@techspokes/typescript-wsdl-client 1.1.5 → 1.2.0

package/dist/compiler/soapHeaders.js

@@ -0,0 +1,42 @@
+const SOAP = 'http://schemas.xmlsoap.org/soap/envelope/';
+/** Assess borrowed parsed Header syntax without claiming unknown block semantics.
+ * @remarks SOAP 1.1 sections 4.2 through 4.2.3 require qualified block names and define absent mustUnderstand
+ *   as 0. Only immediate block attributes govern header processing. Actor-directed processing and mandatory
+ *   block semantics remain unsupported; no security/header emission capability is acquired here.
+ * @see https://www.w3.org/TR/2000/NOTE-SOAP-20000508/
+ */
+export function assessComponentSoapHeader(header, check) {
+    check();
+    if (header.name.namespace !== SOAP || header.name.local !== 'Header' || header.attributes.length)
+        return Object.freeze({ kind: 'protocol', rule: 'SOAP Header shape' });
+    const headers = [];
+    for (const child of header.children) {
+        check();
+        if (child.kind === 'text') {
+            if (/[^\t\r\n ]/.test(child.value))
+                return Object.freeze({ kind: 'protocol', rule: 'SOAP Header text' });
+            continue;
+        }
+        if (!child.name.namespace)
+            return Object.freeze({ kind: 'protocol', rule: 'SOAP header block namespace required' });
+        let mandatory = false;
+        for (const attribute of child.attributes) {
+            check();
+            if (attribute.name.namespace !== SOAP)
+                continue;
+            if (attribute.name.local === 'actor')
+                return Object.freeze({ kind: 'unsupported', rule: 'SOAP actor header capability required' });
+            if (attribute.name.local === 'mustUnderstand') {
+                if (attribute.value !== '0' && attribute.value !== '1')
+                    return Object.freeze({ kind: 'protocol', rule: 'SOAP 1.1 mustUnderstand value' });
+                mandatory = attribute.value === '1';
+            }
+            else if (attribute.name.local !== 'encodingStyle')
+                return Object.freeze({ kind: 'unsupported', rule: 'unknown SOAP header attribute' });
+        }
+        if (mandatory)
+            return Object.freeze({ kind: 'unsupported', rule: 'incoming mandatory SOAP header' });
+        headers.push(Object.freeze({ ...child.name }));
+    }
+    return Object.freeze({ kind: 'ignored-optional-headers', headers: Object.freeze(headers) });
+}

package/dist/compiler/sourceSchemaBinding.d.ts

@@ -23,4 +23,3 @@ export declare function prepareBoundSourceGraph(input: SchemaInput, options: Rea
     sourceLimits?: SemanticLimits;
     accountPreparation?: true;
 }>): BoundSourcePreparation;
-//# sourceMappingURL=sourceSchemaBinding.d.ts.map

package/dist/compiler/standardSchemaComponents.d.ts

@@ -0,0 +1,71 @@
+import type { ExpandedName, SyntaxElement } from '../loader/orderedSyntax.js';
+import type { SemanticBudget } from './semanticBudget.js';
+import { assessSchemaElementInstance } from './schemaElementInstance.js';
+export declare const SCHEMA_ELEMENT_LIBRARY: "w3c-xsd10-schema-element-2004-v1";
+export type StandardSchemaLibraryId = typeof SCHEMA_ELEMENT_LIBRARY;
+export interface StandardSchemaTypeReference {
+    readonly kind: 'standard-type';
+    readonly library: StandardSchemaLibraryId;
+    readonly component: 'schema-element-anonymous' | 'openAttrs';
+}
+export interface StandardSchemaLibrary {
+    readonly id: StandardSchemaLibraryId;
+    readonly specification: string;
+}
+export interface StandardSchemaElementDeclaration {
+    readonly kind: 'standard-element';
+    readonly id: string;
+    readonly name: ExpandedName;
+    readonly scope: 'global';
+    readonly type: StandardSchemaTypeReference;
+    readonly abstract: false;
+    readonly nillable: false;
+    readonly block: readonly ['restriction', 'extension', 'substitution'];
+    readonly final: readonly [];
+    readonly instanceGrammar: 'XSD10-S4S-element-instance-2004';
+}
+export interface StandardSchemaComplexType {
+    readonly kind: 'standard-complex-type';
+    readonly reference: StandardSchemaTypeReference;
+    readonly identity: Readonly<{
+        kind: 'anonymous';
+        owner: ExpandedName;
+    }> | Readonly<{
+        kind: 'global';
+        name: ExpandedName;
+    }>;
+    readonly mixed: false;
+    readonly abstract: false;
+    readonly derivation: Readonly<{
+        kind: 'extension';
+        base: StandardSchemaTypeReference;
+    }> | Readonly<{
+        kind: 'restriction';
+        base: Readonly<{
+            kind: 'builtin';
+            name: ExpandedName;
+        }>;
+    }>;
+    readonly grammar: 'schema' | 'openAttrs';
+}
+/** Acquire the implemented fixed standard definitions explicitly, without metadata I/O.
+ * @remarks The schema element has an anonymous complex type extending the named openAttrs type;
+ *   neither is a primitive builtin or an alias of anyType. These definition handles issue no source-validity receipt.
+ * @returns A native library handle; copied JSON or similarly shaped objects cannot resolve definitions.
+ * @throws TypeError For unknown library identifiers.
+ * @see https://www.w3.org/TR/2004/REC-xmlschema-1-20041028/structures.html#composition-schemaImport
+ */
+export declare function acquireStandardSchemaLibrary(id: string): StandardSchemaLibrary;
+/** Authenticate an acquired declaration before a resolver uses its identity. */
+export declare function inspectStandardSchemaElement(declaration: StandardSchemaElementDeclaration): StandardSchemaElementDeclaration;
+/** Borrow the exact acquired declaration's fixed complex ancestry; selectors cannot manufacture this ownership. */
+export declare function standardSchemaElementTypes(declaration: StandardSchemaElementDeclaration): readonly StandardSchemaComplexType[];
+/** Resolve only the supplied library's implemented global declaration; namespace names initiate no acquisition. */
+export declare function standardSchemaElement(library: StandardSchemaLibrary, name: ExpandedName): StandardSchemaElementDeclaration | undefined;
+/** Resolve a selector through an acquired library, retaining anonymous and named complex identities. */
+export declare function standardSchemaType(library: StandardSchemaLibrary, reference: StandardSchemaTypeReference): StandardSchemaComplexType | undefined;
+/** Apply the existing fixed instance owner to an exact native declaration handle.
+ * @remarks This does not qualify application schema declarations, WSDL operations, mappings or portable artifacts.
+ * @throws TypeError For copied or unowned declaration handles.
+ */
+export declare function assessStandardSchemaElement(declaration: StandardSchemaElementDeclaration, root: SyntaxElement, budget: SemanticBudget, options?: Parameters<typeof assessSchemaElementInstance>[2]): import("./schemaElementInstance.js").SchemaElementInstanceResult;

package/dist/compiler/standardSchemaComponents.js

@@ -0,0 +1,74 @@
+/** Explicit native standard-component acquisition; selecting a library never qualifies an application source. */
+import { globalId } from './canonicalGraph.js';
+import { XSD_NAMESPACE } from '../loader/orderedSyntax.js';
+import { assessSchemaElementInstance } from './schemaElementInstance.js';
+export const SCHEMA_ELEMENT_LIBRARY = 'w3c-xsd10-schema-element-2004-v1';
+const libraries = new WeakMap();
+const elements = new WeakMap();
+/** Acquire the implemented fixed standard definitions explicitly, without metadata I/O.
+ * @remarks The schema element has an anonymous complex type extending the named openAttrs type;
+ *   neither is a primitive builtin or an alias of anyType. These definition handles issue no source-validity receipt.
+ * @returns A native library handle; copied JSON or similarly shaped objects cannot resolve definitions.
+ * @throws TypeError For unknown library identifiers.
+ * @see https://www.w3.org/TR/2004/REC-xmlschema-1-20041028/structures.html#composition-schemaImport
+ */
+export function acquireStandardSchemaLibrary(id) {
+    if (id !== SCHEMA_ELEMENT_LIBRARY)
+        throw new TypeError('Unsupported standard schema component library');
+    const library = Object.freeze({ id, specification: 'https://www.w3.org/TR/2004/REC-xmlschema-1-20041028/structures.html#element-schema' });
+    const name = Object.freeze({ namespace: XSD_NAMESPACE, local: 'schema' });
+    const reference = (component) => Object.freeze({ kind: 'standard-type', library: id, component });
+    const schema = reference('schema-element-anonymous'), openAttrs = reference('openAttrs');
+    const element = Object.freeze({ kind: 'standard-element', id: globalId('element', name), name,
+        scope: 'global', type: schema, abstract: false, nillable: false,
+        block: Object.freeze(['restriction', 'extension', 'substitution']), final: Object.freeze([]),
+        instanceGrammar: 'XSD10-S4S-element-instance-2004' });
+    const types = Object.freeze({
+        'schema-element-anonymous': Object.freeze({ kind: 'standard-complex-type', reference: schema,
+            identity: Object.freeze({ kind: 'anonymous', owner: name }), mixed: false, abstract: false,
+            derivation: Object.freeze({ kind: 'extension', base: openAttrs }), grammar: 'schema' }),
+        openAttrs: Object.freeze({ kind: 'standard-complex-type', reference: openAttrs,
+            identity: Object.freeze({ kind: 'global', name: Object.freeze({ namespace: XSD_NAMESPACE, local: 'openAttrs' }) }), mixed: false, abstract: false,
+            derivation: Object.freeze({ kind: 'restriction', base: Object.freeze({ kind: 'builtin', name: Object.freeze({ namespace: XSD_NAMESPACE, local: 'anyType' }) }) }), grammar: 'openAttrs' }),
+    });
+    libraries.set(library, Object.freeze({ element, types }));
+    elements.set(element, library);
+    return library;
+}
+function definition(library) {
+    const owned = libraries.get(library);
+    if (!owned)
+        throw new TypeError('Native acquired standard schema library required');
+    return owned;
+}
+/** Authenticate an acquired declaration before a resolver uses its identity. */
+export function inspectStandardSchemaElement(declaration) {
+    if (!elements.has(declaration))
+        throw new TypeError('Native standard schema declaration required');
+    return declaration;
+}
+/** Borrow the exact acquired declaration's fixed complex ancestry; selectors cannot manufacture this ownership. */
+export function standardSchemaElementTypes(declaration) {
+    inspectStandardSchemaElement(declaration);
+    const owned = definition(elements.get(declaration));
+    return Object.freeze([owned.types['schema-element-anonymous'], owned.types.openAttrs]);
+}
+/** Resolve only the supplied library's implemented global declaration; namespace names initiate no acquisition. */
+export function standardSchemaElement(library, name) {
+    const owned = definition(library);
+    return name.namespace === XSD_NAMESPACE && name.local === 'schema' ? owned.element : undefined;
+}
+/** Resolve a selector through an acquired library, retaining anonymous and named complex identities. */
+export function standardSchemaType(library, reference) {
+    const owned = definition(library);
+    return reference.kind === 'standard-type' && reference.library === library.id && Object.hasOwn(owned.types, reference.component)
+        ? owned.types[reference.component] : undefined;
+}
+/** Apply the existing fixed instance owner to an exact native declaration handle.
+ * @remarks This does not qualify application schema declarations, WSDL operations, mappings or portable artifacts.
+ * @throws TypeError For copied or unowned declaration handles.
+ */
+export function assessStandardSchemaElement(declaration, root, budget, options = {}) {
+    inspectStandardSchemaElement(declaration);
+    return assessSchemaElementInstance(root, budget, options);
+}

package/dist/compiler/standardSchemaConstruction.d.ts

@@ -0,0 +1,20 @@
+import type { SemanticContext } from './semanticContext.js';
+import type { StandardSchemaElementDeclaration, StandardSchemaComplexType } from './standardSchemaComponents.js';
+import type { ResourceLimitFailure } from './semanticBudget.js';
+export interface StandardElementConstruction {
+    readonly kind: 'checked-standard-element';
+    readonly authority: 'XSD10-fixed-standard-component-v1';
+    readonly scope: 'fixed-standard-element-and-complex-ancestry';
+    readonly contextId: string;
+    readonly declaration: StandardSchemaElementDeclaration;
+    readonly types: readonly StandardSchemaComplexType[];
+}
+/** Consume a native acquired definition in this exact context.
+ * @remarks The fixed dated definitions and S4S instance clauses are implementation-owned, like the builtin
+ *   datatype universe. This establishes their component dependency only, never application source validity,
+ *   opaque payload interpretation, value assessment or portable artifact authority.
+ * @throws TypeError For copied declarations or a declaration not acquired in the selected context.
+ */
+export declare function checkStandardElementConstruction(context: SemanticContext, declaration: StandardSchemaElementDeclaration): StandardElementConstruction | ResourceLimitFailure;
+/** Authenticate both native construction and the selected acquired universe before aggregate closure. */
+export declare function assertStandardElementConstruction(context: SemanticContext, receipt: StandardElementConstruction): void;

package/dist/compiler/standardSchemaConstruction.js

@@ -0,0 +1,34 @@
+/** Native fixed-standard dependencies, separate from application graph construction and mapping authority. */
+import { assertSemanticContext } from './semanticContext.js';
+import { inspectStandardSchemaElement, standardSchemaElementTypes } from './standardSchemaComponents.js';
+const issued = new WeakMap();
+/** Consume a native acquired definition in this exact context.
+ * @remarks The fixed dated definitions and S4S instance clauses are implementation-owned, like the builtin
+ *   datatype universe. This establishes their component dependency only, never application source validity,
+ *   opaque payload interpretation, value assessment or portable artifact authority.
+ * @throws TypeError For copied declarations or a declaration not acquired in the selected context.
+ */
+export function checkStandardElementConstruction(context, declaration) {
+    assertSemanticContext(context);
+    inspectStandardSchemaElement(declaration);
+    return context.budget.guard(() => {
+        context.budget.chargeWork(32 + declaration.id.length);
+        if (context.standardElement(declaration.id) !== declaration)
+            throw new TypeError('Standard declaration is not acquired in this context');
+        const types = standardSchemaElementTypes(declaration);
+        const receipt = Object.freeze({ kind: 'checked-standard-element',
+            authority: 'XSD10-fixed-standard-component-v1', scope: 'fixed-standard-element-and-complex-ancestry',
+            contextId: context.contextId, declaration, types });
+        issued.set(receipt, context);
+        return receipt;
+    });
+}
+/** Authenticate both native construction and the selected acquired universe before aggregate closure. */
+export function assertStandardElementConstruction(context, receipt) {
+    assertSemanticContext(context);
+    if (issued.get(receipt) !== context)
+        throw new TypeError('Native matching standard-element construction required');
+    context.budget.chargeWork(8);
+    if (context.standardElement(receipt.declaration.id) !== receipt.declaration)
+        throw new TypeError('Standard construction scope changed');
+}

package/dist/compiler/structuralCompanions.d.ts

@@ -13,4 +13,3 @@ export type StructuralMerge = Readonly<{
     }>;
 }>;
 export declare function mergeStructuralCompanions(primary: CanonicalGraph, companions: readonly StructuralCompanion[], limits?: SemanticLimits): StructuralMerge;
-//# sourceMappingURL=structuralCompanions.d.ts.map

package/dist/compiler/validateSemanticGraph.d.ts

@@ -2,4 +2,3 @@ import type { CanonicalGraph } from "./canonicalGraph.js";
 export declare function validateSemanticGraph(input: unknown, options?: {
     maxNodes?: number;
 }): asserts input is CanonicalGraph;
-//# sourceMappingURL=validateSemanticGraph.d.ts.map

package/dist/compiler/wildcardAlgebra.d.ts

@@ -23,4 +23,3 @@ export declare function namespaceIntersection(a: NamespaceConstraint, b: Namespa
 export declare function namespaceExpressible(value: NamespaceConstraint, charge?: WildcardCharge): boolean;
 /** The ur-type identity exception belongs to the invoking rule, never spelling. */
 export declare function processContentsRestricts(derived: WildcardProcess, base: WildcardProcess, charge?: WildcardCharge): boolean;
-//# sourceMappingURL=wildcardAlgebra.d.ts.map

package/dist/compiler/wsdlPolicyRequirements.d.ts

@@ -0,0 +1,43 @@
+import type { SchemaInput } from '../loader/schemaInput.js';
+import type { SyntaxElement, SyntaxSource } from '../loader/orderedSyntax.js';
+import type { SemanticBudget, ResourceLimitFailure } from './semanticBudget.js';
+export declare const POLICY_12 = "http://schemas.xmlsoap.org/ws/2004/09/policy";
+export declare const SECURITY_POLICY_11 = "http://schemas.xmlsoap.org/ws/2005/07/securitypolicy";
+declare const suites: readonly ["Basic256", "Basic192", "Basic128", "TripleDes", "Basic256Rsa15", "Basic192Rsa15", "Basic128Rsa15", "TripleDesRsa15", "Basic256Sha256", "Basic192Sha256", "Basic128Sha256", "TripleDesSha256", "Basic256Sha256Rsa15", "Basic192Sha256Rsa15", "Basic128Sha256Rsa15", "TripleDesSha256Rsa15"];
+declare const layouts: readonly ["Strict", "Lax", "LaxTsFirst", "LaxTsLast"];
+export type TransportPolicyRequirements = Readonly<{
+    kind: 'https-transport';
+    requireClientCertificate: boolean;
+    algorithmSuite: typeof suites[number];
+    layout: typeof layouts[number];
+    includeTimestamp: boolean;
+    source: SyntaxSource;
+    enforced: false;
+}>;
+export type BindingPolicyRequirements = Readonly<{
+    kind: 'none';
+}> | TransportPolicyRequirements;
+export interface WsdlPolicyRequirements {
+    readonly kind: 'wsdl-policy-requirements';
+    readonly admitted: false;
+    isPolicyMetadata(node: SyntaxElement): boolean;
+    forBinding(binding: SyntaxElement): BindingPolicyRequirements;
+}
+export type PolicyRequirementsFailure = Readonly<{
+    kind: 'unsupported' | 'invalid-schema';
+    rule: string;
+    source: SyntaxSource;
+}>;
+/** Authenticate the exact loaded snapshot; copied reports or source-shaped records confer no policy authority. */
+export declare function assertWsdlPolicyRequirements(input: SchemaInput, value: WsdlPolicyRequirements): void;
+/** Interpret a closed single-alternative HTTPS transport-policy fragment and same-document binding references.
+ * @remarks Unknown assertions, external/nested references, multiple alternatives/attachments and digest references
+ *   remain explicit refusals. No policy fetch, endpoint permission, algorithm execution or security-header emission occurs.
+ *   The July 2005 defaults are Lax layout and no timestamp. Client-certificate omission is outside this qualified fragment.
+ * @returns Source-owned requirements or an explicit unsupported/invalid/resource result; enforcement remains false.
+ * @throws TypeError For unauthenticated source or foreign binding inspection. Caller cancellation propagates unchanged.
+ * @see https://www.w3.org/submissions/WS-Policy/
+ * @see https://specs.xmlsoap.org/ws/2005/07/securitypolicy/ws-securitypolicy.pdf
+ */
+export declare function prepareWsdlPolicyRequirements(input: SchemaInput, budget: SemanticBudget, check: () => void): WsdlPolicyRequirements | PolicyRequirementsFailure | ResourceLimitFailure;
+export {};

package/dist/compiler/wsdlPolicyRequirements.js

@@ -0,0 +1,239 @@
+/** Source-owned WS-Policy requirements; recognition never grants transport or message-security admission. */
+import { assertLoadedSchemaInput } from '../loader/schemaInput.js';
+import { syntaxAttribute, syntaxElements, isXmlNCName, WSDL_NAMESPACE } from '../loader/orderedSyntax.js';
+import { normalizeWhitespace } from './datatypeValues.js';
+export const POLICY_12 = 'http://schemas.xmlsoap.org/ws/2004/09/policy';
+export const SECURITY_POLICY_11 = 'http://schemas.xmlsoap.org/ws/2005/07/securitypolicy';
+const WSU = 'http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd';
+const suites = ['Basic256', 'Basic192', 'Basic128', 'TripleDes', 'Basic256Rsa15', 'Basic192Rsa15', 'Basic128Rsa15',
+    'TripleDesRsa15', 'Basic256Sha256', 'Basic192Sha256', 'Basic128Sha256', 'TripleDesSha256',
+    'Basic256Sha256Rsa15', 'Basic192Sha256Rsa15', 'Basic128Sha256Rsa15', 'TripleDesSha256Rsa15'];
+const layouts = ['Strict', 'Lax', 'LaxTsFirst', 'LaxTsLast'];
+const issued = new WeakMap();
+class Stop extends Error {
+    result;
+    constructor(result) {
+        super(result.rule);
+        this.result = result;
+    }
+}
+/** Authenticate the exact loaded snapshot; copied reports or source-shaped records confer no policy authority. */
+export function assertWsdlPolicyRequirements(input, value) {
+    assertLoadedSchemaInput(input);
+    if (issued.get(value) !== input)
+        throw new TypeError('Fresh source-bound WSDL policy requirements required');
+}
+/** Interpret a closed single-alternative HTTPS transport-policy fragment and same-document binding references.
+ * @remarks Unknown assertions, external/nested references, multiple alternatives/attachments and digest references
+ *   remain explicit refusals. No policy fetch, endpoint permission, algorithm execution or security-header emission occurs.
+ *   The July 2005 defaults are Lax layout and no timestamp. Client-certificate omission is outside this qualified fragment.
+ * @returns Source-owned requirements or an explicit unsupported/invalid/resource result; enforcement remains false.
+ * @throws TypeError For unauthenticated source or foreign binding inspection. Caller cancellation propagates unchanged.
+ * @see https://www.w3.org/submissions/WS-Policy/
+ * @see https://specs.xmlsoap.org/ws/2005/07/securitypolicy/ws-securitypolicy.pdf
+ */
+export function prepareWsdlPolicyRequirements(input, budget, check) {
+    assertLoadedSchemaInput(input);
+    return budget.guard(() => {
+        const fail = (node, rule, kind = 'unsupported') => {
+            budget.chargeWork(64 + rule.length);
+            throw new Stop(Object.freeze({ kind, rule, source: node.source }));
+        };
+        const elements = (node) => {
+            check();
+            budget.chargeWork(32 + node.children.length * 8 + node.attributes.length * 16);
+            for (const child of node.children)
+                if (child.kind === 'text' && /[^\t\r\n ]/.test(child.value))
+                    fail(node, 'policy-text', 'invalid-schema');
+            return syntaxElements(node);
+        };
+        const attrs = (node, allowed = [], id = false) => {
+            for (const attribute of node.attributes) {
+                check();
+                budget.chargeWork(32 + attribute.value.length * 4);
+                if (attribute.name.namespace === '' && allowed.includes(attribute.name.local))
+                    continue;
+                if (id && attribute.name.namespace === WSU && attribute.name.local === 'Id')
+                    continue;
+                fail(node, 'policy-attribute');
+            }
+        };
+        const is = (node, namespace, local) => node.name.namespace === namespace && node.name.local === local;
+        // Framework flattening is iterative and refuses choice instead of guessing an alternative.
+        const assertions = (policy) => {
+            const pending = [policy], result = [];
+            while (pending.length) {
+                check();
+                const node = pending.pop();
+                if (node.name.namespace === POLICY_12 && ['Policy', 'All', 'ExactlyOne'].includes(node.name.local)) {
+                    attrs(node, [], node === policy && node.name.local === 'Policy');
+                    const children = elements(node);
+                    if (node.name.local === 'ExactlyOne' && children.length !== 1)
+                        fail(node, 'policy-alternatives');
+                    for (let i = children.length - 1; i >= 0; i--) {
+                        check();
+                        pending.push(children[i]);
+                    }
+                }
+                else {
+                    if (node.name.namespace === POLICY_12)
+                        fail(node, 'nested-policy-reference-or-operator');
+                    result.push(node);
+                }
+            }
+            return result;
+        };
+        const nested = (node) => {
+            attrs(node);
+            const children = elements(node);
+            if (children.length !== 1 || !is(children[0], POLICY_12, 'Policy'))
+                return fail(node, 'nested-policy-required');
+            return assertions(children[0]);
+        };
+        const leaf = (node) => { attrs(node); if (elements(node).length)
+            fail(node, 'policy-leaf-content'); };
+        const transport = (node) => {
+            const parts = nested(node), byName = new Map();
+            for (const part of parts) {
+                check();
+                if (part.name.namespace !== SECURITY_POLICY_11 || !['TransportToken', 'AlgorithmSuite', 'Layout', 'IncludeTimestamp'].includes(part.name.local))
+                    fail(part, 'transport-policy-assertion');
+                if (byName.has(part.name.local))
+                    fail(part, 'duplicate-transport-property', 'invalid-schema');
+                byName.set(part.name.local, part);
+            }
+            const token = byName.get('TransportToken'), suite = byName.get('AlgorithmSuite');
+            if (!token || !suite)
+                return fail(node, 'transport-token-and-algorithm-suite-required', 'invalid-schema');
+            const tokens = nested(token);
+            if (tokens.length !== 1 || !is(tokens[0], SECURITY_POLICY_11, 'HttpsToken'))
+                return fail(token, 'transport-token-kind');
+            const https = tokens[0];
+            attrs(https, ['RequireClientCertificate']);
+            if (elements(https).length)
+                fail(https, 'https-token-additional-policy');
+            const certificate = syntaxAttribute(https, 'RequireClientCertificate');
+            if (certificate === undefined)
+                return fail(https, 'https-token-client-certificate-default-unqualified');
+            const lexical = normalizeWhitespace(certificate, 'collapse');
+            if (!['true', '1', 'false', '0'].includes(lexical))
+                fail(https, 'https-token-client-certificate-boolean', 'invalid-schema');
+            const algorithms = nested(suite);
+            if (algorithms.length !== 1 || algorithms[0].name.namespace !== SECURITY_POLICY_11 || !suites.some(name => name === algorithms[0].name.local))
+                return fail(suite, 'algorithm-suite');
+            leaf(algorithms[0]);
+            let layout = 'Lax';
+            const layoutNode = byName.get('Layout');
+            if (layoutNode) {
+                const selected = nested(layoutNode);
+                if (selected.length !== 1 || selected[0].name.namespace !== SECURITY_POLICY_11 || !layouts.some(name => name === selected[0].name.local))
+                    return fail(layoutNode, 'security-header-layout');
+                leaf(selected[0]);
+                layout = selected[0].name.local;
+            }
+            const timestamp = byName.get('IncludeTimestamp');
+            if (timestamp)
+                leaf(timestamp);
+            budget.chargeWork(128);
+            return Object.freeze({ kind: 'https-transport', requireClientCertificate: lexical === 'true' || lexical === '1',
+                algorithmSuite: algorithms[0].name.local, layout, includeTimestamp: timestamp !== undefined,
+                source: node.source, enforced: false });
+        };
+        try {
+            const metadata = new Set(), bindings = new Map();
+            const none = Object.freeze({ kind: 'none' });
+            for (const document of input.documents) {
+                check();
+                if (!is(document.root, WSDL_NAMESPACE, 'definitions'))
+                    continue;
+                const ids = new Map(), pending = [document.root];
+                while (pending.length) {
+                    check();
+                    const node = pending.pop(), lexicalId = syntaxAttribute(node, 'Id', WSU);
+                    if (lexicalId !== undefined) {
+                        budget.chargeWork(32 + lexicalId.length * 4);
+                        const id = normalizeWhitespace(lexicalId, 'collapse');
+                        if (!isXmlNCName(id) || ids.has(id))
+                            fail(node, 'policy-id-uniqueness', 'invalid-schema');
+                        ids.set(id, node);
+                    }
+                    for (const child of syntaxElements(node)) {
+                        check();
+                        pending.push(child);
+                    }
+                }
+                const policies = new Map();
+                const parse = (policy) => {
+                    const cached = policies.get(policy);
+                    if (cached)
+                        return cached;
+                    const leaves = assertions(policy);
+                    if (leaves.length > 1)
+                        return fail(policy, 'policy-assertion-combination');
+                    if (leaves.length && !is(leaves[0], SECURITY_POLICY_11, 'TransportBinding'))
+                        return fail(leaves[0], 'policy-assertion');
+                    const result = leaves.length ? transport(leaves[0]) : none;
+                    policies.set(policy, result);
+                    return result;
+                };
+                for (const node of syntaxElements(document.root))
+                    if (is(node, POLICY_12, 'Policy')) {
+                        parse(node);
+                        metadata.add(node);
+                    }
+                for (const binding of syntaxElements(document.root, WSDL_NAMESPACE, 'binding')) {
+                    const attachments = syntaxElements(binding).filter(node => node.name.namespace === POLICY_12);
+                    if (attachments.length > 1)
+                        fail(binding, 'multiple-policy-attachments');
+                    let result = none;
+                    for (const attachment of attachments) {
+                        if (is(attachment, POLICY_12, 'Policy'))
+                            result = parse(attachment);
+                        else if (is(attachment, POLICY_12, 'PolicyReference')) {
+                            attrs(attachment, ['URI']);
+                            if (elements(attachment).length)
+                                fail(attachment, 'policy-reference-content');
+                            const uri = syntaxAttribute(attachment, 'URI');
+                            if (!uri?.startsWith('#'))
+                                return fail(attachment, 'external-policy-reference');
+                            if (new URL(attachment.baseUri).href.split('#')[0] !== new URL(document.uri).href.split('#')[0])
+                                return fail(attachment, 'external-policy-reference');
+                            let id;
+                            try {
+                                id = decodeURIComponent(uri.slice(1));
+                            }
+                            catch {
+                                return fail(attachment, 'policy-reference-fragment', 'invalid-schema');
+                            }
+                            const target = ids.get(id);
+                            if (!target || !is(target, POLICY_12, 'Policy'))
+                                return fail(attachment, 'policy-reference-target', 'invalid-schema');
+                            if (!metadata.has(target))
+                                return fail(attachment, 'policy-reference-placement');
+                            result = parse(target);
+                        }
+                        else
+                            return fail(attachment, 'policy-attachment');
+                        metadata.add(attachment);
+                    }
+                    bindings.set(binding, result);
+                }
+            }
+            const owner = Object.freeze({ kind: 'wsdl-policy-requirements', admitted: false,
+                isPolicyMetadata(node) { return metadata.has(node); },
+                forBinding(binding) {
+                    const value = bindings.get(binding);
+                    if (!value)
+                        throw new TypeError('Original source binding required for policy requirements');
+                    return value;
+                } });
+            issued.set(owner, input);
+            return owner;
+        }
+        catch (error) {
+            if (error instanceof Stop)
+                return error.result;
+            throw error;
+        }
+    });
+}

package/dist/config.d.ts

@@ -64,4 +64,3 @@ export declare function resolveCompilerOptions(input: Partial<CompilerOptions>,
     wsdl: string;
     out: string;
 }): CompilerOptions;
-//# sourceMappingURL=config.d.ts.map

package/dist/gateway/generateCheckedGateway.d.ts

@@ -0,0 +1,32 @@
+import type { ReconstructedComponentSource } from '../compiler/directSourceCapsule.js';
+interface CheckedGatewayOptions {
+    /** Internal non-writing preparation; native qualification and lowering still run. */
+    readonly emit?: boolean;
+    readonly clientDir: string;
+    readonly gatewayDir: string;
+    readonly openapiFile: string;
+    readonly routePath: string;
+    readonly signal?: AbortSignal;
+}
+/** Lower component mappings through the existing checked gateway emitter, retaining native supplemental validation. */
+export declare function generateComponentGateway(expected: ReconstructedComponentSource, options: CheckedGatewayOptions): Promise<{
+    doc: unknown;
+    emit: () => Promise<void>;
+}>;
+/** Compose per-operation checked routers without merging native source, service or binding identities.
+ * @returns One OpenAPI document and exact operation-to-route mapping, both descriptions rather than authority.
+ * @throws For mixed native handles, invalid/colliding paths, cancellation or filesystem failures.
+ */
+export declare function generateComponentServiceGateway(expected: readonly ReconstructedComponentSource[], options: {
+    clientDir: string;
+    gatewayDir: string;
+    openapiFile: string;
+    basePath: string;
+    signal?: AbortSignal;
+    emit?: boolean;
+}): Promise<{
+    doc: unknown;
+    routes: Readonly<Record<string, string>>;
+    emit: () => Promise<void>;
+}>;
+export {};