xoonya 3.0.1 → 3.1.0

package/lib/auth_interop_contract.js

@@ -1,69 +1,69 @@
-"use strict";
-
-const pkg = require("../package.json");
-
-function buildAuthInteropContract() {
-  return {
-    product: "xoonya",
-    category: "proof-auth-interop-contract",
-    contract_version: "xoonya-auth-interop-contract-v1",
-    service_version: pkg.version,
-    primary_posture: "proof_verification_with_oauth_oidc_and_token_exchange_interop",
-    supported_interop_profiles: [
-      {
-        profile_id: "proof_verifier_client_credentials",
-        standards: ["oauth_2_0", "oidc_optional"],
-        intended_use: "machine verifier access to proof verification surfaces",
-        primary_routes: ["/v1/receipts/verify", "/v1/proof-bundles/verify"]
-      },
-      {
-        profile_id: "runtime_to_proof_handoff_token_exchange",
-        standards: ["oauth_2_0_token_exchange", "jwt_bearer_optional"],
-        intended_use: "map runtime-side bearer posture into bounded proof-side review and bridge intake",
-        primary_routes: ["/v1/proof-center/bridge/economic-handoff"]
-      },
-      {
-        profile_id: "proof_role_governance_interop",
-        standards: ["oauth_2_0", "oidc"],
-        intended_use: "operator and reviewer access to frozen proof-role and governance surfaces",
-        primary_routes: ["/v1/role-freeze", "/v1/role-freeze/package"]
-      }
-    ],
-    native_proof_mapping: {
-      proof_verify: "/v1/proof-bundles/verify",
-      receipt_verify: "/v1/receipts/verify",
-      bridge_economic_handoff: "/v1/proof-center/bridge/economic-handoff",
-      role_freeze_package: "/v1/role-freeze/package"
-    },
-    guardrails: [
-      "proof verification semantics remain canonical inside xoonya rather than inside bearer tokens",
-      "token exchange may convey bounded review posture but must not redefine proof truth",
-      "bridge intake auth must remain subordinate to proof-side review and governance checks"
-    ],
-    linked_surfaces: {
-      openapi_ref: "/openapi.json",
-      asyncapi_ref: "/asyncapi.json",
-      cloudevents_ref: "/cloudevents.json",
-      service_contract_ref: "SERVICE_CONTRACT.md"
-    }
-  };
-}
-
-function summarizeAuthInteropContract() {
-  const contract = buildAuthInteropContract();
-  return {
-    product: "xoonya",
-    category: "proof-auth-interop-contract-summary",
-    summary_version: "xoonya-auth-interop-contract-summary-v1",
-    contract_version: contract.contract_version,
-    profile_count: contract.supported_interop_profiles.length,
-    primary_posture: contract.primary_posture,
-    primary_protocol_lanes: ["proof_verify", "receipt_verify", "bridge"],
-    linked_surfaces: contract.linked_surfaces
-  };
-}
-
-module.exports = {
-  buildAuthInteropContract,
-  summarizeAuthInteropContract
-};
+"use strict";
+
+const pkg = require("../package.json");
+
+function buildAuthInteropContract() {
+  return {
+    product: "xoonya",
+    category: "proof-auth-interop-contract",
+    contract_version: "xoonya-auth-interop-contract-v1",
+    service_version: pkg.version,
+    primary_posture: "proof_verification_with_oauth_oidc_and_token_exchange_interop",
+    supported_interop_profiles: [
+      {
+        profile_id: "proof_verifier_client_credentials",
+        standards: ["oauth_2_0", "oidc_optional"],
+        intended_use: "machine verifier access to proof verification surfaces",
+        primary_routes: ["/v1/receipts/verify", "/v1/proof-bundles/verify"]
+      },
+      {
+        profile_id: "runtime_to_proof_handoff_token_exchange",
+        standards: ["oauth_2_0_token_exchange", "jwt_bearer_optional"],
+        intended_use: "map runtime-side bearer posture into bounded proof-side review and bridge intake",
+        primary_routes: ["/v1/proof-center/bridge/economic-handoff"]
+      },
+      {
+        profile_id: "proof_role_governance_interop",
+        standards: ["oauth_2_0", "oidc"],
+        intended_use: "operator and reviewer access to frozen proof-role and governance surfaces",
+        primary_routes: ["/v1/role-freeze", "/v1/role-freeze/package"]
+      }
+    ],
+    native_proof_mapping: {
+      proof_verify: "/v1/proof-bundles/verify",
+      receipt_verify: "/v1/receipts/verify",
+      bridge_economic_handoff: "/v1/proof-center/bridge/economic-handoff",
+      role_freeze_package: "/v1/role-freeze/package"
+    },
+    guardrails: [
+      "proof verification semantics remain canonical inside xoonya rather than inside bearer tokens",
+      "token exchange may convey bounded review posture but must not redefine proof truth",
+      "bridge intake auth must remain subordinate to proof-side review and governance checks"
+    ],
+    linked_surfaces: {
+      openapi_ref: "/openapi.json",
+      asyncapi_ref: "/asyncapi.json",
+      cloudevents_ref: "/cloudevents.json",
+      service_contract_ref: "SERVICE_CONTRACT.md"
+    }
+  };
+}
+
+function summarizeAuthInteropContract() {
+  const contract = buildAuthInteropContract();
+  return {
+    product: "xoonya",
+    category: "proof-auth-interop-contract-summary",
+    summary_version: "xoonya-auth-interop-contract-summary-v1",
+    contract_version: contract.contract_version,
+    profile_count: contract.supported_interop_profiles.length,
+    primary_posture: contract.primary_posture,
+    primary_protocol_lanes: ["proof_verify", "receipt_verify", "bridge"],
+    linked_surfaces: contract.linked_surfaces
+  };
+}
+
+module.exports = {
+  buildAuthInteropContract,
+  summarizeAuthInteropContract
+};

package/lib/authority_binding_lifecycle_contract.js

@@ -0,0 +1,182 @@
+"use strict";
+
+const packageJson = require("../package.json");
+
+function buildAuthorityBindingLifecycleContractPack() {
+  return {
+    ok: true,
+    product: packageJson.name,
+    category: "naxytra-authority-binding-lifecycle-contract",
+    pack_version: "naxytra-authority-binding-lifecycle-contract-v1",
+    doctrine: "xoonya_reviews_binding_lifecycle_state_without_claiming_universal_external_identity_authority_or_custody_truth",
+    model_state: "core_now",
+    core_claim: "binding lifecycle state is the proof-linked record for identity bindings authority bindings spend credentials and delegated signing",
+    binding_kinds: [
+      {
+        binding_kind: "identity_binding",
+        description: "binds a subject to an identity posture"
+      },
+      {
+        binding_kind: "authority_binding",
+        description: "binds a subject to an authority posture"
+      },
+      {
+        binding_kind: "spend_credential",
+        description: "binds a subject to a spend credential or delegated spend posture"
+      },
+      {
+        binding_kind: "delegation_grant",
+        description: "records a delegated capability grant"
+      },
+      {
+        binding_kind: "delegation_revocation",
+        description: "records that a delegation has been revoked"
+      },
+      {
+        binding_kind: "key_binding",
+        description: "binds a subject to a key or public-key reference"
+      }
+    ],
+    lifecycle_states: [
+      { state: "active", description: "usable and currently in force" },
+      { state: "rotated", description: "superseded by a successor binding" },
+      { state: "revoked", description: "disabled before natural expiry" },
+      { state: "expired", description: "no longer valid because the validity window ended" },
+      { state: "suspended", description: "temporarily unusable pending review" }
+    ],
+    canonical_objects: [
+      {
+        object_id: "binding_lifecycle_record",
+        role: "versioned_lineage_preserving_state_record_for_a_binding_or_credential",
+        required_fields: [
+          "version",
+          "binding_id",
+          "binding_kind",
+          "subject_id",
+          "status",
+          "issued_by",
+          "issued_at_iso"
+        ],
+        recommended_fields: [
+          "expires_at_iso",
+          "rotated_from_binding_id",
+          "replaced_by_binding_id",
+          "revoked_at_iso",
+          "revoke_reason",
+          "scope",
+          "key_ref",
+          "signature_suite",
+          "proof_ref",
+          "anchor_ref"
+        ],
+        optional_fields: [
+          "delegation_ref",
+          "controller_id",
+          "previous_binding_id",
+          "metadata"
+        ],
+        primary_surfaces: [
+          "/v1/phases/phase-4/identity-registry/proof",
+          "/v1/phases/phase-4/identity-registry/proof/summary",
+          "/v1/phases/phase-4/attestation/proof",
+          "/v1/proof-center/trust-portability",
+          "/v1/proof-center/trust-portability/summary"
+        ]
+      }
+    ],
+    transition_rules: [
+      "issue_creates_a_new_active_binding",
+      "renew_extends_expiry_without_breaking_lineage",
+      "rotate_creates_a_successor_binding_and_preserves_predecessor_lineage",
+      "revoke_disables_the_binding_and_preserves_auditability",
+      "expire_marks_the_binding_inactive_when_the_validity_window_ends",
+      "narrow_scope_must_not_silently_broaden_access"
+    ],
+    delegated_signing_rules: [
+      "delegated_signing_must_be_explicit",
+      "delegated_signing_must_be_scope_bounded",
+      "delegated_signing_must_be_time_bounded_unless_a_product_decision_says_otherwise",
+      "delegated_signing_must_preserve_subject_and_issuer_lineage",
+      "delegated_signing_must_not_become_hidden_shared_secret_magic"
+    ],
+    lineage_model: [
+      {
+        layer_id: "binding_review",
+        order_index: 1,
+        objects: ["binding_lifecycle_record"],
+        invariants: [
+          "issuance_is_explicit",
+          "binding_ids_are_versioned_and_auditable"
+        ]
+      },
+      {
+        layer_id: "binding_portability",
+        order_index: 2,
+        objects: ["binding_lifecycle_record"],
+        invariants: [
+          "predecessor_and_successor_linkage_is_preserved",
+          "revocation_history_remains_visible"
+        ]
+      },
+      {
+        layer_id: "proof_followthrough",
+        order_index: 3,
+        objects: ["binding_lifecycle_record"],
+        invariants: [
+          "binding_lineage_can_be_carried_into_proof_without_becoming_proof_truth_itself",
+          "optional_proof_and_anchor_refs_do_not_change_base_binding_meaning"
+        ]
+      }
+    ],
+    invariants: [
+      "binding_state_changes_are_explicit_and_versioned",
+      "rotation_preserves_lineage",
+      "revocation_preserves_auditability",
+      "delegated_signing_remains_bounded",
+      "binding_lifecycle_is_a_proof_followthrough_concept_not_a_general_web_token_story"
+    ],
+    linked_surfaces: {
+      identity_binding_proof_ref: "/v1/phases/phase-4/identity-registry/proof",
+      identity_binding_proof_summary_ref: "/v1/phases/phase-4/identity-registry/proof/summary",
+      attestation_proof_ref: "/v1/phases/phase-4/attestation/proof",
+      trust_portability_ref: "/v1/proof-center/trust-portability",
+      trust_portability_summary_ref: "/v1/proof-center/trust-portability/summary"
+    },
+    claim_boundary: "claim_the_xoonya_binding_lifecycle_followthrough_only_without_claiming_universal_external_identity_authority_or_custody_truth"
+  };
+}
+
+function summarizeAuthorityBindingLifecycleContractPack() {
+  const pack = buildAuthorityBindingLifecycleContractPack();
+  return {
+    ok: true,
+    product: pack.product,
+    category: pack.category,
+    summary_version: "naxytra-authority-binding-lifecycle-contract-summary-v1",
+    pack_version: pack.pack_version,
+    model_state: pack.model_state,
+    binding_kind_count: pack.binding_kinds.length,
+    lifecycle_state_count: pack.lifecycle_states.length,
+    canonical_object_count: pack.canonical_objects.length,
+    transition_rule_count: pack.transition_rules.length,
+    delegated_signing_rule_count: pack.delegated_signing_rules.length,
+    linked_surfaces: pack.linked_surfaces
+  };
+}
+
+function getAuthorityBindingKindDetail(bindingKind) {
+  const normalized = String(bindingKind || "").trim().toLowerCase();
+  return (buildAuthorityBindingLifecycleContractPack().binding_kinds || []).find((entry) => entry.binding_kind === normalized) || null;
+}
+
+function getAuthorityLifecycleStateDetail(state) {
+  const normalized = String(state || "").trim().toLowerCase();
+  return (buildAuthorityBindingLifecycleContractPack().lifecycle_states || []).find((entry) => entry.state === normalized) || null;
+}
+
+module.exports = {
+  buildAuthorityBindingLifecycleContractPack,
+  summarizeAuthorityBindingLifecycleContractPack,
+  getAuthorityBindingKindDetail,
+  getAuthorityLifecycleStateDetail
+};

package/lib/bridge_intelligence.js

@@ -1,102 +1,102 @@
-"use strict";
-
-const packageJson = require("../package.json");
-const proofSdk = require("../proof_sdk");
-
-function classifyBridgeCoverageState(bridgeSummary) {
-  if (bridgeSummary.capability_count >= 8 && bridgeSummary.profile_count >= 3) return "broad";
-  if (bridgeSummary.capability_count >= 4 && bridgeSummary.profile_count >= 2) return "working";
-  return "thin";
-}
-
-function classifyCompatibilityStrengthState(compatibilityPack) {
-  const preservedRouteCount = Array.isArray(compatibilityPack.preserved_routes)
-    ? compatibilityPack.preserved_routes.length
-    : 0;
-  const preservedHelperCount = Array.isArray(compatibilityPack.preserved_helpers)
-    ? compatibilityPack.preserved_helpers.length
-    : 0;
-  if (preservedRouteCount >= 5 && preservedHelperCount >= 8) return "strong";
-  if (preservedRouteCount >= 3 && preservedHelperCount >= 5) return "working";
-  return "thin";
-}
-
-function classifyHandoffDependencyState(operatorReviewPack, handoffCenterSummary) {
-  const includedSectionCount = Array.isArray(operatorReviewPack.included_sections)
-    ? operatorReviewPack.included_sections.length
-    : 0;
-  if (includedSectionCount >= 6 && handoffCenterSummary.source_ref_count >= 3) return "strong";
-  if (includedSectionCount >= 4 && handoffCenterSummary.source_ref_count >= 2) return "working";
-  return "thin";
-}
-
-function buildBridgeIntelligencePack(input) {
-  const payload = input && typeof input === "object" && !Array.isArray(input) ? input : {};
-  const bridgeSummary = proofSdk.summarizeBridgeCenter();
-  const compatibilityPack = proofSdk.buildBridgeCompatibilityPack(payload);
-  const operatorReviewPack = proofSdk.buildBridgeOperatorReviewPack(payload);
-  const handoffCenterSummary = proofSdk.summarizeInteractionResultPackageHandoffCenter();
-
-  const bridgeCoverageState = classifyBridgeCoverageState(bridgeSummary);
-  const compatibilityStrengthState = classifyCompatibilityStrengthState(compatibilityPack);
-  const handoffDependencyState = classifyHandoffDependencyState(operatorReviewPack, handoffCenterSummary);
-
-  let nextBestAction = "continue_bridge_review_motion";
-  if (bridgeCoverageState === "thin") {
-    nextBestAction = "strengthen_bridge_coverage";
-  } else if (compatibilityStrengthState === "thin") {
-    nextBestAction = "strengthen_compatibility_posture";
-  } else if (handoffDependencyState !== "strong") {
-    nextBestAction = "strengthen_bridge_handoff_continuity";
-  } else if (compatibilityStrengthState === "working" || handoffDependencyState === "working") {
-    nextBestAction = "inspect_bridge_operator_pack";
-  }
-
-  return {
-    ok: true,
-    product: packageJson.name,
-    category: "proof-bridge-intelligence-pack",
-    bridge_coverage_state: bridgeCoverageState,
-    compatibility_strength_state: compatibilityStrengthState,
-    handoff_dependency_state: handoffDependencyState,
-    recommended_bridge_motion: "bridge_operator_review_and_handoff_followthrough",
-    next_best_action: nextBestAction,
-    explanation_signals: {
-      bridge_capability_count: bridgeSummary.capability_count,
-      bridge_profile_count: bridgeSummary.profile_count,
-      compatibility_route_count: Array.isArray(compatibilityPack.preserved_routes) ? compatibilityPack.preserved_routes.length : 0,
-      compatibility_helper_count: Array.isArray(compatibilityPack.preserved_helpers) ? compatibilityPack.preserved_helpers.length : 0,
-      compatibility_profile_version_count: Array.isArray(compatibilityPack.profile_versions) ? compatibilityPack.profile_versions.length : 0,
-      operator_pack_section_count: Array.isArray(operatorReviewPack.included_sections) ? operatorReviewPack.included_sections.length : 0,
-      handoff_source_ref_count: handoffCenterSummary.source_ref_count,
-      handoff_mode_count: handoffCenterSummary.handoff_mode_count
-    },
-    linked_surfaces: {
-      bridge_summary_ref: "/v1/proof-center/bridge/summary",
-      bridge_operator_review_pack_ref: "/v1/proof-center/bridge/operator-review-pack",
-      bridge_compatibility_pack_ref: "/v1/proof-center/bridge/compatibility-pack",
-      bridge_workflow_pack_ref: "/v1/proof-center/bridge/workflow-pack",
-      result_package_handoff_summary_ref: "/v1/proof-center/result-package-handoff/summary",
-      result_package_handoff_run_ref: "/v1/proof-center/result-package-handoff/run"
-    }
-  };
-}
-
-function summarizeBridgeIntelligencePack(input) {
-  const pack = buildBridgeIntelligencePack(input);
-  return {
-    ok: true,
-    product: pack.product,
-    category: pack.category,
-    bridge_coverage_state: pack.bridge_coverage_state,
-    compatibility_strength_state: pack.compatibility_strength_state,
-    handoff_dependency_state: pack.handoff_dependency_state,
-    next_best_action: pack.next_best_action,
-    signal_count: Object.keys(pack.explanation_signals).length
-  };
-}
-
-module.exports = {
-  buildBridgeIntelligencePack,
-  summarizeBridgeIntelligencePack
-};
+"use strict";
+
+const packageJson = require("../package.json");
+const proofSdk = require("../proof_sdk");
+
+function classifyBridgeCoverageState(bridgeSummary) {
+  if (bridgeSummary.capability_count >= 8 && bridgeSummary.profile_count >= 3) return "broad";
+  if (bridgeSummary.capability_count >= 4 && bridgeSummary.profile_count >= 2) return "working";
+  return "thin";
+}
+
+function classifyCompatibilityStrengthState(compatibilityPack) {
+  const preservedRouteCount = Array.isArray(compatibilityPack.preserved_routes)
+    ? compatibilityPack.preserved_routes.length
+    : 0;
+  const preservedHelperCount = Array.isArray(compatibilityPack.preserved_helpers)
+    ? compatibilityPack.preserved_helpers.length
+    : 0;
+  if (preservedRouteCount >= 5 && preservedHelperCount >= 8) return "strong";
+  if (preservedRouteCount >= 3 && preservedHelperCount >= 5) return "working";
+  return "thin";
+}
+
+function classifyHandoffDependencyState(operatorReviewPack, handoffCenterSummary) {
+  const includedSectionCount = Array.isArray(operatorReviewPack.included_sections)
+    ? operatorReviewPack.included_sections.length
+    : 0;
+  if (includedSectionCount >= 6 && handoffCenterSummary.source_ref_count >= 3) return "strong";
+  if (includedSectionCount >= 4 && handoffCenterSummary.source_ref_count >= 2) return "working";
+  return "thin";
+}
+
+function buildBridgeIntelligencePack(input) {
+  const payload = input && typeof input === "object" && !Array.isArray(input) ? input : {};
+  const bridgeSummary = proofSdk.summarizeBridgeCenter();
+  const compatibilityPack = proofSdk.buildBridgeCompatibilityPack(payload);
+  const operatorReviewPack = proofSdk.buildBridgeOperatorReviewPack(payload);
+  const handoffCenterSummary = proofSdk.summarizeInteractionResultPackageHandoffCenter();
+
+  const bridgeCoverageState = classifyBridgeCoverageState(bridgeSummary);
+  const compatibilityStrengthState = classifyCompatibilityStrengthState(compatibilityPack);
+  const handoffDependencyState = classifyHandoffDependencyState(operatorReviewPack, handoffCenterSummary);
+
+  let nextBestAction = "continue_bridge_review_motion";
+  if (bridgeCoverageState === "thin") {
+    nextBestAction = "strengthen_bridge_coverage";
+  } else if (compatibilityStrengthState === "thin") {
+    nextBestAction = "strengthen_compatibility_posture";
+  } else if (handoffDependencyState !== "strong") {
+    nextBestAction = "strengthen_bridge_handoff_continuity";
+  } else if (compatibilityStrengthState === "working" || handoffDependencyState === "working") {
+    nextBestAction = "inspect_bridge_operator_pack";
+  }
+
+  return {
+    ok: true,
+    product: packageJson.name,
+    category: "proof-bridge-intelligence-pack",
+    bridge_coverage_state: bridgeCoverageState,
+    compatibility_strength_state: compatibilityStrengthState,
+    handoff_dependency_state: handoffDependencyState,
+    recommended_bridge_motion: "bridge_operator_review_and_handoff_followthrough",
+    next_best_action: nextBestAction,
+    explanation_signals: {
+      bridge_capability_count: bridgeSummary.capability_count,
+      bridge_profile_count: bridgeSummary.profile_count,
+      compatibility_route_count: Array.isArray(compatibilityPack.preserved_routes) ? compatibilityPack.preserved_routes.length : 0,
+      compatibility_helper_count: Array.isArray(compatibilityPack.preserved_helpers) ? compatibilityPack.preserved_helpers.length : 0,
+      compatibility_profile_version_count: Array.isArray(compatibilityPack.profile_versions) ? compatibilityPack.profile_versions.length : 0,
+      operator_pack_section_count: Array.isArray(operatorReviewPack.included_sections) ? operatorReviewPack.included_sections.length : 0,
+      handoff_source_ref_count: handoffCenterSummary.source_ref_count,
+      handoff_mode_count: handoffCenterSummary.handoff_mode_count
+    },
+    linked_surfaces: {
+      bridge_summary_ref: "/v1/proof-center/bridge/summary",
+      bridge_operator_review_pack_ref: "/v1/proof-center/bridge/operator-review-pack",
+      bridge_compatibility_pack_ref: "/v1/proof-center/bridge/compatibility-pack",
+      bridge_workflow_pack_ref: "/v1/proof-center/bridge/workflow-pack",
+      result_package_handoff_summary_ref: "/v1/proof-center/result-package-handoff/summary",
+      result_package_handoff_run_ref: "/v1/proof-center/result-package-handoff/run"
+    }
+  };
+}
+
+function summarizeBridgeIntelligencePack(input) {
+  const pack = buildBridgeIntelligencePack(input);
+  return {
+    ok: true,
+    product: pack.product,
+    category: pack.category,
+    bridge_coverage_state: pack.bridge_coverage_state,
+    compatibility_strength_state: pack.compatibility_strength_state,
+    handoff_dependency_state: pack.handoff_dependency_state,
+    next_best_action: pack.next_best_action,
+    signal_count: Object.keys(pack.explanation_signals).length
+  };
+}
+
+module.exports = {
+  buildBridgeIntelligencePack,
+  summarizeBridgeIntelligencePack
+};