xytara 3.1.0 → 3.1.2

package/lib/authority_binding_lifecycle_contract.js

@@ -1,182 +1,182 @@
-"use strict";
-
-const packageJson = require("../package.json");
-
-function buildAuthorityBindingLifecycleContractPack() {
-  return {
-    ok: true,
-    product: packageJson.name,
-    category: "naxytra-authority-binding-lifecycle-contract",
-    pack_version: "naxytra-authority-binding-lifecycle-contract-v1",
-    doctrine: "xytara_keeps_bindings_versioned_lineage_preserving_and_revocation_aware",
-    model_state: "core_now",
-    core_claim: "binding lifecycle state is the shared control-plane record for identity bindings authority bindings spend credentials and delegated signing",
-    binding_kinds: [
-      {
-        binding_kind: "identity_binding",
-        description: "binds a subject to an identity posture"
-      },
-      {
-        binding_kind: "authority_binding",
-        description: "binds a subject to an authority posture"
-      },
-      {
-        binding_kind: "spend_credential",
-        description: "binds a subject to a spend credential or delegated spend posture"
-      },
-      {
-        binding_kind: "delegation_grant",
-        description: "records a delegated capability grant"
-      },
-      {
-        binding_kind: "delegation_revocation",
-        description: "records that a delegation has been revoked"
-      },
-      {
-        binding_kind: "key_binding",
-        description: "binds a subject to a key or public-key reference"
-      }
-    ],
-    lifecycle_states: [
-      { state: "active", description: "usable and currently in force" },
-      { state: "rotated", description: "superseded by a successor binding" },
-      { state: "revoked", description: "disabled before natural expiry" },
-      { state: "expired", description: "no longer valid because the validity window ended" },
-      { state: "suspended", description: "temporarily unusable pending review" }
-    ],
-    canonical_objects: [
-      {
-        object_id: "binding_lifecycle_record",
-        role: "versioned_lineage_preserving_state_record_for_a_binding_or_credential",
-        required_fields: [
-          "version",
-          "binding_id",
-          "binding_kind",
-          "subject_id",
-          "status",
-          "issued_by",
-          "issued_at_iso"
-        ],
-        recommended_fields: [
-          "expires_at_iso",
-          "rotated_from_binding_id",
-          "replaced_by_binding_id",
-          "revoked_at_iso",
-          "revoke_reason",
-          "scope",
-          "key_ref",
-          "signature_suite",
-          "proof_ref",
-          "anchor_ref"
-        ],
-        optional_fields: [
-          "delegation_ref",
-          "controller_id",
-          "previous_binding_id",
-          "metadata"
-        ],
-        primary_surfaces: [
-          "/v1/identity/bindings",
-          "/v1/account-auth/authority-bindings",
-          "/v1/account-auth/spend-credentials",
-          "/v1/economics/accounts/:account_id/authority-summary",
-          "/v1/economics/accounts/:account_id/authority-bundle"
-        ]
-      }
-    ],
-    transition_rules: [
-      "issue_creates_a_new_active_binding",
-      "renew_extends_expiry_without_breaking_lineage",
-      "rotate_creates_a_successor_binding_and_preserves_predecessor_lineage",
-      "revoke_disables_the_binding_and_preserves_auditability",
-      "expire_marks_the_binding_inactive_when_the_validity_window_ends",
-      "narrow_scope_must_not_silently_broaden_access"
-    ],
-    delegated_signing_rules: [
-      "delegated_signing_must_be_explicit",
-      "delegated_signing_must_be_scope_bounded",
-      "delegated_signing_must_be_time_bounded_unless_a_product_decision_says_otherwise",
-      "delegated_signing_must_preserve_subject_and_issuer_lineage",
-      "delegated_signing_must_not_become_hidden_shared_secret_magic"
-    ],
-    lineage_model: [
-      {
-        layer_id: "binding_issue",
-        order_index: 1,
-        objects: ["binding_lifecycle_record"],
-        invariants: [
-          "issuance_is_explicit",
-          "binding_ids_are_versioned_and_auditable"
-        ]
-      },
-      {
-        layer_id: "binding_rotation_and_revocation",
-        order_index: 2,
-        objects: ["binding_lifecycle_record"],
-        invariants: [
-          "predecessor_and_successor_linkage_is_preserved",
-          "revocation_history_remains_visible"
-        ]
-      },
-      {
-        layer_id: "proof_followthrough",
-        order_index: 3,
-        objects: ["binding_lifecycle_record"],
-        invariants: [
-          "binding_lineage_can_be_carried_into_proof_without_becoming_proof_truth_itself",
-          "optional_proof_and_anchor_refs_do_not_change_base_binding_meaning"
-        ]
-      }
-    ],
-    invariants: [
-      "binding_state_changes_are_explicit_and_versioned",
-      "rotation_preserves_lineage",
-      "revocation_preserves_auditability",
-      "delegated_signing_remains_bounded",
-      "binding_lifecycle_is_a_control_plane_concept_not_a_general_web_token_story"
-    ],
-    linked_surfaces: {
-      identity_binding_ref: "/v1/identity/bindings",
-      authority_binding_ref: "/v1/account-auth/authority-bindings",
-      spend_credentials_ref: "/v1/account-auth/spend-credentials",
-      authority_summary_ref: "/v1/economics/accounts/:account_id/authority-summary",
-      authority_bundle_ref: "/v1/economics/accounts/:account_id/authority-bundle"
-    },
-    claim_boundary: "claim_the_xytara_binding_lifecycle_control_plane_only_without_claiming_universal_external_identity_authority_or_custody_truth"
-  };
-}
-
-function summarizeAuthorityBindingLifecycleContractPack() {
-  const pack = buildAuthorityBindingLifecycleContractPack();
-  return {
-    ok: true,
-    product: pack.product,
-    category: pack.category,
-    summary_version: "naxytra-authority-binding-lifecycle-contract-summary-v1",
-    pack_version: pack.pack_version,
-    model_state: pack.model_state,
-    binding_kind_count: pack.binding_kinds.length,
-    lifecycle_state_count: pack.lifecycle_states.length,
-    canonical_object_count: pack.canonical_objects.length,
-    transition_rule_count: pack.transition_rules.length,
-    delegated_signing_rule_count: pack.delegated_signing_rules.length,
-    linked_surfaces: pack.linked_surfaces
-  };
-}
-
-function getAuthorityBindingKindDetail(bindingKind) {
-  const normalized = String(bindingKind || "").trim().toLowerCase();
-  return (buildAuthorityBindingLifecycleContractPack().binding_kinds || []).find((entry) => entry.binding_kind === normalized) || null;
-}
-
-function getAuthorityLifecycleStateDetail(state) {
-  const normalized = String(state || "").trim().toLowerCase();
-  return (buildAuthorityBindingLifecycleContractPack().lifecycle_states || []).find((entry) => entry.state === normalized) || null;
-}
-
-module.exports = {
-  buildAuthorityBindingLifecycleContractPack,
-  summarizeAuthorityBindingLifecycleContractPack,
-  getAuthorityBindingKindDetail,
-  getAuthorityLifecycleStateDetail
-};
+"use strict";
+
+const packageJson = require("../package.json");
+
+function buildAuthorityBindingLifecycleContractPack() {
+  return {
+    ok: true,
+    product: packageJson.name,
+    category: "naxytra-authority-binding-lifecycle-contract",
+    pack_version: "naxytra-authority-binding-lifecycle-contract-v1",
+    doctrine: "xytara_keeps_bindings_versioned_lineage_preserving_and_revocation_aware",
+    model_state: "core_now",
+    core_claim: "binding lifecycle state is the shared control-plane record for identity bindings authority bindings spend credentials and delegated signing",
+    binding_kinds: [
+      {
+        binding_kind: "identity_binding",
+        description: "binds a subject to an identity posture"
+      },
+      {
+        binding_kind: "authority_binding",
+        description: "binds a subject to an authority posture"
+      },
+      {
+        binding_kind: "spend_credential",
+        description: "binds a subject to a spend credential or delegated spend posture"
+      },
+      {
+        binding_kind: "delegation_grant",
+        description: "records a delegated capability grant"
+      },
+      {
+        binding_kind: "delegation_revocation",
+        description: "records that a delegation has been revoked"
+      },
+      {
+        binding_kind: "key_binding",
+        description: "binds a subject to a key or public-key reference"
+      }
+    ],
+    lifecycle_states: [
+      { state: "active", description: "usable and currently in force" },
+      { state: "rotated", description: "superseded by a successor binding" },
+      { state: "revoked", description: "disabled before natural expiry" },
+      { state: "expired", description: "no longer valid because the validity window ended" },
+      { state: "suspended", description: "temporarily unusable pending review" }
+    ],
+    canonical_objects: [
+      {
+        object_id: "binding_lifecycle_record",
+        role: "versioned_lineage_preserving_state_record_for_a_binding_or_credential",
+        required_fields: [
+          "version",
+          "binding_id",
+          "binding_kind",
+          "subject_id",
+          "status",
+          "issued_by",
+          "issued_at_iso"
+        ],
+        recommended_fields: [
+          "expires_at_iso",
+          "rotated_from_binding_id",
+          "replaced_by_binding_id",
+          "revoked_at_iso",
+          "revoke_reason",
+          "scope",
+          "key_ref",
+          "signature_suite",
+          "proof_ref",
+          "anchor_ref"
+        ],
+        optional_fields: [
+          "delegation_ref",
+          "controller_id",
+          "previous_binding_id",
+          "metadata"
+        ],
+        primary_surfaces: [
+          "/v1/identity/bindings",
+          "/v1/account-auth/authority-bindings",
+          "/v1/account-auth/spend-credentials",
+          "/v1/economics/accounts/:account_id/authority-summary",
+          "/v1/economics/accounts/:account_id/authority-bundle"
+        ]
+      }
+    ],
+    transition_rules: [
+      "issue_creates_a_new_active_binding",
+      "renew_extends_expiry_without_breaking_lineage",
+      "rotate_creates_a_successor_binding_and_preserves_predecessor_lineage",
+      "revoke_disables_the_binding_and_preserves_auditability",
+      "expire_marks_the_binding_inactive_when_the_validity_window_ends",
+      "narrow_scope_must_not_silently_broaden_access"
+    ],
+    delegated_signing_rules: [
+      "delegated_signing_must_be_explicit",
+      "delegated_signing_must_be_scope_bounded",
+      "delegated_signing_must_be_time_bounded_unless_a_product_decision_says_otherwise",
+      "delegated_signing_must_preserve_subject_and_issuer_lineage",
+      "delegated_signing_must_not_become_hidden_shared_secret_magic"
+    ],
+    lineage_model: [
+      {
+        layer_id: "binding_issue",
+        order_index: 1,
+        objects: ["binding_lifecycle_record"],
+        invariants: [
+          "issuance_is_explicit",
+          "binding_ids_are_versioned_and_auditable"
+        ]
+      },
+      {
+        layer_id: "binding_rotation_and_revocation",
+        order_index: 2,
+        objects: ["binding_lifecycle_record"],
+        invariants: [
+          "predecessor_and_successor_linkage_is_preserved",
+          "revocation_history_remains_visible"
+        ]
+      },
+      {
+        layer_id: "proof_followthrough",
+        order_index: 3,
+        objects: ["binding_lifecycle_record"],
+        invariants: [
+          "binding_lineage_can_be_carried_into_proof_without_becoming_proof_truth_itself",
+          "optional_proof_and_anchor_refs_do_not_change_base_binding_meaning"
+        ]
+      }
+    ],
+    invariants: [
+      "binding_state_changes_are_explicit_and_versioned",
+      "rotation_preserves_lineage",
+      "revocation_preserves_auditability",
+      "delegated_signing_remains_bounded",
+      "binding_lifecycle_is_a_control_plane_concept_not_a_general_web_token_story"
+    ],
+    linked_surfaces: {
+      identity_binding_ref: "/v1/identity/bindings",
+      authority_binding_ref: "/v1/account-auth/authority-bindings",
+      spend_credentials_ref: "/v1/account-auth/spend-credentials",
+      authority_summary_ref: "/v1/economics/accounts/:account_id/authority-summary",
+      authority_bundle_ref: "/v1/economics/accounts/:account_id/authority-bundle"
+    },
+    claim_boundary: "claim_the_xytara_binding_lifecycle_control_plane_only_without_claiming_universal_external_identity_authority_or_custody_truth"
+  };
+}
+
+function summarizeAuthorityBindingLifecycleContractPack() {
+  const pack = buildAuthorityBindingLifecycleContractPack();
+  return {
+    ok: true,
+    product: pack.product,
+    category: pack.category,
+    summary_version: "naxytra-authority-binding-lifecycle-contract-summary-v1",
+    pack_version: pack.pack_version,
+    model_state: pack.model_state,
+    binding_kind_count: pack.binding_kinds.length,
+    lifecycle_state_count: pack.lifecycle_states.length,
+    canonical_object_count: pack.canonical_objects.length,
+    transition_rule_count: pack.transition_rules.length,
+    delegated_signing_rule_count: pack.delegated_signing_rules.length,
+    linked_surfaces: pack.linked_surfaces
+  };
+}
+
+function getAuthorityBindingKindDetail(bindingKind) {
+  const normalized = String(bindingKind || "").trim().toLowerCase();
+  return (buildAuthorityBindingLifecycleContractPack().binding_kinds || []).find((entry) => entry.binding_kind === normalized) || null;
+}
+
+function getAuthorityLifecycleStateDetail(state) {
+  const normalized = String(state || "").trim().toLowerCase();
+  return (buildAuthorityBindingLifecycleContractPack().lifecycle_states || []).find((entry) => entry.state === normalized) || null;
+}
+
+module.exports = {
+  buildAuthorityBindingLifecycleContractPack,
+  summarizeAuthorityBindingLifecycleContractPack,
+  getAuthorityBindingKindDetail,
+  getAuthorityLifecycleStateDetail
+};