index.ts

@@ -0,0 +1,130 @@
+import { AUTHORIZATION_RESOURCE_KINDS, authorizationRequest, createAuthorizer, freezeJson, jsonValue, MayuraError,
+  type AuthorizationDecision, type AuthorizationDenyReason, type AuthorizationPolicy, type AuthorizationRequest,
+  type AuthorizationResourceKind, type Authorizer, type AuthorizerOptions, type Permissions } from 'mayura';
+import { sha256Hex } from 'mayura/core/host';
+import { createOsoTransport, type OsoTransportOptions } from './transport.js';
+export type { OsoTransportOptions } from './transport.js';
+
+/** Exact trusted Mayura resource/action to native Oso resource type/action mapping. No inferred grants. */
+export interface OsoAuthorizationMapping {
+  readonly kind: AuthorizationResourceKind; readonly action: string;
+  readonly resourceType: string; readonly osoAction: string;
+}
+/** Native Oso Cloud single authorization input. Facts, variables and policy overrides are deliberately absent. */
+export interface OsoAuthorizationInput {
+  readonly actor_type: string; readonly actor_id: string; readonly action: string;
+  readonly resource_type: string; readonly resource_id: string;
+}
+export interface OsoAuthorizationPolicyOptions extends OsoTransportOptions {
+  /** Explicit service base URL, optionally with a fixed reverse-proxy prefix. Appends /api/authorize. */
+  readonly apiUrl: string;
+  /** Fixed environment credential; never read from an incoming request or ambient environment. */
+  readonly apiKey: string;
+  /** Host assertion of credential/environment identity. Native check results cannot attest this value. */
+  readonly environmentId: string;
+  /** Host deployment revision, not a native policy pin. Update with policy/data semantics changes. */
+  readonly version: string;
+  /** Stable application namespace; changing it requires separate fact provisioning. */
+  readonly namespace: string;
+  /** Actor type declared by the host's deployed Polar policy. */
+  readonly actorType: string;
+  readonly mappings: readonly OsoAuthorizationMapping[];
+  /** authz:oso admits provider I/O; core evaluation/audit retain their separate grants. */
+  readonly permissions?: Permissions;
+}
+export interface OsoAuthorizationPolicy extends AuthorizationPolicy {
+  /** Pure fact-provisioning helper. Unmapped actions return null; malformed or mismatched scope throws fixed errors. */
+  input(request: AuthorizationRequest): OsoAuthorizationInput | null;
+  /** Refuse new work and cancel admitted transport. Never writes facts, policies or tool results. */
+  close(): void;
+}
+export interface OsoAuthorizerOptions extends OsoAuthorizationPolicyOptions {
+  readonly audit?: AuthorizerOptions['audit']; readonly limits?: AuthorizerOptions['limits'];
+}
+const identifier = /^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$/u;
+const action = /^[a-z][a-z0-9_.:-]{0,127}$/u;
+const nativeType = /^[A-Z][A-Za-z0-9_]{0,127}$/u;
+const nativeAction = /^[a-z][a-z0-9_-]{0,127}$/u;
+const key = (kind: string, action: string) => JSON.stringify([kind, action]);
+function invalid(): never { throw new MayuraError('INVALID_CONFIG', 'Oso authorization requires explicit service/environment settings, scoped mappings and bounded transport.'); }
+function capture(raw: AuthorizationRequest): AuthorizationRequest {
+  const snapshot = jsonValue(raw, { maxBytes: 4096, maxDepth: 4, maxNodes: 32 });
+  if (!snapshot || typeof snapshot !== 'object' || Array.isArray(snapshot) || Object.keys(snapshot).sort().join(',') !== 'action,resource,subject') {
+    throw new MayuraError('INVALID_INPUT', 'Invalid scoped authorization request.');
+  }
+  const data = snapshot as unknown as AuthorizationRequest; return authorizationRequest(data.subject, data.action, data.resource);
+}
+function canonical(value: unknown): string {
+  if (value === null || typeof value !== 'object') return JSON.stringify(value);
+  if (Array.isArray(value)) return `[${value.map(canonical).join(',')}]`;
+  const record = value as Record<string, unknown>;
+  return `{${Object.keys(record).sort().map(name => `${JSON.stringify(name)}:${canonical(record[name])}`).join(',')}}`;
+}
+/**
+ * Read-only native Oso Cloud checks with full verified principal/project/namespace encoded in both typed IDs.
+ * The host deploys Polar and provisions facts separately; requests cannot inject facts, queries or policy source.
+ * Configuration fingerprints describe host deployment identity, not an attested service revision or data watermark.
+ */
+export function createOsoAuthorizationPolicy(options: OsoAuthorizationPolicyOptions): OsoAuthorizationPolicy {
+  let namespace: string; let actorType: string; let version: string; let admitted: boolean;
+  let mappings: ReadonlyMap<string, OsoAuthorizationMapping>; let transport: ReturnType<typeof createOsoTransport>;
+  try {
+    if (!options || [options.version, options.namespace, options.environmentId].some(value => typeof value !== 'string' || !identifier.test(value))
+      || typeof options.actorType !== 'string' || !nativeType.test(options.actorType)
+      || typeof options.apiUrl !== 'string' || options.apiUrl.length > 2048
+      || (options.allowInsecureLoopback !== undefined && typeof options.allowInsecureLoopback !== 'boolean')) return invalid();
+    const base = new URL(options.apiUrl);
+    if (base.username || base.password || base.search || base.hash || !base.hostname
+      || (base.protocol !== 'https:' && !(options.allowInsecureLoopback === true && base.protocol === 'http:' && ['127.0.0.1', '[::1]'].includes(base.hostname)))) return invalid();
+    base.pathname = `${base.pathname.replace(/\/+$/, '')}/api/authorize`; const endpoint = base.href;
+    const captured = jsonValue(options.mappings, { maxBytes: 65_536, maxDepth: 2, maxNodes: 2561 });
+    if (!Array.isArray(captured) || captured.length < 1 || captured.length > 512) return invalid();
+    const mapped = new Map<string, OsoAuthorizationMapping>();
+    for (const raw of captured) {
+      if (!raw || typeof raw !== 'object' || Array.isArray(raw) || Object.keys(raw).sort().join(',') !== 'action,kind,osoAction,resourceType'
+        || !AUTHORIZATION_RESOURCE_KINDS.includes(raw['kind'] as AuthorizationResourceKind) || typeof raw['action'] !== 'string' || !action.test(raw['action'])
+        || typeof raw['resourceType'] !== 'string' || !nativeType.test(raw['resourceType']) || typeof raw['osoAction'] !== 'string' || !nativeAction.test(raw['osoAction'])) return invalid();
+      const binding = freezeJson(raw) as unknown as OsoAuthorizationMapping; const name = key(binding.kind, binding.action);
+      if (mapped.has(name)) return invalid(); mapped.set(name, binding);
+    }
+    const grants = jsonValue(options.permissions?.allow ?? [], { maxBytes: 1_048_576, maxDepth: 1, maxNodes: 4097 });
+    if (!Array.isArray(grants) || grants.length > 4096 || grants.some(grant => typeof grant !== 'string' || !grant.length || grant.length > 256)) return invalid();
+    admitted = grants.includes('authz:oso'); namespace = options.namespace; actorType = options.actorType; mappings = mapped;
+    version = `oso:${sha256Hex(canonical({ protocol: 'mayura.oso.v1', endpoint, environmentId: options.environmentId,
+      revision: options.version, namespace, actorType, mappings: [...mapped.values()].sort((a, b) => key(a.kind, a.action) < key(b.kind, b.action) ? -1 : 1) }))}`;
+    transport = createOsoTransport(endpoint, options.apiKey, options);
+  } catch { return invalid(); }
+  let closed = false;
+  const deny = (reason: AuthorizationDenyReason): AuthorizationDecision => Object.freeze({ effect: 'deny', reason, policyVersion: version, ruleId: null });
+  const input: OsoAuthorizationPolicy['input'] = raw => {
+    const request = capture(raw); const scope = request.subject;
+    if (scope.principalId !== request.resource.scope.principalId || scope.projectId !== request.resource.scope.projectId) {
+      throw new MayuraError('INVALID_INPUT', 'The authorization resource does not belong to the verified scope.');
+    }
+    const binding = mappings.get(key(request.resource.kind, request.action)); if (!binding) return null;
+    const identity = (domain: string, values: readonly string[]) => sha256Hex(JSON.stringify([domain, namespace, scope.projectId, scope.principalId, ...values]));
+    return Object.freeze({ actor_type: actorType, actor_id: identity('mayura.oso.actor.v1', []), action: binding.osoAction,
+      resource_type: binding.resourceType, resource_id: identity('mayura.oso.resource.v1', [request.resource.kind, request.resource.id]) });
+  };
+  const authorize: AuthorizationPolicy['authorize'] = async (raw, context) => {
+    let request: AuthorizationRequest;
+    try { request = capture(raw); if (!(context?.signal instanceof AbortSignal)) return deny('invalid_request'); } catch { return deny('invalid_request'); }
+    if (closed || context.signal.aborted) return deny('cancelled');
+    if (request.subject.principalId !== request.resource.scope.principalId || request.subject.projectId !== request.resource.scope.projectId) return deny('scope_mismatch');
+    if (!admitted) return deny('permission_denied');
+    const mapped = input(request); if (!mapped) return deny('no_match');
+    const result = await transport.check(mapped, context.signal);
+    if (closed || context.signal.aborted) return deny('cancelled');
+    return result === true ? Object.freeze({ effect: 'allow', reason: 'allowed', policyVersion: version, ruleId: null }) : deny(result === false ? 'no_match' : result);
+  };
+  return Object.freeze({ version, input, authorize, close() { if (closed) return; closed = true; transport.close(); } });
+}
+/** Core enforcement/audit own the final receipt; closing also shuts down the policy transport. */
+export function createOsoAuthorizer(options: OsoAuthorizerOptions): Authorizer {
+  const policy = createOsoAuthorizationPolicy(options);
+  try {
+    const authorizer = createAuthorizer({ policy, ...(options.permissions === undefined ? {} : { permissions: options.permissions }),
+      ...(options.audit === undefined ? {} : { audit: options.audit }), ...(options.limits === undefined ? {} : { limits: options.limits }) });
+    return Object.freeze({ ...authorizer, close() { authorizer.close(); policy.close(); } });
+  } catch (error) { policy.close(); throw error; }
+}

package/src/transport.ts

@@ -0,0 +1,99 @@
+import { jsonValue, MayuraError, type AuthorizationDenyReason } from 'mayura';
+import type { OsoAuthorizationInput } from './index.js';
+
+/** Web-standard, explicit-service transport settings. Credentials never come from an incoming request. */
+export interface OsoTransportOptions {
+  readonly fetch?: typeof globalThis.fetch;
+  /** Development exception for literal 127.0.0.1 / ::1, not a hostname or production endpoint. */
+  readonly allowInsecureLoopback?: boolean;
+  /** Per-check wall-clock deadline, default 1000 ms; 1–30000. */
+  readonly timeoutMs?: number;
+  /** Outstanding I/O tasks, default 32; 1–256. Ignored aborts retain their slots. */
+  readonly maxConcurrent?: number;
+  /** UTF-8 request bytes, default 8192; 1024–16384. */
+  readonly maxRequestBytes?: number;
+  /** Decoded response bytes, default 2048; 256–16384. */
+  readonly maxResponseBytes?: number;
+}
+function invalid(): never { throw new MayuraError('INVALID_CONFIG', 'Invalid bounded Oso Cloud transport configuration.'); }
+function bound(value: number | undefined, fallback: number, min: number, max: number): number {
+  const result = value ?? fallback; if (!Number.isSafeInteger(result) || result < min || result > max) return invalid(); return result;
+}
+/** Explicit environment credential; never forwarded from a user request or discovered from the environment. */
+function headers(apiKey: string): Headers {
+  if (typeof apiKey !== 'string' || !/^[A-Za-z0-9._~+\/-]{1,4096}={0,2}$/u.test(apiKey)) return invalid();
+  return new Headers({ 'content-type': 'application/json', accept: 'application/json', authorization: `Bearer ${apiKey}` });
+}
+/** Only the native single-check boolean response is admitted. Ambiguous/duplicate fields cannot allow. */
+function allowed(text: string): boolean | null {
+  const raw = jsonValue(JSON.parse(text), { maxBytes: 16_384, maxDepth: 1, maxNodes: 2 });
+  if (!raw || typeof raw !== 'object' || Array.isArray(raw) || Object.keys(raw).join(',') !== 'allowed' || typeof raw['allowed'] !== 'boolean'
+    || !/^\s*\{\s*"allowed"\s*:\s*(?:true|false)\s*\}\s*$/u.test(text)) return null;
+  return raw['allowed'];
+}
+/** One native Oso Cloud /api/authorize check per evaluation. No automatic retry, redirects, cookies, discovery or local decision cache. */
+export function createOsoTransport(destination: string, apiKey: string, options: OsoTransportOptions) {
+  const fixedHeaders = headers(apiKey); const transport = options.fetch ?? globalThis.fetch;
+  if (typeof transport !== 'function') return invalid();
+  const timeoutMs = bound(options.timeoutMs, 1000, 1, 30_000); const maxConcurrent = bound(options.maxConcurrent, 32, 1, 256);
+  const maxRequestBytes = bound(options.maxRequestBytes, 8192, 1024, 16_384); const maxResponseBytes = bound(options.maxResponseBytes, 2048, 256, 16_384);
+  const active = new Set<AbortController>(); let closed = false;
+  type Result = boolean | AuthorizationDenyReason;
+  const check = async (input: OsoAuthorizationInput, signal: AbortSignal): Promise<Result> => {
+    if (closed || signal.aborted) return 'cancelled';
+    if (active.size >= maxConcurrent) return 'limit_exceeded';
+    const payload = JSON.stringify(input);
+    if (new TextEncoder().encode(payload).byteLength > maxRequestBytes) return 'limit_exceeded';
+    const control = new AbortController(); const deadline = Date.now() + timeoutMs; active.add(control);
+    return await new Promise<Result>(resolve => {
+      let finished = false; let expired = false; let timer: ReturnType<typeof setTimeout> | undefined;
+      const finish = (result: Result) => {
+        if (finished) return; finished = true; clearTimeout(timer);
+        signal.removeEventListener('abort', relay); control.signal.removeEventListener('abort', aborted); resolve(result);
+      };
+      const relay = () => control.abort(); const aborted = () => finish(expired ? 'unavailable' : 'cancelled');
+      control.signal.addEventListener('abort', aborted, { once: true }); signal.addEventListener('abort', relay, { once: true });
+      timer = setTimeout(() => { expired = true; control.abort(); }, timeoutMs); if (signal.aborted) relay();
+      // The observed decision can finish early. The I/O slot remains held until fetch/read/cancellation really settles.
+      const work = async (): Promise<Result> => {
+        if (control.signal.aborted) return expired ? 'unavailable' : 'cancelled';
+        let response: Response | undefined; let reader: ReadableStreamDefaultReader<Uint8Array> | undefined;
+        let cancellation: Promise<void> | undefined;
+        const cancelBody = (): Promise<void> | undefined => {
+          if (cancellation) return cancellation;
+          try { if (reader) cancellation = reader.cancel().catch(() => {}); else if (response?.body) cancellation = response.body.cancel().catch(() => {}); }
+          catch { cancellation = Promise.resolve(); }
+          return cancellation;
+        };
+        const stopBody = () => { void cancelBody(); }; control.signal.addEventListener('abort', stopBody, { once: true });
+        try {
+          response = await transport(destination, { method: 'POST', headers: new Headers(fixedHeaders), body: payload,
+            signal: control.signal, redirect: 'error', credentials: 'omit', cache: 'no-store', referrerPolicy: 'no-referrer' });
+          if (control.signal.aborted || closed) return expired ? 'unavailable' : 'cancelled';
+          if (response.status !== 200 || response.redirected || (response.url && response.url !== destination)
+            || !/^application\/json(?:\s*;|$)/i.test(response.headers.get('content-type') ?? '') || !response.body) return 'unavailable';
+          const length = response.headers.get('content-length');
+          if (length !== null && (!/^[0-9]{1,9}$/.test(length) || Number(length) > maxResponseBytes)) return 'unavailable';
+          reader = response.body.getReader(); const chunks: Uint8Array[] = []; let size = 0;
+          for (;;) {
+            if (control.signal.aborted) return expired ? 'unavailable' : 'cancelled';
+            const item = await reader.read(); if (item.done) break;
+            size += item.value.byteLength; if (size > maxResponseBytes) return 'unavailable';
+            if (item.value.byteLength) chunks.push(new Uint8Array(item.value));
+          }
+          const bytes = new Uint8Array(size); let offset = 0; for (const chunk of chunks) { bytes.set(chunk, offset); offset += chunk.byteLength; }
+          const decision = allowed(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+          if (Date.now() >= deadline && !control.signal.aborted) { expired = true; control.abort(); }
+          return control.signal.aborted || closed ? expired ? 'unavailable' : 'cancelled' : decision ?? 'unavailable';
+        } catch { return control.signal.aborted ? expired ? 'unavailable' : 'cancelled' : 'unavailable'; }
+        finally { control.signal.removeEventListener('abort', stopBody); await cancelBody(); if (reader) reader.releaseLock(); }
+      };
+      void Promise.resolve().then(work).then(result => {
+        active.delete(control);
+        if (Date.now() >= deadline && !control.signal.aborted) { expired = true; control.abort(); }
+        finish(control.signal.aborted || closed ? expired ? 'unavailable' : 'cancelled' : result);
+      }, () => { active.delete(control); finish('unavailable'); });
+    });
+  };
+  return Object.freeze({ check, close() { if (closed) return; closed = true; for (const controller of active) controller.abort(); } });
+}