nestjs-ddd-cli 3.2.1 → 3.3.0

package/dist/templates/recipes/oidc-resource-server/verifier.ts.hbs

@@ -0,0 +1,440 @@
+import { UnauthorizedException } from '@nestjs/common';
+import {
+  constants,
+  createPublicKey,
+  type JsonWebKey,
+  type KeyObject,
+  verify as verifySignature,
+} from 'node:crypto';
+
+export interface OidcResourceServerOptions {
+  issuer: string;
+  jwksUri: string;
+  audiences: readonly string[];
+  authorizedClients: readonly string[];
+  clockToleranceSeconds?: number;
+  jwksCacheTtlSeconds?: number;
+  jwksRefreshCooldownSeconds?: number;
+  jwksFetchTimeoutMs?: number;
+}
+
+export interface VerifiedOidcAccessToken {
+  readonly [claim: string]: unknown;
+  readonly sub: string;
+  readonly iss: string;
+  readonly aud: string | readonly string[];
+  readonly azp: string;
+  readonly iat: number;
+  readonly exp: number;
+  readonly nbf?: number;
+}
+
+export const OIDC_RESOURCE_SERVER_OPTIONS = Symbol('OIDC_RESOURCE_SERVER_OPTIONS');
+
+const MAX_TOKEN_BYTES = 32 * 1024;
+const MAX_HEADER_BYTES = 4 * 1024;
+const MAX_PAYLOAD_BYTES = 24 * 1024;
+const MAX_SIGNATURE_BYTES = 1024;
+const MAX_JWKS_BYTES = 256 * 1024;
+const MAX_JWKS_KEYS = 100;
+const MAX_KEY_ID_LENGTH = 256;
+const BASE64URL = /^[A-Za-z0-9_-]+$/;
+
+interface JwtHeader {
+  readonly alg: 'RS256';
+  readonly kid: string;
+}
+
+interface RsaJwk extends JsonWebKey {
+  readonly kty: 'RSA';
+  readonly kid: string;
+  readonly n: string;
+  readonly e: string;
+  readonly alg?: string;
+  readonly use?: string;
+  readonly key_ops?: readonly string[];
+}
+
+interface JwksDocument {
+  readonly keys: readonly unknown[];
+}
+
+interface NormalizedOptions {
+  readonly issuer: string;
+  readonly jwksUri: string;
+  readonly audiences: readonly string[];
+  readonly authorizedClients: readonly string[];
+  readonly clockToleranceSeconds: number;
+  readonly jwksCacheTtlSeconds: number;
+  readonly jwksRefreshCooldownSeconds: number;
+  readonly jwksFetchTimeoutMs: number;
+}
+
+function assertHttpsUrl(value: string): void {
+  const parsed = new URL(value);
+  if (
+    parsed.protocol !== 'https:' ||
+    parsed.username !== '' ||
+    parsed.password !== '' ||
+    parsed.hash !== ''
+  ) {
+    throw new Error('Explicit trusted HTTPS issuer/JWKS required');
+  }
+}
+
+function isNonemptyList(values: readonly string[]): boolean {
+  return (
+    Array.isArray(values) &&
+    values.length > 0 &&
+    values.every(
+      (value) => typeof value === 'string' && value.length > 0 && value === value.trim(),
+    )
+  );
+}
+
+function boundedNumber(
+  value: number | undefined,
+  fallback: number,
+  minimum: number,
+  maximum: number,
+  name: string,
+): number {
+  const selected = value ?? fallback;
+  if (!Number.isFinite(selected) || selected < minimum || selected > maximum) {
+    throw new Error(`${name} must be between ${minimum} and ${maximum}`);
+  }
+  return selected;
+}
+
+function decodeBase64Url(segment: string, maximumBytes: number): Buffer {
+  if (
+    segment.length === 0 ||
+    segment.length % 4 === 1 ||
+    !BASE64URL.test(segment) ||
+    segment.length > Math.ceil((maximumBytes * 4) / 3)
+  ) {
+    throw new Error('Malformed token');
+  }
+  const decoded = Buffer.from(segment, 'base64url');
+  if (decoded.length > maximumBytes || decoded.toString('base64url') !== segment) {
+    throw new Error('Malformed token');
+  }
+  return decoded;
+}
+
+function parseJsonRecord(segment: string, maximumBytes: number): Record<string, unknown> {
+  const value: unknown = JSON.parse(decodeBase64Url(segment, maximumBytes).toString('utf8'));
+  if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+    throw new Error('Malformed token');
+  }
+  return value as Record<string, unknown>;
+}
+
+function parseHeader(segment: string): JwtHeader {
+  const header = parseJsonRecord(segment, MAX_HEADER_BYTES);
+  if (
+    header['alg'] !== 'RS256' ||
+    typeof header['kid'] !== 'string' ||
+    header['kid'].length === 0 ||
+    header['kid'].length > MAX_KEY_ID_LENGTH ||
+    header['kid'] !== header['kid'].trim() ||
+    header['crit'] !== undefined ||
+    header['b64'] !== undefined
+  ) {
+    throw new Error('Unsupported token header');
+  }
+  return { alg: 'RS256', kid: header['kid'] };
+}
+
+function parseJwks(value: unknown): JwksDocument {
+  if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+    throw new Error('Invalid JWKS');
+  }
+  const keys = (value as Record<string, unknown>)['keys'];
+  if (!Array.isArray(keys) || keys.length === 0 || keys.length > MAX_JWKS_KEYS) {
+    throw new Error('Invalid JWKS');
+  }
+  return { keys };
+}
+
+function isUsableRsaJwk(value: unknown): value is RsaJwk {
+  if (value === null || typeof value !== 'object' || Array.isArray(value)) return false;
+  const key = value as Record<string, unknown>;
+  return (
+    key['kty'] === 'RSA' &&
+    typeof key['kid'] === 'string' &&
+    key['kid'].length > 0 &&
+    key['kid'].length <= MAX_KEY_ID_LENGTH &&
+    key['kid'] === key['kid'].trim() &&
+    typeof key['n'] === 'string' &&
+    key['n'].length > 0 &&
+    key['n'].length <= 2048 &&
+    BASE64URL.test(key['n']) &&
+    typeof key['e'] === 'string' &&
+    key['e'].length > 0 &&
+    key['e'].length <= 16 &&
+    BASE64URL.test(key['e']) &&
+    (key['alg'] === undefined || key['alg'] === 'RS256') &&
+    (key['use'] === undefined || key['use'] === 'sig') &&
+    (key['key_ops'] === undefined ||
+      (Array.isArray(key['key_ops']) &&
+        key['key_ops'].every((operation) => typeof operation === 'string') &&
+        key['key_ops'].includes('verify')))
+  );
+}
+
+function candidateKeyId(value: unknown): string | undefined {
+  if (value === null || typeof value !== 'object' || Array.isArray(value)) return undefined;
+  const keyId = (value as Record<string, unknown>)['kid'];
+  return typeof keyId === 'string' ? keyId : undefined;
+}
+
+function importRsaVerificationKey(
+  value: unknown,
+): { keyId: string; key: KeyObject } | undefined {
+  if (!isUsableRsaJwk(value)) return undefined;
+  try {
+    const key = createPublicKey({ key: value, format: 'jwk' });
+    const modulusLength = key.asymmetricKeyDetails?.modulusLength;
+    if (
+      key.asymmetricKeyType !== 'rsa' ||
+      typeof modulusLength !== 'number' ||
+      modulusLength < 2048 ||
+      modulusLength > 8192
+    ) {
+      return undefined;
+    }
+    return { keyId: value.kid, key };
+  } catch {
+    // An unusable provider key is not trusted and cannot poison other valid keys.
+    return undefined;
+  }
+}
+
+function audienceClaim(value: unknown): readonly string[] {
+  if (typeof value === 'string' && value.length > 0) return [value];
+  const values: readonly unknown[] = Array.isArray(value) ? value : [];
+  if (
+    values.length > 0 &&
+    values.every((audience) => typeof audience === 'string' && audience.length > 0)
+  ) {
+    return values as readonly string[];
+  }
+  return [];
+}
+
+async function readBoundedBody(
+  response: Awaited<ReturnType<typeof fetch>>,
+  maximumBytes: number,
+): Promise<string> {
+  const declaredLength = response.headers.get('content-length');
+  if (declaredLength !== null) {
+    const parsedLength = Number(declaredLength);
+    if (!Number.isFinite(parsedLength) || parsedLength < 0 || parsedLength > maximumBytes) {
+      throw new Error('JWKS response is too large');
+    }
+  }
+  if (response.body === null) throw new Error('JWKS response body is missing');
+
+  const reader = response.body.getReader();
+  const chunks: Buffer[] = [];
+  let size = 0;
+  try {
+    while (true) {
+      const chunk = await reader.read();
+      if (chunk.done) break;
+      size += chunk.value.byteLength;
+      if (size > maximumBytes) {
+        await reader.cancel();
+        throw new Error('JWKS response is too large');
+      }
+      chunks.push(Buffer.from(chunk.value));
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  return Buffer.concat(chunks, size).toString('utf8');
+}
+
+export class OidcAccessTokenVerifier {
+  private readonly options: NormalizedOptions;
+  private readonly audiences: ReadonlySet<string>;
+  private readonly authorizedClients: ReadonlySet<string>;
+  private keys = new Map<string, KeyObject>();
+  private keysExpireAt = 0;
+  private lastRefreshAttemptAt = 0;
+  private refreshInFlight: Promise<void> | undefined;
+
+  constructor(options: OidcResourceServerOptions) {
+    assertHttpsUrl(options.issuer);
+    assertHttpsUrl(options.jwksUri);
+    if (!isNonemptyList(options.audiences) || !isNonemptyList(options.authorizedClients)) {
+      throw new Error('Explicit resource audiences and authorized clients required');
+    }
+    this.options = {
+      issuer: options.issuer,
+      jwksUri: options.jwksUri,
+      audiences: [...options.audiences],
+      authorizedClients: [...options.authorizedClients],
+      clockToleranceSeconds: boundedNumber(
+        options.clockToleranceSeconds,
+        0,
+        0,
+        60,
+        'Clock tolerance',
+      ),
+      jwksCacheTtlSeconds: boundedNumber(
+        options.jwksCacheTtlSeconds,
+        600,
+        30,
+        86400,
+        'JWKS cache TTL',
+      ),
+      jwksRefreshCooldownSeconds: boundedNumber(
+        options.jwksRefreshCooldownSeconds,
+        30,
+        1,
+        300,
+        'JWKS refresh cooldown',
+      ),
+      jwksFetchTimeoutMs: boundedNumber(
+        options.jwksFetchTimeoutMs,
+        5000,
+        250,
+        10000,
+        'JWKS fetch timeout',
+      ),
+    };
+    this.audiences = new Set(this.options.audiences);
+    this.authorizedClients = new Set(this.options.authorizedClients);
+  }
+
+  async verify(token: string): Promise<VerifiedOidcAccessToken> {
+    try {
+      if (
+        typeof token !== 'string' ||
+        token.length === 0 ||
+        Buffer.byteLength(token, 'utf8') > MAX_TOKEN_BYTES
+      ) {
+        throw new Error('Malformed token');
+      }
+      const segments = token.split('.');
+      if (segments.length !== 3) throw new Error('Malformed token');
+      const [encodedHeader, encodedPayload, encodedSignature] = segments as [
+        string,
+        string,
+        string,
+      ];
+      const header = parseHeader(encodedHeader);
+      const payload = parseJsonRecord(encodedPayload, MAX_PAYLOAD_BYTES);
+      const signature = decodeBase64Url(encodedSignature, MAX_SIGNATURE_BYTES);
+      const key = await this.resolveKey(header.kid);
+      const validSignature = verifySignature(
+        'RSA-SHA256',
+        Buffer.from(`${encodedHeader}.${encodedPayload}`, 'ascii'),
+        { key, padding: constants.RSA_PKCS1_PADDING },
+        signature,
+      );
+      if (!validSignature) throw new Error('Invalid signature');
+      return this.validateClaims(payload);
+    } catch {
+      // Never include bearer tokens, claims, key data or upstream bodies in errors.
+      throw new UnauthorizedException('Invalid resource access token');
+    }
+  }
+
+  private validateClaims(payload: Record<string, unknown>): VerifiedOidcAccessToken {
+    const skew = this.options.clockToleranceSeconds;
+    const now = Date.now() / 1000;
+    const audience = audienceClaim(payload['aud']);
+    if (
+      payload['iss'] !== this.options.issuer ||
+      typeof payload['sub'] !== 'string' ||
+      payload['sub'].trim().length === 0 ||
+      !audience.some((value) => this.audiences.has(value)) ||
+      typeof payload['azp'] !== 'string' ||
+      !this.authorizedClients.has(payload['azp']) ||
+      typeof payload['iat'] !== 'number' ||
+      !Number.isFinite(payload['iat']) ||
+      payload['iat'] < 0 ||
+      payload['iat'] > now + skew ||
+      typeof payload['exp'] !== 'number' ||
+      !Number.isFinite(payload['exp']) ||
+      payload['exp'] <= payload['iat'] ||
+      payload['exp'] <= now - skew ||
+      (payload['nbf'] !== undefined &&
+        (typeof payload['nbf'] !== 'number' ||
+          !Number.isFinite(payload['nbf']) ||
+          payload['nbf'] > now + skew))
+    ) {
+      throw new Error('Rejected claims');
+    }
+    return payload as VerifiedOidcAccessToken;
+  }
+
+  private async resolveKey(keyId: string): Promise<KeyObject> {
+    const now = Date.now();
+    const cached = this.keys.get(keyId);
+    if (cached !== undefined && now < this.keysExpireAt) return cached;
+
+    const refreshCooldownMs = this.options.jwksRefreshCooldownSeconds * 1000;
+    const shouldRefresh =
+      this.lastRefreshAttemptAt === 0 || now - this.lastRefreshAttemptAt >= refreshCooldownMs;
+    if (this.refreshInFlight !== undefined) await this.refreshInFlight;
+    else if (shouldRefresh) await this.refreshKeys();
+
+    const selected = this.keys.get(keyId);
+    if (selected === undefined || Date.now() >= this.keysExpireAt) {
+      throw new Error('No trusted key');
+    }
+    return selected;
+  }
+
+  private async refreshKeys(): Promise<void> {
+    if (this.refreshInFlight !== undefined) return this.refreshInFlight;
+    this.lastRefreshAttemptAt = Date.now();
+    const operation = this.fetchKeys().then((keys) => {
+      this.keys = keys;
+      this.keysExpireAt = Date.now() + this.options.jwksCacheTtlSeconds * 1000;
+    });
+    this.refreshInFlight = operation;
+    try {
+      await operation;
+    } finally {
+      this.refreshInFlight = undefined;
+    }
+  }
+
+  private async fetchKeys(): Promise<Map<string, KeyObject>> {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), this.options.jwksFetchTimeoutMs);
+    try {
+      const response = await fetch(this.options.jwksUri, {
+        method: 'GET',
+        redirect: 'error',
+        signal: controller.signal,
+        headers: { accept: 'application/json' },
+      });
+      if (!response.ok) throw new Error('JWKS request failed');
+      const document: unknown = JSON.parse(await readBoundedBody(response, MAX_JWKS_BYTES));
+      const jwks = parseJwks(document);
+      const seenKeyIds = new Set<string>();
+      const imported = new Map<string, KeyObject>();
+      for (const candidate of jwks.keys) {
+        const keyId = candidateKeyId(candidate);
+        if (keyId !== undefined) {
+          if (seenKeyIds.has(keyId)) throw new Error('Duplicate JWKS key identifier');
+          seenKeyIds.add(keyId);
+        }
+        const verificationKey = importRsaVerificationKey(candidate);
+        if (verificationKey !== undefined) {
+          imported.set(verificationKey.keyId, verificationKey.key);
+        }
+      }
+      if (imported.size === 0) throw new Error('JWKS has no usable RS256 keys');
+      return imported;
+    } finally {
+      clearTimeout(timeout);
+    }
+  }
+}

package/dist/templates/recipes/platform-parc-bound-authorization/README.md.hbs

@@ -0,0 +1,92 @@
+# PARC bound authorization
+
+Generate with `ddd recipe platform-parc-bound-authorization --dry-run`, then
+without `--dry-run`. Existing differing files and symlinks are refused. No
+dependency installation, role assignment, application wiring or activation occurs.
+
+This integration uses the current `POST /v1/decisions/check-bound` contract.
+PARC consumes a fresh opaque Service Access lease with this service's admitted
+machine credential. Do **not** place the legacy Service Access introspection
+guard before this call: leases are single-use. Do not decode the lease, construct
+an actor, relabel IAM as ZITADEL, forward browser bearer/cookie headers, or fall
+back to `/v1/decisions/check`. The client makes one request and does not retry.
+
+```typescript
+const parc = new ParcBoundAuthorizationClient(config.parcHttpsOrigin, 'owner-service');
+const receipt = await parc.check({
+  lease: opaqueLease,
+  credential: config.admittedServiceCredential,
+  permission: 'owner-service.records.update',
+  action: 'update',
+  resource: { type: 'record', id: record.id },
+  contextDigest: ownerVerifiedOperationDigest,
+  expected: { businessId: record.businessId, clientAppId: configuredApplicationId },
+});
+// Enforce owner invariants and receipt expiry immediately before the mutation.
+// Persist decisionReference with the owner transaction and its audit/outbox.
+```
+
+Select permission/action/resource from the owner route and persisted domain
+facts, never caller-supplied role or identity headers. Supply
+`expected.subjectId` when independently verified and required by the operation.
+The returned subject is PARC's canonical actor, not a locally reconstructed one.
+The operation digest must cover the owner-verified material being authorized.
+
+For multi-tenant create/quote intake, use a required tenant selector in the route
+as `expected.businessId`. It is a claim to check, not authenticated scope: do not
+introspect the single-use lease to derive it. `check` returns only after PARC's
+canonical business exactly matches that selector. Use the returned `businessId`,
+`subjectId` and `clientAppId` as authorized scope. No static tenant configuration
+or optional-business mode is needed. An application selector, when the service
+accepts several admitted applications, is likewise untrusted until exact receipt
+matching; route-specific application restrictions remain the owner's concern.
+Include the selected tenant and operation inputs in the digest, constrain every
+existing-resource lookup to that tenant, and reject any conflicting tenant in
+the body. Do not expose tenant data or make side effects before authorization.
+
+The client checks freshness when the HTTP response arrives, not when a later
+owner transaction commits. Preserve `expiresAt` alongside the immutable receipt;
+after Contract resolution and database lock waits, check it immediately before
+the protected write and again before committing. Expiry means rollback, not an
+extended TTL or reuse of the consumed lease. A SQL expiry predicate must use a
+current wall clock, not a transaction-start timestamp. For flows likely to exceed
+five seconds, resolve through an independently authorized reader first, then
+consume a fresh lease for the final decision bound to the resolved immutable
+terms/version and mutation inputs. Revalidate those inputs in the transaction;
+an earlier decision cannot authorize changed terms. If both preliminary and
+final authorization are required, they need distinct fresh leases.
+
+This recipe authorizes one owner operation. It does not issue downstream
+delegated authority, turn a decision reference into a Contract credential, or
+make caller-supplied realm/session headers trustworthy. A Billing-to-Contract
+reader needs its own supported governed authority contract; this recipe alone
+does not complete that integration.
+
+The lease carries authentication context to PARC. Its Service Access adapter
+validates the canonical actor, issuer/consumer grants, audience and membership.
+For shared IAM external authentication PARC preserves realm/session evidence,
+requires its enabled current relationship adapter and fresh IAM evaluation,
+and excludes staff-managed assignments. This shared-external contract is not
+the internal staff contract: it accepts only `SHARED_EXTERNAL`,
+`shared-external-v2`, and issuer `https://id.joonalabs.com`.
+
+For ZITADEL-issued staff tokens verified through IAM, Identity retains the
+original ZITADEL issuer. SA's governed staff readback requires provider `zitadel`
+and internal actor/organization scope; it emits `authenticatedBy: 'zitadel'`
+without shared-external authentication provenance. PARC accepts that through its
+existing bound staff path. Do not relabel staff as `iam-orchestrator` or require
+the shared-external relationship path for this flow. A legacy consumer that
+accepts this canonical ZITADEL context is not blocked merely because IAM did the
+upstream verification; adopting this recipe is not a new staff-release gate.
+Neither issuer label grants permission. Source compatibility does not establish
+governed reader admission or prove a real staff login through deployed owners.
+The receipt is PARC decision evidence; it does not independently prove an IAM
+login or expose the session/realm evidence retained in PARC's decision record.
+
+Missing admission, disabled relationships, revoked scope or upstream failure
+denies access. No generic key or legacy fallback is provided. HTTPS verification
+must remain enabled; use `NODE_EXTRA_CA_CERTS` for private CAs. Response bodies
+are bounded at 16 KiB under a five-second deadline; redirects are refused.
+Receipts must bind the exact scope, operation and resource and expire within
+PARC's five-second bound. Never cache/reuse them as durable permissions. A failed
+request may already have consumed its lease; obtain fresh authority explicitly.

package/dist/templates/recipes/platform-parc-bound-authorization/client.ts.hbs

@@ -0,0 +1,142 @@
+import { BoundedJsonHttpClient } from '../../auth/oauth2-token-introspection/bounded-json-http.client';
+
+export interface ParcBoundRequest {
+  /** Fresh opaque SA lease. PARC consumes it; do not introspect it first. */
+  lease: string;
+  /** This consuming service's admitted machine credential, from private configuration. */
+  credential: string;
+  permission: string;
+  action: string;
+  resource: { type: string; id: string };
+  /** SHA-256 of the owner-verified operation material. */
+  contextDigest: string;
+  /** Persisted owner scope or an untrusted route selector; trusted only after exact receipt matching. */
+  expected: { businessId: string; clientAppId: string; subjectId?: string };
+}
+
+export interface ParcBoundReceipt {
+  decisionReference: string;
+  allowed: true;
+  subjectId: string;
+  businessId: string;
+  clientAppId: string;
+  service: string;
+  permission: string;
+  action: string;
+  resource: Readonly<{ type: string; id: string }>;
+  contextDigest: string;
+  decidedAt: string;
+  expiresAt: string;
+}
+
+export class ParcBoundAuthorizationError extends Error {
+  constructor(readonly reason: 'invalid_request' | 'denied' | 'unavailable' | 'invalid_receipt') {
+    super('PARC bound authorization ' + reason);
+    this.name = 'ParcBoundAuthorizationError';
+  }
+}
+
+const uuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+const identifier = /^[A-Za-z0-9][A-Za-z0-9._:@/-]*$/;
+
+/** No actor reconstruction, role assignment, retry, cache or legacy fallback. */
+export class ParcBoundAuthorizationClient {
+  private readonly origin: string;
+  private readonly service: string;
+
+  constructor(origin: string, service: string) {
+    this.requireTls();
+    try {
+      const url = new URL(origin);
+      if (url.protocol !== 'https:' || url.username || url.password ||
+          url.pathname !== '/' || origin.includes('?') || origin.includes('#') ||
+          !/^[a-z][a-z0-9-]{0,62}$/.test(service)) throw new Error();
+      this.origin = url.origin;
+      this.service = service;
+    } catch { throw new ParcBoundAuthorizationError('invalid_request'); }
+  }
+
+  /** Checks freshness on receipt only; the owner must recheck expiresAt at its write/commit boundary. */
+  async check(input: ParcBoundRequest): Promise<Readonly<ParcBoundReceipt>> {
+    this.requireTls();
+    // Snapshot validated material before the asynchronous request.
+    const lease = this.authority(input?.lease);
+    const credential = this.authority(input?.credential);
+    const permission = this.token(input?.permission, 200, 3);
+    if (!permission.startsWith(this.service + '.')) this.invalid();
+    const request = {
+      permission,
+      action: this.token(input?.action, 200),
+      resource: {
+        type: this.token(input?.resource?.type, 100),
+        id: this.token(input?.resource?.id, 200),
+      },
+      contextDigest: input?.contextDigest,
+    };
+    if (typeof request.contextDigest !== 'string' ||
+        !/^[a-f0-9]{64}$/.test(request.contextDigest)) this.invalid();
+    const expected = {
+      businessId: this.id(input?.expected?.businessId),
+      clientAppId: this.id(input?.expected?.clientAppId),
+      subjectId: input?.expected?.subjectId === undefined
+        ? undefined : this.id(input.expected.subjectId),
+    };
+    const startedAt = Date.now();
+    let value: unknown;
+    try {
+      value = await new BoundedJsonHttpClient({
+        origin: this.origin,
+        timeoutMs: 5000,
+        maxResponseBytes: 16384,
+        requestHeaders: {
+          'x-request-context-lease': lease,
+          'x-service-access-credential': credential,
+        },
+      }).postJson(['v1', 'decisions', 'check-bound'], request);
+    } catch { throw new ParcBoundAuthorizationError('unavailable'); }
+    this.requireTls();
+    const fail = (): never => { throw new ParcBoundAuthorizationError('invalid_receipt'); };
+    if (!value || typeof value !== 'object' || Array.isArray(value)) fail();
+    const r = value as Record<string, unknown>;
+    const keys = ['decisionReference', 'allowed', 'subjectId', 'businessId', 'clientAppId',
+      'service', 'permission', 'action', 'resource', 'contextDigest', 'decidedAt', 'expiresAt'];
+    if (Object.keys(r).length !== keys.length || keys.some(k => !Object.hasOwn(r, k))) fail();
+    const resource = r.resource as Record<string, unknown> | undefined;
+    if (typeof r.allowed !== 'boolean' || typeof r.subjectId !== 'string' || !uuid.test(r.subjectId) ||
+        r.businessId !== expected.businessId || r.clientAppId !== expected.clientAppId ||
+        (expected.subjectId !== undefined && r.subjectId !== expected.subjectId) ||
+        r.service !== this.service || r.permission !== request.permission || r.action !== request.action ||
+        r.contextDigest !== request.contextDigest || !resource || Array.isArray(resource) ||
+        Object.keys(resource).sort().join(',') !== 'id,type' ||
+        resource.type !== request.resource.type || resource.id !== request.resource.id ||
+        typeof r.decisionReference !== 'string' || !/^PARC-BND-[A-Za-z0-9_-]{24}$/.test(r.decisionReference)) fail();
+    const date = (v: unknown): number => {
+      if (typeof v !== 'string') return fail();
+      const time = Date.parse(v);
+      if (!Number.isFinite(time) || new Date(time).toISOString() !== v) return fail();
+      return time;
+    };
+    const decided = date(r.decidedAt), expires = date(r.expiresAt), now = Date.now();
+    if (decided < startedAt - 1000 || decided > now + 1000 || expires <= now ||
+        expires <= decided || expires - decided > 5000) fail();
+    if (!r.allowed) throw new ParcBoundAuthorizationError('denied');
+    return Object.freeze({ ...r, resource: Object.freeze({ ...resource }) }) as unknown as Readonly<ParcBoundReceipt>;
+  }
+
+  private requireTls(): void {
+    if (process.env.NODE_TLS_REJECT_UNAUTHORIZED === '0') this.invalid();
+  }
+  private token(value: unknown, max: number, min = 1): string {
+    if (typeof value !== 'string' || value.length < min || value.length > max || !identifier.test(value)) this.invalid();
+    return value as string;
+  }
+  private authority(value: unknown): string {
+    if (typeof value !== 'string' || !value || value.length > 4096 || /[\s\u0000-\u001f\u007f]/.test(value)) this.invalid();
+    return value as string;
+  }
+  private id(value: unknown): string {
+    if (typeof value !== 'string' || !uuid.test(value)) this.invalid();
+    return value as string;
+  }
+  private invalid(): never { throw new ParcBoundAuthorizationError('invalid_request'); }
+}