@fabricorg/assembly 0.3.0

package/CHANGELOG.md

@@ -0,0 +1,84 @@
+# @fabricorg/assembly
+
+## 0.3.0
+
+### Minor Changes
+
+- 89982ba: Lock federated component-pack delivery. A component pack may declare a `remote` with its entry URL,
+  a subresource-integrity value, and its exposed modules; `resolveAssembly` locks that binding in the
+  lockfile alongside the artifact digest, and `validateSduiRelease` rejects a release whose declared
+  remote does not match the locked one, or which adds or drops a remote the assembly did not.
+
+  A federated pack executes whatever its remote entry serves at load time, so an approved artifact
+  digest describes the pack that was reviewed rather than the code that runs. Locking the entry and
+  its integrity closes that gap without Fabric loading anything: the shell verifies integrity against
+  the lockfile before executing. The field is optional, so packs delivered any other way are unchanged.
+
+### Patch Changes
+
+- 6f5471b: Close the gaps an independent review found in the grant, remote and identity work.
+
+  A capability reference object was treated as a leaf, so a granted reference could shield ungranted
+  ones parked beside it on the same object; sibling keys are now walked. Prop recursion is depth
+  bounded, so cyclic programmatic input reports a finding instead of exhausting the stack. Federated
+  remotes now compare their exposed-module mapping, not only entry and integrity, and the locked remote
+  is carried onto the promoted release so two releases differing only in their remote cannot share a
+  digest. Pack lookup matches full pack identity rather than namespace and name alone, and a stored
+  lockfile that declares one pack or capability twice is rejected rather than resolved by first match.
+
+  Grant digests omit `variants` and `fragments` when absent, so a release that declares neither digests
+  exactly as it did before those fields existed and previously promoted releases keep verifying.
+  Variants are hashed in id order, so reordering the same set no longer churns the digest. Fragment
+  grants written as a `{ __proto__: … }` object literal are rejected, because that sets the prototype
+  rather than creating the entry and the narrowing would silently disappear.
+
+  `assertActorClaimsCoverScope` no longer fails open: an invalid clock is rejected instead of making
+  every temporal comparison false, timestamps must be RFC 3339 with an explicit offset so a credential
+  cannot expire at different instants on different hosts, and `spaceIds` must be an array of strings so
+  a bare string cannot reach substring matching where `"space_10"` would cover `"space_1"`.
+
+- Updated dependencies
+  - @fabricorg/gen-capability@0.5.0
+
+## 0.2.0
+
+### Minor Changes
+
+- 62dd1ca: Add deterministic application assembly: versioned assembly manifests, resolved
+  lockfiles, and a single build gate for capabilities, component packs, and
+  adoption bindings. `resolveAssembly` resolves semver ranges against available
+  versions, rejects unresolved or duplicate capability identities, validates
+  usage contracts, component packs, and adoption bindings as one gate, and
+  produces a locked lockfile with a canonical SHA-256 digest. Lockfiles now hash
+  the resolved application, capability manifests, generated usage-contract
+  content, component-pack artifacts, and adoption bindings rather than the input
+  ranges. `assertAssemblyLockfile` rejects content changed after resolution.
+  Assembly manifest and lockfile documents move to format version 2.
+
+### Patch Changes
+
+- Updated dependencies [62dd1ca]
+- Updated dependencies [b932767]
+  - @fabricorg/adoption-bindings@0.2.1
+  - @fabricorg/gen-capability@0.4.1
+
+## 0.1.0
+
+### Minor Changes
+
+- First release. Deterministic application assembly: versioned assembly manifests,
+  resolved lockfiles, and a single build gate for capabilities, component packs,
+  and adoption bindings.
+
+  `resolveAssembly` resolves semver ranges (`^`, `~`, `>=`, `>`, `<=`, `<`, `=`,
+  exact, `*`, compound) against available versions, rejects unresolved or
+  duplicate capability identities, validates usage contracts, component packs,
+  and adoption bindings as one gate, and produces a locked lockfile with a
+  canonical SHA-256 digest. `assertAssemblyResolved` throws with every finding
+  listed for use as a CI step.
+
+### Patch Changes
+
+- Updated dependencies
+  - @fabricorg/adoption-bindings@0.2.0
+  - @fabricorg/gen-capability@0.4.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Fabric
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,70 @@
+# `@fabricorg/assembly`
+
+Deterministic application assembly for Fabric verticals. It takes a versioned
+assembly manifest — the capabilities, component packs, adoption bindings, and
+usage contracts a vertical assembles — resolves dependency ranges
+deterministically, validates contracts, packs, and bindings as one build gate,
+and produces a locked, digest-bearing lockfile.
+
+## What it does
+
+- **Assembly manifest** (`AssemblyManifest`): a versioned declaration of what a
+  vertical assembles. Capabilities and component packs carry semver ranges;
+  bindings and generated usage-contract documents are supplied inline for
+  validation.
+- **Lockfile** (`AssemblyLockfile`): the resolved, deterministic output. Every
+  capability and pack version is locked with its range and artifact digest,
+  generated contracts are tied to the resolved capability manifest, every
+  binding carries a content digest, and the whole resolved document carries a
+  canonical SHA-256 digest.
+- **Resolution** (`resolveAssembly`): resolves semver ranges against available
+  versions, rejects unresolved or duplicate capability identities, validates
+  usage contracts, component packs, and adoption bindings, and returns every
+  finding rather than throwing on the first.
+- **Build gate** (`assertAssemblyResolved`): throws with every finding listed,
+  for use as a CI step.
+- **Runtime verification** (`assertAssemblyLockfile`): validates a stored or
+  transported lockfile and rejects any resolved content that no longer matches
+  its `assemblyDigest`.
+- **Runtime compatibility** (`assertAssemblyRuntimeCompatible`): fails startup
+  unless loaded capability versions and manifest digests exactly match the
+  approved lockfile, including rejection of missing or extra modules.
+
+## Semver ranges
+
+The resolver supports the subset of npm range syntax a deterministic lockfile
+needs: `^` (caret), `~` (tilde), `>=`, `>`, `<=`, `<`, `=` (exact), bare exact
+versions, `*` (wildcard), and compound ranges (`>=1.0.0 <2.0.0`). Prerelease
+versions follow npm semantics: a prerelease only satisfies a range when a
+comparator in the range declares a prerelease at the same `[major, minor, patch]`
+tuple.
+
+## Usage
+
+```typescript
+import { assertAssemblyResolved } from "@fabricorg/assembly";
+
+const lockfile = assertAssemblyResolved({
+  manifest: {
+    formatVersion: 2,
+    application: "lending",
+    capabilities: [{ namespace: "recovery", range: "^1.0.0" }],
+    componentPacks: [{ pack: "lender-components", namespace: "lender", range: "^1.0.0" }],
+    bindings: [{ capability: "recovery", binding }],
+    contracts: [{ namespace: "recovery", document: usageContractDocument }],
+  },
+  capabilities: [{ namespace: "recovery", version: "1.1.0", manifestDigest: "…" }],
+  componentPacks: [{
+    pack: "lender-components",
+    namespace: "lender",
+    version: "1.1.0",
+    artifactDigest: "…",
+  }],
+  packManifests: [pack],
+  coreComponents: ["Card", "List", "DetailLayout"],
+});
+```
+
+It does not load live modules, execute handlers, or run inside
+`@fabricorg/platform`. The assembly package depends on `@fabricorg/adoption-bindings`
+and `@fabricorg/gen-capability` for contract and binding validation.