fatoority 0.0.0-stage → 0.4.1

package/LICENSE-APACHE

@@ -0,0 +1,201 @@
+                              Apache License
+                        Version 2.0, January 2004
+                     http://www.apache.org/licenses/
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1. Definitions.
+
+   "License" shall mean the terms and conditions for use, reproduction,
+   and distribution as defined by Sections 1 through 9 of this document.
+
+   "Licensor" shall mean the copyright owner or entity authorized by
+   the copyright owner that is granting the License.
+
+   "Legal Entity" shall mean the union of the acting entity and all
+   other entities that control, are controlled by, or are under common
+   control with that entity. For the purposes of this definition,
+   "control" means (i) the power, direct or indirect, to cause the
+   direction or management of such entity, whether by contract or
+   otherwise, or (ii) ownership of fifty percent (50%) or more of the
+   outstanding shares, or (iii) beneficial ownership of such entity.
+
+   "You" (or "Your") shall mean an individual or Legal Entity
+   exercising permissions granted by this License.
+
+   "Source" form shall mean the preferred form for making modifications,
+   including but not limited to software source code, documentation
+   source, and configuration files.
+
+   "Object" form shall mean any form resulting from mechanical
+   transformation or translation of a Source form, including but
+   not limited to compiled object code, generated documentation,
+   and conversions to other media types.
+
+   "Work" shall mean the work of authorship, whether in Source or
+   Object form, made available under the License, as indicated by a
+   copyright notice that is included in or attached to the work
+   (an example is provided in the Appendix below).
+
+   "Derivative Works" shall mean any work, whether in Source or Object
+   form, that is based on (or derived from) the Work and for which the
+   editorial revisions, annotations, elaborations, or other modifications
+   represent, as a whole, an original work of authorship. For the purposes
+   of this License, Derivative Works shall not include works that remain
+   separable from, or merely link (or bind by name) to the interfaces of,
+   the Work and Derivative Works thereof.
+
+   "Contribution" shall mean any work of authorship, including
+   the original version of the Work and any modifications or additions
+   to that Work or Derivative Works thereof, that is intentionally
+   submitted to Licensor for inclusion in the Work by the copyright owner
+   or by an individual or Legal Entity authorized to submit on behalf of
+   the copyright owner. For the purposes of this definition, "submitted"
+   means any form of electronic, verbal, or written communication sent
+   to the Licensor or its representatives, including but not limited to
+   communication on electronic mailing lists, source code control systems,
+   and issue tracking systems that are managed by, or on behalf of, the
+   Licensor for the purpose of discussing and improving the Work, but
+   excluding communication that is conspicuously marked or otherwise
+   designated in writing by the copyright owner as "Not a Contribution."
+
+   "Contributor" shall mean Licensor and any individual or Legal Entity
+   on behalf of whom a Contribution has been received by Licensor and
+   subsequently incorporated within the Work.
+
+2. Grant of Copyright License. Subject to the terms and conditions of
+   this License, each Contributor hereby grants to You a perpetual,
+   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+   copyright license to reproduce, prepare Derivative Works of,
+   publicly display, publicly perform, sublicense, and distribute the
+   Work and such Derivative Works in Source or Object form.
+
+3. Grant of Patent License. Subject to the terms and conditions of
+   this License, each Contributor hereby grants to You a perpetual,
+   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+   (except as stated in this section) patent license to make, have made,
+   use, offer to sell, sell, import, and otherwise transfer the Work,
+   where such license applies only to those patent claims licensable
+   by such Contributor that are necessarily infringed by their
+   Contribution(s) alone or by combination of their Contribution(s)
+   with the Work to which such Contribution(s) was submitted. If You
+   institute patent litigation against any entity (including a
+   cross-claim or counterclaim in a lawsuit) alleging that the Work
+   or a Contribution incorporated within the Work constitutes direct
+   or contributory patent infringement, then any patent licenses
+   granted to You under this License for that Work shall terminate
+   as of the date such litigation is filed.
+
+4. Redistribution. You may reproduce and distribute copies of the
+   Work or Derivative Works thereof in any medium, with or without
+   modifications, and in Source or Object form, provided that You
+   meet the following conditions:
+
+   (a) You must give any other recipients of the Work or
+       Derivative Works a copy of this License; and
+
+   (b) You must cause any modified files to carry prominent notices
+       stating that You changed the files; and
+
+   (c) You must retain, in the Source form of any Derivative Works
+       that You distribute, all copyright, patent, trademark, and
+       attribution notices from the Source form of the Work,
+       excluding those notices that do not pertain to any part of
+       the Derivative Works; and
+
+   (d) If the Work includes a "NOTICE" text file as part of its
+       distribution, then any Derivative Works that You distribute must
+       include a readable copy of the attribution notices contained
+       within such NOTICE file, excluding those notices that do not
+       pertain to any part of the Derivative Works, in at least one
+       of the following places: within a NOTICE text file distributed
+       as part of the Derivative Works; within the Source form or
+       documentation, if provided along with the Derivative Works; or,
+       within a display generated by the Derivative Works, if and
+       wherever such third-party notices normally appear. The contents
+       of the NOTICE file are for informational purposes only and
+       do not modify the License. You may add Your own attribution
+       notices within Derivative Works that You distribute, alongside
+       or as an addendum to the NOTICE text from the Work, provided
+       that such additional attribution notices cannot be construed
+       as modifying the License.
+
+   You may add Your own copyright statement to Your modifications and
+   may provide additional or different license terms and conditions
+   for use, reproduction, or distribution of Your modifications, or
+   for any such Derivative Works as a whole, provided Your use,
+   reproduction, and distribution of the Work otherwise complies with
+   the conditions stated in this License.
+
+5. Submission of Contributions. Unless You explicitly state otherwise,
+   any Contribution intentionally submitted for inclusion in the Work
+   by You to the Licensor shall be under the terms and conditions of
+   this License, without any additional terms or conditions.
+   Notwithstanding the above, nothing herein shall supersede or modify
+   the terms of any separate license agreement you may have executed
+   with Licensor regarding such Contributions.
+
+6. Trademarks. This License does not grant permission to use the trade
+   names, trademarks, service marks, or product names of the Licensor,
+   except as required for reasonable and customary use in describing the
+   origin of the Work and reproducing the content of the NOTICE file.
+
+7. Disclaimer of Warranty. Unless required by applicable law or
+   agreed to in writing, Licensor provides the Work (and each
+   Contributor provides its Contributions) on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+   implied, including, without limitation, any warranties or conditions
+   of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+   PARTICULAR PURPOSE. You are solely responsible for determining the
+   appropriateness of using or redistributing the Work and assume any
+   risks associated with Your exercise of permissions under this License.
+
+8. Limitation of Liability. In no event and under no legal theory,
+   whether in tort (including negligence), contract, or otherwise,
+   unless required by applicable law (such as deliberate and grossly
+   negligent acts) or agreed to in writing, shall any Contributor be
+   liable to You for damages, including any direct, indirect, special,
+   incidental, or consequential damages of any character arising as a
+   result of this License or out of the use or inability to use the
+   Work (including but not limited to damages for loss of goodwill,
+   work stoppage, computer failure or malfunction, or any and all
+   other commercial damages or losses), even if such Contributor
+   has been advised of the possibility of such damages.
+
+9. Accepting Warranty or Additional Liability. While redistributing
+   the Work or Derivative Works thereof, You may choose to offer,
+   and charge a fee for, acceptance of support, warranty, indemnity,
+   or other liability obligations and/or rights consistent with this
+   License. However, in accepting such obligations, You may act only
+   on Your own behalf and on Your sole responsibility, not on behalf
+   of any other Contributor, and only if You agree to indemnify,
+   defend, and hold each Contributor harmless for any liability
+   incurred by, or claims asserted against, such Contributor by reason
+   of your accepting any such warranty or additional liability.
+
+END OF TERMS AND CONDITIONS
+
+APPENDIX: How to apply the Apache License to your work.
+
+   To apply the Apache License to your work, attach the following
+   boilerplate notice, with the fields enclosed by brackets "[]"
+   replaced with your own identifying information. (Don't include
+   the brackets!)  The text should be enclosed in the appropriate
+   comment syntax for the file format. We also recommend that a
+   file or class name and description of purpose be included on the
+   same "printed page" as the copyright notice for easier
+   identification within third-party archives.
+
+Copyright [yyyy] [name of copyright owner]
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

package/LICENSE-MIT

@@ -0,0 +1,22 @@
+MIT License
+
+Copyright (c) 2026 Mohamad Alsadhan
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+

package/README.md

@@ -1,3 +1,76 @@
-# Temporary Holding Version
+# Fatoority JavaScript / TypeScript
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+ES modules backed by Diplomat 0.16.1 and WebAssembly. Supports Node 22+ and modern browsers with WebAssembly, Web Crypto, FinalizationRegistry and top-level await.
+
+Build from the repository root:
+
+```sh
+rustup target add wasm32-unknown-unknown
+cargo install diplomat-tool --version 0.16.1 --locked
+npm ci --prefix bindings/js
+python3 scripts/generate_bindings.py
+python3 scripts/build_js.py
+npm run check --prefix bindings/js
+node bindings/js/tests/runtime.test.mjs
+python3 scripts/check_js_package.py
+```
+
+Build a local tarball with `npm pack` in `bindings/js`. Version tags publish the tested package to npm through GitHub Actions.
+
+See the [JS/TS reference](https://docs.fatoority.com/reference/bindings/javascript/) for complete installation, browser deployment and API examples.
+
+```js
+import { Config, SigningKey, CsidCompliance, ZatcaClient } from 'fatoority';
+
+const key = SigningKey.generate();
+const config = Config.new_(0); // 0: nonproduction, 1: simulation, 2: production
+const client = new ZatcaClient(config);
+const compliance = CsidCompliance.create(0, 'request-id', 'token', 'secret');
+const production = await client.postCcsidForPcsid(compliance, {
+  signal: AbortSignal.timeout(30_000),
+});
+```
+
+API methods prepare requests and decode responses in Rust; the facade calls `fetch`. Inject a fetch implementation with `new ZatcaClient(config, {fetch})`. Requests refuse redirects. HTTP errors go to Rust decoding, and a successful invoice HTTP response still requires `response.ensureAccepted()` or inspection of `response.outcome()`.
+
+For your own transport, import `ZatcaClient` from `fatoority/raw`, call a `prepare*` method, and read `method()`, `url()`, `headersJson()` (an array of header pairs), and `body().asSlice()`. Complete with `request.decode(status, bytes)`, or use `sendPrepared(request, {fetch, signal})`. The request owns its data and the operation/environment needed for decoding. It contains authorization headers and must not be logged.
+
+The generated API preserves Rust names in camelCase; a Rust `new` constructor is `new_`. Decimal arguments and outputs are strings, and invoice counters are `bigint`. Optional strings use `null`, distinct from `''`. Consuming operations such as `build()`, signing and `intoXml()` reject reuse. Generated owners are released by FinalizationRegistry; do not manually free pointers or share handles between workers. Byte slices returned by the generated JS are copies. The facade snapshots outgoing bytes before awaiting the network.
+
+Generated Rust errors are JavaScript `Error` objects whose `cause` is a `BindingError`. Inspect `error.cause.code()`, `.message()` and `.detailsJson()`. Network, cancellation and response-body read failures throw `TransportError`, retaining the original cause and, when available, `httpStatus`.
+
+`Xml.validateZatca(config, xml, optionsJson)` supplies the host clock when `evaluated_at` is absent. An explicit timestamp makes validation reproducible. The raw API requires `evaluated_at` on WASM. Filesystem helpers are excluded from JS; read files in the host and pass their contents.
+
+The browser loader resolves `fatoora_ffi.wasm` relative to the package modules. Deploy the generated modules and WASM together, or configure the bundler to copy the WASM at that URL. Direct gateway requests depend on the gateway's CORS policy. Keep signing keys and credentials in the host environment appropriate to your application.
+
+If you set `RUSTFLAGS` or `CARGO_ENCODED_RUSTFLAGS`, retain `--cfg getrandom_backend="custom"`: these override `.cargo/config.toml` and otherwise break the WASM random backend.
+
+The WASM build uses getrandom's custom backend with Web Crypto. `xsd-schema` transitively enables Chrono's wasm-bindgen features; the pinned Binaryen step removes unused descriptor exports and maps its retained UTF-8 throw helper to Diplomat's equivalent host import. The build fails if any unsupported import remains, including a JS clock or wasm-bindgen object runtime. Native transport and clock behavior use the normal Rust dependencies.
+
+## Licensing
+
+This package follows the native CLI/FFI archives and Python wheels: the compiled
+validator includes SDK-derived rule predicates and messages, and the upstream
+notices are distributed with it. This is not an entirely MIT/Apache-2.0 artifact.
+
+Original project code is `MIT OR Apache-2.0`. The 257 translated assertion sites
+and imported messages retain the terms recorded for ZATCA SDK `238-R3.4.8`,
+including LGPL v3. The included GPL v3 text is incorporated by LGPL v3; its
+presence is not a separate relicensing of all project code. The SDK's CEN
+stylesheet claims LGPL v3 through EUPL compatibility; the exact upstream revision
+and conversion basis remain unverified, as recorded in the existing native notices.
+
+The npm `license` field points to [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md).
+Read that file and [licenses/zatca/NOTICE.md](licenses/zatca/NOTICE.md), alongside
+[LGPL v3](licenses/zatca/LICENSE-LGPL-3.0.txt) and
+[GPL v3](licenses/zatca/LICENSE-GPL-3.0.txt). Copying notices alone does not resolve
+all distribution obligations; downstream distribution must account for the
+applicable source and relinking requirements. The source and build instructions
+are in the [Fatoority repository](https://github.com/mqqz/fatoority), with versioned
+source under the corresponding release tag. No ZATCA SDK JAR is bundled.
+
+## WASM size
+
+The measured package is 3.525 MB raw and 1.512 MB gzipped, down from an 8.974 MB Rust release artifact. `scripts/build_js.py` selects `wasm-release` (`opt-level = "z"`, LTO, one codegen unit and symbol stripping), runs pinned Binaryen `wasm-opt -Oz`, and rejects artifacts above 4 MB raw or 1.8 MB gzip.
+
+The 15 UBL schemas originally totalled 2,996,782 bytes. WASM embeds them with lossless compression; each build verifies that decompression reproduces every source byte. Unicode regex behavior remains enabled. Run `python3 scripts/check_wasm_size.py --json` to inspect code/data sections and transfer size. Schema compilation still requires decompressed data in memory.

package/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,311 @@
+# Third-party notices
+
+Original fatoority code is available under `MIT OR Apache-2.0`. The materials
+below retain their applicable upstream terms. Paths are relative to the repository
+root; a package may contain only a subset. Existing file notices must be retained.
+
+Source comparisons used ZATCA Java SDK `238-R3.4.8` on 2026-09-11. The source
+references below identify upstream materials and distinguish project changes.
+
+## UBL schemas
+
+Files: `fatoora-core/assets/schemas/UBL2.1/xsd/`.
+Source: [OASIS UBL 2.1 OS, 4 November 2013](https://docs.oasis-open.org/ubl/os-UBL-2.1/),
+obtained through the [ZATCA SDK](https://zatca.gov.sa/en/E-Invoicing/SystemsDevelopers/ComplianceEnablementToolbox/Pages/DownloadSDK.aspx).
+
+The eleven OASIS schemas carry Copyright (c) OASIS Open 2013 and their full
+permission notices. They match the SDK copies without modification. The four
+files below have separate upstream origins:
+
+- `common/CCTS_CCT_SchemaModule-2.1.xsd`: Copyright (C) UN/CEFACT (2006).
+  Unmodified SDK copy; the full permission notice is embedded in the file.
+- `common/UBL-XAdESv132-2.1.xsd` and `common/UBL-XAdESv141-2.1.xsd`: OASIS adaptations
+  of [ETSI XAdES v1.3.2](https://uri.etsi.org/01903/v1.3.2/XAdES.xsd) and
+  [v1.4.1](https://uri.etsi.org/01903/v1.4.1/XAdESv141.xsd). Our copies match the
+  official OASIS UBL 2.1 files byte-for-byte:
+  [v1.3.2](https://docs.oasis-open.org/ubl/os-UBL-2.1/xsd/common/UBL-XAdESv132-2.1.xsd)
+  and [v1.4.1](https://docs.oasis-open.org/ubl/os-UBL-2.1/xsd/common/UBL-XAdESv141-2.1.xsd).
+  The OASIS headers are retained. ETSI publishes BSD-3-Clause terms with its
+  XAdES repository; that notice is reproduced below with its source version.
+- `common/UBL-xmldsig-core-schema-2.1.xsd`: derived from the W3C XML Signature
+  schema. Copyright 2001 The Internet Society and W3C (Massachusetts Institute
+  of Technology, Institut National de Recherche en Informatique et en
+  Automatique, Keio University). All Rights Reserved. OASIS's DOCTYPE changes
+  are described in the file header. Mohamad Alsadhan modified the serial-number
+  type on 2025-12-18 (commit `1fc08cdcfc5d34bda07b56aba4c9dd1aa7a63d6d`), adding
+  `X509SerialNumberString` with pattern `[0-9]+` and using it instead of `integer`
+  for `X509SerialNumber`. The applicable W3C notice follows.
+
+### ETSI XAdES repository notice (BSD-3-Clause)
+
+Source: [ETSI XAdES repository, tag v1.3.1](https://forge.etsi.org/rep/esi/x19_13201_xades/-/raw/v1.3.1/LICENSE).
+This notice comes from the 2024 repository release; the bundled schemas remain
+the unchanged OASIS UBL 2.1 copies from 2013.
+
+Copyright 2024 ETSI
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice,
+   this list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+3. Neither the name of the copyright holder nor the names of its contributors
+   may be used to endorse or promote products derived from this software without
+   specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
+INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
+OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+OF THE POSSIBILITY OF SUCH DAMAGE.
+
+### W3C SOFTWARE NOTICE AND LICENSE
+
+Source: <https://www.w3.org/Consortium/Legal/copyright-software-19980720>.
+
+Copyright © 1994-2002 World Wide Web Consortium, (Massachusetts Institute of
+Technology, Institut National de Recherche en Informatique et en Automatique,
+Keio University). All Rights Reserved. http://www.w3.org/Consortium/Legal/
+
+This W3C work (including software, documents, or other related items) is being
+provided by the copyright holders under the following license. By obtaining,
+using and/or copying this work, you (the licensee) agree that you have read,
+understood, and will comply with the following terms and conditions:
+
+Permission to use, copy, modify, and distribute this software and its
+documentation, with or without modification, for any purpose and without fee or
+royalty is hereby granted, provided that you include the following on ALL copies
+of the software and documentation or portions thereof, including modifications,
+that you make:
+
+1. The full text of this NOTICE in a location viewable to users of the
+   redistributed or derivative work.
+2. Any pre-existing intellectual property disclaimers, notices, or terms and
+   conditions. If none exist, a short notice of the following form (hypertext
+   is preferred, text is permitted) should be used within the body of any
+   redistributed or derivative code: "Copyright © [$date-of-software] World Wide
+   Web Consortium, (Massachusetts Institute of Technology, Institut National de
+   Recherche en Informatique et en Automatique, Keio University). All Rights
+   Reserved. http://www.w3.org/Consortium/Legal/"
+3. Notice of any changes or modifications to the W3C files, including the date
+   changes were made. (We recommend you provide URIs to the location from which
+   the code is derived.)
+
+THIS SOFTWARE AND DOCUMENTATION IS PROVIDED "AS IS," AND COPYRIGHT HOLDERS MAKE
+NO REPRESENTATIONS OR WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED
+TO, WARRANTIES OF MERCHANTABILITY OR FITNESS FOR ANY PARTICULAR PURPOSE OR THAT
+THE USE OF THE SOFTWARE OR DOCUMENTATION WILL NOT INFRINGE ANY THIRD PARTY
+PATENTS, COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS.
+
+COPYRIGHT HOLDERS WILL NOT BE LIABLE FOR ANY DIRECT, INDIRECT, SPECIAL OR
+CONSEQUENTIAL DAMAGES ARISING OUT OF ANY USE OF THE SOFTWARE OR DOCUMENTATION.
+
+The name and trademarks of copyright holders may NOT be used in advertising or
+publicity pertaining to the software without specific, written prior permission.
+Title to copyright in this software and any associated documentation will at all
+times remain with copyright holders.
+
+## ZATCA test samples
+
+Source: ZATCA Java SDK `238-R3.4.8`, linked above.
+
+| Repository files under `fatoora-core/tests/fixtures/` | SDK source | Changes |
+| --- | --- | --- |
+| `invoices/Standard/**` and `invoices/Simplified/**` (19 XML files) | Corresponding paths under `Data/Samples/` | None |
+| `invoices/sample-simplified-invoice.xml` | `Data/Samples/Simplified/Invoice/Simplified_Invoice.xml` | Added final newline |
+| `csr-configs/*.properties` (5 files) | Corresponding files under `Data/Input/` | None |
+| `certs/zatca_cert_b64.txt` | `Data/Certificates/cert.pem` | Local double-base64 and SDK single-base64 decode to identical certificate DER |
+| `pkeys/test_zatca_pkey.der` | `Data/Certificates/ec-secp256k1-priv-key.pem` | Local DER and SDK base64-encoded PEM have the same public-key identity |
+
+The SDK ships `LICENSE.txt` containing the
+[GNU Lesser General Public License, version 3](https://www.gnu.org/licenses/lgpl-3.0.html),
+which incorporates the [GNU GPL, version 3](https://www.gnu.org/licenses/gpl-3.0.html).
+The sample files carry no separate file-specific license notice. These links
+record the license supplied with the source SDK; the samples are not relicensed
+under the project's MIT/Apache-2.0 terms.
+
+The SDK parity corpus under `fatoora-core/tests/fixtures/sdk-parity/` additionally
+records CLI outputs, signed XML, generated test CSRs/keys, canonical bytes, and
+SignedProperties preimages produced by SDK `238-R3.4.8`. Each case's manifest
+entry identifies its input source. The payable-rounding, exempt, zero-rated,
+and document-charge inputs reuse the existing SDK XML samples; CSR inputs reuse
+its English/Arabic properties. The certificate/key are the existing dummy test
+credentials in decoded DER form. The upstream attribution and SDK license
+reference above also apply to these source materials. No SDK JAR or executable
+is bundled.
+The Java adapters in `scripts/sdk-parity/` are repository-authored test tooling.
+
+The business-rule development corpus under
+`fatoora-core/tests/fixtures/business-rules/` includes structured extractions of
+the SDK's CEN and Saudi rule stylesheets, findings extracted from the parity logs,
+and targeted invoice mutations with official SDK validation output. Its
+`NOTICE.md` identifies the exact source files and representation changes; source
+hashes are recorded in `catalog.json`. The SDK's LGPL v3 text and the incorporated
+GPL v3 text accompany those materials. Imported rules and messages retain their
+upstream terms. Extraction and capture scripts are repository-authored. No SDK
+JAR or executable is included.
+
+The rule-family modules in
+`fatoora-core/src/invoice/validation/business_rules/` translate all 257 assertion
+sites from those pinned SDK stylesheets into Rust. Its `metadata.rs` retains
+the corresponding rule identifiers and messages. The source-site mapping and
+tests are recorded in the corpus coverage ledger. The imported predicates and
+messages retain the upstream terms described above; the general XML, numeric,
+and reporting infrastructure is project-authored. Python wheels include the SDK
+rule notices and LGPL/GPL texts under `fatoora/licenses/zatca/`. Native CLI and FFI
+archives include the same files under `licenses/zatca/`. The npm WASM package
+compiles these rule predicates and messages too and includes the same files under
+`licenses/zatca/`. Its package license field points to this notice because the
+project license does not replace these upstream terms.
+
+## Templates
+
+`fatoora-core/assets/templates/*.xml` (3 files) were made by Mohamad Alsadhan,
+adapted from ZATCA examples, as confirmed by the author on 2026-09-18. Related
+XML fragments are used in `fatoora-core/src/invoice/sign.rs`. The author's
+project contributions use the project's `MIT OR Apache-2.0` terms; the ZATCA
+source attribution and upstream terms above are retained for adapted material.
+
+## Other repository materials
+
+- `fatoora-core/tests/fixtures/csrs/test_zatca_en1.csr`: base64-encoded DER test
+  CSR, checked into the project by Mohamad Alsadhan. Its public key differs
+  from the SDK sample key; the original generation command was not recorded.
+- `docs/assets/images/crab-logo.{svg,png,webp}`: project artwork adapting
+  [Ferris](https://www.rustacean.net/) by Karen Rustad Tölva. The upstream author
+  has waived all copyright and related or neighboring rights to Ferris to the
+  extent possible under law. The project artwork was added by Mohamad Alsadhan
+  in commit `f442a3e`; the exact base-image variant was not recorded.
+- `CODE_OF_CONDUCT.md`: adapted from
+  [Contributor Covenant version 2.0](https://www.contributor-covenant.org/version/2/0/code_of_conduct/),
+  originally authored by Coraline Ada Ehmke, under
+  [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/).
+  The [upstream license before version 3](https://github.com/EthicalSource/contributor_covenant/blob/91532d80ea5f39b6685aff4892bc6854bf2f6d6f/LICENSE.md)
+  records that grant. The enforcement contact was set for this project.
+  Existing attribution, including the Mozilla enforcement-ladder reference,
+  is retained.
+
+## Native dependencies
+
+Native binaries and Python wheels use the Rust XML implementations and do not
+link or bundle libxml2. The isolated compatibility maintenance tools under
+`scripts/xml-reference` and `scripts/xsd-compat` retain libxml2 as a reference
+oracle; they are not distributed with the library.
+
+## Historical files
+
+The current tree contains no Schematron XSL files or PDF-A3 invoice samples.
+The following source notes concern files retained only in Git history:
+
+- `fatoora-core/assets/schematrons/CEN-EN16931-UBL.xsl`: matches SDK `238-R3.4.8`;
+  its header claims LGPL v3 through EUPL 1.2 compatibility. The exact upstream
+  revision and basis for that conversion remain unverified.
+- `fatoora-core/assets/schematrons/20210819_ZATCA_E-invoice_Validation_Rules.xsl`:
+  header declares Copyright 2021 ZATCA, LGPL v3; differs from SDK `238-R3.4.8`.
+  Both XSL files were removed in commit `8ffeccf153428f262c56c256046416b67fda0d42`.
+- `fatoora-core/tests/fixtures/invoices/PDF-A3/*.pdf` (16 files): exact SDK sample
+  copies removed in commit `bb473ec`; see the SDK license reference above.
+
+For old distributions containing the stylesheets, review the applicable LGPL/GPL
+texts and source requirements. This notice does not retroactively update those
+archives.
+
+## Diplomat runtime and generated bindings
+
+Diplomat macro/tool 0.16.1 and runtime 0.16.0: https://github.com/rust-diplomat/diplomat.
+The generated C/C++ runtime headers and Rust runtime retain these MIT terms.
+
+MIT License
+
+Copyright (c) 2022 The Diplomat Developers
+
+Permission is hereby granted, free of charge, to any
+person obtaining a copy of this software and associated
+documentation files (the "Software"), to deal in the
+Software without restriction, including without
+limitation the rights to use, copy, modify, merge,
+publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software
+is furnished to do so, subject to the following
+conditions:
+
+The above copyright notice and this permission notice
+shall be included in all copies or substantial portions
+of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF
+ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED
+TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
+PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT
+SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR
+IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+DEALINGS IN THE SOFTWARE.
+
+## Python native extension
+
+The Python wheel links Nanobind 2.12.0 (https://github.com/wjakob/nanobind)
+and its bundled robin-map headers (https://github.com/Tessil/robin-map).
+The following notices are copied from that Nanobind distribution.
+
+### Nanobind
+
+Copyright (c) 2022 Wenzel Jakob <wenzel.jakob@epfl.ch>, All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its contributors
+   may be used to endorse or promote products derived from this software
+   without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+### robin-map
+
+MIT License
+
+Copyright (c) 2017 Thibaut Goetghebuer-Planchon <tessil@gmx.com>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/generated/Address.d.mts

@@ -0,0 +1,32 @@
+// generated by diplomat-tool
+import type { BindingError } from "./BindingError.mjs"
+import type { Text } from "./Text.mjs"
+import type { pointer, codepoint } from "./diplomat-runtime.mjs";
+
+
+
+export class Address {
+    /** @internal */
+    get ffiValue(): pointer;
+    /** @internal */
+    constructor();
+
+
+    static new_(countryCode: string, city: string, street: string, buildingNumber: string, postalCode: string, additionalStreet: string | null, additionalNumber: string | null, district: string | null): Address;
+
+    city(): string;
+
+    street(): string;
+
+    buildingNumber(): string;
+
+    postalCode(): string;
+
+    countryCode(): string;
+
+    additionalStreet(): Text | null;
+
+    additionalNumber(): Text | null;
+
+    district(): Text | null;
+}