@techspokes/typescript-wsdl-client 1.1.4 → 1.1.8

package/docs/concepts.md

@@ -29,6 +29,141 @@ interface Price {
 }
 ```
 
+## Mapping terminology and naming
+
+Use one term for one concept across source analysis, internal code, generated types, application JSON, OpenAPI descriptions and documentation. Different concepts must not share a convenient label merely because their current representations look alike. This section owns the conceptual vocabulary; the reserved-key inventory below owns mapping-property spellings and their implementation status.
+
+| Term | Meaning |
+|---|---|
+| Element | An XML element declaration or instance, distinguished explicitly by context |
+| Attribute | An XML attribute; its identity and rules are distinct from a child element |
+| Sequence | A source constraint requiring its members in order |
+| Choice | A source constraint permitting alternatives |
+| Alternative | One permitted member of a choice; it can itself contain several fields |
+| All group | The XSD `all` compositor, with its own rules; not a synonym for sequence |
+| Application group | A generated object keeping related values and constraints together; it need not be an XML wrapper |
+| Occurrence bounds | The allowed minimum and maximum repetitions of the particular source particle |
+| Content | An element's ordered text and child elements; attributes are separate |
+| Value | Data assessed under the selected type; use text, scalar value or structured value when specificity matters |
+| Projection | The mapping between source-defined XML values and application values |
+| Expanded name | Namespace URI plus local name, independently of the chosen prefix |
+| Namespace binding | A prefix-to-namespace association in the applicable scope |
+| Nil | Explicit absence of content on a present element, distinct from a missing element or empty non-nil value |
+
+A choice is a rule, an alternative is a permitted branch, and a selection is an instance's use of a branch. They are not interchangeable glossary terms. The research now uses `$choice` for a choice site; source occurrence bounds determine whether its value is one object or an array, just as they do for other items.
+
+Keep the canonical word stem when deriving related names: normal TypeScript casing for internal identifiers and type names, and `$` plus lower camel case for mapper-owned application properties. Source-derived XML data names and established profile mappings retain their declared spellings. The bounded allocator below names opt-in checked groups without renaming ordinary business fields.
+
+Private source-graph and configuration objects do not need `$` prefixes merely to follow the payload namespace rule, but their names and descriptions must use the same concepts. Standards-owned names such as XSD `minOccurs`, existing graph `occurs`, and JSON Schema `oneOf` have explicit semantic mappings rather than mechanical renames. Choose `oneOf`, `anyOf` or other schema operators for their actual validation meaning, not because their names resemble a source term.
+
+An OpenAPI property must use the exact JSON key accepted by the mapper, validator and serializer; titles and descriptions must explain that same concept. Schema definition and TypeScript type names derive deterministically from the source identity and role, with collision handling; human-readable names alone are not component identity.
+
+Reuse a shared name constant or source-owned mapping description where code and schemas need the same key. Keep independently authored test inputs literal so they can expose drift instead of reproducing the implementation's mistake. When terminology or a key changes, update its inventory entry, code, schemas, examples, errors and tests together; record any compatibility handling explicitly rather than silently accepting a synonym.
+
+This convention does not create another architecture layer, public mode or mandatory vocabulary migration. Existing mismatches remain visible review work, not templates for introducing more synonyms. File and directory names continue to follow [file naming and path organization](https://github.com/TechSpokes/typescript-wsdl-client/blob/main/docs/file-naming-and-path-organization.md).
+
+### Choice groups and named alternatives
+
+Enable checked groups with `applicationGroups: {}` in the existing checked generation configuration. Each record uses reconstructible structured groups or retains its existing ordered presentation, with its disposition/reason in `inventory.json`. Absence of this option preserves existing checked shapes and generated artifacts.
+
+Use `$choice`, `$choice2` and subsequent numbers for independent choice sites in one containing application object, in retained source order. Repeated sequences use `$sequence`, `$sequence2` and subsequent numbers. Repeating a site uses one array without pluralizing its key or item type; JSON property order never controls XML order.
+
+| Source bounds | Application value | Schema |
+|---|---|---|
+| `1..1` | One alternative object | Required property referencing the choice union |
+| `0..1` | Omitted or one alternative object | Optional property referencing the choice union |
+| `1..3` | Array, including for one occurrence | Required array with `minItems: 1`, `maxItems: 3` |
+| `0..unbounded` | Optional array | Array with no finite maximum |
+
+Optional repeated groups with nonempty bodies accept an empty array and canonically omit that property without mutating input. Required minima and finite maxima retain source bounds. Empty-capable bodies and ambiguous partitions retain ordered values and ADR-003 normalization; optional occurrence bounds alone do not make a body empty-capable.
+
+Every structured alternative has a named object schema and TypeScript type, including singleton choices. For a source type `Request`, defaults are union `RequestChoice` and objects `RequestChoiceAlternative1` and `RequestChoiceAlternative2`. A repeated sequence references its named item object; recursive types remain finite references rather than unrolled combinations.
+
+A single property references the union directly; an array references the same union in `items`, and TypeScript uses `RequestChoice[]`. Sharing application schema structure does not merge the distinct native source declarations used for reconstruction.
+
+Default type stems use the owning named type's local name, or the anonymous type's containing element and scoped path digest, followed by `Choice` or `Sequence`. Nonalphanumeric source characters use injective `_u<hex>_` escaping; anonymous stems use `___Anonymous_<digest>`. Nested generated roles use `___` boundaries, which cannot occur in escaped source stems, and contribute once; alternatives append `Alternative1`, `Alternative2` and subsequent numbers in source order.
+
+Several source type namespaces with the same local name receive a namespace digest suffix.
+
+Retain complete business names ending in `Choice`, `Choices` or `Sequence`; source type `PaymentChoice` therefore produces `PaymentChoiceChoice`. Default collisions append an underscore and the first twelve hexadecimal digits of the source-target digest. Ordinary fields and unrelated distinct declarations keep their names; explicit names never receive silent collision suffixes.
+
+Several occurrences of one choice site use one array. Several independent choice sites need distinct reserved properties and distinct contextual schemas; merging them into one array would lose their separate rules. The source identity and structural position distinguish such sites even when the alternatives have identical field names; display names do not establish identity.
+
+### Configured application names
+
+The optional `applicationGroups.names` array configures the synthetic property, union/item type and structured alternative names independently. Generate with `applicationGroups: {}`, copy opaque tokens from `inventory.json` under `applicationGroups.targets`, and regenerate with entries containing `target`, optional `propertyName` and optional `typeName`. The same data works in `--checked-config` and `PipelineOptions.checkedComponents`; no additional command or flag is needed.
+
+| Naming target | Prototype default | Example configured name |
+|---|---|---|
+| Synthetic group property | `$choice` | `$payment` |
+| Union type and schema | `RequestChoice` | `PaymentMethod` |
+| First alternative type and schema | `RequestChoiceAlternative1` | `CardPayment` |
+| Second alternative type and schema | `RequestChoiceAlternative2` | `BankPayment` |
+
+Such names change presentation, not the source definition: `$payment` can reference `PaymentMethod` or `PaymentMethod[]`, and the union references `CardPayment` and `BankPayment`. Group bounds, required fields, alternative membership, source XML names/namespaces and native validation remain governed by the same selected source contract. Renaming an alternative's schema does not add a discriminator or an XML wrapper.
+
+Target overrides by exact scoped source identity and structural role, including the choice site and alternative, rather than only by a generated display name, field spelling or an occurrence in one value. Source order provides the prototype's alternative numbers but is not by itself a stable configuration selector across source revisions. Provide discoverable source selectors; unknown or ambiguous targets fail rather than silently doing nothing, and an alias never becomes another selector for an alias chain.
+
+Resolve default and configured names before emission and use that one mapping for TypeScript declarations, OpenAPI components and references, JSON validation, adapters, serializers, diagnostics and examples. A synthetic property keeps the `$` prefix after renaming; type/schema aliases must be valid for their generated targets. Reject conflicting aliases in the relevant property/type/schema scopes, including collisions with other configured names, source-derived names and reserved mapping keys; do not silently overwrite or suffix an explicitly requested name.
+
+A configured alias selects the emitted/accepted name for that generated contract, not additional runtime synonyms. For example, a contract configured with `$payment` does not also accept `$choice` by default. Changing published keys or type names needs an explicit compatibility disposition and regenerated matching artifacts; runtime callers cannot submit naming configuration or change the native source binding through the payload.
+
+Choice and sequence targets accept either override; alternative targets accept only `typeName`. Properties must be `$` followed by a lower-camel ASCII identifier and cannot use reserved metadata keys; type names must be non-reserved ASCII TypeScript identifiers that are unchanged valid OpenAPI component keys. Unknown fields, duplicate targets, stale targets, accessors, proxies, malformed arrays and scoped collisions fail before artifact emission.
+
+Tokens are `ag1:` plus a SHA-256 digest of scoped owning/source/use-site identities, structural role and a guard of the selected record's effective particle shape. They are independent of physical snapshot paths, unrelated global declaration order, display names and aliases. A relevant particle edit invalidates old tokens; regenerate defaults and copy new tokens rather than migrating by position.
+
+Names are definition-scoped within the selected service, including recursive references and reuse across request, response and fault directions. Named-group uses in different owning records remain distinct targets. Inventory is diagnostic data only; capsules persist the selected options and reconstruction rederives them against authenticated authorized sources, while mismatched generated artifacts refuse.
+
+## Reserved mapping keys
+
+Keys introduced by the mapper into XML-derived application objects must start with `$`. XML element and attribute names remain source-derived data keys; generated grouping objects, text slots and interpretation metadata must not occupy that same unprefixed namespace. The XML name grammar excludes `$`, so an actual XML child `choice` and the synthetic `$choice` container remain distinct.
+
+This convention applies recursively to synthetic mapping properties, including metadata descriptors if retained. It does not rename private TypeScript variables, source graph fields, artifact/configuration schemas or actual XML data keys. Entries inside data dictionaries, such as prefixes in `$namespaces` and XML names in an attribute bag, are data rather than additional synthetic property names.
+
+### Mapping-key inventory and status
+
+The inventory distinguishes existing behavior from the [selected mapping contract](https://github.com/TechSpokes/typescript-wsdl-client/blob/main/docs/mapping-contract.md#selected-keyed-mapping-contract). [Checked mixed/namespace/open mappings](checked-gateway.md#mixed-namespaced-and-open-values) implement the qualified keyed slice, and opt-in application groups implement the bounded reconstructible grammar above. Research-only dynamic-type forms remain handoffs rather than production capability claims.
+
+| Key | Meaning and scope | Status |
+|---|---|---|
+| `$value` | Scalar text/simple content alongside attributes; exact scalar policy belongs to the selected mapping | Existing legacy/component convention |
+| `$attributes` | Attribute channel; named entries derive unique source identities, otherwise distinguish unqualified scalars and namespaced holders | Existing legacy bags unchanged; qualified checked keyed fallback |
+| `$content` | Ordered content; new entries are text objects or one named child occurrence | Existing ordered shapes unchanged; qualified checked keyed mixed/open grammar |
+| `$choice`, `$choice2`, ... | Complete source choice; object or array from source bounds | Opt-in checked application groups |
+| `$sequence`, `$sequence2`, ... | Source sequence item; array for repeated groups | Opt-in checked application groups |
+| `$nil` | Explicit assessed nil marker, exactly `true`, alongside applicable source-mapped attributes | [Checked component nil values](checked-gateway.md#nil-values); no null shorthand |
+| `$namespace` | Actual namespace URI of the element/attribute/type identity at this location | Qualified checked element/attribute metadata; type execution remains separate |
+| `$namespaces` | Prefix bindings introduced/rebound here, inherited by descendants | Qualified checked snapshot-at-boundary plus local-delta contract |
+| `$type` | Explicit assessed type identity with flat `$name`/`$namespace` strings | Selected research shape; native type checks remain required |
+| `$name` | XML type name string within `$type` | Selected research shape; never a nested name object or child-name duplicate |
+
+Configured group aliases allocate only their selected `$` property spelling. `$selection` and `$selections` were superseded research spellings; `$choices` is not a plural alias. `$text` and `$element` occur in comparison alternatives only and are not additional accepted spellings.
+
+### Existing unprefixed descriptors requiring a deliberate correction
+
+Existing checked ordered entries contain `name` and `value`, with `namespace` and `local` inside their identity descriptor. Those describe the mapping rather than XML business properties; their existing implementation is recorded compatibility work, not justification for using unprefixed metadata in new mappings.
+
+| Existing descriptor property | Prefixed spelling if that descriptor is retained | Disposition |
+|---|---|---|
+| `name` | Named child entry key | New keyed entries remove the descriptor wrapper |
+| `value` | `$value` | Reuse the existing reserved word where its role is explicitly defined |
+| `namespace` | `$namespace` where needed | URI supplied only when source mapping cannot determine identity |
+| `local` | Named entry key, or `$name` inside `$type` | No `$localName` alias is allocated |
+
+This table describes the new research grammar, not aliases accepted by existing runtimes. Current accepted component/QName shapes and the shipped direct-runtime protocol retain their contracts, including reused descendants inside new mappings. A migration requires an explicit compatibility decision and fresh inverse/serializer tests. Ordinary XML properties actually named `name`, `value`, `namespace` or `local` remain ordinary data keys.
+
+### Transport, schema and implementation namespaces
+
+| Name | Actual role | Application-mapping disposition |
+|---|---|---|
+| `$xml`, `_xml` | Dependency-owned SOAP/XML serialization hooks | Not generic fields accepted by the application mapping |
+| `attributes`, `$` | Existing configurable/dependency attribute containers and aliases | Existing adapter behavior, not new canonical metadata keys |
+| `$schema`, `$id`, `$ref` | JSON Schema dialect/identity/reference keywords | Schema documents, not XML-derived payload properties |
+| `$raw/...`, `/$hypothetical/...`, `$semantic-content/...`, `$semantic-builtin-anyType/...` | Internal source/candidate reference paths and generated component paths | Path strings, not public JSON mapping keys |
+| `$env`, `$_` | Shell/documentation syntax encountered during the inventory | Not mapping keys |
+
+A `$` prefix identifies a reserved namespace, not permission to submit arbitrary metadata. The selected mapping and HTTP schema must declare every accepted key, reject unknown/conflicting metadata without mutation, preserve accepted fields during serialization, and consume synthetic groups without inventing XML wrapper elements. Legacy configurable attribute-key overrides remain their existing separate contract.
+
 ## Primitive Mapping
 
 All XSD numeric and date-time types map to `string` by default. This prevents
@@ -232,7 +367,7 @@ details:
 
 ### Streaming Bypass
 
-Operations opted into streaming with `--stream-config` bypass the success envelope on the `200` response path. The OpenAPI response content is declared as the configured stream media type, and the gateway writes raw NDJSON lines or one streamed JSON array straight to the response body. Error responses (400, 502, and the rest) still use the normal envelope so clients always see structured failures before the first record. See [ADR-002](decisions/002-streamable-responses.md) for the full rationale.
+Operations opted into streaming with `--stream-config` bypass the success envelope on the `200` response path. The OpenAPI response content is declared as the configured stream media type, and the gateway writes raw NDJSON lines or one streamed JSON array straight to the response body. Error responses (400, 502, and the rest) still use the normal envelope so clients always see structured failures before the first record. See [ADR-002](https://github.com/TechSpokes/typescript-wsdl-client/blob/main/docs/decisions/002-streamable-responses.md) for the full rationale.
 
 ### Envelope Naming
 

package/docs/configuration.md

@@ -4,6 +4,10 @@ Optional JSON configuration files for customizing OpenAPI generation. Pass these
 
 See [CLI Reference](cli-reference.md) for flag details and [README](../README.md) for quick start.
 
+## Planned application naming overrides
+
+Choice-group property names, union type/schema names and individual alternative type/schema names must support developer-configured aliases in the planned application mapping. The [configured application names contract](concepts.md#configured-application-names) defines the naming targets, reserved `$` prefix, source identity, collision and consistency requirements. This is a design requirement under #420; no corresponding configuration fields or CLI options are implemented yet.
+
 ## Security Configuration
 
 Pass via `--openapi-security-config-file`.
@@ -133,7 +137,7 @@ operations not listed in the file.
 - Structural name collisions across catalogs fail the build; structurally
   identical types dedupe silently.
 
-See [ADR-002](decisions/002-streamable-responses.md) for rationale and the
+See [ADR-002](https://github.com/TechSpokes/typescript-wsdl-client/blob/main/docs/decisions/002-streamable-responses.md) for rationale and the
 terminal-error policy.
 
 ## Example Files

package/docs/corpus.md

@@ -0,0 +1,33 @@
+# Product Corpus Evidence
+
+Representative inputs and their maintained product checks. See the root [README](../README.md) and [Supported Patterns](supported-patterns.md) for the separate legacy and checked support boundaries.
+
+## Evidence index
+
+This table is generated from `test/conformance/readiness-corpus.json`; its source identity and permission records are checked by the readiness inventory tests. A row indexes executable evidence, not a percentage of WSDL/XSD support or a claim of live provider acceptance.
+
+| Input | Provenance tier | Mode | Expected result | Evidence stages | Executable evidence |
+|---|---|---|---|---|---|
+| [noaa-ndfd](https://github.com/TechSpokes/typescript-wsdl-client/blob/main/test/fixtures/wsdl/real-services/noaa-ndfd/ndfd-xml.wsdl) | real | checked | refused | original source decoding and 12-operation inventory, locationless-import planning refusal, zero SOAP dispatch | [noaa-ndfd-qualification.test.ts](https://github.com/TechSpokes/typescript-wsdl-client/blob/main/test/integration/noaa-ndfd-qualification.test.ts) |
+| [weather](https://github.com/TechSpokes/typescript-wsdl-client/blob/main/examples/minimal/weather.wsdl) | synthetic | legacy | supported | generate, typecheck, OpenAPI, gateway mock, installed package | [gateway-routes.test.ts](https://github.com/TechSpokes/typescript-wsdl-client/blob/main/test/integration/gateway-routes.test.ts); `npm run package:smoke` |
+| [checked-forecast](https://github.com/TechSpokes/typescript-wsdl-client/blob/main/test/conformance/fixtures/assessment/forecast.wsdl) | synthetic | checked | supported | generate, install, typecheck, HTTP/SOAP success and faults | [checked-gateway-installed.test.ts](https://github.com/TechSpokes/typescript-wsdl-client/blob/main/test/integration/checked-gateway-installed.test.ts) |
+| [application-groups](https://github.com/TechSpokes/typescript-wsdl-client/blob/main/test/conformance/fixtures/assessment/application-groups.wsdl) | synthetic | checked | supported | generate, native SOAP, OpenAPI, installed HTTP/SOAP variant | [checked-application-groups.test.ts](https://github.com/TechSpokes/typescript-wsdl-client/blob/main/test/integration/checked-application-groups.test.ts), [checked-gateway-installed.test.ts](https://github.com/TechSpokes/typescript-wsdl-client/blob/main/test/integration/checked-gateway-installed.test.ts) |
+
+## Run the corpus
+
+```bash
+npm run test:corpus
+```
+
+The command selects the existing tests once and delegates installed-package checks to their existing script. Refused rows prove their named failure and dispatch boundary; they do not count as successfully generated services.
+
+Installed variant evidence uses independently checked source-derived variants where named; it does not assert an unchanged production-provider contract. Private service evidence remains separate and is not required by this public corpus command.
+
+## Maintain the index
+
+Add rights-cleared inputs and independent expected exchanges to the existing conformance framework. Preserve supported behavior, invalid-input checks, compatibility and security requirements alongside corpus growth.
+
+```bash
+npm run docs:corpus
+npm run docs:corpus:check
+```

package/docs/direct-values.md

@@ -0,0 +1,311 @@
+# Direct scalar values
+
+Internal direct mapping, bare-root XML codec and portable source contract. See the root [README](../README.md) and [matching contract](https://github.com/TechSpokes/typescript-wsdl-client/blob/main/docs/content-model-matching.md).
+
+## Package-root binding for generated direct clients
+
+The root export `checkedDirectRuntimeV1` preserves the v1.1.5 execution contract for existing generated direct clients through the native source, capsule, schema/scalar, XML and buffered SOAP engines. The [checked gateway workflow](checked-gateway.md) exposes legacy and component generation; the unpublished intermediate direct-generation choice has been removed. Frozen v1.1.5-issued client and capsule fixtures verify compatibility against the installed candidate runtime. Historical P3 sections below record earlier internal milestones, not another current public generation entry.
+
+Use a matched generated client, capsule and explicitly authorized original local WSDL. The caller supplies its actual owned server endpoint; a WSDL service address never authorizes dispatch.
+
+```typescript
+import {readFile} from 'node:fs/promises';
+import {fileURLToPath} from 'node:url';
+import {checkedDirectRuntimeV1} from '@techspokes/typescript-wsdl-client';
+import {createClient} from '../.generated/checked-client.js';
+
+declare const endpoint: string; // Actual endpoint returned by the host's owned loopback server.
+const directory = new URL('../.generated/', import.meta.url);
+const controller = new AbortController();
+const client = createClient(checkedDirectRuntimeV1);
+const result = await client.GetForecast({city: 'Paris', days: 2}, {
+  localSource: fileURLToPath(new URL('forecast.wsdl', directory)),
+  fileRoots: [fileURLToPath(directory)],
+  capsule: await readFile(new URL('forecast.capsule.json', directory)),
+  soap: {
+    service: {namespace: 'urn:checked:forecast', local: 'ForecastService'},
+    port: 'ForecastPort', endpoint,
+    allowEndpoint: url => url.href === endpoint,
+    signal: controller.signal,
+    timeoutMs: 5000,
+    limits: {maxBytes: 8 * 1024 * 1024, maxDepth: 64, maxNodes: 100000, maxText: 8 * 1024 * 1024},
+  },
+});
+if (result.kind === 'soap-response') console.log(result.value.temperature);
+else if (result.kind === 'soap-fault') console.log(result.fault.name, result.value.message);
+else console.error(result.kind, result.rule);
+```
+
+The timeout, size/depth controls and signal above are explicit caller choices. Omitting them installs no normal work quota, source/XML size ceiling or SOAP deadline; timeout zero also disables the SOAP deadline. Limits cover the XML request and complete response, including the envelope; text counts UTF-16 units. The host owns capacity, logging and resource failure handling, including source-file size policy and worker/process/OS containment. Same-thread cancellation cannot preempt synchronous JavaScript; no hard heap/RSS/CPU guarantee is provided. Profiling budgets are private test/research hooks and are refused by this root entry.
+
+### Compatibility and repair
+
+The frozen binding's `version` and generated invocation protocol are exactly `checked-direct-runtime-v1`, independent of npm version. The generated wrapper checks the binding version before execution; the binding independently checks the invocation version before inspecting options or loading source. Missing, older or foreign protocol versions return `incompatible-artifact` with rule `generated-runtime-version`. P3.7 artifacts without this handshake require regeneration; no guessed upgrade is supported.
+
+Capsule format 1 requires model `xsd10-faithful-v1`, scope `direct-soap11-single-utf8-v1`, mapping `direct-values-v1`, scalar policy `direct-string-boolean-int-v1` and runtime policy `owned-loopback-http-no-extensions-v1`. Each invocation pins capsule bytes to the generated literal, reads the separately authorized local file and reissues fresh native authority. It compares selected service/port/binding/action, input/output/fault roots and types, ordered slots, occurrences and scalar identities before HTTP. Saved reports, fingerprints and old handles authorize no I/O.
+
+`generated-capsule-mismatch`, `local-source-changed` and version/contract incompatibility require regenerating the client and capsule together from the explicitly authorized original WSDL with the installed runtime. Exact byte changes require regeneration even when the semantic descriptor would remain compatible. Harmless file relocation preserves emitted source; location still needs fresh file-root authorization. Missing authority requires correcting the explicit file-root permission or endpoint selection/authorization, never enabling implicit source fetching.
+
+Failures retain `unsupported`, `missing-authority`, `incompatible-artifact`, `invalid-schema`, `inconclusive`, `scalar-invalid`, `value-invalid`, `xml-invalid`, `mismatch`, `protocol`, `transport`, `resource-limit` and `cancelled` categories. A configured size refusal is `resource-limit`, a SOAP deadline or early connection close is `transport`, and caller abort is `cancelled`; none becomes schema invalidity or partial successful output. Host/runtime capacity failures can still throw; malformed data-only options or invalid operational limit values can throw `TypeError`/`RangeError`. Normal usage counters `{nodes: 0, work: 0}` mean disabled profiling.
+
+### Restricted supported grammar
+
+This entry supports one safe UTF-8 local WSDL resource and SOAP 1.1 document/literal over explicitly authorized owned IPv4 loopback HTTP. Values are built-in string/int32/Boolean scalar roots, empty sequences or flat sequences of distinct scalar elements with minOccurs 0/1 and maxOccurs 1/unbounded, including declared faults. Source loading and native qualification retain the [direct correspondence restrictions](https://github.com/TechSpokes/typescript-wsdl-client/blob/main/docs/decisions/003-content-model-contracts.md#qualified-dated-xsd-direct-route).
+
+Nested complex/group content, attributes, nil, facets, import/include graphs and general XSD completeness are outside this slice. Dependency-reserved names such as `__proto__`, `constructor`, `toString`, inherited Object.prototype names and `prototype` refuse safely. Remote source loading, production endpoints, TLS/auth/WS-Security, arbitrary headers, SOAP 1.2, redirects, attachments, compression and streaming remain unsupported. `admitted:false` remains unchanged.
+
+TypeScript approximates the runtime contract: `number` does not enforce int32 range, and structural typing does not exclude every extra property or invalid occurrence. Fresh values always undergo native shape/scalar checks. The generated `Runtime` is a trusted injection interface; supply the documented root binding, since a replacement implementation can lie about its protocol or returned values. No source authorization handle, mutable transport object or native receipt is exported.
+
+## Current direct-client resource policy
+
+Normal generated-client execution has no profiling work quota, payload-size quota or default SOAP deadline. The application hosting a client or REST gateway owns its resource capacity, timeout choices, logging and failure handling. This policy implements the October 27, 2026 clarification and supersedes older direct-path claims below that test budgets protect consumer applications.
+
+### Plan and implementation
+
+The implementation separates data ownership from profiling, removes artificial allocation reservations, makes normal execution unmetered, and keeps bounded profiles explicit in tests. It reuses the existing copier, validators, codec and transport. Source authorization, native contract identity, correct schema/protocol validation and rejection of unsupported features remain required; they are not resource quotas.
+
+`createApplicationBudget()` supplies the semantic engine interface without collecting counters or rejecting work. Tests explicitly supply profiling limits to opt into the existing measured/bounded engine. The default 125-million-work/100,000-node research profile is unchanged for those tests and research tools; it is not silently installed into ordinary generated calls. Zero usage counters in normal mode mean metering is disabled, not that execution was free.
+
+The generated client options do not expose the internal profiling budget. A caller may still explicitly supply SOAP byte/depth/text/node limits or a timeout for its own application policy. Only supplied size/depth values are enforced in normal mode; an absent timeout or timeout zero creates no SOAP deadline. Configuration is owned before asynchronous use, preserving the earlier mutation fix independently of profiling.
+
+Portable capsule/source handling, generated-file emission, value inverse construction and metadata ownership likewise do not inherit the bounded test profile during normal execution. Existing low-level numeric interfaces use JavaScript's safe-integer representation ceiling to express the absence of a configured quota; this is not a supported maximum workload or a resource-safety promise. Actual process, runtime and operating-system limits can still fail, and those failures belong to the hosting application.
+
+### Testing and optimization profiles
+
+These numbers are selected only when a test opts into profiling. They are not normal client defaults or guarantees that all data below them fits memory.
+
+| Test boundary | Profile value | Purpose |
+| --- | --- | --- |
+| Local WSDL | 64 KiB | Reproduce small-source qualification cases |
+| Capsule | 256 KiB | Exercise at/beyond byte-boundary behavior |
+| XML | 1 MiB bytes/text, depth 256, 100,000 nodes | Test concrete buffer and traversal boundaries |
+| Fresh values | 1 MiB string content, 100,000 scalar items | Test failure before inverse construction |
+| Metadata copies | 100,000 entries, 1 MiB text, depth 256 | Exercise malformed option-graph cases |
+| Generated file | 512 KiB conservative bound | Test emission refusal |
+| Native algorithms | Existing work/node counters | Compare optimization behavior and test exhaustion |
+
+Text counters use UTF-16 units; byte counters use encoded bytes. Work units remain an internal diagnostic model, not milliseconds, CPU time, heap allocation or RSS. Historical measurements and default research-engine accounting are not rewritten. The extracted ownership implementation preserves those counters when profiling is explicitly selected.
+
+Routine base64/JSON handling, copying, freezing, source bootstrap, codec emission and publication no longer assign artificial work prices. In particular, the node-soap bootstrap does not reserve `4 * sourceBytes²` or invented bootstrap node allocations. Profiling exhaustion stays sticky within a profiled test invocation; each independent invocation creates fresh state.
+
+### Alternatives and product decision
+
+| Approach | Decision | Consequence |
+| --- | --- | --- |
+| Mandatory library quotas | Removed from normal direct execution | Valid work is not rejected by a test allowance |
+| Explicit profiling limits | Retained in test/internal controls | Optimization and at/beyond-boundary evidence remain reproducible |
+| Application-selected timeout/size controls | Honored when supplied | The host chooses its own operational policy |
+| Worker/process or OS CPU/memory containment | Hosting-application option | Requires deployment and lifecycle decisions outside this library |
+
+The library makes no hard heap, RSS, CPU-time or preemption guarantee. A large workload can exhaust process resources; the hosting application observes and handles that failure. Same-thread timers cannot interrupt synchronous JavaScript. Format, schema and authorization checks remain separate from resource profiling, including the existing restriction to the supported direct grammar and owned-loopback adapter.
+
+### Verification and observed improvement
+
+The diagnostic probe in `test/helpers/directResourceProbe.ts` compares separately loaded builds against the same local server and 10,655-byte WSDL. The archived P3.7 build returned resource-limit with zero requests; the changed build returned soap-response with one request. This demonstrates removal of an artificial rejection, not a latency speedup: the old build never completed equivalent work.
+
+Installed-consumer tests additionally generate and execute a client from a WSDL above 64 KiB with request and response values above 1 MiB using normal defaults. The same generated call explicitly given a 1 KiB application limit refuses before HTTP. Normal loading also follows an authorized seven-redirect chain and caller cancellation interrupts a deliberately stalled WSDL fetch without relying on a deadline. Existing request/response/fault, authority, optional/array, mutation/getter/proxy and cancellation controls remain. Tests of profiling limits now opt in explicitly; normal-mode tests assert that no work quota or counters are activated.
+
+## Implementation checkpoint
+
+One integration owner implements the complete chain under #382, #155, #184 and #182. Inputs are an authentic operation, a newly issued successful structural match, or an authentic source-derived mapping plus fresh application data. Receipt identity, never digest or diagnostic JSON, supplies authority.
+
+The complete native root plan determines every slot, including unobserved optional members. Scalar roots project to primitives; complex roots project to owned null-prototype records keyed by distinct source local names. Required singletons are required; optional singletons are omitted when absent; unbounded members always have dense ordered arrays, empty only when min=0. Empty sequences yield empty records.
+
+String content is preserved; boolean maps to boolean; validated int32 maps exactly to number, normalizing negative zero to zero. Original lexical spellings, declaration/type identities, namespaces and source paths remain immutable evidence. The inverse accepts fresh values, reconstructs expanded names and source order with canonical scalar spellings, and reuses structural and shared scalar validation. It produces lexical data, not XML bytes.
+
+Data inputs are plain records and dense arrays without proxies or accessors. Unknown keys, symbols, nonenumerable fields, inherited/custom prototypes, boxed/callable values, sparse/extra-property arrays, missing required members and wrong scalar types are refused without coercion, getters or caller mutation. Ordinary Object.prototype and null prototypes are accepted for fresh records.
+
+The original inclusive sticky request budget covers controlled inspections, planning, values, text, keys, construction, revalidation and publication, subject to the intrinsic enumeration limitation below. Cancellation is cooperative; failures issue no partial receipt. No new runtime budget lifetime is introduced. Success still has admitted:false; transport, persistence, generation and public activation remain deferred. The internal byte codec below extends the value boundary only.
+
+## Laws and rule basis
+
+For admitted data-only fresh application values, project(validate(expand(v))) equals normalizeApplication(v). Expansion of a projected validated payload preserves expanded names, declaration order, occurrence counts and typed values modulo canonical scalar spelling. Normalization is deterministic, idempotent and non-mutating; it changes only record key order/prototype ownership and numeric negative zero, never repairs invalid shapes.
+
+These are the original in-memory structure/value laws. The byte codec below extends them across its qualified XML boundary. Scalar rules come from the dated [XSD Datatypes recommendation](https://www.w3.org/TR/2004/REC-xmlschema-2-20041028/): string 3.2.1, boolean 3.2.2, int 3.3.17, integer 3.3.13 and whiteSpace 4.3.6; XML character validity follows XML 1.0 Char. Neutral datatype calculations are shared with schema assessment; payload diagnostics and issuance are separate.
+
+## APIs and failures
+
+`createDirectValueMapping(contract, direction, options?)` returns an issued `direct-mapping`, independent of any payload. `assessDirectScalars(contract, match, options?)` authenticates the final `structural-match`, validates every duty, projects the application value and returns an issued `direct-value` with `mapping`, `structural`, `operands`, `value` and usage. `expandDirectValue(contract, mapping, freshValue, options?)` returns an issued `direct-expanded` with generated `payload` lexical data and its revalidated `validated` value receipt.
+
+The identity-only inspectors are `inspectDirectStructuralMatch`, `inspectDirectValueMapping`, `inspectDirectValue` and `inspectDirectExpandedValue`; every inspector takes the receipt then the expected original operation contract. Inspectors do not perform operational work or grant a fresh budget. Each operational API checks cancellation and remaining resources again. Copies, JSON, context IDs and equal digests supply no authority.
+
+Payload lexical failures return `scalar-invalid` with schema and numeric payload paths. Application shape/type failures return `value-invalid`; native unavailability returns `unsupported`; interruption returns `cancelled` or sticky `resource-limit`. No failure publishes values, operands, mappings or partially reconstructed payloads. Malformed receipt authority throws `TypeError`; genuine internal errors propagate rather than becoming invalid caller data.
+
+## Accepted resource model
+
+This section records the historical P3.3 accounting contract. The current direct-client resource policy above supersedes its procedural pricing requirements while retaining data/shape validation and the intrinsic-enumeration limitation.
+
+The user explicitly accepted the following scoped resource qualification for P3.3 on October 26, 2026, recorded in [#382](https://github.com/TechSpokes/typescript-wsdl-client/issues/382#issuecomment-6424153066): JavaScript `Reflect.ownKeys` constructs an intrinsic temporary key vector before its length can be known. Rejecting every symbol/nonenumerable extra field on an arbitrary plain data object requires this bulk intrinsic; a prior guessed cap cannot bound the allocation. The inverse precharges the maximum valid vector before the intrinsic: the source slot count for records, or length plus one for dense arrays. It immediately refuses any excess count before per-key traversal. This reserves every valid key vector before construction, but a malformed object can still cause the engine to allocate a larger temporary vector before control returns.
+
+All controlled traversal, scalar work, retained copies, construction and publication use the original budget. This model does not establish a hard heap bound or preemption of intrinsic enumeration. Exact all-allocation precharging for arbitrary malformed application objects is not established and is outside the accepted model. The scope decision preserves all value/shape checks and the original budget; it does not introduce a V8 memory ceiling or permit successful output on exhaustion. No default budgets or test deadlines were raised.
+
+## Runnable three-direction example
+
+From the repository root run `node --import tsx --input-type=module-typescript` and supply this program on standard input. The existing ordered parser is used only as a test adapter; this example does not qualify a secure SOAP codec.
+
+```typescript
+import path from 'node:path';
+import {readFile} from 'node:fs/promises';
+import {pathToFileURL} from 'node:url';
+import {selectDirectOperation} from './src/compiler/directOperation.ts';
+import {matchDirectOperation} from './src/compiler/directStructure.ts';
+import {assessDirectScalars, createDirectValueMapping, expandDirectValue} from './src/compiler/directValues.ts';
+import {parseOrderedSyntax, syntaxElements} from './src/loader/orderedSyntax.ts';
+
+const directory = path.resolve('test/conformance/fixtures/assessment');
+const namespace = 'urn:checked:forecast';
+const selected = await selectDirectOperation(path.join(directory, 'forecast.wsdl'), {
+  portType: {namespace, local: 'ForecastPortType'},
+  binding: {namespace, local: 'ForecastBinding'}, operation: 'GetForecast',
+}, {loading: {policy: {fileRoots: [directory]}}});
+if (selected.kind !== 'selected') throw new Error(selected.kind);
+const cases = [
+  ['request', {kind: 'input'}, {city: 'Paris', days: 2}],
+  ['response', {kind: 'output'}, {city: 'Paris', temperature: [18, -2], complete: true}],
+  ['fault', {kind: 'fault', name: 'ForecastError'}, {code: 'NOT_FOUND', message: 'Unknown city'}],
+] as const;
+for (const [file, direction, fresh] of cases) {
+  const uri = path.join(directory, 'forecast-messages', file + '.xml');
+  const envelope = parseOrderedSyntax(await readFile(uri), pathToFileURL(uri).href).root;
+  let payload = syntaxElements(syntaxElements(envelope)[0]!)[0]!;
+  if (file === 'fault') payload = syntaxElements(syntaxElements(payload).find(n => n.name.local === 'detail')!)[0]!;
+  const match = matchDirectOperation(selected.contract, direction, payload);
+  if (match.kind !== 'structural-match') throw new Error(match.kind);
+  const value = assessDirectScalars(selected.contract, match);
+  const mapping = createDirectValueMapping(selected.contract, direction);
+  if (value.kind !== 'direct-value' || mapping.kind !== 'direct-mapping') throw new Error('validation failed');
+  const inverse = expandDirectValue(selected.contract, mapping, fresh);
+  if (inverse.kind !== 'direct-expanded') throw new Error(inverse.kind);
+  console.log(file, value.value, inverse.validated.value);
+}
+```
+
+## Internal bare-root XML codec
+
+P3.4 under [#384](https://github.com/TechSpokes/typescript-wsdl-client/issues/384) implements the minimal in-memory consumer for #185/#186/#187/#188/#189. Its metadata is the original authentic operation and source-owned mapping with version `direct-values-v1`; no additional bundle or fingerprint authority is introduced. The broader owners retain their full-profile acceptance criteria.
+
+`encodeDirectXml(contract, mapping, freshValue, options?)` calls `expandDirectValue` before emitting deterministic UTF-8 bytes. It returns `direct-encoded` with caller-owned mutable `bytes`, the authentic `expanded` receipt, encoding and usage. The byte array is data, never authority; changing it cannot change the validated expansion or authenticate another payload.
+
+`decodeDirectXml(contract, mapping, bytes, options?)` accepts a non-shared `Uint8Array` or Buffer, copies its native byte slots without length/buffer/iterator getters, parses ordered observed syntax, then calls `matchDirectOperation` and `assessDirectScalars`. It returns `direct-decoded` with immutable observed `payload`, authentic `validated` receipt and usage. Both APIs are internal exports from [directCodec.ts](https://github.com/TechSpokes/typescript-wsdl-client/blob/main/src/compiler/directCodec.ts), absent from the package public API.
+
+Identity checks precede property/version interpretation. Foreign/copied/JSON/wrong-version handles throw TypeError; genuine future incompatible metadata returns unsupported. Direction and exact root come from the mapping, with no guessed catalog upgrade or source reload. SOAP 1.1 document/literal binding/action remain source metadata and authorize no I/O.
+
+### Supported values and joint laws
+
+The codec covers the entire currently admitted direct grammar: string/int/boolean scalar roots and named element-only flat distinct scalar sequences, including empty sequences and every admitted optional/required singleton/unbounded pair. It preserves optional omission versus present empty strings and always-present dense repeated arrays. It emits schema order, independent of application key order, without synthetic application containers.
+
+For valid fresh data, `decode(encode(v)).validated.value = normalizeApplication(v)`. For admissible XML, re-encoding the decoded value preserves expanded names, declaration order, occurrence counts and exact typed values modulo canonical scalar spelling. It preserves string content; boolean emits true/false, int32 emits exact decimal with numeric negative zero becoming zero. This is not original lexical-byte identity or a signed-byte round trip.
+
+Prefixes are allocated by first source-order use of expanded namespaces, then bound at each use. The encoder never emits a default namespace, so unqualified children stay unqualified without inheriting an ambient default. Text escapes ampersand/angle brackets, preserves Unicode and encodes CR as `
`; namespace attributes additionally escape quotes/tab/newline. The delivered shared scalar core checks XML characters and scalar validity before successful encoding.
+
+### Secure byte boundary and provenance
+
+The codec reuses [orderedSyntax.ts](https://github.com/TechSpokes/typescript-wsdl-client/blob/main/src/loader/orderedSyntax.ts) with namespace-aware `saxes` 6.0.0, strict fatal decoding and XML 1.0-only mode. Saxes is an in-memory tokenizer with no resolver or external I/O; DTD declarations are refused, predefined/numeric references are processed, and unknown/general/external entities fail. Schema locations, namespace URIs and xml:base are never fetched; unsupported application attributes, nil and xsi:type fail through the existing matcher.
+
+UTF-8 with optional BOM and BOM-qualified UTF-16LE/BE are supported. XML declaration encoding must agree with the bytes; unsupported encodings, doubled BOMs, isolated surrogates, malformed Unicode, namespace errors, multiple roots and truncated syntax fail without repair. XML 1.1 is unsupported. BOM-less UTF-16 is refused. EOF completion precedes any successful decoded result.
+
+Observed syntax retains the digest of the exact incoming bytes, caller-supplied absolute `options.uri` (default `urn:typescript-wsdl-client:observed-direct-xml`), namespace contexts, lexical text and numeric source paths. Positions remain one-based lines/columns and zero-based UTF-16 offsets in BOM-decoded text, as in the syntax owner; these are decoded-text positions, not byte offsets. Generated expansions retain their explicit generated URN/empty digest/zero positions and are never relabeled as observed input.
+
+Malformed XML returns `xml-invalid`; unsupported syntax/semantics returns `unsupported`; valid XML with wrong structure returns `mismatch`; shared-core lexical failures return `scalar-invalid`; fresh shape/type errors return `value-invalid`. Cancellation and resource limits remain separate terminal failures, with no bytes or validated payload on failure. Diagnostics contain safe fixed rules and source coordinates rather than raw payload text; native internal errors propagate.
+
+### Resources and cancellation
+
+`options.limits` may set positive safe-integer `maxBytes`, `maxDepth`, `maxNodes` and `maxText`. The initial internal codec profile defaults to 1 MiB bytes, depth 256, 100,000 emitted/retained syntax nodes and 1 MiB aggregate element text in UTF-16 units; it deliberately does not claim the broader ADR buffered transport profile. Limits are inclusive and apply per invocation; raising them never raises or resets the original request budget.
+
+The inclusive sticky operation budget still covers selection, mapping, inverse, parser/encoder traversal, native byte copies, hash/decoder/SAX token buffers, line indexes, inherited namespace/path copies, scalar checks and publication. Bytes are capped and bulk work reserved before copying/decoding/tokenization, including ignored comments, processing instructions and forbidden DTD tokens. Namespace/path copies, relative xml:base URL resolution and retained nodes/text are charged before construction. The engine-intrinsic exclusion for malformed arbitrary application key vectors remains exactly as accepted above.
+
+A configured syntax cap fails that invocation; work already spent remains spent. Exhaustion of the original operation work/node budget is sticky across both codec APIs and all earlier APIs. No V8 heap ceiling or instantaneous preemption is promised. Cancellation is cooperative at entry, parser chunks of at most 1024 decoded UTF-16 units, node/text visits and before publication; the bounded decoder/hash intrinsics complete before the next checkpoint.
+
+Encoder node/text accounting includes generated empty text nodes; the parser counts retained text events, so empty XML elements may consume fewer nodes. Both stages honor their declared inclusive caps; neither metric is a wire-byte equivalence claim. A production reusable client's per-call budget lifetime remains a later explicit decision, not a permanent-client counter or new session framework.
+
+### Runnable codec example
+
+After selecting an authentic operation with the earlier example, use its contract and mapping directly:
+
+```typescript
+import {encodeDirectXml, decodeDirectXml} from './src/compiler/directCodec.ts';
+import {createDirectValueMapping} from './src/compiler/directValues.ts';
+import type {DirectOperationContract} from './src/compiler/directOperation.ts';
+declare const contract: DirectOperationContract;
+const mapping = createDirectValueMapping(contract, {kind: 'input'});
+if (mapping.kind !== 'direct-mapping') throw new Error(mapping.kind);
+const encoded = encodeDirectXml(contract, mapping, {city: 'Paris', days: 2});
+if (encoded.kind !== 'direct-encoded') throw new Error(encoded.kind);
+const decoded = decodeDirectXml(contract, mapping, encoded.bytes);
+if (decoded.kind !== 'direct-decoded') throw new Error(decoded.kind);
+console.log(decoded.validated.value);
+```
+
+### Qualification and remaining boundary
+
+[Codec controls](https://github.com/TechSpokes/typescript-wsdl-client/blob/main/test/unit/direct-codec.test.ts) run the actual Forecast request/response/ForecastError fixture payload bytes against independent expectations, fresh-byte laws, renamed/form/prefix sources, scalar/empty roots, all counts, reserved names, Unicode/CR/escaping, encoding/security failures, authenticity, cancellation and inclusive limits. [Nonauthor controls](https://github.com/TechSpokes/typescript-wsdl-client/blob/main/test/unit/direct-codec-independent.test.ts) independently exercise BOM/URN repairs, native byte access, chunk boundaries and observed provenance. These are bare-root tests; their test-only SOAP extraction is not a production envelope parser.
+
+Exact P3.4 review, local/hosted checks and merged-main identities belong to #384 and [roadmap #379](https://github.com/TechSpokes/typescript-wsdl-client/issues/379). The separately scoped P3.5 adapter under #388 now consumes this codec for an internal buffered SOAP 1.1 unauthenticated loopback exchange; its [transport contract and qualifications](https://github.com/TechSpokes/typescript-wsdl-client/blob/main/docs/content-model-soap-feasibility.md#p35-original-byte-qualification) cover source-byte bootstrap, original response bytes, envelopes, declared Faults and request lifetime. Broad portable bundles, public structured generation, security combinations and activation remain separate work.
+
+The internal decoder accepts a protocol payload selector over the single parsed observed document. Its selected mapping is authenticated against the same operation, and the payload must be an actual descendant by object identity. It reuses structural/scalar checks without subtree reserialization, preserving the complete original document digest, actual coordinates and inherited namespace bindings on the selected response or fault detail. A synthetic tree cannot acquire observed provenance through this seam.
+
+## P3.6 internal portable source capsule
+
+[The private capsule module](https://github.com/TechSpokes/typescript-wsdl-client/blob/main/src/compiler/directSourceCapsule.ts) consumes authentic operations and existing native mappings. It adds no package export, public CLI, generated client or admission; package 1.1.4 and legacy defaults remain unchanged. This narrow capsule is not the full ADR bundle format or completion of #185/#186.
+
+### Source authority and reconstruction
+
+An installed consumer must separately authorize a new physical local WSDL copy. `reconstructDirectSourceCapsule(bytes, localSource, {policy, limits?, signal?})` reads that file through the existing resource loader, checks its exact bytes against the capsule, then runs whole-source native qualification, explicit operation selection, the shared SOAP bootstrap guard and fresh native mapping issuance. The reader does not write the source file or choose a filesystem location.
+
+The original checkout URI is never retained, authorized or fetched. File-root and symlink policy remain enforced; resource graphs and network sources are refused. An artifact digest detects corruption and never supplies permission, source authority or signature verification.
+
+`readDirectSourceCapsule(bytes, budget, signal?)` reads bounded data without I/O. Its result is not a contract or a reconstructible handle. Serialized operation/mapping/report objects and copied reconstruction results cannot acquire WeakMap authority.
+
+`createDirectSourceCapsule(contract, {service, port}, signal?)` writes deterministic UTF-8 JSON bytes from a native operation. Its sole source payload is canonical base64 of the exact retained UTF-8 WSDL bytes, including any original BOM; it does not reconstruct WSDL from declarations.
+
+### Format and comparison
+
+The closed format records its capsule/model/scope versions, native mapping and scalar policy versions, and the owned-loopback HTTP runtime policy. Compatibility records the explicit expanded portType/binding, operation, service, port and action, plus request/response/declared-fault message parts, expanded root/type names and native ordered slots with exact bounds and builtins. No executable plan, source path, context identifier, endpoint permission or runtime handle is persisted.
+
+`checkDirectSourceCompatibility(expected, contract, selection, signal?)` requires an identity-issued reconstruction as `expected`, so its embedded source and claimed contract have already been checked together. The actual contract must also be a fresh native operation; raw artifact bytes or JSON copies are refused. A comparison checks complete native-derived descriptors and distinguishes `exact-bytes` from `revised-bytes` without calling either authenticated trust.
+
+Authorized retrieval relocation, harmless QName prefix changes and source formatting can preserve the checked contract. Changed action, service/port/binding/operation identity, expanded roots/faults/members, order, occurrence bounds or scalar meaning require regeneration. Unknown/mixed/legacy formats and unsupported version or policy identifiers fail closed with regeneration guidance.
+
+The reader accepts at most 256 KiB of artifact bytes, 64 KiB of source and JSON nesting depth 16. It rejects malformed UTF-8/JSON, duplicate escaped keys, missing/unknown fields, noncanonical base64, corruption, shared byte backing and unsupported versions before semantic preparation. A recomputed checksum cannot rescue a false source-derived descriptor: reconstruction compares it against the newly qualified source before publishing handles.
+
+### Request resources and installed evidence
+
+Reconstruction starts one fresh request-specific inclusive sticky budget for artifact decoding, duplicate/shape checks, canonical copies/hashes, physical source reading, preliminary syntax, native load/qualification, mappings and publication. Comparison spends the actual operation's existing budget; reading an already reconstructed expected descriptor does not revive or dispatch its operation. Each future independent invocation starts a new budget; there is no reusable-client lifetime counter.
+
+Byte/depth/node limits, cancellation, schema inconclusive, incompatible artifacts, unsupported scope and missing authority remain separate failures. These are engineering work/allocation reservations with cooperative checkpoints, not a hard heap limit or preemptive execution guarantee.
+
+[Installed qualification](https://github.com/TechSpokes/typescript-wsdl-client/blob/main/test/integration/portable-installed.test.ts) packs and installs the npm tarball in a separate temporary directory and process. The copied test-only TypeScript harness verifies physical private `dist` imports, denies checkout filesystem reads with Node permissions, blocks implicit fetches, requalifies an authorized copy, relocates it and issues fresh mappings and deterministic XML. Private-module testing establishes no supported package subpath; package exports remain root-only.
+
+### Next consumer boundary
+
+The P3.6 handoff to P3.7 under #195/#201 is implemented by the internal consumer below. It preserves explicit service/port/endpoint authorization and fresh per-invocation budgets. Public exports/CLI, general generated-client design, broader grammar/security and activation require later decisions.
+
+## P3.7 internal generated TypeScript consumer
+
+[The native-plan generator](https://github.com/TechSpokes/typescript-wsdl-client/blob/main/src/client/generateDirectClient.ts) accepts an identity-issued reconstructed source, authenticates compatibility and each mapping, and emits one deterministic strict NodeNext TypeScript file plus its exact capsule. It uses the shared preamble composer with a dedicated internal-artifact preamble. There is no public command or package export for this generator.
+
+### Typed internal binding
+
+The generated file has no imports. `createClient(runtime)` receives a trusted internal binding with one `execute` method; the generated operation has the exact source operation spelling as a computed quoted key. [The binding owner](https://github.com/TechSpokes/typescript-wsdl-client/blob/main/src/client/directClientRuntime.ts) delegates exclusively to the existing capsule, mapping and buffered SOAP owners. The test harness loads this binding by verified physical installed private-module path; that mechanism is not a supported package subpath or plugin interface.
+
+The generated capsule literal pins the static contract. Each invocation requires matching loaded capsule bytes, an explicitly authorized physical local source and file roots, and explicit SOAP service, port, endpoint and endpoint authorization. The binding copies options before asynchronous work, refuses accessors/proxies and unsupported options, creates one fresh budget, reconstructs native authority from the authorized file, checks native compatibility and calls `exchangeDirectSoap`. No handle, endpoint permission, budget or source authorization is cached between independent calls.
+
+Exact capsule pinning intentionally rejects mixed generated files and capsules, even where a different source might have a compatible semantic shape. Regenerate the matched internal file and capsule after source-byte changes; an authorized relocation of identical bytes remains valid. Capsule reading and checksums confer no permission. Failure results retain native categories and never contain a typed usable value.
+
+### Static shapes and naming
+
+`Request`, `Response` and indexed `Fault_0` declarations are direction-specific roles, not prettified schema names. Equal local names in different namespaces cannot merge these declarations; the capsule retains all expanded native identities. Source keys and operation spellings are JSON-quoted, and operation keys are computed to avoid prototype setters. The generated fault union retains exact declared fault names and value shapes, including scalar and empty roots.
+
+Optional singletons are omittable; zero-or-more slots are required readonly arrays; one-or-more slots are readonly nonempty tuples. Empty sequences use `Readonly<Record<string, never>>`. String, Boolean and int32 map to `string`, `boolean` and `number`; native validation enforces int32 range, exact keys, dense arrays, scalar semantics and occurrence rules that TypeScript alone cannot express. Consumers can enable `exactOptionalPropertyTypes` to reject explicit undefined statically; the runtime always enforces omission semantics.
+
+The inherited node-soap bootstrap refuses `__proto__`, `constructor`, `toString`, other `Object.prototype` names and `prototype` anywhere in source declaration names. These fail before generation and dispatch; this packet does not weaken that boundary or claim arbitrary XML-name execution. Accepted reserved JavaScript words and hyphenated XML names are emitted safely. Broader dependency-name support requires a separately reviewed transport-owner change.
+
+### Accounting and qualification
+
+Emission bounds variable source contributions against a 512 KiB output ceiling before building source strings. `writeDirectClient` authenticates the bounded artifact and refuses an already failed semantic request; procedural emission and writes have no synthetic allocation price. Generated code contains no source path, checkout dependency or private package import.
+
+Native semantic accounting spans qualification and validation without resetting; routine byte copying, base64 comparison, serialization and publication use actual input/output caps. Separate calls get separate budgets; exhausted calls return no partial usable value. Normal calls no longer inherit the old source/capsule/XML test caps or semantic work allowance; cooperative cancellation and any explicit application-selected limits remain available. This is engineering accounting, not a hard heap or preemption guarantee; malformed own-key vector allocation has the same intrinsic qualification as the existing adapter.
+
+[Installed tests](https://github.com/TechSpokes/typescript-wsdl-client/blob/main/test/integration/generated-direct-installed.test.ts) generate bounded files for Forecast, renamed and prefix-aliased sources, optional/nonempty-array shapes, scalar and empty roots. They install the actual npm tarball in another directory, compile independently authored valid/invalid TypeScript and execute the emitted wrappers in a child with checkout reads denied. The harness permits only its consumer directory for file reads/writes and verifies real SOAP request namespace/order/scalars, response arrays and HTTP 200/500 declared faults, relocation, stale/mixed inputs, missing permissions, unsupported capabilities, cancellation and exhaustion. Node 24's permission model does not restrict sockets; endpoint restriction remains the native owned-loopback policy. Node versions exposing network permissions additionally receive the explicit loopback grant.
+
+[Independent controls](https://github.com/TechSpokes/typescript-wsdl-client/blob/main/test/unit/generated-direct-independent.test.ts) challenge getters/proxies, mutable option metadata, copied authority, sticky exhausted generation and preserved dependency-name refusals. Hosted Linux and Windows Node24/26 run the generated installed qualification explicitly. Public-interface readiness and any remaining blockers belong to a separate P3.8 task; public activation, legacy defaults, package 1.1.4, root-only exports and `admitted:false` remain unchanged.

package/docs/examples/checked-forecast.wsdl

@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<wsdl:definitions xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/" xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:t="urn:checked:forecast" targetNamespace="urn:checked:forecast">
+  <wsdl:types>
+    <xs:schema targetNamespace="urn:checked:forecast" elementFormDefault="qualified">
+      <xs:complexType name="ForecastRequest"><xs:sequence><xs:element name="city" type="xs:string"/><xs:element name="days" type="xs:int"/></xs:sequence></xs:complexType>
+      <xs:complexType name="ForecastResponse"><xs:sequence><xs:element name="city" type="xs:string"/><xs:element name="temperature" type="xs:int" minOccurs="0" maxOccurs="unbounded"/><xs:element name="complete" type="xs:boolean"/></xs:sequence></xs:complexType>
+      <xs:complexType name="ForecastFault"><xs:sequence><xs:element name="code" type="xs:string"/><xs:element name="message" type="xs:string"/></xs:sequence></xs:complexType>
+      <xs:element name="GetForecast" type="t:ForecastRequest"/>
+      <xs:element name="GetForecastResponse" type="t:ForecastResponse"/>
+      <xs:element name="ForecastFault" type="t:ForecastFault"/>
+    </xs:schema>
+  </wsdl:types>
+  <wsdl:message name="ForecastInput"><wsdl:part name="parameters" element="t:GetForecast"/></wsdl:message>
+  <wsdl:message name="ForecastOutput"><wsdl:part name="parameters" element="t:GetForecastResponse"/></wsdl:message>
+  <wsdl:message name="ForecastError"><wsdl:part name="detail" element="t:ForecastFault"/></wsdl:message>
+  <wsdl:portType name="ForecastPortType"><wsdl:operation name="GetForecast"><wsdl:input message="t:ForecastInput"/><wsdl:output message="t:ForecastOutput"/><wsdl:fault name="ForecastError" message="t:ForecastError"/></wsdl:operation></wsdl:portType>
+  <wsdl:binding name="ForecastBinding" type="t:ForecastPortType"><soap:binding style="document" transport="http://schemas.xmlsoap.org/soap/http"/><wsdl:operation name="GetForecast"><soap:operation soapAction="urn:checked:GetForecast"/><wsdl:input><soap:body use="literal"/></wsdl:input><wsdl:output><soap:body use="literal"/></wsdl:output><wsdl:fault name="ForecastError"><soap:fault name="ForecastError" use="literal"/></wsdl:fault></wsdl:operation></wsdl:binding>
+  <wsdl:service name="ForecastService"><wsdl:port name="ForecastPort" binding="t:ForecastBinding"><soap:address location="http://127.0.0.1:1/forecast"/></wsdl:port></wsdl:service>
+</wsdl:definitions>

package/docs/gateway-guide.md

@@ -281,7 +281,7 @@ await app.register(async (scope) => {
 await app.listen({ port: 3000 });
 ```
 
-See [`examples/fastify-gateway`](../examples/fastify-gateway/README.md) for a complete example.
+See [`examples/fastify-gateway`](https://github.com/TechSpokes/typescript-wsdl-client/blob/main/examples/fastify-gateway/README.md) for a complete example.
 
 ## Contract Assumptions