@techspokes/typescript-wsdl-client 1.1.5 → 1.2.0

package/dist/compiler/directSoap.js

@@ -1,18 +1,21 @@
 import { isApplicationUnmetered } from './semanticBudget.js';
 import { directDataOwnership, directLimit } from './directExecutionPolicy.js';
-/** Internal, one-retained-operation, unauthenticated loopback SOAP 1.1 adapter. */
+/** Shared retained-operation SOAP 1.1 exchange; profile-specific authority stays explicit. */
 import { checkSemanticBudget } from './semanticBudget.js';
 import { DataOwnershipLimitError } from './dataOwnership.js';
 import { Agent } from 'node:http';
+import { Agent as HttpsAgent } from 'node:https';
 import { types } from 'node:util';
 import { WSDL } from 'soap/lib/wsdl/index.js';
 import { Client } from 'soap/lib/client.js';
 import { HttpClient } from 'soap/lib/http.js';
 import { inspectDirectOperation } from './directOperation.js';
-import { createDirectValueMapping, inspectDirectValueMapping } from './directValues.js';
-import { decodeDirectXml, encodeDirectXml, DIRECT_XML_LIMITS } from './directCodec.js';
-import { prepareDirectSoapSource, DirectSoapSourceError } from './directSoapSource.js';
-import { isXmlNCName, resolveLexicalQName, SchemaLoadingError } from '../loader/orderedSyntax.js';
+import { createDirectValueMapping, inspectDirectValueMapping, createComponentDirectionalMapping, inspectComponentValueMapping } from './directValues.js';
+import { decodeDirectXml, encodeDirectXml, decodeComponentXml, encodeComponentXml, DIRECT_XML_LIMITS } from './directCodec.js';
+import { prepareDirectSoapSource, prepareComponentSoapWsdl, DirectSoapSourceError } from './directSoapSource.js';
+import { isXmlNCName, resolveLexicalQName, SchemaLoadingError, syntaxElements, syntaxAttribute, WSDL_NAMESPACE } from '../loader/orderedSyntax.js';
+import { decodeComponentRecordXml, inspectComponentRecordProjection } from './componentRecordProjection.js';
+import { assessComponentSoapHeader } from './soapHeaders.js';
 const SOAP = 'http://schemas.xmlsoap.org/soap/envelope/';
 class Stop extends Error {
     kind;
@@ -25,11 +28,11 @@ class Stop extends Error {
 }
 const same = (a, b) => a.namespace === b.namespace && a.local === b.local;
 /** Shared entry guard: consumers must call before reading any SOAP option. */
-export function directSoapOptionsShape(options, check) {
+export function directSoapOptionsShape(options, check, additional = []) {
     if (!options || typeof options !== 'object' || types.isProxy(options)
         || ![null, Object.prototype].includes(Object.getPrototypeOf(options)))
         return 'data-only SOAP options required';
-    const allowed = new Set(['service', 'port', 'endpoint', 'allowEndpoint', 'signal', 'timeoutMs', 'limits', 'capabilities']);
+    const allowed = new Set(['service', 'port', 'endpoint', 'allowEndpoint', 'signal', 'timeoutMs', 'limits', 'capabilities', ...additional]);
     for (const key of Reflect.ownKeys(options)) {
         check();
         const descriptor = Object.getOwnPropertyDescriptor(options, key);
@@ -40,12 +43,58 @@ export function directSoapOptionsShape(options, check) {
 }
 /** Authentication and fresh-value validation precede dependency bootstrap and all HTTP I/O. */
 export async function exchangeDirectSoap(contract, inputMapping, application, options) {
-    const { context, source } = inspectDirectOperation(contract);
     const input = inspectDirectValueMapping(inputMapping, contract);
+    return exchangeSoap(contract, input, application, options, {
+        component: false, encode: encodeDirectXml, decode: decodeDirectXml, create: createDirectValueMapping,
+        prepare: async (selection, check) => {
+            const { source } = inspectDirectOperation(contract);
+            const { wsdlText } = prepareDirectSoapSource(contract, selection, check);
+            const wsdl = new WSDL(wsdlText, source.root.uri, { wsdl_options: { overrideImportLocation: () => { throw new Stop('unsupported', 'dependency import forbidden'); } } });
+            await new Promise((resolve, reject) => wsdl.onReady(error => error ? reject(error) : resolve()));
+            return wsdl;
+        },
+    });
+}
+export async function exchangeComponentSoap(contract, inputMapping, application, options, responseProjection) {
+    const { mapping: input } = inspectComponentValueMapping(inputMapping, contract);
+    if (responseProjection !== undefined) {
+        inspectComponentRecordProjection(responseProjection, contract);
+        return exchangeSoap(contract, input, application, options, {
+            component: true,
+            encode(owner, mapping, value, controls) {
+                if (mapping.kind !== 'component-mapping')
+                    throw new TypeError('SOAP input requires the native input mapping');
+                return encodeComponentXml(owner, mapping, value, controls);
+            },
+            decode(owner, mapping, bytes, controls) {
+                if (mapping.kind === 'component-record-projection')
+                    return decodeComponentRecordXml(owner, mapping, bytes, controls);
+                return decodeComponentXml(owner, mapping, bytes, { ...controls, selectPayload(root) {
+                        const selected = controls.selectPayload(root);
+                        if (selected.mapping.kind !== 'component-mapping')
+                            throw new TypeError('Normal component decoding requires its exact mapping');
+                        return { payload: selected.payload, mapping: selected.mapping };
+                    } });
+            },
+            create(owner, direction, controls) {
+                return direction.kind === 'output' ? responseProjection : createComponentDirectionalMapping(owner, input, direction, controls);
+            },
+            prepare: (selection, check) => prepareComponentSoapWsdl(contract, selection, check),
+        });
+    }
+    return exchangeSoap(contract, input, application, options, {
+        component: true, encode: encodeComponentXml, decode: decodeComponentXml,
+        create: (owner, direction, controls) => createComponentDirectionalMapping(owner, input, direction, controls),
+        prepare: (selection, check) => prepareComponentSoapWsdl(contract, selection, check),
+    });
+}
+async function exchangeSoap(contract, input, application, options, profile) {
+    const { context } = inspectDirectOperation(contract);
     if (input.direction.kind !== 'input')
         throw new TypeError('SOAP request requires the exact input mapping');
     const { budget } = context;
-    const fail = (kind, rule) => Object.freeze({ kind, rule, usage: Object.freeze({ ...budget.usage() }) });
+    const fail = (kind, rule, phase) => Object.freeze({ kind, rule,
+        ...(profile.component && phase ? { phase } : {}), usage: Object.freeze({ ...budget.usage() }) });
     let signal;
     const check = () => { checkSemanticBudget(budget); if (signal?.aborted)
         throw new Stop('cancelled', 'cooperative-cancellation'); };
@@ -58,7 +107,7 @@ export async function exchangeDirectSoap(contract, inputMapping, application, op
         check();
         // Options are a closed capability surface. Never silently discard security,
         // headers, endpoint agents, redirects, streaming or other caller extensions.
-        const optionRule = directSoapOptionsShape(options, check);
+        const optionRule = directSoapOptionsShape(options, check, profile.component ? ['ca'] : []);
         if (optionRule)
             return fail('unsupported', optionRule);
         signal = options.signal;
@@ -66,8 +115,20 @@ export async function exchangeDirectSoap(contract, inputMapping, application, op
             return fail('unsupported', 'native AbortSignal required');
         const allowEndpoint = options.allowEndpoint;
         check();
-        const config = directDataOwnership(budget).freeze(directDataOwnership(budget).snapshot({ service: options.service, port: options.port, endpoint: options.endpoint,
-            timeoutMs: options.timeoutMs ?? (isApplicationUnmetered(budget) ? 0 : 15_000), limits: options.limits ?? {}, capabilities: options.capabilities ?? [] }));
+        let selectedEndpoint = options.endpoint;
+        if (profile.component && selectedEndpoint === undefined) {
+            const { source } = inspectDirectOperation(contract);
+            const services = source.documents.flatMap(d => syntaxElements(d.root, WSDL_NAMESPACE, 'service').filter(n => syntaxAttribute(d.root, 'targetNamespace') === options.service?.namespace && syntaxAttribute(n, 'name') === options.service?.local));
+            const ports = services.flatMap(n => syntaxElements(n, WSDL_NAMESPACE, 'port').filter(p => syntaxAttribute(p, 'name') === options.port));
+            const addresses = ports.flatMap(p => syntaxElements(p, 'http://schemas.xmlsoap.org/wsdl/soap/', 'address'));
+            if (services.length !== 1 || ports.length !== 1 || addresses.length !== 1 || !syntaxAttribute(addresses[0], 'location')) {
+                return fail('unsupported', 'Select one SOAP service/port address or supply an endpoint override');
+            }
+            selectedEndpoint = syntaxAttribute(addresses[0], 'location');
+        }
+        const config = directDataOwnership(budget).freeze(directDataOwnership(budget).snapshot({ service: options.service, port: options.port, endpoint: selectedEndpoint,
+            timeoutMs: options.timeoutMs ?? (profile.component || isApplicationUnmetered(budget) ? 0 : 15_000), limits: options.limits ?? {},
+            ca: options.ca, capabilities: options.capabilities ?? [] }));
         if (!Array.isArray(config.capabilities) || config.capabilities.length)
             return fail('unsupported', 'SOAP capability');
         if (!Number.isSafeInteger(config.timeoutMs) || config.timeoutMs < 0 || config.timeoutMs > 2_147_483_647)
@@ -81,62 +142,107 @@ export async function exchangeDirectSoap(contract, inputMapping, application, op
         if (typeof config.endpoint !== 'string' || typeof config.port !== 'string' || !isXmlNCName(config.port)
             || !config.service || typeof config.service.namespace !== 'string' || !isXmlNCName(config.service.local))
             return fail('unsupported', 'explicit SOAP selection');
-        const endpoint = new URL(config.endpoint);
-        if (endpoint.protocol !== 'http:' || endpoint.hostname !== '127.0.0.1' || !endpoint.port || endpoint.port === '1'
+        let endpoint;
+        try {
+            endpoint = new URL(config.endpoint);
+        }
+        catch {
+            return fail('unsupported', 'explicit HTTP(S) endpoint required');
+        }
+        if (profile.component) {
+            if (!['http:', 'https:'].includes(endpoint.protocol) || endpoint.username || endpoint.password || endpoint.hash || endpoint.search)
+                return fail('unsupported', 'explicit HTTP(S) endpoint required');
+            if (config.ca !== undefined && (typeof config.ca !== 'string' || endpoint.protocol !== 'https:'))
+                return fail('unsupported', 'HTTPS PEM trust anchor required');
+            const policy = contract.policy;
+            if (!policy)
+                return fail('unsupported', 'component policy authority required');
+            if (policy.kind === 'https-transport') {
+                if (endpoint.protocol !== 'https:')
+                    return fail('unsupported', 'policy requires HTTPS');
+                if (policy.requireClientCertificate || policy.includeTimestamp || !['Strict', 'Lax'].includes(policy.layout))
+                    return fail('unsupported', 'message security or client certificate capability required');
+            }
+        }
+        else if (endpoint.protocol !== 'http:' || endpoint.hostname !== '127.0.0.1' || !endpoint.port || endpoint.port === '1'
             || endpoint.username || endpoint.password || endpoint.hash || endpoint.search)
             return fail('unsupported', 'owned loopback HTTP endpoint required');
-        if (typeof allowEndpoint !== 'function' || allowEndpoint(new URL(endpoint.href)) !== true)
+        if (!(profile.component && allowEndpoint === undefined)
+            && (typeof allowEndpoint !== 'function' || allowEndpoint(new URL(endpoint.href)) !== true))
             return fail('unsupported', 'endpoint authorization');
         const action = contract.binding.action;
+        const rpc = contract.binding.style === 'rpc';
         if (/[^\x20-\x21\x23-\x7e]|\\/.test(action))
             return fail('unsupported', 'unsafe SOAPAction');
-        const { wsdlText } = prepareDirectSoapSource(contract, config, check);
         const elements = (node) => {
             check();
             return node.children.filter((child) => child.kind === 'element');
         };
-        const encoded = encodeDirectXml(contract, input, application, { signal, limits });
-        if (encoded.kind !== 'direct-encoded')
-            return fail(encoded.kind, encoded.rule);
-        const output = createDirectValueMapping(contract, { kind: 'output' }, { signal });
-        if (output.kind !== 'direct-mapping')
+        const encoded = profile.encode(contract, input, application, { signal, limits });
+        if (!('bytes' in encoded))
+            return fail(encoded.kind, encoded.rule, 'input');
+        const output = profile.create(contract, { kind: 'output' }, { signal });
+        if (!('direction' in output))
             return fail(output.kind, output.rule);
         const faults = new Map();
         for (const fault of contract.faults) {
             check();
-            const mapping = createDirectValueMapping(contract, { kind: 'fault', name: fault.name }, { signal });
-            if (mapping.kind !== 'direct-mapping')
+            const mapping = profile.create(contract, { kind: 'fault', name: fault.name }, { signal });
+            if (!('direction' in mapping))
                 return fail(mapping.kind, mapping.rule);
             faults.set(fault.name, mapping);
         }
-        const shape = (node) => {
+        const shape = (node, encodedScope = false) => {
             const children = elements(node);
-            if (node.attributes.length || node.children.some(n => n.kind === 'text' && /[^\t\r\n ]/.test(n.value)))
+            if (node.attributes.some(a => !(encodedScope && a.name.namespace === SOAP && a.name.local === 'encodingStyle'
+                && a.value === 'http://schemas.xmlsoap.org/soap/encoding/')) || node.children.some(n => n.kind === 'text' && /[^\t\r\n ]/.test(n.value)))
                 stop('protocol', 'SOAP protocol attributes or text');
             return children;
         };
-        const bodyRoot = (root) => {
+        const ignoredHeaders = [];
+        const bodyRoot = (root, incoming = false) => {
             if (!same(root.name, { namespace: SOAP, local: 'Envelope' }))
                 stop('protocol', 'SOAP 1.1 Envelope required');
-            const children = shape(root);
+            const children = shape(root, rpc);
             if (children[0]?.name.namespace === SOAP && children[0].name.local === 'Header') {
-                if (shape(children[0]).length)
+                if (profile.component && incoming) {
+                    const assessed = assessComponentSoapHeader(children[0], check);
+                    if (assessed.kind !== 'ignored-optional-headers')
+                        stop(assessed.kind, assessed.rule);
+                    else
+                        for (const name of assessed.headers) {
+                            check();
+                            ignoredHeaders.push(name);
+                        }
+                }
+                else if (shape(children[0]).length)
                     stop('unsupported', 'incoming SOAP headers');
                 children.shift();
             }
             if (children.length !== 1 || !same(children[0].name, { namespace: SOAP, local: 'Body' }))
                 stop('protocol', 'one SOAP Body required');
-            const body = shape(children[0]);
+            const body = shape(children[0], rpc);
+            if (rpc && !body.some(n => same(n.name, { namespace: SOAP, local: 'Fault' })))
+                return children[0];
             if (body.length !== 1)
                 stop('protocol', 'one SOAP Body payload required');
             return body[0];
         };
-        // The native dependency receives only the explicitly byte-bounded source.
-        const wsdl = new WSDL(wsdlText, source.root.uri, { wsdl_options: { overrideImportLocation: () => { throw new Stop('unsupported', 'dependency import forbidden'); } } });
-        await new Promise((resolve, reject) => wsdl.onReady(error => error ? reject(error) : resolve()));
+        const wsdl = await profile.prepare(config, check);
         check();
+        // @why node-soap's RPC writer would wrap `_xml` as a parameter. This private
+        //   instance retains its selected method/transport while native bytes own RPC construction.
+        const rpcArguments = Object.freeze({});
+        if (rpc)
+            wsdl.objectToRpcXML = (name, args) => {
+                check();
+                if (name !== contract.selector.operation || args !== rpcArguments)
+                    stop('protocol', 'dependency RPC selection mismatch');
+                return Buffer.from(encoded.bytes).toString('utf8');
+            };
         // HTTP and codec byte limits bound buffering and output copies directly.
-        agent = new Agent({ keepAlive: false, maxSockets: 1 });
+        agent = endpoint.protocol === 'https:' ? new HttpsAgent({ keepAlive: false, maxSockets: 1, rejectUnauthorized: true,
+            ...(config.ca === undefined ? {} : { ca: config.ca }) }) : new Agent({ keepAlive: false, maxSockets: 1 });
         controller = new AbortController();
         signal?.addEventListener('abort', abort, { once: true });
         let timedOut = false;
@@ -153,9 +259,9 @@ export async function exchangeDirectSoap(contract, inputMapping, application, op
                         stop('protocol', 'dependency dispatch mismatch');
                     if (Buffer.byteLength(data) > limits.maxBytes)
                         stop('resource-limit', 'SOAP request byte limit');
-                    const outgoing = decodeDirectXml(contract, input, Buffer.from(data), { signal, limits,
+                    const outgoing = profile.decode(contract, input, Buffer.from(data), { signal, limits,
                         uri: 'urn:typescript-wsdl-client:outgoing-soap', selectPayload: root => ({ payload: bodyRoot(root), mapping: input }) });
-                    if (outgoing.kind !== 'direct-decoded')
+                    if (!('validated' in outgoing))
                         stop(outgoing.kind, outgoing.rule);
                     check();
                 }
@@ -185,7 +291,7 @@ export async function exchangeDirectSoap(contract, inputMapping, application, op
                     // xmlToObject, including its special err.response parsing path.
                     callback(complete);
                 }, headers, { responseType: 'arraybuffer', decompress: false, maxRedirects: 0, maxContentLength: limits.maxBytes,
-                    maxBodyLength: limits.maxBytes, proxy: false, httpAgent: agent, signal: controller.signal, timeout: config.timeoutMs });
+                    maxBodyLength: limits.maxBytes, proxy: false, httpAgent: agent, httpsAgent: agent, signal: controller.signal, timeout: config.timeoutMs });
             }
         }
         const client = new Client(wsdl, endpoint.href, { httpClient: new BufferedHttp() });
@@ -198,7 +304,7 @@ export async function exchangeDirectSoap(contract, inputMapping, application, op
         if (typeof method !== 'function')
             return fail('unsupported', 'dependency selected method unavailable');
         check();
-        await new Promise((resolve, reject) => method({ _xml: Buffer.from(encoded.bytes).toString('utf8') }, (error) => error === complete ? resolve() : reject(error), {}, { SOAPAction: `"${action}"` }));
+        await new Promise((resolve, reject) => method(rpc ? rpcArguments : { _xml: Buffer.from(encoded.bytes).toString('utf8') }, (error) => error === complete ? resolve() : reject(error), {}, { SOAPAction: `"${action}"` }));
         check();
         if (timedOut)
             return fail('transport', 'SOAP deadline exceeded');
@@ -209,21 +315,24 @@ export async function exchangeDirectSoap(contract, inputMapping, application, op
         const observed = response;
         if (observed.encoding && observed.encoding.toLowerCase() !== 'identity')
             return fail('unsupported', 'HTTP compression');
-        const media = /^text\/xml(?:\s*;\s*charset\s*=\s*(?:"(utf-8|utf-16|utf-16le|utf-16be)"|(utf-8|utf-16|utf-16le|utf-16be)))?\s*$/i.exec(observed.contentType);
+        const media = /^text\/xml(?:\s*;\s*charset\s*=\s*(?:"(utf-8|utf-16|utf-16le|utf-16be|iso-8859-1)"|(utf-8|utf-16|utf-16le|utf-16be|iso-8859-1)))?\s*$/i.exec(observed.contentType);
         if (!media)
             return fail('protocol', 'SOAP response Content-Type');
         if (observed.status !== 200 && observed.status !== 500)
             return fail('transport', 'SOAP HTTP status');
         // Header charset is a protocol assertion, checked against actual BOM bytes.
         const charset = (media[1] ?? media[2])?.toLowerCase();
+        if (!profile.component && charset === 'iso-8859-1')
+            return fail('protocol', 'SOAP response Content-Type');
         const bom = observed.bytes[0] === 0xff && observed.bytes[1] === 0xfe ? 'utf-16le'
             : observed.bytes[0] === 0xfe && observed.bytes[1] === 0xff ? 'utf-16be' : 'utf-8';
-        if (charset && charset !== bom && !(charset === 'utf-16' && bom.startsWith('utf-16')))
+        if (!profile.component && charset && charset !== bom && !(charset === 'utf-16' && bom.startsWith('utf-16')))
             return fail('protocol', 'SOAP charset disagrees with bytes');
         let faultInfo;
-        const decoded = decodeDirectXml(contract, output, observed.bytes, { signal, limits, uri: endpoint.href,
+        const decoded = profile.decode(contract, output, observed.bytes, { signal, limits, uri: endpoint.href,
+            ...(profile.component ? { componentResponseEncoding: { charset } } : {}),
             selectPayload: root => {
-                const payload = bodyRoot(root);
+                const payload = bodyRoot(root, true);
                 if (!same(payload.name, { namespace: SOAP, local: 'Fault' })) {
                     if (observed.status !== 200)
                         stop('protocol', 'HTTP 500 requires SOAP Fault');
@@ -261,12 +370,13 @@ export async function exchangeDirectSoap(contract, inputMapping, application, op
                 directDataOwnership(budget).freeze(faultInfo);
                 return { payload: detail[0], mapping: faults.get(faultInfo.name) };
             } });
-        if (decoded.kind !== 'direct-decoded')
-            return fail(decoded.kind, decoded.rule);
+        if (!('validated' in decoded))
+            return fail(decoded.kind, decoded.rule, 'response');
         check();
         check();
         return Object.freeze({ kind: faultInfo ? 'soap-fault' : 'soap-response', admitted: false, decoded,
-            responseBytes: new Uint8Array(observed.bytes), status: observed.status, ...(faultInfo ? { fault: faultInfo } : {}), usage: Object.freeze({ ...budget.usage() }) });
+            responseBytes: new Uint8Array(observed.bytes), status: observed.status, ...(faultInfo ? { fault: faultInfo } : {}),
+            ...(ignoredHeaders.length ? { ignoredHeaders: Object.freeze(ignoredHeaders) } : {}), usage: Object.freeze({ ...budget.usage() }) });
     }
     catch (error) {
         if (budget.exhausted())

package/dist/compiler/directSoapSource.d.ts

@@ -1,5 +1,6 @@
 import type { DirectOperationContract } from './directOperation.js';
 import type { ExpandedName } from '../loader/orderedSyntax.js';
+import { WSDL } from 'soap/lib/wsdl/index.js';
 export declare const DIRECT_SOAP_SOURCE_MAX_BYTES: number;
 export declare class DirectSoapSourceError extends Error {
     readonly kind: 'unsupported' | 'resource-limit';
@@ -12,4 +13,26 @@ export declare function prepareDirectSoapSource(contract: DirectOperationContrac
     original: Uint8Array<ArrayBufferLike>;
     wsdlText: string;
 };
-//# sourceMappingURL=directSoapSource.d.ts.map
+/** Check each native operation before sharing its source metadata.
+ * @param contract Authentic component operation.
+ * @param config Exact service and port.
+ * @param check Invocation cancellation/resource checks.
+ * @returns No metadata or portable authority.
+ * @throws For foreign handles, unsupported source profile, action or selection.
+ */
+export declare function validateComponentSoapSelection(contract: DirectOperationContract, config: {
+    service: ExpandedName;
+    port: string;
+}, check: () => void): void;
+/** Build the existing SOAP dependency from the exact authorized snapshot, with no file/network import fallback.
+ * @remarks Acyclic metadata resources are decoded independently under the native metadata policy. Original bytes and native semantics
+ *   are unchanged. The dependency receives private aliases and a fresh prefilled cache; its import hook accepts only
+ *   unambiguous native source edges to already prepared resources. This grants no endpoint or policy enforcement.
+ * @returns A prepared node-soap WSDL for the exact original service/port/binding.
+ * @throws DirectSoapSourceError For incompatible source/profile, unsafe dependency names, cycles or ambiguous imports.
+ *   Caller cancellation/resource exceptions propagate unchanged.
+ */
+export declare function prepareComponentSoapWsdl(contract: DirectOperationContract, config: {
+    service: ExpandedName;
+    port: string;
+}, check: () => void): Promise<WSDL>;

package/dist/compiler/directSoapSource.js

@@ -2,7 +2,9 @@ import { directLimit } from './directExecutionPolicy.js';
 /** Shared authenticated single-resource SOAP bootstrap policy; no transport. */
 import { inspectDirectOperation } from './directOperation.js';
 import { copyOriginalSchemaResource } from '../loader/schemaInput.js';
-import { resolveLexicalQName, syntaxAttribute, WSDL_NAMESPACE, XSD_NAMESPACE } from '../loader/orderedSyntax.js';
+import { decodeMetadataXml, resolveLexicalQName, syntaxAttribute, WSDL_NAMESPACE, XSD_NAMESPACE } from '../loader/orderedSyntax.js';
+import { WSDL } from 'soap/lib/wsdl/index.js';
+import { normalizeWhitespace } from './datatypeValues.js';
 const WSDL_SOAP = 'http://schemas.xmlsoap.org/wsdl/soap/';
 const same = (a, b) => a.namespace === b.namespace && a.local === b.local;
 export const DIRECT_SOAP_SOURCE_MAX_BYTES = 64 * 1024;
@@ -13,6 +15,26 @@ export class DirectSoapSourceError extends Error {
         this.kind = kind;
     }
 }
+function validateSoapSelection(source, contract, config, check) {
+    const elements = (node) => { check(); return node.children.filter((child) => child.kind === 'element'); };
+    const definitions = source.root.root;
+    if (definitions.name.namespace !== WSDL_NAMESPACE || definitions.name.local !== 'definitions')
+        throw new DirectSoapSourceError('WSDL definitions required');
+    const services = elements(definitions).filter(n => n.name.namespace === WSDL_NAMESPACE && n.name.local === 'service'
+        && same({ namespace: syntaxAttribute(definitions, 'targetNamespace') ?? '', local: syntaxAttribute(n, 'name') ?? '' }, config.service));
+    if (services.length !== 1)
+        throw new DirectSoapSourceError('SOAP service mismatch');
+    const ports = elements(services[0]).filter(n => n.name.namespace === WSDL_NAMESPACE && n.name.local === 'port' && syntaxAttribute(n, 'name') === config.port);
+    if (ports.length !== 1)
+        throw new DirectSoapSourceError('SOAP port mismatch');
+    const binding = syntaxAttribute(ports[0], 'binding');
+    if (!binding || !same(resolveLexicalQName(binding, ports[0]), contract.selector.binding))
+        throw new DirectSoapSourceError('SOAP binding mismatch');
+    const addresses = elements(ports[0]).filter(n => n.name.namespace === WSDL_SOAP && n.name.local === 'address');
+    if (addresses.length !== 1 || elements(ports[0]).some(n => !(n.name.namespace === WSDL_SOAP && n.name.local === 'address')
+        && !(n.name.namespace === WSDL_NAMESPACE && n.name.local === 'documentation')))
+        throw new DirectSoapSourceError('SOAP port extension');
+}
 export function prepareDirectSoapSource(contract, config, check) {
     const { source, context: { budget } } = inspectDirectOperation(contract);
     if (source.resources.some(r => r.byteLength > directLimit(budget, DIRECT_SOAP_SOURCE_MAX_BYTES))) {
@@ -53,24 +75,8 @@ export function prepareDirectSoapSource(contract, config, check) {
             inspectSource(child);
     };
     inspectSource(source.root.root);
-    const definitions = source.root.root;
-    if (definitions.name.namespace !== WSDL_NAMESPACE || definitions.name.local !== 'definitions')
-        throw new DirectSoapSourceError('WSDL definitions required');
-    const services = elements(definitions).filter(n => n.name.namespace === WSDL_NAMESPACE && n.name.local === 'service'
-        && same({ namespace: syntaxAttribute(definitions, 'targetNamespace') ?? '', local: syntaxAttribute(n, 'name') ?? '' }, config.service));
-    if (services.length !== 1)
-        throw new DirectSoapSourceError('SOAP service mismatch');
-    const ports = elements(services[0]).filter(n => n.name.namespace === WSDL_NAMESPACE && n.name.local === 'port' && syntaxAttribute(n, 'name') === config.port);
-    if (ports.length !== 1)
-        throw new DirectSoapSourceError('SOAP port mismatch');
-    const binding = syntaxAttribute(ports[0], 'binding');
-    if (!binding || !same(resolveLexicalQName(binding, ports[0]), contract.selector.binding))
-        throw new DirectSoapSourceError('SOAP binding mismatch');
-    const addresses = elements(ports[0]).filter(n => n.name.namespace === WSDL_SOAP && n.name.local === 'address');
-    if (addresses.length !== 1 || elements(ports[0]).some(n => !(n.name.namespace === WSDL_SOAP && n.name.local === 'address')
-        && !(n.name.namespace === WSDL_NAMESPACE && n.name.local === 'documentation')))
-        throw new DirectSoapSourceError('SOAP port extension');
-    const original = copyOriginalSchemaResource(source, source.root.uri, amount => { check(); });
+    validateSoapSelection(source, contract, config, check);
+    const original = copyOriginalSchemaResource(source, source.root.uri, () => { check(); });
     // This packet admits UTF-8 source bootstrap only; response encoding remains
     // owned by the existing strict XML byte decoder.
     let wsdlText;
@@ -84,3 +90,144 @@ export function prepareDirectSoapSource(contract, config, check) {
         throw new DirectSoapSourceError('UTF-8 WSDL bootstrap required');
     return { original, wsdlText };
 }
+/** Check each native operation before sharing its source metadata.
+ * @param contract Authentic component operation.
+ * @param config Exact service and port.
+ * @param check Invocation cancellation/resource checks.
+ * @returns No metadata or portable authority.
+ * @throws For foreign handles, unsupported source profile, action or selection.
+ */
+export function validateComponentSoapSelection(contract, config, check) {
+    const { source } = inspectDirectOperation(contract);
+    check();
+    if (contract.basis !== 'native-component-premises-v1' || contract.correspondence !== 'dated-XSD-2004-components-v1')
+        throw new DirectSoapSourceError('Component source profile required');
+    if (/[^\x20-\x21\x23-\x7e]|\\/.test(contract.binding.action))
+        throw new DirectSoapSourceError('unsafe SOAPAction');
+    validateSoapSelection(source, contract, config, check);
+}
+/** Build the existing SOAP dependency from the exact authorized snapshot, with no file/network import fallback.
+ * @remarks Acyclic metadata resources are decoded independently under the native metadata policy. Original bytes and native semantics
+ *   are unchanged. The dependency receives private aliases and a fresh prefilled cache; its import hook accepts only
+ *   unambiguous native source edges to already prepared resources. This grants no endpoint or policy enforcement.
+ * @returns A prepared node-soap WSDL for the exact original service/port/binding.
+ * @throws DirectSoapSourceError For incompatible source/profile, unsafe dependency names, cycles or ambiguous imports.
+ *   Caller cancellation/resource exceptions propagate unchanged.
+ */
+export async function prepareComponentSoapWsdl(contract, config, check) {
+    const { source, context: { budget } } = inspectDirectOperation(contract);
+    validateComponentSoapSelection(contract, config, check);
+    const refuse = (rule) => { throw new DirectSoapSourceError(rule); };
+    const nodes = new Map(), dependencySyntax = new Set();
+    const key = (uri, path) => JSON.stringify([uri, path]);
+    for (const edge of source.edges) {
+        check();
+        dependencySyntax.add(key(edge.source.uri, edge.source.path));
+    }
+    for (const document of source.documents) {
+        const pending = [document.root];
+        while (pending.length) {
+            check();
+            const node = pending.pop();
+            budget.chargeWork(32 + node.children.length * 8 + node.attributes.length * 16);
+            const identity = key(node.source.uri, node.source.path);
+            nodes.set(identity, node);
+            if (['import', 'include', 'redefine'].includes(node.name.local) && !dependencySyntax.has(identity))
+                refuse('unowned dependency syntax');
+            for (const attribute of node.attributes) {
+                check();
+                if (attribute.name.local === 'name' && (attribute.value in Object.prototype || attribute.value === 'prototype'))
+                    refuse('dependency reserved name');
+            }
+            for (const prefix in node.namespaces) {
+                check();
+                if (['__proto__', 'prototype', 'constructor'].includes(prefix) || /["<&\r\n\t]/.test(node.namespaces[prefix]))
+                    refuse('dependency namespace interpolation');
+            }
+            for (const child of node.children)
+                if (child.kind === 'element')
+                    pending.push(child);
+        }
+    }
+    const resources = [...source.resources].sort((a, b) => a.uri < b.uri ? -1 : a.uri > b.uri ? 1 : 0);
+    const aliases = new Map(), originals = new Map();
+    const dependencies = new Map(), imports = new Map();
+    for (const [index, resource] of resources.entries()) {
+        check();
+        const alias = 'https://wsdl-snapshot.invalid/resource/' + index;
+        aliases.set(resource.uri, alias);
+        originals.set(alias, resource.uri);
+        dependencies.set(resource.uri, new Set());
+    }
+    const schemaUris = new Map(source.schemas.map(schema => [schema.key, schema.documentUri]));
+    for (const edge of source.edges) {
+        check();
+        if (!edge.to)
+            continue;
+        const target = schemaUris.get(edge.to) ?? edge.to, parent = edge.source.uri;
+        if (!aliases.has(target) || !aliases.has(parent))
+            refuse('dependency outside retained snapshot');
+        const node = nodes.get(key(edge.source.uri, edge.source.path));
+        if (!node)
+            refuse('dependency source unavailable');
+        const location = syntaxAttribute(node, edge.kind === 'wsdl-import' ? 'location' : 'schemaLocation');
+        if (location === undefined)
+            continue;
+        const slot = key(parent, normalizeWhitespace(location, 'collapse')), previous = imports.get(slot);
+        if (previous !== undefined && previous !== target)
+            refuse('ambiguous dependency import context');
+        imports.set(slot, target);
+        dependencies.get(parent).add(target);
+    }
+    const cache = Object.create(null), prepared = new Set();
+    const remaining = new Map(), dependents = new Map(), ready = [];
+    for (const [uri, required] of dependencies) {
+        check();
+        remaining.set(uri, required.size);
+        if (!required.size)
+            ready.push(uri);
+        for (const dependency of required) {
+            check();
+            let users = dependents.get(dependency);
+            if (!users) {
+                users = [];
+                dependents.set(dependency, users);
+            }
+            users.push(uri);
+        }
+    }
+    for (let cursor = 0; cursor < ready.length; cursor++) {
+        const uri = ready[cursor];
+        check();
+        const bytes = copyOriginalSchemaResource(source, uri, amount => { check(); budget.chargeWork(amount); });
+        budget.chargeWork(4096 + bytes.byteLength * 64);
+        const text = decodeMetadataXml(bytes);
+        const options = { WSDL_CACHE: cache, wsdl_options: { overrideImportLocation: (_path, parentAlias, location) => {
+                    check();
+                    const parent = originals.get(parentAlias);
+                    const target = parent === undefined ? undefined : imports.get(key(parent, normalizeWhitespace(location, 'collapse')));
+                    const alias = target === undefined ? undefined : aliases.get(target);
+                    if (!target || !alias || !prepared.has(target) || !Object.hasOwn(cache, alias))
+                        return refuse('unowned SOAP metadata import');
+                    return alias;
+                } } };
+        const alias = aliases.get(uri), wsdl = new WSDL(text, alias, options);
+        cache[alias] = wsdl;
+        await new Promise((resolve, reject) => wsdl.onReady(error => error ? reject(error) : resolve()));
+        check();
+        prepared.add(uri);
+        for (const dependent of dependents.get(uri) ?? []) {
+            check();
+            const count = remaining.get(dependent) - 1;
+            remaining.set(dependent, count);
+            if (count === 0)
+                ready.push(dependent);
+        }
+    }
+    if (prepared.size !== resources.length)
+        refuse('cyclic SOAP metadata dependencies');
+    const root = aliases.get(source.root.uri);
+    if (!root || !Object.hasOwn(cache, root))
+        return refuse('original root unavailable');
+    return cache[root];
+}