@techspokes/typescript-wsdl-client 1.1.3 → 1.1.5

package/dist/compiler/directSoapSource.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"directSoapSource.d.ts","sourceRoot":"","sources":["../../src/compiler/directSoapSource.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAC,uBAAuB,EAAC,MAAM,sBAAsB,CAAC;AAGlE,OAAO,KAAK,EAAC,YAAY,EAAgB,MAAM,4BAA4B,CAAC;AAG5E,eAAO,MAAM,4BAA4B,QAAY,CAAC;AACtD,qBAAa,qBAAsB,SAAQ,KAAK;IACjB,QAAQ,CAAC,IAAI,EAAE,aAAa,GAAG,gBAAgB;gBAAhE,OAAO,EAAE,MAAM,EAAW,IAAI,GAAE,aAAa,GAAG,gBAAgC;CAC7F;AACD,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,uBAAuB,EAAE,MAAM,EAAE;IAAC,OAAO,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,EAAE,KAAK,EAAE,MAAM,IAAI;;;EA0D1I"}

package/dist/compiler/directSoapSource.js

@@ -0,0 +1,86 @@
+import { directLimit } from './directExecutionPolicy.js';
+/** Shared authenticated single-resource SOAP bootstrap policy; no transport. */
+import { inspectDirectOperation } from './directOperation.js';
+import { copyOriginalSchemaResource } from '../loader/schemaInput.js';
+import { resolveLexicalQName, syntaxAttribute, WSDL_NAMESPACE, XSD_NAMESPACE } from '../loader/orderedSyntax.js';
+const WSDL_SOAP = 'http://schemas.xmlsoap.org/wsdl/soap/';
+const same = (a, b) => a.namespace === b.namespace && a.local === b.local;
+export const DIRECT_SOAP_SOURCE_MAX_BYTES = 64 * 1024;
+export class DirectSoapSourceError extends Error {
+    kind;
+    constructor(message, kind = 'unsupported') {
+        super(message);
+        this.kind = kind;
+    }
+}
+export function prepareDirectSoapSource(contract, config, check) {
+    const { source, context: { budget } } = inspectDirectOperation(contract);
+    if (source.resources.some(r => r.byteLength > directLimit(budget, DIRECT_SOAP_SOURCE_MAX_BYTES))) {
+        throw new DirectSoapSourceError('SOAP source byte limit', 'resource-limit');
+    }
+    const refuse = (rule) => { throw new DirectSoapSourceError(rule); };
+    if (/[^\x20-\x21\x23-\x7e]|\\/.test(contract.binding.action))
+        refuse('unsafe SOAPAction');
+    if (source.resources.length !== 1 || source.edges.length || source.documents.length !== 1)
+        throw new DirectSoapSourceError('single original WSDL resource required');
+    const elements = (node) => {
+        check();
+        return node.children.filter((child) => child.kind === 'element');
+    };
+    // node-soap uses local-name dispatch and ordinary object maps internally.
+    // Refuse fetch triggers even in foreign/otherwise ignored source syntax.
+    const inspectSource = (node) => {
+        check();
+        if (['import', 'include', 'redefine'].includes(node.name.local))
+            refuse('dependency bootstrap imports');
+        const grammar = {
+            [WSDL_NAMESPACE]: ['definitions', 'types', 'message', 'part', 'portType', 'operation', 'input', 'output', 'fault', 'binding', 'service', 'port', 'documentation'],
+            [WSDL_SOAP]: ['binding', 'operation', 'body', 'fault', 'address'],
+            ['http://schemas.xmlsoap.org/wsdl/soap12/']: ['binding', 'operation', 'body', 'fault', 'address'],
+            [XSD_NAMESPACE]: ['schema', 'complexType', 'sequence', 'element'],
+        };
+        if (!Object.hasOwn(grammar, node.name.namespace) || !grammar[node.name.namespace].includes(node.name.local))
+            refuse('WSDL bootstrap extension');
+        for (const a of node.attributes) {
+            if (a.name.local === 'name' && (a.value in Object.prototype || a.value === 'prototype'))
+                refuse('dependency reserved name');
+        }
+        for (const prefix in node.namespaces) {
+            if (['__proto__', 'prototype', 'constructor'].includes(prefix) || /["<&\r\n\t]/.test(node.namespaces[prefix]))
+                refuse('dependency namespace interpolation');
+        }
+        for (const child of elements(node))
+            inspectSource(child);
+    };
+    inspectSource(source.root.root);
+    const definitions = source.root.root;
+    if (definitions.name.namespace !== WSDL_NAMESPACE || definitions.name.local !== 'definitions')
+        throw new DirectSoapSourceError('WSDL definitions required');
+    const services = elements(definitions).filter(n => n.name.namespace === WSDL_NAMESPACE && n.name.local === 'service'
+        && same({ namespace: syntaxAttribute(definitions, 'targetNamespace') ?? '', local: syntaxAttribute(n, 'name') ?? '' }, config.service));
+    if (services.length !== 1)
+        throw new DirectSoapSourceError('SOAP service mismatch');
+    const ports = elements(services[0]).filter(n => n.name.namespace === WSDL_NAMESPACE && n.name.local === 'port' && syntaxAttribute(n, 'name') === config.port);
+    if (ports.length !== 1)
+        throw new DirectSoapSourceError('SOAP port mismatch');
+    const binding = syntaxAttribute(ports[0], 'binding');
+    if (!binding || !same(resolveLexicalQName(binding, ports[0]), contract.selector.binding))
+        throw new DirectSoapSourceError('SOAP binding mismatch');
+    const addresses = elements(ports[0]).filter(n => n.name.namespace === WSDL_SOAP && n.name.local === 'address');
+    if (addresses.length !== 1 || elements(ports[0]).some(n => !(n.name.namespace === WSDL_SOAP && n.name.local === 'address')
+        && !(n.name.namespace === WSDL_NAMESPACE && n.name.local === 'documentation')))
+        throw new DirectSoapSourceError('SOAP port extension');
+    const original = copyOriginalSchemaResource(source, source.root.uri, amount => { check(); });
+    // This packet admits UTF-8 source bootstrap only; response encoding remains
+    // owned by the existing strict XML byte decoder.
+    let wsdlText;
+    try {
+        wsdlText = new TextDecoder('utf-8', { fatal: true }).decode(original);
+    }
+    catch {
+        throw new DirectSoapSourceError('UTF-8 WSDL bootstrap required');
+    }
+    if (/^<\?xml\s[^?]*encoding\s*=\s*["'](?!utf-?8["'])/i.test(wsdlText))
+        throw new DirectSoapSourceError('UTF-8 WSDL bootstrap required');
+    return { original, wsdlText };
+}

package/dist/compiler/directSourceCapsule.d.ts

@@ -0,0 +1,97 @@
+import type { SemanticBudget, SemanticBudgetLimits, ResolverUsage } from './semanticBudget.js';
+import type { DirectOperationContract, DirectOperationSelector } from './directOperation.js';
+import type { DirectValueMapping } from './directValues.js';
+import type { SchemaResourcePolicy } from '../loader/schemaResources.js';
+import type { ExpandedName } from '../loader/orderedSyntax.js';
+export declare const DIRECT_CAPSULE_LIMITS: Readonly<{
+    maxBytes: number;
+    sourceBytes: number;
+}>;
+declare const versions: Readonly<{
+    readonly capsuleFormat: 1;
+    readonly model: "xsd10-faithful-v1";
+    readonly scope: "direct-soap11-single-utf8-v1";
+    readonly mapping: "direct-values-v1";
+    readonly scalarPolicy: "direct-string-boolean-int-v1";
+    readonly runtimePolicy: "owned-loopback-http-no-extensions-v1";
+}>;
+export interface DirectSourceSelection {
+    readonly service: ExpandedName;
+    readonly port: string;
+}
+interface Root {
+    readonly element: ExpandedName;
+    readonly message: ExpandedName;
+    readonly part: string;
+    readonly type: ExpandedName;
+    readonly builtin: ExpandedName | null;
+    readonly slots: readonly {
+        element: ExpandedName;
+        builtin: ExpandedName;
+        min: string;
+        max: string;
+    }[];
+}
+interface Compatibility extends DirectSourceSelection {
+    readonly selector: DirectOperationSelector;
+    readonly action: string;
+    readonly input: Root;
+    readonly output: Root;
+    readonly faults: readonly {
+        name: string;
+        root: Root;
+    }[];
+}
+interface Capsule {
+    readonly versions: typeof versions;
+    readonly source: {
+        readonly base64: string;
+        readonly digest: string;
+    };
+    readonly compatibility: Compatibility;
+    readonly fingerprint: string;
+}
+export interface ReconstructedDirectSource {
+    readonly kind: 'reconstructed-direct';
+    readonly contract: DirectOperationContract;
+    readonly mappings: readonly DirectValueMapping[];
+    readonly selection: DirectSourceSelection;
+    readonly admitted: false;
+    readonly usage: ResolverUsage;
+}
+export interface DirectCapsuleFailure {
+    readonly kind: 'incompatible-artifact' | 'unsupported' | 'missing-authority' | 'resource-limit' | 'cancelled' | 'inconclusive' | 'invalid-schema';
+    readonly rule: string;
+    readonly repair: string;
+    readonly usage: ResolverUsage;
+}
+/** Bounded bytes only, duplicate checking delegated to the existing catalog reader. No I/O. */
+export declare function readDirectSourceCapsule(bytes: Uint8Array, budget: SemanticBudget, signal?: AbortSignal): Capsule | DirectCapsuleFailure;
+/** Writer consumes native authority; produced bytes contain no handles or source paths. */
+export declare function createDirectSourceCapsule(contract: DirectOperationContract, selection: DirectSourceSelection, signal?: AbortSignal): Readonly<{
+    kind: 'direct-capsule';
+    bytes: Uint8Array;
+    admitted: false;
+    usage: ResolverUsage;
+}> | DirectCapsuleFailure;
+/** No capsule path is used. Caller chooses and authorizes a NEW physical source. */
+export declare function reconstructDirectSourceCapsule(bytes: Uint8Array, localSource: string, options: Readonly<{
+    policy: SchemaResourcePolicy;
+    limits?: SemanticBudgetLimits;
+    signal?: AbortSignal;
+}>): Promise<ReconstructedDirectSource | DirectCapsuleFailure>;
+/** Internal consumer entry: decoding/emission and reconstruction share one sticky request. */
+export declare function reconstructDirectSourceCapsuleInRequest(bytes: Uint8Array, localSource: string, options: Readonly<{
+    policy: SchemaResourcePolicy;
+    limits?: SemanticBudgetLimits;
+    signal?: AbortSignal;
+}>, budget: SemanticBudget): Promise<ReconstructedDirectSource | DirectCapsuleFailure>;
+/** #195/#201 handoff: compare expected data against a freshly issued native plan. */
+export declare function checkDirectSourceCompatibility(expected: unknown, contract: DirectOperationContract, selection: DirectSourceSelection, signal?: AbortSignal): Readonly<{
+    kind: 'compatible-direct';
+    sourceIdentity: 'exact-bytes' | 'revised-bytes';
+    admitted: false;
+    usage: ResolverUsage;
+}> | DirectCapsuleFailure;
+export {};
+//# sourceMappingURL=directSourceCapsule.d.ts.map

package/dist/compiler/directSourceCapsule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"directSourceCapsule.d.ts","sourceRoot":"","sources":["../../src/compiler/directSourceCapsule.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAC,cAAc,EAAE,oBAAoB,EAAE,aAAa,EAAC,MAAM,qBAAqB,CAAC;AAE7F,OAAO,KAAK,EAAC,uBAAuB,EAAE,uBAAuB,EAAC,MAAM,sBAAsB,CAAC;AAE3F,OAAO,KAAK,EAAC,kBAAkB,EAAC,MAAM,mBAAmB,CAAC;AAG1D,OAAO,KAAK,EAAC,oBAAoB,EAAC,MAAM,8BAA8B,CAAC;AAEvE,OAAO,KAAK,EAAC,YAAY,EAAC,MAAM,4BAA4B,CAAC;AAE7D,eAAO,MAAM,qBAAqB;;;EAAmF,CAAC;AACtH,QAAA,MAAM,QAAQ;;;;;;;EACuH,CAAC;AACtI,MAAM,WAAW,qBAAqB;IAAE,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAC;AAC9F,UAAU,IAAI;IACZ,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtF,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI,CAAC;IACnE,QAAQ,CAAC,KAAK,EAAE,SAAS;QAAC,OAAO,EAAE,YAAY,CAAC;QAAC,OAAO,EAAE,YAAY,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAC,EAAE,CAAC;CACrG;AACD,UAAU,aAAc,SAAQ,qBAAqB;IACnD,QAAQ,CAAC,QAAQ,EAAE,uBAAuB,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACpE,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,IAAI,CAAA;KAAC,EAAE,CAAC;CACrG;AACD,UAAU,OAAO;IACf,QAAQ,CAAC,QAAQ,EAAE,OAAO,QAAQ,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAC,CAAC;IACpE,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CACrE;AACD,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,uBAAuB,CAAC;IAClF,QAAQ,CAAC,QAAQ,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,qBAAqB,CAAC;IAC5F,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;CACzD;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,uBAAuB,GAAG,aAAa,GAAG,mBAAmB,GAAG,gBAAgB,GAAG,WAAW,GAAG,cAAc,GAAG,gBAAgB,CAAC;IAClJ,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;CAC/E;AA8CD,+FAA+F;AAC/F,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,GAAG,oBAAoB,CAEvI;AA+DD,2FAA2F;AAC3F,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,uBAAuB,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,QAAQ,CAAC;IAAC,IAAI,EAAE,gBAAgB,CAAC;IAAC,KAAK,EAAE,UAAU,CAAC;IAAC,QAAQ,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,aAAa,CAAA;CAAC,CAAC,GAAG,oBAAoB,CAaxP;AACD,oFAAoF;AACpF,wBAAsB,8BAA8B,CAAC,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC;IAC7G,MAAM,EAAE,oBAAoB,CAAC;IAAC,MAAM,CAAC,EAAE,oBAAoB,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CACnF,CAAC,GAAG,OAAO,CAAC,yBAAyB,GAAG,oBAAoB,CAAC,CAG7D;AACD,8FAA8F;AAC9F,wBAAsB,uCAAuC,CAAC,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC;IACtH,MAAM,EAAE,oBAAoB,CAAC;IAAC,MAAM,CAAC,EAAE,oBAAoB,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CACnF,CAAC,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,yBAAyB,GAAG,oBAAoB,CAAC,CAwCrF;AACD,qFAAqF;AACrF,wBAAgB,8BAA8B,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,uBAAuB,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,QAAQ,CAAC;IAAC,IAAI,EAAE,mBAAmB,CAAC;IAAC,cAAc,EAAE,aAAa,GAAG,eAAe,CAAC;IAAC,QAAQ,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,aAAa,CAAA;CAAC,CAAC,GAAG,oBAAoB,CAUjT"}

package/dist/compiler/directSourceCapsule.js

@@ -0,0 +1,305 @@
+import { directDataOwnership, directLimit, directLoadingLimits } from './directExecutionPolicy.js';
+/** Internal P3.6 data boundary. Reading data never grants source or dispatch authority. */
+import { checkSemanticBudget } from './semanticBudget.js';
+import { DataOwnershipLimitError } from './dataOwnership.js';
+import { createHash } from 'node:crypto';
+import { types } from 'node:util';
+import { canonicalJson, parseCatalogJson, CatalogError } from './catalogErrors.js';
+import { createApplicationBudget } from './semanticBudget.js';
+import { inspectDirectOperation, selectDirectOperationInRequest } from './directOperation.js';
+import { createDirectValueMapping, DIRECT_VALUE_VERSION, DIRECT_SCALAR_POLICY } from './directValues.js';
+import { prepareDirectSoapSource, DirectSoapSourceError, DIRECT_SOAP_SOURCE_MAX_BYTES } from './directSoapSource.js';
+import { SchemaResourceLoader, resolveResourceUri } from '../loader/schemaResources.js';
+import { parseOrderedSyntax, syntaxElements, isXmlNCName, SchemaLoadingError } from '../loader/orderedSyntax.js';
+export const DIRECT_CAPSULE_LIMITS = Object.freeze({ maxBytes: 256 * 1024, sourceBytes: DIRECT_SOAP_SOURCE_MAX_BYTES });
+const versions = Object.freeze({ capsuleFormat: 1, model: 'xsd10-faithful-v1', scope: 'direct-soap11-single-utf8-v1',
+    mapping: DIRECT_VALUE_VERSION, scalarPolicy: DIRECT_SCALAR_POLICY, runtimePolicy: 'owned-loopback-http-no-extensions-v1' });
+const reconstructed = new WeakMap();
+class Stop extends Error {
+    kind;
+    rule;
+    constructor(kind, rule) {
+        super(rule);
+        this.kind = kind;
+        this.rule = rule;
+    }
+}
+const reject = (rule) => { throw new Stop('incompatible-artifact', rule); };
+function failure(error, budget) {
+    let kind, rule;
+    if (budget.exhausted()) {
+        kind = 'resource-limit';
+        rule = 'request-budget';
+    }
+    else if (error instanceof DataOwnershipLimitError) {
+        kind = 'resource-limit';
+        rule = error.message;
+    }
+    else if (error instanceof Stop) {
+        ({ kind, rule } = error);
+    }
+    else if (error instanceof CatalogError) {
+        kind = error.category === 'resource-limit' ? 'resource-limit' : 'incompatible-artifact';
+        rule = 'capsule-json';
+    }
+    else if (error instanceof DirectSoapSourceError) {
+        kind = error.kind;
+        rule = error.message;
+    }
+    else if (error instanceof SchemaLoadingError) {
+        kind = error.category === 'resource-limit' ? 'resource-limit' : 'missing-authority';
+        rule = 'authorized-local-source-required';
+    }
+    else
+        throw error;
+    return Object.freeze({ kind, rule, repair: 'Regenerate matched internal direct artifacts from explicitly authorized original WSDL; public generation remains unavailable.', usage: Object.freeze({ ...budget.usage() }) });
+}
+function check(budget, signal) {
+    checkSemanticBudget(budget);
+    if (signal?.aborted)
+        throw new Stop('cancelled', 'cooperative-cancellation');
+}
+function hash(text) { return createHash('sha256').update(text).digest('hex'); }
+function json(value, budget) {
+    directDataOwnership(budget).freeze(value);
+    return canonicalJson(value);
+}
+function record(value, fields) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return reject('data-record-required');
+    const result = value;
+    const keys = Object.keys(result);
+    if (keys.length !== fields.length || keys.some(key => !fields.includes(key)))
+        return reject('missing-or-unknown-field');
+    return result;
+}
+function text(value) { if (typeof value !== 'string')
+    reject('string-required'); }
+function name(value) {
+    const v = record(value, ['namespace', 'local']);
+    text(v.namespace);
+    text(v.local);
+    if (!isXmlNCName(v.local))
+        reject('expanded-name-required');
+}
+function ncname(value) { text(value); if (!isXmlNCName(value))
+    reject('name-required'); }
+function root(value) {
+    const v = record(value, ['element', 'message', 'part', 'type', 'builtin', 'slots']);
+    name(v.element);
+    name(v.message);
+    ncname(v.part);
+    name(v.type);
+    if (v.builtin !== null)
+        name(v.builtin);
+    if (!Array.isArray(v.slots))
+        reject('slots-required');
+    for (const item of v.slots) {
+        const slot = record(item, ['element', 'builtin', 'min', 'max']);
+        name(slot.element);
+        name(slot.builtin);
+        if (!['0', '1'].includes(slot.min) || !['1', 'unbounded'].includes(slot.max))
+            reject('direct-occurrence-required');
+    }
+}
+/** Bounded bytes only, duplicate checking delegated to the existing catalog reader. No I/O. */
+export function readDirectSourceCapsule(bytes, budget, signal) {
+    try {
+        return read(bytes, budget, signal);
+    }
+    catch (error) {
+        return failure(error, budget);
+    }
+}
+function read(bytes, budget, signal) {
+    check(budget, signal);
+    if (!types.isUint8Array(bytes) || types.isProxy(bytes))
+        return reject('byte-input-required');
+    const typed = Object.getPrototypeOf(Uint8Array.prototype);
+    const length = Object.getOwnPropertyDescriptor(typed, 'byteLength').get.call(bytes);
+    const backing = Object.getOwnPropertyDescriptor(typed, 'buffer').get.call(bytes);
+    if (types.isSharedArrayBuffer(backing))
+        return reject('shared-bytes-unsupported');
+    if (length > directLimit(budget, DIRECT_CAPSULE_LIMITS.maxBytes))
+        throw new Stop('resource-limit', 'capsule-byte-limit');
+    // The actual capsule byte/depth caps bound decoding, hashing and canonicalization.
+    const input = new Uint8Array(length);
+    Uint8Array.prototype.set.call(input, bytes);
+    let decoded;
+    try {
+        decoded = new TextDecoder('utf-8', { fatal: true, ignoreBOM: true }).decode(input);
+    }
+    catch {
+        return reject('capsule-utf8');
+    }
+    const parsed = record(parseCatalogJson(decoded, { maxBytes: directLimit(budget, DIRECT_CAPSULE_LIMITS.maxBytes), maxDepth: 16 }), ['versions', 'source', 'compatibility', 'fingerprint']);
+    const actual = record(parsed.versions, Object.keys(versions));
+    for (const key of Object.keys(versions))
+        if (actual[key] !== versions[key])
+            reject('unsupported-version-mode-or-policy');
+    const source = record(parsed.source, ['base64', 'digest']);
+    text(source.base64);
+    text(source.digest);
+    if (source.base64.length > Math.ceil(directLimit(budget, DIRECT_CAPSULE_LIMITS.sourceBytes) / 3) * 4)
+        throw new Stop('resource-limit', 'source-byte-limit');
+    const sourceBytes = Buffer.from(source.base64, 'base64');
+    if (sourceBytes.byteLength > directLimit(budget, DIRECT_CAPSULE_LIMITS.sourceBytes))
+        throw new Stop('resource-limit', 'source-byte-limit');
+    if (sourceBytes.toString('base64') !== source.base64 || hash(sourceBytes) !== source.digest)
+        reject('corrupt-source');
+    try {
+        new TextDecoder('utf-8', { fatal: true }).decode(sourceBytes);
+    }
+    catch {
+        return reject('source-utf8');
+    }
+    const c = record(parsed.compatibility, ['selector', 'service', 'port', 'action', 'input', 'output', 'faults']);
+    const s = record(c.selector, ['portType', 'binding', 'operation']);
+    name(s.portType);
+    name(s.binding);
+    ncname(s.operation);
+    name(c.service);
+    ncname(c.port);
+    text(c.action);
+    root(c.input);
+    root(c.output);
+    if (!Array.isArray(c.faults))
+        reject('faults-required');
+    const faults = new Set();
+    for (const item of c.faults) {
+        const f = record(item, ['name', 'root']);
+        ncname(f.name);
+        root(f.root);
+        if (faults.has(f.name))
+            reject('duplicate-fault');
+        faults.add(f.name);
+    }
+    text(parsed.fingerprint);
+    if (hash(json({ versions: parsed.versions, compatibility: c }, budget)) !== parsed.fingerprint)
+        reject('compatibility-fingerprint');
+    check(budget, signal);
+    return directDataOwnership(budget).freeze(parsed);
+}
+function descriptor(contract, selection, signal) {
+    const { context: { budget }, source } = inspectDirectOperation(contract);
+    check(budget, signal);
+    if (source.resources.some(r => r.byteLength > directLimit(budget, DIRECT_CAPSULE_LIMITS.sourceBytes)))
+        throw new Stop('resource-limit', 'source-byte-limit');
+    const owned = directDataOwnership(budget).snapshot(selection, () => check(budget, signal));
+    name(owned.service);
+    ncname(owned.port);
+    record(owned, ['service', 'port']);
+    const { original } = prepareDirectSoapSource(contract, owned, () => check(budget, signal));
+    if (original.byteLength > directLimit(budget, DIRECT_CAPSULE_LIMITS.sourceBytes))
+        throw new Stop('resource-limit', 'source-byte-limit');
+    const mappings = [];
+    const make = (direction) => {
+        const m = createDirectValueMapping(contract, direction, { signal });
+        if (m.kind !== 'direct-mapping')
+            throw new Stop(m.kind === 'resource-limit' || m.kind === 'cancelled' ? m.kind : 'unsupported', m.rule);
+        mappings.push(m);
+        // Resolved schema type names and expanded slot identities are independent
+        // of retrieval URI, source offsets, lexical prefixes and context IDs.
+        const type = m.root.type;
+        if (type.kind !== 'builtin' && type.kind !== 'symbol')
+            throw new Stop('unsupported', 'named-direct-type-required');
+        return { element: m.root.element.name, message: m.root.message, part: m.root.part, type: type.name,
+            builtin: m.rootBuiltin ?? null, slots: m.slots.map(s => ({ element: s.element.name, builtin: s.builtin, min: s.particle.occurs.min, max: s.particle.occurs.max })) };
+    };
+    const input = make({ kind: 'input' }), output = make({ kind: 'output' });
+    const faults = contract.faults.map(f => ({ name: f.name, root: make({ kind: 'fault', name: f.name }) }));
+    const compatibility = directDataOwnership(budget).freeze({ selector: contract.selector, service: owned.service, port: owned.port, action: contract.binding.action, input, output, faults });
+    return { compatibility, original, mappings };
+}
+/** Writer consumes native authority; produced bytes contain no handles or source paths. */
+export function createDirectSourceCapsule(contract, selection, signal) {
+    const { budget } = inspectDirectOperation(contract).context;
+    try {
+        const { compatibility, original } = descriptor(contract, selection, signal);
+        const capsule = { versions, source: { base64: Buffer.from(original).toString('base64'), digest: hash(original) }, compatibility,
+            fingerprint: hash(json({ versions, compatibility }, budget)) };
+        const serialized = json(capsule, budget) + '\n';
+        if (Buffer.byteLength(serialized) > directLimit(budget, DIRECT_CAPSULE_LIMITS.maxBytes))
+            throw new Stop('resource-limit', 'capsule-byte-limit');
+        const bytes = Buffer.from(serialized);
+        read(bytes, budget, signal);
+        check(budget, signal);
+        return Object.freeze({ kind: 'direct-capsule', bytes, admitted: false, usage: Object.freeze({ ...budget.usage() }) });
+    }
+    catch (error) {
+        return failure(error, budget);
+    }
+}
+/** No capsule path is used. Caller chooses and authorizes a NEW physical source. */
+export async function reconstructDirectSourceCapsule(bytes, localSource, options) {
+    const budget = createApplicationBudget(options.limits);
+    return reconstructDirectSourceCapsuleInRequest(bytes, localSource, options, budget);
+}
+/** Internal consumer entry: decoding/emission and reconstruction share one sticky request. */
+export async function reconstructDirectSourceCapsuleInRequest(bytes, localSource, options, budget) {
+    try {
+        const capsule = read(bytes, budget, options.signal);
+        if (new URL(resolveResourceUri(localSource)).protocol !== 'file:')
+            throw new Stop('missing-authority', 'new-local-file-required');
+        // Pin the caller-authorized actual file, rather than substituting artifact
+        // bytes for a modified file. No network origins are inherited or accepted.
+        const loader = await SchemaResourceLoader.create({ fileRoots: options.policy.fileRoots }, { ...directLoadingLimits(budget), resources: 1, resourceBytes: directLimit(budget, DIRECT_CAPSULE_LIMITS.sourceBytes), totalBytes: directLimit(budget, DIRECT_CAPSULE_LIMITS.sourceBytes) }, undefined, () => check(budget, options.signal), options.signal);
+        const resource = await loader.fetchResource(localSource);
+        if (resource.digest !== capsule.source.digest || Buffer.from(resource.bytes).toString('base64') !== capsule.source.base64)
+            reject('local-source-changed');
+        // Existing syntax owner refuses DTD/entities; graph triggers are rejected
+        // before semantic preparation, even if the caller authorized a wider root.
+        let syntax;
+        try {
+            syntax = parseOrderedSyntax(resource.bytes, resource.uri, { maxDepth: directLimit(budget, 256), maxNodes: options.limits?.maxNodes,
+                reserveNode: () => budget.reserveNodes(1), chargeWork: () => check(budget, options.signal) });
+        }
+        catch (error) {
+            if (error instanceof SchemaLoadingError)
+                throw new Stop(error.category === 'resource-limit' ? 'resource-limit' : error.category === 'unsupported-capability' ? 'unsupported' : 'invalid-schema', 'source-syntax');
+            throw error;
+        }
+        const stack = [syntax.root];
+        while (stack.length) {
+            check(budget, options.signal);
+            const node = stack.pop();
+            if (['import', 'include', 'redefine'].includes(node.name.local))
+                throw new Stop('unsupported', 'single-source-required');
+            stack.push(...syntaxElements(node));
+        }
+        const selected = await selectDirectOperationInRequest(resource.uri, capsule.compatibility.selector, {
+            loading: { policy: { fileRoots: options.policy.fileRoots }, offlineResources: new Map([[resource.uri, resource]]) }, limits: options.limits, signal: options.signal,
+        }, budget);
+        if (selected.kind !== 'selected')
+            throw new Stop(selected.kind === 'loading-refused' ? 'missing-authority' : selected.kind === 'selection-refused' ? 'incompatible-artifact' : selected.kind, selected.rule);
+        const derived = descriptor(selected.contract, { service: capsule.compatibility.service, port: capsule.compatibility.port }, options.signal);
+        if (json(derived.compatibility, budget) !== json(capsule.compatibility, budget))
+            reject('source-contract-changed');
+        check(budget, options.signal);
+        const result = Object.freeze({ kind: 'reconstructed-direct', contract: selected.contract, mappings: Object.freeze(derived.mappings), selection: Object.freeze({ service: capsule.compatibility.service, port: capsule.compatibility.port }), admitted: false, usage: Object.freeze({ ...budget.usage() }) });
+        reconstructed.set(result, capsule);
+        return result;
+    }
+    catch (error) {
+        if (!budget.exhausted() && options.signal?.aborted)
+            return failure(new Stop('cancelled', 'cooperative-cancellation'), budget);
+        return failure(error, budget);
+    }
+}
+/** #195/#201 handoff: compare expected data against a freshly issued native plan. */
+export function checkDirectSourceCompatibility(expected, contract, selection, signal) {
+    const { budget } = inspectDirectOperation(contract).context;
+    if (!expected || typeof expected !== 'object' || !reconstructed.has(expected))
+        throw new TypeError('Freshly reconstructed expected source required');
+    try {
+        const capsule = reconstructed.get(expected);
+        const fresh = descriptor(contract, selection, signal);
+        if (json(capsule.compatibility, budget) !== json(fresh.compatibility, budget))
+            reject('operation-binding-root-fault-slot-or-datatype-changed');
+        check(budget, signal);
+        return Object.freeze({ kind: 'compatible-direct', sourceIdentity: capsule.source.digest === hash(fresh.original) ? 'exact-bytes' : 'revised-bytes', admitted: false, usage: Object.freeze({ ...budget.usage() }) });
+    }
+    catch (error) {
+        return failure(error, budget);
+    }
+}

package/dist/compiler/directStructure.d.ts

@@ -0,0 +1,51 @@
+import type { DirectMessageRoot, DirectOperationContract } from './directOperation.js';
+import type { ElementNode, Reference } from './canonicalGraph.js';
+import type { ExpandedName, SyntaxElement, SyntaxSource } from '../loader/orderedSyntax.js';
+import type { ResolverUsage } from './semanticBudget.js';
+export type DirectDirection = Readonly<{
+    kind: 'input' | 'output';
+} | {
+    kind: 'fault';
+    name: string;
+}>;
+export interface DirectScalarDuty {
+    readonly declaration: ElementNode;
+    readonly type: Reference;
+    readonly builtin: ExpandedName;
+    readonly lexical: string;
+    readonly namespaces: Readonly<Record<string, string>>;
+    readonly payloadSource: SyntaxSource;
+    readonly payloadPath: string;
+    readonly schemaPath: string;
+}
+export type DirectStructuralResult = Readonly<{
+    kind: 'structural-match';
+    scope: 'structure-only';
+    scalarValidity: 'unassessed';
+    admitted: false;
+    root: DirectMessageRoot;
+    contextId: string;
+    direction: DirectDirection;
+    occurrences: readonly DirectScalarDuty[];
+    usage: ResolverUsage;
+}> | Readonly<{
+    kind: 'mismatch' | 'unsupported' | 'cancelled' | 'resource-limit';
+    rule: string;
+    schemaPath?: string;
+    payloadPath?: string;
+    usage: ResolverUsage;
+}>;
+export type DirectStructuralMatch = Extract<DirectStructuralResult, {
+    kind: 'structural-match';
+}>;
+/** Identity is checked before any receipt fields; no retrospective authentication. */
+export declare function inspectDirectStructuralMatch(match: unknown, expectedContract: DirectOperationContract): DirectStructuralMatch;
+/**
+ * Data-only SyntaxElement input (plain records/arrays, no proxies/accessors). Malformed
+ * input throws TypeError; XML structure differences return mismatch. No caller is frozen.
+ * Cancellation is synchronous/cooperative, checked at visits and before publication.
+ */
+export declare function matchDirectOperation(contract: DirectOperationContract, direction: DirectDirection, payload: SyntaxElement, options?: Readonly<{
+    signal?: AbortSignal;
+}>): DirectStructuralResult;
+//# sourceMappingURL=directStructure.d.ts.map

package/dist/compiler/directStructure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"directStructure.d.ts","sourceRoot":"","sources":["../../src/compiler/directStructure.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAC,iBAAiB,EAAE,uBAAuB,EAAC,MAAM,sBAAsB,CAAC;AACrF,OAAO,KAAK,EAAC,WAAW,EAAE,SAAS,EAAC,MAAM,qBAAqB,CAAC;AAChE,OAAO,KAAK,EAAC,YAAY,EAAE,aAAa,EAAc,YAAY,EAAC,MAAM,4BAA4B,CAAC;AAEtG,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,qBAAqB,CAAC;AAEvD,MAAM,MAAM,eAAe,GAAG,QAAQ,CAAC;IAAC,IAAI,EAAE,OAAO,GAAG,QAAQ,CAAA;CAAC,GAAG;IAAC,IAAI,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,CAAC,CAAC;AACnG,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,QAAQ,CAAC,aAAa,EAAE,YAAY,CAAC;IACrC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AACD,MAAM,MAAM,sBAAsB,GAAG,QAAQ,CAAC;IAC5C,IAAI,EAAE,kBAAkB,CAAC;IAAC,KAAK,EAAE,gBAAgB,CAAC;IAAC,cAAc,EAAE,YAAY,CAAC;IAAC,QAAQ,EAAE,KAAK,CAAC;IACjG,IAAI,EAAE,iBAAiB,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,eAAe,CAAC;IACvE,WAAW,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAAC,KAAK,EAAE,aAAa,CAAC;CAChE,CAAC,GAAG,QAAQ,CAAC;IACZ,IAAI,EAAE,UAAU,GAAG,aAAa,GAAG,WAAW,GAAG,gBAAgB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAChF,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,aAAa,CAAC;CACjE,CAAC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,OAAO,CAAC,sBAAsB,EAAE;IAAC,IAAI,EAAE,kBAAkB,CAAA;CAAC,CAAC,CAAC;AAEhG,sFAAsF;AACtF,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,GAAG,qBAAqB,CAI7H;AAMD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,uBAAuB,EAAE,SAAS,EAAE,eAAe,EAAE,OAAO,EAAE,aAAa,EACxH,OAAO,GAAE,QAAQ,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAAC,CAAM,GAAG,sBAAsB,CAwJxE"}