@techspokes/typescript-wsdl-client 1.1.5 → 1.1.8

package/dist/compiler/directOperation.js

@@ -5,14 +5,19 @@ import { SchemaLoadingError, WSDL_NAMESPACE, syntaxAttribute, syntaxElements, is
 import { globalId } from './canonicalGraph.js';
 import { createApplicationBudget, DEFAULT_MAX_NODES } from './semanticBudget.js';
 import { qualifyDirectSource } from './checkedSourcePreparation.js';
+import { qualifyComponentSource, inspectComponentSourceQualification } from './checkedComponentSource.js';
+import { prepareWsdlPolicyRequirements, assertWsdlPolicyRequirements } from './wsdlPolicyRequirements.js';
 const SOAP = 'http://schemas.xmlsoap.org/wsdl/soap/';
 const HTTP = 'http://schemas.xmlsoap.org/soap/http';
+const ADDRESSING_WSDL = 'http://www.w3.org/2006/05/addressing/wsdl';
 const issued = new WeakMap();
 /** Object identity authenticates the exact issued roots; context IDs and digests do not. */
 export function inspectDirectOperation(contract, expectedContext) {
     const owned = issued.get(contract);
     if (!owned || expectedContext !== undefined && owned.context !== expectedContext)
         throw new TypeError('Unauthenticated or foreign direct operation');
+    if (owned.policyOwner)
+        assertWsdlPolicyRequirements(owned.source, owned.policyOwner);
     return owned;
 }
 class Refusal extends Error {
@@ -32,10 +37,47 @@ export async function selectDirectOperation(source, selector, options) {
 }
 /** Private-module composition seam: portable reading and selection share one request. */
 export async function selectDirectOperationInRequest(source, selector, options, budget) {
+    return selectOperationInRequest(source, selector, options, budget, 'direct');
+}
+/** Select through additive native component qualification without granting codec, transport or runtime admission.
+ * @remarks The same WSDL binding/message owner is used by the existing preview. New contracts carry a distinct
+ *   basis and correspondence; preview codecs and source capsules continue to refuse them until independently extended.
+ * @returns Fresh source-bound operation roots or an explicit qualification/selection failure.
+ */
+export async function selectComponentOperation(source, selector, options) {
+    return selectComponentOperationInRequest(source, selector, options, createApplicationBudget(options.limits));
+}
+/** Private composition seam: artifact reading and fresh component selection share the same sticky request. */
+export async function selectComponentOperationInRequest(source, selector, options, budget) {
+    return selectOperationInRequest(source, selector, { ...options, standardLibraries: Object.freeze([...(options.standardLibraries ?? [])]) }, budget, 'components');
+}
+/** Select requested service operations against one fresh native source snapshot and sticky request.
+ * @remarks Native whole-source qualification is reused by identity within this batch only. Every binding/message
+ *   selection still runs through the same owner; no source flags, saved reports or operation-name guesses are consumed.
+ * @returns One result in each requested position, including explicit refusals. No requested operation is omitted.
+ */
+export async function selectComponentOperations(source, selectors, options) {
+    const budget = createApplicationBudget(options.limits), cache = {};
+    const owned = budget.snapshot(selectors);
+    if (!Array.isArray(owned) || Object.keys(owned).length !== owned.length)
+        throw new TypeError('Dense operation selectors required');
+    const results = [];
+    const captured = { ...options, standardLibraries: Object.freeze([...(options.standardLibraries ?? [])]) };
+    for (const selector of owned)
+        results.push(await selectOperationInRequest(source, selector, captured, budget, 'components', cache));
+    return Object.freeze(results);
+}
+async function selectOperationInRequest(source, selector, options, budget, profile, cache) {
     const check = () => { if (options.signal?.aborted)
         throw new Cancelled(); budget.chargeWork(); };
     const refuse = (kind, rule) => { throw new Refusal(kind, rule); };
     const failure = (kind, rule) => Object.freeze({ kind, rule, usage: Object.freeze({ ...budget.usage() }) });
+    const sourceFailure = (kind, rule) => {
+        const result = failure(kind, rule);
+        if (cache && result.kind !== 'selected')
+            cache.failure = result;
+        return result;
+    };
     try {
         // Fixed terminal envelope and issuance bookkeeping, before any source work.
         budget.chargeWork(4096);
@@ -44,20 +86,43 @@ export async function selectDirectOperationInRequest(source, selector, options,
         const name = (value) => value && typeof value.namespace === 'string' && typeof value.local === 'string' && isXmlNCName(value.local);
         if (!name(ownedSelector.portType) || !name(ownedSelector.binding) || typeof ownedSelector.operation !== 'string' || !isXmlNCName(ownedSelector.operation))
             return failure('selection-refused', 'explicit-selector');
-        const input = await loadSemanticSchemaInput(source, { ...options.loading, limits: directLoadingLimits(budget, options.loading.limits), signal: options.signal, chargeWork: amount => { check(); budget.chargeWork(amount); } });
+        if (cache?.failure)
+            return failure(cache.failure.kind, cache.failure.rule);
+        const input = cache?.input ?? await loadSemanticSchemaInput(source, { ...options.loading, limits: directLoadingLimits(budget, options.loading.limits), signal: options.signal, chargeWork: amount => { check(); budget.chargeWork(amount); } });
+        if (cache)
+            cache.input = input;
         check();
         const result = budget.guard(() => {
-            const qualified = qualifyDirectSource(input, { budget, maxNodes: options.limits?.maxNodes ?? directLimit(budget, DEFAULT_MAX_NODES), check });
+            const qualificationOptions = { budget, maxNodes: options.limits?.maxNodes ?? directLimit(budget, DEFAULT_MAX_NODES), check };
+            const qualified = cache?.qualified ?? (profile === 'direct' ? qualifyDirectSource(input, qualificationOptions)
+                : qualifyComponentSource(input, { ...qualificationOptions, standardLibraries: options.standardLibraries }));
             if (qualified.kind === 'resource-limit')
-                return failure('resource-limit', 'source-qualification');
+                return sourceFailure('resource-limit', 'source-qualification');
             if (qualified.kind === 'source-preparation-failed' && qualified.category === 'resource-limit')
-                return failure('resource-limit', 'source-preparation');
-            if (qualified.kind !== 'qualified-source')
-                return failure(qualified.kind === 'source-preparation-failed' && qualified.category === 'invalid-schema' ? 'invalid-schema' : 'inconclusive', 'source-preparation');
-            if (!qualified.eligible)
-                return failure(qualified.localDisproved || qualified.closure.kind === 'invalid-schema' ? 'invalid-schema' : 'inconclusive', 'whole-source-qualification');
-            const { request } = qualified;
+                return sourceFailure('resource-limit', 'source-preparation');
+            if (qualified.kind !== 'qualified-source' && qualified.kind !== 'component-source')
+                return sourceFailure(qualified.kind === 'source-preparation-failed' && qualified.category === 'invalid-schema' ? 'invalid-schema' : 'inconclusive', 'source-preparation');
+            if (qualified.kind === 'component-source')
+                inspectComponentSourceQualification(qualified, input);
+            const construction = qualified.kind === 'component-source' ? qualified.construction : qualified;
+            const eligible = qualified.kind === 'component-source' ? qualified.schemaEligible : qualified.eligible;
+            if (!eligible)
+                return sourceFailure(construction.localDisproved || construction.closure.kind === 'invalid-schema' ? 'invalid-schema' : 'inconclusive', qualified.kind === 'component-source' && qualified.correspondence.kind === 'inconclusive-correspondence'
+                    ? `whole-source-qualification:${qualified.correspondence.rule}${qualified.correspondence.path ? ':' + qualified.correspondence.path : ''}` : 'whole-source-qualification');
+            const { request } = construction;
             const context = request.actual;
+            let policyOwner;
+            if (profile === 'components') {
+                const policies = cache?.policy ?? prepareWsdlPolicyRequirements(input, budget, check);
+                if (policies.kind !== 'wsdl-policy-requirements')
+                    return sourceFailure(policies.kind, 'rule' in policies ? policies.rule : 'policy-budget');
+                assertWsdlPolicyRequirements(input, policies);
+                policyOwner = policies;
+                if (cache && qualified.kind === 'component-source') {
+                    cache.qualified = qualified;
+                    cache.policy = policies;
+                }
+            }
             const children = (node) => {
                 check();
                 budget.chargeWork(128 + node.children.length * 16 + node.attributes.length * 32);
@@ -70,6 +135,15 @@ export async function selectDirectOperationInRequest(source, selector, options,
                 return syntaxElements(node);
             };
             const attr = syntaxAttribute;
+            const addressingMessages = new Set();
+            if (profile === 'components')
+                for (const document of input.documents) {
+                    for (const portType of children(document.root).filter(node => node.name.namespace === WSDL_NAMESPACE && node.name.local === 'portType'))
+                        for (const operation of children(portType).filter(node => node.name.namespace === WSDL_NAMESPACE && node.name.local === 'operation'))
+                            for (const message of children(operation).filter(node => node.name.namespace === WSDL_NAMESPACE && ['input', 'output', 'fault'].includes(node.name.local)))
+                                addressingMessages.add(message);
+                }
+            const addressingAttribute = (node, namespace, local) => addressingMessages.has(node) && namespace === ADDRESSING_WSDL && local === 'Action';
             const exactly = (node, namespace, local) => {
                 const found = children(node).filter(c => c.name.namespace === namespace && c.name.local === local);
                 if (found.length !== 1)
@@ -78,7 +152,8 @@ export async function selectDirectOperationInRequest(source, selector, options,
             };
             const shape = (node, allowed) => {
                 for (const child of children(node))
-                    if (!allowed.includes(`${child.name.namespace}#${child.name.local}`))
+                    if (!allowed.includes(`${child.name.namespace}#${child.name.local}`)
+                        && !policyOwner?.isPolicyMetadata(child))
                         refuse('unsupported', 'binding-child-shape');
                 for (const child of node.children) {
                     if (child.kind !== 'text')
@@ -93,7 +168,8 @@ export async function selectDirectOperationInRequest(source, selector, options,
             const attrs = (node, allowed) => {
                 children(node);
                 for (const a of node.attributes)
-                    if (a.name.namespace !== '' || !allowed.includes(a.name.local))
+                    if (!addressingAttribute(node, a.name.namespace, a.name.local)
+                        && (a.name.namespace !== '' || !allowed.includes(a.name.local)))
                         refuse('unsupported', 'binding-attribute-shape');
             };
             // Conservative extension policy: only known WSDL 1.1/SOAP 1.1 syntax, even when optional.
@@ -113,12 +189,18 @@ export async function selectDirectOperationInRequest(source, selector, options,
                     const nested = children(node);
                     if (qualifiedSchemas.has(node))
                         continue;
+                    if (policyOwner?.isPolicyMetadata(node))
+                        continue;
                     if (node.name.namespace === WSDL_NAMESPACE && node.name.local === 'documentation')
                         continue;
                     const allowed = node.name.namespace === WSDL_NAMESPACE ? attributes[node.name.local] : node.name.namespace === SOAP ? soapAttributes[node.name.local] : undefined;
                     if (!allowed)
                         return refuse('unsupported', 'wsdl-extension');
                     for (const a of node.attributes) {
+                        // @why The May 2006 WSDL binding assigns no normative intent to Action without UsingAddressing.
+                        //   UsingAddressing remains unsupported, so these attributes are retained metadata, never SOAP header instructions.
+                        if (addressingAttribute(node, a.name.namespace, a.name.local))
+                            continue;
                         if (a.name.namespace === WSDL_NAMESPACE && a.name.local === 'required' && node.name.namespace === SOAP && ['true', '1', 'false', '0'].includes(a.value))
                             continue;
                         if (a.name.namespace !== '' || !allowed.includes(a.name.local))
@@ -255,15 +337,24 @@ export async function selectDirectOperationInRequest(source, selector, options,
             });
             check();
             // Charge publication traversal before retaining authority. Roots stay exact context objects.
-            const contract = { selector: ownedSelector, contextId: context.contextId, basis: 'native-direct-premises-v1', correspondence: 'dated-XSD-2004-direct-v1',
+            const contract = { selector: ownedSelector, contextId: context.contextId,
+                basis: profile === 'direct' ? 'native-direct-premises-v1' : 'native-component-premises-v1',
+                correspondence: profile === 'direct' ? 'dated-XSD-2004-direct-v1' : 'dated-XSD-2004-components-v1',
                 binding: { version: '1.1', style: 'document', use: 'literal', transport: HTTP, action, source: binding.context.source },
                 input: requestRoot, output: responseRoot, faults,
-                missingCapabilities: ['matcher', 'projection', 'scalar-payload', 'bundle', 'codec', 'buffered-transport', 'structured-generation'], admitted: false };
+                ...(policyOwner ? { policy: policyOwner.forBinding(binding.syntax), addressingActions: { required: false,
+                        input: attr(abstractInput, 'Action', ADDRESSING_WSDL), output: attr(abstractOutput, 'Action', ADDRESSING_WSDL),
+                        faults: declaredFaults.flatMap(fault => {
+                            const action = attr(fault, 'Action', ADDRESSING_WSDL);
+                            return action === undefined ? [] : [{ name: attr(fault, 'name'), action }];
+                        }) } } : {}),
+                missingCapabilities: ['matcher', 'projection', 'scalar-payload', 'bundle', 'codec', 'buffered-transport', 'structured-generation',
+                    ...(policyOwner?.forBinding(binding.syntax).kind === 'https-transport' ? ['policy-enforcement'] : [])], admitted: false };
             budget.freeze(contract);
             check();
             budget.chargeWork(256);
             const selected = Object.freeze({ kind: 'selected', contract, usage: Object.freeze({ ...budget.usage() }) });
-            issued.set(contract, Object.freeze({ contract, context, source: input, evidence: qualified }));
+            issued.set(contract, Object.freeze({ contract, context, source: input, evidence: qualified, ...(policyOwner ? { policyOwner } : {}) }));
             return selected;
         });
         return result.kind === 'resource-limit' ? failure('resource-limit', 'request-budget') : result;

package/dist/compiler/directSoap.d.ts

@@ -1,7 +1,8 @@
 import type { DirectOperationContract } from './directOperation.js';
-import type { DirectCodecFailure, DirectDecodedXml, DirectXmlLimits } from './directCodec.js';
+import type { DirectCodecFailure, DirectDecodedXml, ComponentDecodedXml, DirectXmlLimits } from './directCodec.js';
 import type { ExpandedName, SyntaxElement } from '../loader/orderedSyntax.js';
 import type { ResolverUsage } from './semanticBudget.js';
+import type { ComponentRecordProjection, ComponentRecordDecodedXml } from './componentRecordProjection.js';
 export interface DirectSoapOptions {
     readonly service: ExpandedName;
     readonly port: string;
@@ -18,11 +19,12 @@ export interface DirectSoapFailure {
     readonly kind: DirectCodecFailure['kind'] | 'transport' | 'protocol';
     readonly rule: string;
     readonly usage: ResolverUsage;
+    readonly phase?: 'input' | 'response';
 }
-export type DirectSoapResult = DirectSoapFailure | Readonly<{
+type SoapResult<D> = DirectSoapFailure | Readonly<{
     kind: 'soap-response' | 'soap-fault';
     admitted: false;
-    decoded: DirectDecodedXml;
+    decoded: D;
     /** Actual bounded HTTP entity bytes, before any decoding; caller-owned data. */
     responseBytes: Uint8Array;
     status: number;
@@ -33,10 +35,32 @@ export type DirectSoapResult = DirectSoapFailure | Readonly<{
         string: string;
         actor?: string;
     }>;
+    /** Qualified optional response blocks ignored under SOAP 1.1; their application semantics were not assessed. */
+    ignoredHeaders?: readonly ExpandedName[];
     usage: ResolverUsage;
 }>;
+export type DirectSoapResult = SoapResult<DirectDecodedXml>;
+export type ComponentSoapResult = SoapResult<ComponentDecodedXml>;
+export type ComponentRecordSoapResult = SoapResult<ComponentDecodedXml | ComponentRecordDecodedXml>;
+export interface ComponentSoapOptions extends Omit<DirectSoapOptions, 'endpoint' | 'allowEndpoint'> {
+    readonly endpoint?: string;
+    /** Optional restriction; omission permits only the configured or selected address. */
+    readonly allowEndpoint?: (endpoint: URL) => boolean;
+    /** Additional caller-owned PEM trust anchor; certificate and hostname verification remain enabled. */
+    readonly ca?: string;
+}
 /** Shared entry guard: consumers must call before reading any SOAP option. */
-export declare function directSoapOptionsShape(options: unknown, check: () => void): string | undefined;
+export declare function directSoapOptionsShape(options: unknown, check: () => void, additional?: readonly string[]): string | undefined;
 /** Authentication and fresh-value validation precede dependency bootstrap and all HTTP I/O. */
 export declare function exchangeDirectSoap(contract: DirectOperationContract, inputMapping: unknown, application: unknown, options: DirectSoapOptions): Promise<DirectSoapResult>;
-//# sourceMappingURL=directSoap.d.ts.map
+/** Execute one authenticated component mapping through the existing SOAP client and native XML checks.
+ * @remarks HTTPS transport with verified server identity is supported. Client certificates, timestamps and
+ *   timestamp layouts refuse before I/O. Algorithm suites constrain WS-Security cryptographic operations;
+ *   this fragment has no supporting tokens, signature or encryption operations and emits no security header.
+ *   Optional caller restrictions narrow the selected/configured endpoint. No gateway or source admission is granted here.
+ * @returns A validated response/fault or explicit failure, with owned work and connections closed.
+ * @throws TypeError For foreign native handles. Invalid explicit timer/XML capacities throw RangeError.
+ */
+export declare function exchangeComponentSoap(contract: DirectOperationContract, inputMapping: unknown, application: unknown, options: ComponentSoapOptions): Promise<ComponentSoapResult>;
+export declare function exchangeComponentSoap(contract: DirectOperationContract, inputMapping: unknown, application: unknown, options: ComponentSoapOptions, responseProjection: ComponentRecordProjection): Promise<ComponentRecordSoapResult>;
+export {};

package/dist/compiler/directSoap.js

@@ -1,18 +1,21 @@
 import { isApplicationUnmetered } from './semanticBudget.js';
 import { directDataOwnership, directLimit } from './directExecutionPolicy.js';
-/** Internal, one-retained-operation, unauthenticated loopback SOAP 1.1 adapter. */
+/** Shared retained-operation SOAP 1.1 exchange; profile-specific authority stays explicit. */
 import { checkSemanticBudget } from './semanticBudget.js';
 import { DataOwnershipLimitError } from './dataOwnership.js';
 import { Agent } from 'node:http';
+import { Agent as HttpsAgent } from 'node:https';
 import { types } from 'node:util';
 import { WSDL } from 'soap/lib/wsdl/index.js';
 import { Client } from 'soap/lib/client.js';
 import { HttpClient } from 'soap/lib/http.js';
 import { inspectDirectOperation } from './directOperation.js';
-import { createDirectValueMapping, inspectDirectValueMapping } from './directValues.js';
-import { decodeDirectXml, encodeDirectXml, DIRECT_XML_LIMITS } from './directCodec.js';
-import { prepareDirectSoapSource, DirectSoapSourceError } from './directSoapSource.js';
-import { isXmlNCName, resolveLexicalQName, SchemaLoadingError } from '../loader/orderedSyntax.js';
+import { createDirectValueMapping, inspectDirectValueMapping, createComponentDirectionalMapping, inspectComponentValueMapping } from './directValues.js';
+import { decodeDirectXml, encodeDirectXml, decodeComponentXml, encodeComponentXml, DIRECT_XML_LIMITS } from './directCodec.js';
+import { prepareDirectSoapSource, prepareComponentSoapWsdl, DirectSoapSourceError } from './directSoapSource.js';
+import { isXmlNCName, resolveLexicalQName, SchemaLoadingError, syntaxElements, syntaxAttribute, WSDL_NAMESPACE } from '../loader/orderedSyntax.js';
+import { decodeComponentRecordXml, inspectComponentRecordProjection } from './componentRecordProjection.js';
+import { assessComponentSoapHeader } from './soapHeaders.js';
 const SOAP = 'http://schemas.xmlsoap.org/soap/envelope/';
 class Stop extends Error {
     kind;
@@ -25,11 +28,11 @@ class Stop extends Error {
 }
 const same = (a, b) => a.namespace === b.namespace && a.local === b.local;
 /** Shared entry guard: consumers must call before reading any SOAP option. */
-export function directSoapOptionsShape(options, check) {
+export function directSoapOptionsShape(options, check, additional = []) {
     if (!options || typeof options !== 'object' || types.isProxy(options)
         || ![null, Object.prototype].includes(Object.getPrototypeOf(options)))
         return 'data-only SOAP options required';
-    const allowed = new Set(['service', 'port', 'endpoint', 'allowEndpoint', 'signal', 'timeoutMs', 'limits', 'capabilities']);
+    const allowed = new Set(['service', 'port', 'endpoint', 'allowEndpoint', 'signal', 'timeoutMs', 'limits', 'capabilities', ...additional]);
     for (const key of Reflect.ownKeys(options)) {
         check();
         const descriptor = Object.getOwnPropertyDescriptor(options, key);
@@ -40,12 +43,58 @@ export function directSoapOptionsShape(options, check) {
 }
 /** Authentication and fresh-value validation precede dependency bootstrap and all HTTP I/O. */
 export async function exchangeDirectSoap(contract, inputMapping, application, options) {
-    const { context, source } = inspectDirectOperation(contract);
     const input = inspectDirectValueMapping(inputMapping, contract);
+    return exchangeSoap(contract, input, application, options, {
+        component: false, encode: encodeDirectXml, decode: decodeDirectXml, create: createDirectValueMapping,
+        prepare: async (selection, check) => {
+            const { source } = inspectDirectOperation(contract);
+            const { wsdlText } = prepareDirectSoapSource(contract, selection, check);
+            const wsdl = new WSDL(wsdlText, source.root.uri, { wsdl_options: { overrideImportLocation: () => { throw new Stop('unsupported', 'dependency import forbidden'); } } });
+            await new Promise((resolve, reject) => wsdl.onReady(error => error ? reject(error) : resolve()));
+            return wsdl;
+        },
+    });
+}
+export async function exchangeComponentSoap(contract, inputMapping, application, options, responseProjection) {
+    const { mapping: input } = inspectComponentValueMapping(inputMapping, contract);
+    if (responseProjection !== undefined) {
+        inspectComponentRecordProjection(responseProjection, contract);
+        return exchangeSoap(contract, input, application, options, {
+            component: true,
+            encode(owner, mapping, value, controls) {
+                if (mapping.kind !== 'component-mapping')
+                    throw new TypeError('SOAP input requires the native input mapping');
+                return encodeComponentXml(owner, mapping, value, controls);
+            },
+            decode(owner, mapping, bytes, controls) {
+                if (mapping.kind === 'component-record-projection')
+                    return decodeComponentRecordXml(owner, mapping, bytes, controls);
+                return decodeComponentXml(owner, mapping, bytes, { ...controls, selectPayload(root) {
+                        const selected = controls.selectPayload(root);
+                        if (selected.mapping.kind !== 'component-mapping')
+                            throw new TypeError('Normal component decoding requires its exact mapping');
+                        return { payload: selected.payload, mapping: selected.mapping };
+                    } });
+            },
+            create(owner, direction, controls) {
+                return direction.kind === 'output' ? responseProjection : createComponentDirectionalMapping(owner, input, direction, controls);
+            },
+            prepare: (selection, check) => prepareComponentSoapWsdl(contract, selection, check),
+        });
+    }
+    return exchangeSoap(contract, input, application, options, {
+        component: true, encode: encodeComponentXml, decode: decodeComponentXml,
+        create: (owner, direction, controls) => createComponentDirectionalMapping(owner, input, direction, controls),
+        prepare: (selection, check) => prepareComponentSoapWsdl(contract, selection, check),
+    });
+}
+async function exchangeSoap(contract, input, application, options, profile) {
+    const { context } = inspectDirectOperation(contract);
     if (input.direction.kind !== 'input')
         throw new TypeError('SOAP request requires the exact input mapping');
     const { budget } = context;
-    const fail = (kind, rule) => Object.freeze({ kind, rule, usage: Object.freeze({ ...budget.usage() }) });
+    const fail = (kind, rule, phase) => Object.freeze({ kind, rule,
+        ...(profile.component && phase ? { phase } : {}), usage: Object.freeze({ ...budget.usage() }) });
     let signal;
     const check = () => { checkSemanticBudget(budget); if (signal?.aborted)
         throw new Stop('cancelled', 'cooperative-cancellation'); };
@@ -58,7 +107,7 @@ export async function exchangeDirectSoap(contract, inputMapping, application, op
         check();
         // Options are a closed capability surface. Never silently discard security,
         // headers, endpoint agents, redirects, streaming or other caller extensions.
-        const optionRule = directSoapOptionsShape(options, check);
+        const optionRule = directSoapOptionsShape(options, check, profile.component ? ['ca'] : []);
         if (optionRule)
             return fail('unsupported', optionRule);
         signal = options.signal;
@@ -66,8 +115,20 @@ export async function exchangeDirectSoap(contract, inputMapping, application, op
             return fail('unsupported', 'native AbortSignal required');
         const allowEndpoint = options.allowEndpoint;
         check();
-        const config = directDataOwnership(budget).freeze(directDataOwnership(budget).snapshot({ service: options.service, port: options.port, endpoint: options.endpoint,
-            timeoutMs: options.timeoutMs ?? (isApplicationUnmetered(budget) ? 0 : 15_000), limits: options.limits ?? {}, capabilities: options.capabilities ?? [] }));
+        let selectedEndpoint = options.endpoint;
+        if (profile.component && selectedEndpoint === undefined) {
+            const { source } = inspectDirectOperation(contract);
+            const services = source.documents.flatMap(d => syntaxElements(d.root, WSDL_NAMESPACE, 'service').filter(n => syntaxAttribute(d.root, 'targetNamespace') === options.service?.namespace && syntaxAttribute(n, 'name') === options.service?.local));
+            const ports = services.flatMap(n => syntaxElements(n, WSDL_NAMESPACE, 'port').filter(p => syntaxAttribute(p, 'name') === options.port));
+            const addresses = ports.flatMap(p => syntaxElements(p, 'http://schemas.xmlsoap.org/wsdl/soap/', 'address'));
+            if (services.length !== 1 || ports.length !== 1 || addresses.length !== 1 || !syntaxAttribute(addresses[0], 'location')) {
+                return fail('unsupported', 'Select one SOAP service/port address or supply an endpoint override');
+            }
+            selectedEndpoint = syntaxAttribute(addresses[0], 'location');
+        }
+        const config = directDataOwnership(budget).freeze(directDataOwnership(budget).snapshot({ service: options.service, port: options.port, endpoint: selectedEndpoint,
+            timeoutMs: options.timeoutMs ?? (profile.component || isApplicationUnmetered(budget) ? 0 : 15_000), limits: options.limits ?? {},
+            ca: options.ca, capabilities: options.capabilities ?? [] }));
         if (!Array.isArray(config.capabilities) || config.capabilities.length)
             return fail('unsupported', 'SOAP capability');
         if (!Number.isSafeInteger(config.timeoutMs) || config.timeoutMs < 0 || config.timeoutMs > 2_147_483_647)
@@ -81,31 +142,52 @@ export async function exchangeDirectSoap(contract, inputMapping, application, op
         if (typeof config.endpoint !== 'string' || typeof config.port !== 'string' || !isXmlNCName(config.port)
             || !config.service || typeof config.service.namespace !== 'string' || !isXmlNCName(config.service.local))
             return fail('unsupported', 'explicit SOAP selection');
-        const endpoint = new URL(config.endpoint);
-        if (endpoint.protocol !== 'http:' || endpoint.hostname !== '127.0.0.1' || !endpoint.port || endpoint.port === '1'
+        let endpoint;
+        try {
+            endpoint = new URL(config.endpoint);
+        }
+        catch {
+            return fail('unsupported', 'explicit HTTP(S) endpoint required');
+        }
+        if (profile.component) {
+            if (!['http:', 'https:'].includes(endpoint.protocol) || endpoint.username || endpoint.password || endpoint.hash || endpoint.search)
+                return fail('unsupported', 'explicit HTTP(S) endpoint required');
+            if (config.ca !== undefined && (typeof config.ca !== 'string' || endpoint.protocol !== 'https:'))
+                return fail('unsupported', 'HTTPS PEM trust anchor required');
+            const policy = contract.policy;
+            if (!policy)
+                return fail('unsupported', 'component policy authority required');
+            if (policy.kind === 'https-transport') {
+                if (endpoint.protocol !== 'https:')
+                    return fail('unsupported', 'policy requires HTTPS');
+                if (policy.requireClientCertificate || policy.includeTimestamp || !['Strict', 'Lax'].includes(policy.layout))
+                    return fail('unsupported', 'message security or client certificate capability required');
+            }
+        }
+        else if (endpoint.protocol !== 'http:' || endpoint.hostname !== '127.0.0.1' || !endpoint.port || endpoint.port === '1'
             || endpoint.username || endpoint.password || endpoint.hash || endpoint.search)
             return fail('unsupported', 'owned loopback HTTP endpoint required');
-        if (typeof allowEndpoint !== 'function' || allowEndpoint(new URL(endpoint.href)) !== true)
+        if (!(profile.component && allowEndpoint === undefined)
+            && (typeof allowEndpoint !== 'function' || allowEndpoint(new URL(endpoint.href)) !== true))
             return fail('unsupported', 'endpoint authorization');
         const action = contract.binding.action;
         if (/[^\x20-\x21\x23-\x7e]|\\/.test(action))
             return fail('unsupported', 'unsafe SOAPAction');
-        const { wsdlText } = prepareDirectSoapSource(contract, config, check);
         const elements = (node) => {
             check();
             return node.children.filter((child) => child.kind === 'element');
         };
-        const encoded = encodeDirectXml(contract, input, application, { signal, limits });
-        if (encoded.kind !== 'direct-encoded')
-            return fail(encoded.kind, encoded.rule);
-        const output = createDirectValueMapping(contract, { kind: 'output' }, { signal });
-        if (output.kind !== 'direct-mapping')
+        const encoded = profile.encode(contract, input, application, { signal, limits });
+        if (!('bytes' in encoded))
+            return fail(encoded.kind, encoded.rule, 'input');
+        const output = profile.create(contract, { kind: 'output' }, { signal });
+        if (!('direction' in output))
             return fail(output.kind, output.rule);
         const faults = new Map();
         for (const fault of contract.faults) {
             check();
-            const mapping = createDirectValueMapping(contract, { kind: 'fault', name: fault.name }, { signal });
-            if (mapping.kind !== 'direct-mapping')
+            const mapping = profile.create(contract, { kind: 'fault', name: fault.name }, { signal });
+            if (!('direction' in mapping))
                 return fail(mapping.kind, mapping.rule);
             faults.set(fault.name, mapping);
         }
@@ -115,12 +197,23 @@ export async function exchangeDirectSoap(contract, inputMapping, application, op
                 stop('protocol', 'SOAP protocol attributes or text');
             return children;
         };
-        const bodyRoot = (root) => {
+        const ignoredHeaders = [];
+        const bodyRoot = (root, incoming = false) => {
             if (!same(root.name, { namespace: SOAP, local: 'Envelope' }))
                 stop('protocol', 'SOAP 1.1 Envelope required');
             const children = shape(root);
             if (children[0]?.name.namespace === SOAP && children[0].name.local === 'Header') {
-                if (shape(children[0]).length)
+                if (profile.component && incoming) {
+                    const assessed = assessComponentSoapHeader(children[0], check);
+                    if (assessed.kind !== 'ignored-optional-headers')
+                        stop(assessed.kind, assessed.rule);
+                    else
+                        for (const name of assessed.headers) {
+                            check();
+                            ignoredHeaders.push(name);
+                        }
+                }
+                else if (shape(children[0]).length)
                     stop('unsupported', 'incoming SOAP headers');
                 children.shift();
             }
@@ -131,12 +224,11 @@ export async function exchangeDirectSoap(contract, inputMapping, application, op
                 stop('protocol', 'one SOAP Body payload required');
             return body[0];
         };
-        // The native dependency receives only the explicitly byte-bounded source.
-        const wsdl = new WSDL(wsdlText, source.root.uri, { wsdl_options: { overrideImportLocation: () => { throw new Stop('unsupported', 'dependency import forbidden'); } } });
-        await new Promise((resolve, reject) => wsdl.onReady(error => error ? reject(error) : resolve()));
+        const wsdl = await profile.prepare(config, check);
         check();
         // HTTP and codec byte limits bound buffering and output copies directly.
-        agent = new Agent({ keepAlive: false, maxSockets: 1 });
+        agent = endpoint.protocol === 'https:' ? new HttpsAgent({ keepAlive: false, maxSockets: 1, rejectUnauthorized: true,
+            ...(config.ca === undefined ? {} : { ca: config.ca }) }) : new Agent({ keepAlive: false, maxSockets: 1 });
         controller = new AbortController();
         signal?.addEventListener('abort', abort, { once: true });
         let timedOut = false;
@@ -153,9 +245,9 @@ export async function exchangeDirectSoap(contract, inputMapping, application, op
                         stop('protocol', 'dependency dispatch mismatch');
                     if (Buffer.byteLength(data) > limits.maxBytes)
                         stop('resource-limit', 'SOAP request byte limit');
-                    const outgoing = decodeDirectXml(contract, input, Buffer.from(data), { signal, limits,
+                    const outgoing = profile.decode(contract, input, Buffer.from(data), { signal, limits,
                         uri: 'urn:typescript-wsdl-client:outgoing-soap', selectPayload: root => ({ payload: bodyRoot(root), mapping: input }) });
-                    if (outgoing.kind !== 'direct-decoded')
+                    if (!('validated' in outgoing))
                         stop(outgoing.kind, outgoing.rule);
                     check();
                 }
@@ -185,7 +277,7 @@ export async function exchangeDirectSoap(contract, inputMapping, application, op
                     // xmlToObject, including its special err.response parsing path.
                     callback(complete);
                 }, headers, { responseType: 'arraybuffer', decompress: false, maxRedirects: 0, maxContentLength: limits.maxBytes,
-                    maxBodyLength: limits.maxBytes, proxy: false, httpAgent: agent, signal: controller.signal, timeout: config.timeoutMs });
+                    maxBodyLength: limits.maxBytes, proxy: false, httpAgent: agent, httpsAgent: agent, signal: controller.signal, timeout: config.timeoutMs });
             }
         }
         const client = new Client(wsdl, endpoint.href, { httpClient: new BufferedHttp() });
@@ -221,9 +313,9 @@ export async function exchangeDirectSoap(contract, inputMapping, application, op
         if (charset && charset !== bom && !(charset === 'utf-16' && bom.startsWith('utf-16')))
             return fail('protocol', 'SOAP charset disagrees with bytes');
         let faultInfo;
-        const decoded = decodeDirectXml(contract, output, observed.bytes, { signal, limits, uri: endpoint.href,
+        const decoded = profile.decode(contract, output, observed.bytes, { signal, limits, uri: endpoint.href,
             selectPayload: root => {
-                const payload = bodyRoot(root);
+                const payload = bodyRoot(root, true);
                 if (!same(payload.name, { namespace: SOAP, local: 'Fault' })) {
                     if (observed.status !== 200)
                         stop('protocol', 'HTTP 500 requires SOAP Fault');
@@ -261,12 +353,13 @@ export async function exchangeDirectSoap(contract, inputMapping, application, op
                 directDataOwnership(budget).freeze(faultInfo);
                 return { payload: detail[0], mapping: faults.get(faultInfo.name) };
             } });
-        if (decoded.kind !== 'direct-decoded')
-            return fail(decoded.kind, decoded.rule);
+        if (!('validated' in decoded))
+            return fail(decoded.kind, decoded.rule, 'response');
         check();
         check();
         return Object.freeze({ kind: faultInfo ? 'soap-fault' : 'soap-response', admitted: false, decoded,
-            responseBytes: new Uint8Array(observed.bytes), status: observed.status, ...(faultInfo ? { fault: faultInfo } : {}), usage: Object.freeze({ ...budget.usage() }) });
+            responseBytes: new Uint8Array(observed.bytes), status: observed.status, ...(faultInfo ? { fault: faultInfo } : {}),
+            ...(ignoredHeaders.length ? { ignoredHeaders: Object.freeze(ignoredHeaders) } : {}), usage: Object.freeze({ ...budget.usage() }) });
     }
     catch (error) {
         if (budget.exhausted())

package/dist/compiler/directSoapSource.d.ts

@@ -1,5 +1,6 @@
 import type { DirectOperationContract } from './directOperation.js';
 import type { ExpandedName } from '../loader/orderedSyntax.js';
+import { WSDL } from 'soap/lib/wsdl/index.js';
 export declare const DIRECT_SOAP_SOURCE_MAX_BYTES: number;
 export declare class DirectSoapSourceError extends Error {
     readonly kind: 'unsupported' | 'resource-limit';
@@ -12,4 +13,26 @@ export declare function prepareDirectSoapSource(contract: DirectOperationContrac
     original: Uint8Array<ArrayBufferLike>;
     wsdlText: string;
 };
-//# sourceMappingURL=directSoapSource.d.ts.map
+/** Check each native operation before sharing its source metadata.
+ * @param contract Authentic component operation.
+ * @param config Exact service and port.
+ * @param check Invocation cancellation/resource checks.
+ * @returns No metadata or portable authority.
+ * @throws For foreign handles, unsupported source profile, action or selection.
+ */
+export declare function validateComponentSoapSelection(contract: DirectOperationContract, config: {
+    service: ExpandedName;
+    port: string;
+}, check: () => void): void;
+/** Build the existing SOAP dependency from the exact authorized snapshot, with no file/network import fallback.
+ * @remarks Acyclic metadata resources are decoded independently under the native metadata policy. Original bytes and native semantics
+ *   are unchanged. The dependency receives private aliases and a fresh prefilled cache; its import hook accepts only
+ *   unambiguous native source edges to already prepared resources. This grants no endpoint or policy enforcement.
+ * @returns A prepared node-soap WSDL for the exact original service/port/binding.
+ * @throws DirectSoapSourceError For incompatible source/profile, unsafe dependency names, cycles or ambiguous imports.
+ *   Caller cancellation/resource exceptions propagate unchanged.
+ */
+export declare function prepareComponentSoapWsdl(contract: DirectOperationContract, config: {
+    service: ExpandedName;
+    port: string;
+}, check: () => void): Promise<WSDL>;