@fabricorg/experience-gateway 1.0.0

package/CHANGELOG.md

@@ -0,0 +1,101 @@
+# Changelog
+
+## 1.0.0
+
+### Minor Changes
+
+- 337e89c: Make offline replay truthful and give three conformance suites teeth.
+
+  Offline replay carried no marker and dropped the capture moment. An adapter had to remember to set
+  `executionReason` for the gateway to apply offline eligibility rules, and capture-authority evidence
+  was stamped at receipt, so it attested a moment nobody was there for. `ExperienceReplayRequest` now
+  carries `executionReason` and `capturedAt` structurally, and the gateway uses the supplied instant,
+  bounded so it must parse and must not be in the future.
+
+  Replay resolved to `completed` or `failed`, which collapsed three outcomes the platform deliberately
+  distinguishes and kept every failure queued. A capture the platform had already applied counted as a
+  failure and retried, when replaying an idempotent action twice is the mechanism working; a capture
+  refused on authority grounds retried until its TTL rather than surfacing. `replay()` now returns
+  `reconciled` alongside the counts, holding each settled refusal and the reason given. Unrecognised
+  errors stay transient, so an unfamiliar failure is retried rather than discarded.
+
+  Gateway conformance accepted any result carrying an `actionInvocationId`, so a replacement that
+  fabricated an id and queried data directly passed; the subject now reports what the governed hosts
+  observed, and reads are certified through `ProjectionHost`. Component-pack certification accepted one
+  placeholder for every declared component and could not see a fresh function per call, because every
+  function stringifies to `undefined`. Renderers must now be distinct per component, undeclared names
+  must resolve to nothing, and determinism compares identity for anything not JSON-representable.
+
+- a598fb9: Close the remaining review findings.
+
+  **One capability-reference grammar.** `sdui-release` accepted any name after the namespace while
+  `sdui-composer` rejected `/`, so a view named `orders/reports/daily` produced a release that validated
+  and then died at promotion with nothing wrong upstream to point at. Both now share
+  `parseCapabilityRef`, tightened to lowercase path segments matching what the platform permits for a
+  view name. Two views in one contract that reduce to the same reference are reported as
+  `ambiguous_capability_reference` at validation rather than surfacing as an ambiguous route later.
+
+  **A bounded replay window.** A client-supplied `capturedAt` had no lower bound. Deferring it to the
+  Host looked safe and was not: the Host checks staleness only when the capture-authority adapter
+  supplies an `expiresAt`, and skips the execution-time expiry check entirely for actions governed at
+  capture. A gateway that accepts replay must now declare `maxOfflineReplayAgeMs`, and the instant must
+  be RFC 3339 with an explicit offset.
+
+  **One token-set grammar.** `document.tokenSet` accepted names and versions that `supportedTokenSets`
+  rejected, while validation treats the two fields as interchangeable.
+
+  **Port requirements narrow as they are checked.** A requirement for a standard _and_ a version could
+  be satisfied by two different adapters covering one constraint each. `requirement.standard.version`
+  was declared and never read.
+
+- 9b2e55b: Close what a fourth review found: each earlier fix closed one instance of a class and left its
+  siblings.
+
+  **Replay disposition is now exhaustive over `ActionStatus`.** The previous fix enumerated the two
+  statuses that looked like refusals, so `failed`, `validation_failed` and `waiting_for_approval` fell
+  through and were deleted from the queue and reported to the operator as applied — the same bug the
+  fix set out to kill, one layer in. Any returned outcome now means the platform holds the invocation,
+  so the capture leaves the queue either way; what differs is whether a person needs to hear about it.
+  An undeterminable adapter outcome is reported as `unknown` rather than `refused`, because the effect
+  may well have happened. `isSettledReplayFailure` learned the refusals the sibling commit introduced,
+  including a capture rejected for age, which can never come good.
+
+  **A replay without `capturedAt` is refused.** It was reachable only through an untyped cast, so
+  omitting it skipped the age check entirely and stamped receipt time into durable capture evidence.
+
+  **A capability can name a namespaced port.** `definePort` required a dot and the manifest validator
+  forbade one, so no real capability could name a defined port and the certification gate was
+  unreachable. Certification is also checked structurally rather than by the presence of a property, so
+  a hand-written claim no longer satisfies the gate that exists to demand evidence, and a port
+  requirement narrows its candidates as each constraint is applied.
+
+  **`assertPortSuiteHasTeeth` names every vacuous check** rather than returning on the first one that
+  bites, and a reference port is actually run through it. The payments control asserts its result, so
+  an adapter that never charges no longer certifies. The capability-reference grammar matches the
+  platform's own view-name rule instead of being stricter than it, and ambiguity is counted by
+  occurrence across views and intents rather than by comparing names within one contract.
+
+### Patch Changes
+
+- Updated dependencies [8ce5e06]
+- Updated dependencies [337e89c]
+- Updated dependencies [a598fb9]
+- Updated dependencies [9a5b18a]
+- Updated dependencies [9b2e55b]
+- Updated dependencies [0d1f6f6]
+  - @fabricorg/ports@0.4.0
+  - @fabricorg/experience-runtime@0.2.0
+  - @fabricorg/platform-host@7.0.0
+
+## 0.1.0
+
+### Minor Changes
+
+- Add trusted view and intent routing, exact action-version enforcement,
+  capture-authority adapters, public conformance, and non-forgeable initiating-release
+  evidence.
+
+### Patch Changes
+
+- Updated dependencies
+  - @fabricorg/experience-runtime@0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Fabric
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,17 @@
+# `@fabricorg/experience-gateway`
+
+Trusted server adapter between an experience runtime and Fabric Hosts. It verifies
+identity and scope through `IdentityPort`, resolves only server-held plan handles,
+routes reads through ProjectionHost, and submits mutations through PlatformHost.
+
+Configure PlatformHost's `composition.resolveInitiatingReleaseDigest` with
+`createInitiatingReleaseEvidence().resolve`. Release evidence is held in an
+instance-scoped WeakMap and is never accepted from browser request data.
+
+Provide `actionVersion` from the registered application module set so pinned release
+routes cannot silently invoke another action version. Actions governed at the
+`capture` authority moment additionally require a trusted `captureAuthority` adapter;
+the browser cannot manufacture an authorization binding.
+
+Replacement gateways can run `experienceGatewayChecks` as a public compatibility
+suite.

package/dist/index.cjs

@@ -0,0 +1,257 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// index.ts
+var index_exports = {};
+__export(index_exports, {
+  createExperienceGateway: () => createExperienceGateway,
+  createInitiatingReleaseEvidence: () => createInitiatingReleaseEvidence,
+  experienceGatewayChecks: () => experienceGatewayChecks,
+  runExperienceGatewayChecks: () => runExperienceGatewayChecks
+});
+module.exports = __toCommonJS(index_exports);
+var import_platform_host = require("@fabricorg/platform-host");
+var import_ports = require("@fabricorg/ports");
+function experienceGatewayChecks() {
+  return [
+    {
+      id: "fabric.experience.gateway-host-routing.v1",
+      async run(subject) {
+        const before = subject.observed.submitActionCount();
+        const result = await subject.gateway.invoke(subject.validIntent);
+        if (!result.actionInvocationId) throw new Error("Gateway did not return a governed Host invocation.");
+        const submitted = subject.observed.submitActionCount() - before;
+        if (submitted !== 1) {
+          throw new Error(
+            `Gateway returned an invocation id after ${submitted} calls to PlatformHost.submitAction; a mutation must reach the Host exactly once.`
+          );
+        }
+        return [result.actionInvocationId];
+      }
+    },
+    {
+      id: "fabric.experience.gateway-projection-routing.v1",
+      async run(subject) {
+        const before = subject.observed.projectionCount();
+        await subject.gateway.read(subject.validRead);
+        const projected = subject.observed.projectionCount() - before;
+        if (projected !== 1) {
+          throw new Error(
+            `Gateway served a read after ${projected} calls to ProjectionHost.project; a read must go through the projection host.`
+          );
+        }
+        return ["read routed through ProjectionHost"];
+      }
+    },
+    {
+      id: "fabric.experience.gateway-scope-denial.v1",
+      async run(subject) {
+        let rejected = false;
+        try {
+          await subject.gateway.invoke(subject.deniedIntent);
+        } catch {
+          rejected = true;
+        }
+        if (!rejected) throw new Error("Gateway accepted an intent outside trusted identity scope.");
+        return ["out-of-scope intent rejected"];
+      }
+    }
+  ];
+}
+async function runExperienceGatewayChecks(subject, checks = experienceGatewayChecks()) {
+  const results = [];
+  for (const check of checks) {
+    try {
+      results.push({ id: check.id, status: "passed", evidence: await check.run(subject) });
+    } catch (error) {
+      results.push({ id: check.id, status: "failed", evidence: [], error: error instanceof Error ? error.message : String(error) });
+    }
+  }
+  return { passed: results.every((result) => result.status === "passed"), checks: results };
+}
+function createInitiatingReleaseEvidence() {
+  const evidence = /* @__PURE__ */ new WeakMap();
+  return {
+    bind(input, releaseDigest) {
+      evidence.set(input, releaseDigest);
+    },
+    resolve(input) {
+      return evidence.get(input);
+    },
+    release(input) {
+      evidence.delete(input);
+    }
+  };
+}
+function createExperienceGateway(options) {
+  const now = options.now ?? (() => /* @__PURE__ */ new Date());
+  return {
+    async invoke(input) {
+      const claims = await options.identity.verify(input.context.credential);
+      if (!claims) throw new Error("Experience request credential is not authenticated.");
+      (0, import_ports.assertActorClaimsCoverScope)(claims, {
+        tenantId: input.context.tenantId,
+        spaceId: input.context.spaceId
+      }, now());
+      const scope = {
+        tenantId: input.context.tenantId,
+        spaceId: input.context.spaceId,
+        actorId: claims.subject,
+        actorType: claims.actorType
+      };
+      const resolved = await options.runtime.resolveIntent({
+        planId: input.request.planId,
+        fragmentId: input.request.fragmentId,
+        eventName: input.request.eventName,
+        scope
+      });
+      if (resolved.assemblyDigest !== options.assemblyDigest) {
+        throw new Error("Experience render plan belongs to a different application assembly.");
+      }
+      if (options.actionVersion(resolved.actionId) !== resolved.actionVersion) {
+        throw new Error(`Experience intent route for "${resolved.actionId}" does not match the registered action version.`);
+      }
+      if (resolved.execution?.idempotency === "required" && !input.request.idempotencyKey) {
+        throw new Error(`Action "${resolved.actionId}" requires an idempotency key.`);
+      }
+      if (input.executionReason === "offline_replay" && resolved.execution?.connectivity !== "offline-capturable") {
+        throw new Error(`Action "${resolved.actionId}" is not eligible for offline replay.`);
+      }
+      const correlationId = options.nextCorrelationId();
+      let capturedAt;
+      if (input.executionReason === "offline_replay") {
+        const supplied = input.capturedAt ?? input.request.capturedAt;
+        if (typeof supplied !== "string") {
+          throw new Error("Offline replay requires capturedAt; receipt time cannot attest when the operator acted.");
+        }
+        capturedAt = assertCaptureMoment(supplied, now(), options.maxOfflineReplayAgeMs);
+      } else {
+        capturedAt = now().toISOString();
+      }
+      const parameterDigest = (0, import_platform_host.digestParameters)(input.request.parameters);
+      const capturedAuthority = resolved.execution?.authorityMoment === "capture" ? await options.captureAuthority?.({
+        actionId: resolved.actionId,
+        scope,
+        parameters: input.request.parameters,
+        parameterDigest,
+        capturedAt
+      }) : void 0;
+      if (resolved.execution?.authorityMoment === "capture" && !capturedAuthority) {
+        throw new Error(`Action "${resolved.actionId}" requires a trusted capture-authority adapter.`);
+      }
+      const submission = {
+        actionId: resolved.actionId,
+        parameters: input.request.parameters,
+        tenantId: scope.tenantId,
+        spaceId: scope.spaceId,
+        actorId: scope.actorId,
+        actorType: claims.actorType,
+        correlationId,
+        provenance: {
+          source: "ui",
+          correlationId,
+          ...resolved.execution?.sensitivity === "restricted" ? {} : { auditAttributes: { "fabric.experience.fragment": input.request.fragmentId } }
+        },
+        ...input.request.idempotencyKey === void 0 ? {} : { idempotencyKey: input.request.idempotencyKey },
+        ...input.executionReason === void 0 ? {} : { executionReason: input.executionReason },
+        ...capturedAuthority === void 0 ? {} : {
+          authorizationBindingId: capturedAuthority.id,
+          authorizationBinding: {
+            id: capturedAuthority.id,
+            governingMoment: "capture",
+            capturedAt,
+            ...capturedAuthority.expiresAt === void 0 ? {} : { expiresAt: capturedAuthority.expiresAt },
+            tenantId: scope.tenantId,
+            actorId: scope.actorId,
+            actionId: resolved.actionId,
+            parameterDigest
+          }
+        }
+      };
+      options.evidence.bind(submission, resolved.initiatingReleaseDigest);
+      try {
+        return await options.host.submitAction(submission);
+      } finally {
+        options.evidence.release(submission);
+      }
+    },
+    async read(input) {
+      const claims = await options.identity.verify(input.context.credential);
+      if (!claims) throw new Error("Experience request credential is not authenticated.");
+      (0, import_ports.assertActorClaimsCoverScope)(claims, {
+        tenantId: input.context.tenantId,
+        spaceId: input.context.spaceId
+      }, now());
+      const scope = {
+        tenantId: input.context.tenantId,
+        spaceId: input.context.spaceId,
+        actorId: claims.subject,
+        actorType: claims.actorType
+      };
+      const resolved = await options.runtime.resolveView({
+        planId: input.request.planId,
+        fragmentId: input.request.fragmentId,
+        bindingName: input.request.bindingName,
+        scope
+      });
+      if (resolved.assemblyDigest !== options.assemblyDigest) {
+        throw new Error("Experience render plan belongs to a different application assembly.");
+      }
+      const result = await options.projectionHost.project({
+        view: { name: resolved.name, version: resolved.version },
+        scope: { tenantId: scope.tenantId, spaceId: scope.spaceId },
+        actor: { id: scope.actorId, type: claims.actorType },
+        parameters: input.request.parameters
+      });
+      return {
+        data: result.state,
+        evidence: {
+          releaseDigest: resolved.initiatingReleaseDigest,
+          assemblyDigest: resolved.assemblyDigest,
+          eventCursor: result.eventCursor,
+          source: result.source
+        }
+      };
+    }
+  };
+}
+var RFC3339 = /^\d{4}-\d{2}-\d{2}[Tt]\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:[Zz]|[+-]\d{2}:\d{2})$/;
+function assertCaptureMoment(capturedAt, now, maxAgeMs) {
+  if (!RFC3339.test(capturedAt)) {
+    throw new Error("Offline replay capturedAt must be an RFC 3339 instant with an explicit offset.");
+  }
+  const parsed = Date.parse(capturedAt);
+  if (Number.isNaN(parsed)) throw new Error("Offline replay capturedAt is not a parseable instant.");
+  if (parsed > now.getTime()) throw new Error("Offline replay capturedAt is in the future.");
+  if (maxAgeMs === void 0) {
+    throw new Error("Gateway accepts offline replay but declares no maxOfflineReplayAgeMs, so a capture has no lower bound.");
+  }
+  if (now.getTime() - parsed > maxAgeMs) {
+    throw new Error(`Offline replay capturedAt is older than the ${maxAgeMs}ms this gateway accepts.`);
+  }
+  return new Date(parsed).toISOString();
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  createExperienceGateway,
+  createInitiatingReleaseEvidence,
+  experienceGatewayChecks,
+  runExperienceGatewayChecks
+});
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../index.ts"],"sourcesContent":["import type {\n\tGovernedActionHost,\n\tSubmitActionInput,\n\tSubmitActionResult,\n} from \"@fabricorg/platform-host\";\nimport { digestParameters } from \"@fabricorg/platform-host\";\nimport type { ProjectionHost } from \"@fabricorg/projection-host\";\nimport {\n\tassertActorClaimsCoverScope,\n\ttype IdentityPort,\n} from \"@fabricorg/ports\";\nimport type { ExperienceIntentRequest, ExperienceReadRequest } from \"@fabricorg/experience-runtime\";\nimport type {\n\tExperienceScope,\n\tExperienceServerRuntime,\n} from \"@fabricorg/experience-runtime/server\";\n\nexport interface TrustedExperienceRequestContext {\n\t/** Presented only to IdentityPort and never persisted or forwarded. */\n\tcredential: string;\n\ttenantId: string;\n\tspaceId: string;\n}\n\nexport interface ExperienceGateway {\n\tinvoke(input: {\n\t\tcontext: TrustedExperienceRequestContext;\n\t\trequest: ExperienceIntentRequest;\n\t\texecutionReason?: \"initial\" | \"offline_replay\";\n\t\t/**\n\t\t * When the operator acted, for a replay. Required whenever\n\t\t * `executionReason` is `offline_replay`: reading it through an untyped\n\t\t * cast made omitting it the easy mistake, and omitting it silently\n\t\t * stamped receipt time into durable capture evidence.\n\t\t */\n\t\tcapturedAt?: string;\n\t}): Promise<SubmitActionResult>;\n\tread(input: {\n\t\tcontext: TrustedExperienceRequestContext;\n\t\trequest: ExperienceReadRequest;\n\t}): Promise<{\n\t\tdata: unknown;\n\t\tevidence: {\n\t\t\treleaseDigest: string;\n\t\t\tassemblyDigest: string;\n\t\t\teventCursor: string | null;\n\t\t\tsource: \"cache\" | \"replay\";\n\t\t};\n\t}>;\n}\n\nexport interface ExperienceGatewayConformanceSubject {\n\tgateway: ExperienceGateway;\n\tvalidIntent: Parameters<ExperienceGateway[\"invoke\"]>[0];\n\tdeniedIntent: Parameters<ExperienceGateway[\"invoke\"]>[0];\n\tvalidRead: Parameters<ExperienceGateway[\"read\"]>[0];\n\t/**\n\t * What the governed hosts actually saw.\n\t *\n\t * A returned invocation id proves only that a string was produced. The\n\t * point of a gateway is that mutations reach `PlatformHost.submitAction` and\n\t * reads reach `ProjectionHost.project`; a replacement that fabricates an id\n\t * and queries the database directly satisfies every observable contract\n\t * except this one, so the subject has to report the calls.\n\t */\n\tobserved: {\n\t\tsubmitActionCount(): number;\n\t\tprojectionCount(): number;\n\t};\n}\n\nexport interface ExperienceGatewayCheck {\n\tid:\n\t\t| \"fabric.experience.gateway-host-routing.v1\"\n\t\t| \"fabric.experience.gateway-scope-denial.v1\"\n\t\t| \"fabric.experience.gateway-projection-routing.v1\";\n\trun(subject: ExperienceGatewayConformanceSubject): Promise<string[]>;\n}\n\nexport function experienceGatewayChecks(): readonly ExperienceGatewayCheck[] {\n\treturn [\n\t\t{\n\t\t\tid: \"fabric.experience.gateway-host-routing.v1\",\n\t\t\tasync run(subject) {\n\t\t\t\tconst before = subject.observed.submitActionCount();\n\t\t\t\tconst result = await subject.gateway.invoke(subject.validIntent);\n\t\t\t\tif (!result.actionInvocationId) throw new Error(\"Gateway did not return a governed Host invocation.\");\n\t\t\t\tconst submitted = subject.observed.submitActionCount() - before;\n\t\t\t\tif (submitted !== 1) {\n\t\t\t\t\tthrow new Error(\n\t\t\t\t\t\t`Gateway returned an invocation id after ${submitted} calls to PlatformHost.submitAction; a mutation must reach the Host exactly once.`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\treturn [result.actionInvocationId];\n\t\t\t},\n\t\t},\n\t\t{\n\t\t\tid: \"fabric.experience.gateway-projection-routing.v1\",\n\t\t\tasync run(subject) {\n\t\t\t\tconst before = subject.observed.projectionCount();\n\t\t\t\tawait subject.gateway.read(subject.validRead);\n\t\t\t\tconst projected = subject.observed.projectionCount() - before;\n\t\t\t\tif (projected !== 1) {\n\t\t\t\t\tthrow new Error(\n\t\t\t\t\t\t`Gateway served a read after ${projected} calls to ProjectionHost.project; a read must go through the projection host.`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\treturn [\"read routed through ProjectionHost\"];\n\t\t\t},\n\t\t},\n\t\t{\n\t\t\tid: \"fabric.experience.gateway-scope-denial.v1\",\n\t\t\tasync run(subject) {\n\t\t\t\tlet rejected = false;\n\t\t\t\ttry { await subject.gateway.invoke(subject.deniedIntent); } catch { rejected = true; }\n\t\t\t\tif (!rejected) throw new Error(\"Gateway accepted an intent outside trusted identity scope.\");\n\t\t\t\treturn [\"out-of-scope intent rejected\"];\n\t\t\t},\n\t\t},\n\t];\n}\n\nexport async function runExperienceGatewayChecks(\n\tsubject: ExperienceGatewayConformanceSubject,\n\tchecks: readonly ExperienceGatewayCheck[] = experienceGatewayChecks(),\n): Promise<{ passed: boolean; checks: Array<{ id: ExperienceGatewayCheck[\"id\"]; status: \"passed\" | \"failed\"; evidence: string[]; error?: string }> }> {\n\tconst results: Array<{ id: ExperienceGatewayCheck[\"id\"]; status: \"passed\" | \"failed\"; evidence: string[]; error?: string }> = [];\n\tfor (const check of checks) {\n\t\ttry { results.push({ id: check.id, status: \"passed\", evidence: await check.run(subject) }); }\n\t\tcatch (error) { results.push({ id: check.id, status: \"failed\", evidence: [], error: error instanceof Error ? error.message : String(error) }); }\n\t}\n\treturn { passed: results.every((result) => result.status === \"passed\"), checks: results };\n}\n\nexport interface InitiatingReleaseEvidence {\n\tbind(input: SubmitActionInput, releaseDigest: string): void;\n\tresolve(input: SubmitActionInput): string | undefined;\n\trelease(input: SubmitActionInput): void;\n}\n\n/**\n * Creates an instance-scoped, non-serializable evidence seam. The Host's\n * `composition.resolveInitiatingReleaseDigest` reads this WeakMap using the\n * exact submission object. A browser field cannot populate or forge it.\n */\nexport function createInitiatingReleaseEvidence(): InitiatingReleaseEvidence {\n\tconst evidence = new WeakMap<SubmitActionInput, string>();\n\treturn {\n\t\tbind(input, releaseDigest) {\n\t\t\tevidence.set(input, releaseDigest);\n\t\t},\n\t\tresolve(input) {\n\t\t\treturn evidence.get(input);\n\t\t},\n\t\trelease(input) {\n\t\t\tevidence.delete(input);\n\t\t},\n\t};\n}\n\nexport function createExperienceGateway(options: {\n\tidentity: IdentityPort;\n\truntime: ExperienceServerRuntime;\n\thost: Pick<GovernedActionHost, \"submitAction\">;\n\tprojectionHost: Pick<ProjectionHost, \"project\">;\n\tevidence: InitiatingReleaseEvidence;\n\tassemblyDigest: string;\n\tactionVersion(actionId: `${string}.${string}`): number | undefined;\n\tnextCorrelationId(): string;\n\t/**\n\t * How old an offline capture may be and still replay.\n\t *\n\t * Required to accept replay at all. The Host's own staleness check is\n\t * conditional on the capture-authority adapter supplying an `expiresAt`, and\n\t * is skipped entirely for actions governed at capture time, so without this\n\t * a client-reported instant has no lower bound.\n\t */\n\tmaxOfflineReplayAgeMs?: number;\n\tcaptureAuthority?(input: {\n\t\tactionId: `${string}.${string}`;\n\t\tscope: ExperienceScope;\n\t\tparameters: Record<string, unknown>;\n\t\tparameterDigest: string;\n\t\tcapturedAt: string;\n\t}): Promise<{ id: string; expiresAt?: string }>;\n\tnow?: () => Date;\n}): ExperienceGateway {\n\tconst now = options.now ?? (() => new Date());\n\treturn {\n\t\tasync invoke(input) {\n\t\t\tconst claims = await options.identity.verify(input.context.credential);\n\t\t\tif (!claims) throw new Error(\"Experience request credential is not authenticated.\");\n\t\t\tassertActorClaimsCoverScope(claims, {\n\t\t\t\ttenantId: input.context.tenantId,\n\t\t\t\tspaceId: input.context.spaceId,\n\t\t\t}, now());\n\t\t\tconst scope: ExperienceScope = {\n\t\t\t\ttenantId: input.context.tenantId,\n\t\t\t\tspaceId: input.context.spaceId,\n\t\t\t\tactorId: claims.subject,\n\t\t\t\tactorType: claims.actorType,\n\t\t\t};\n\t\t\tconst resolved = await options.runtime.resolveIntent({\n\t\t\t\tplanId: input.request.planId,\n\t\t\t\tfragmentId: input.request.fragmentId,\n\t\t\t\teventName: input.request.eventName,\n\t\t\t\tscope,\n\t\t\t});\n\t\t\tif (resolved.assemblyDigest !== options.assemblyDigest) {\n\t\t\t\tthrow new Error(\"Experience render plan belongs to a different application assembly.\");\n\t\t\t}\n\t\t\tif (options.actionVersion(resolved.actionId) !== resolved.actionVersion) {\n\t\t\t\tthrow new Error(`Experience intent route for \"${resolved.actionId}\" does not match the registered action version.`);\n\t\t\t}\n\t\t\tif (resolved.execution?.idempotency === \"required\" && !input.request.idempotencyKey) {\n\t\t\t\tthrow new Error(`Action \"${resolved.actionId}\" requires an idempotency key.`);\n\t\t\t}\n\t\t\tif (input.executionReason === \"offline_replay\" && resolved.execution?.connectivity !== \"offline-capturable\") {\n\t\t\t\tthrow new Error(`Action \"${resolved.actionId}\" is not eligible for offline replay.`);\n\t\t\t}\n\t\t\tconst correlationId = options.nextCorrelationId();\n\t\t\t// A replay attests when the operator acted, not when the network came\n\t\t\t// back. Stamping receipt time would make capture-authority evidence\n\t\t\t// describe a moment nobody was there for.\n\t\t\tlet capturedAt: string;\n\t\t\tif (input.executionReason === \"offline_replay\") {\n\t\t\t\t// Accept it from either position, but require it: a replay with no\n\t\t\t\t// capture moment cannot be evidenced, and defaulting to receipt\n\t\t\t\t// time would attest a moment nobody was there for.\n\t\t\t\tconst supplied = input.capturedAt\n\t\t\t\t\t?? (input.request as Partial<{ capturedAt: string }>).capturedAt;\n\t\t\t\tif (typeof supplied !== \"string\") {\n\t\t\t\t\tthrow new Error(\"Offline replay requires capturedAt; receipt time cannot attest when the operator acted.\");\n\t\t\t\t}\n\t\t\t\tcapturedAt = assertCaptureMoment(supplied, now(), options.maxOfflineReplayAgeMs);\n\t\t\t} else {\n\t\t\t\tcapturedAt = now().toISOString();\n\t\t\t}\n\t\t\tconst parameterDigest = digestParameters(input.request.parameters);\n\t\t\tconst capturedAuthority = resolved.execution?.authorityMoment === \"capture\"\n\t\t\t\t? await options.captureAuthority?.({\n\t\t\t\t\tactionId: resolved.actionId,\n\t\t\t\t\tscope,\n\t\t\t\t\tparameters: input.request.parameters,\n\t\t\t\t\tparameterDigest,\n\t\t\t\t\tcapturedAt,\n\t\t\t\t})\n\t\t\t\t: undefined;\n\t\t\tif (resolved.execution?.authorityMoment === \"capture\" && !capturedAuthority) {\n\t\t\t\tthrow new Error(`Action \"${resolved.actionId}\" requires a trusted capture-authority adapter.`);\n\t\t\t}\n\t\t\tconst submission: SubmitActionInput = {\n\t\t\t\tactionId: resolved.actionId,\n\t\t\t\tparameters: input.request.parameters,\n\t\t\t\ttenantId: scope.tenantId,\n\t\t\t\tspaceId: scope.spaceId,\n\t\t\t\tactorId: scope.actorId,\n\t\t\t\tactorType: claims.actorType,\n\t\t\t\tcorrelationId,\n\t\t\t\tprovenance: {\n\t\t\t\t\tsource: \"ui\",\n\t\t\t\t\tcorrelationId,\n\t\t\t\t\t...(resolved.execution?.sensitivity === \"restricted\"\n\t\t\t\t\t\t? {}\n\t\t\t\t\t\t: { auditAttributes: { \"fabric.experience.fragment\": input.request.fragmentId } }),\n\t\t\t\t},\n\t\t\t\t...(input.request.idempotencyKey === undefined ? {} : { idempotencyKey: input.request.idempotencyKey }),\n\t\t\t\t...(input.executionReason === undefined ? {} : { executionReason: input.executionReason }),\n\t\t\t\t...(capturedAuthority === undefined ? {} : {\n\t\t\t\t\tauthorizationBindingId: capturedAuthority.id,\n\t\t\t\t\tauthorizationBinding: {\n\t\t\t\t\t\tid: capturedAuthority.id,\n\t\t\t\t\t\tgoverningMoment: \"capture\",\n\t\t\t\t\t\tcapturedAt,\n\t\t\t\t\t\t...(capturedAuthority.expiresAt === undefined ? {} : { expiresAt: capturedAuthority.expiresAt }),\n\t\t\t\t\t\ttenantId: scope.tenantId,\n\t\t\t\t\t\tactorId: scope.actorId,\n\t\t\t\t\t\tactionId: resolved.actionId,\n\t\t\t\t\t\tparameterDigest,\n\t\t\t\t\t},\n\t\t\t\t}),\n\t\t\t};\n\t\t\toptions.evidence.bind(submission, resolved.initiatingReleaseDigest);\n\t\t\ttry {\n\t\t\t\treturn await options.host.submitAction(submission);\n\t\t\t} finally {\n\t\t\t\toptions.evidence.release(submission);\n\t\t\t}\n\t\t},\n\t\tasync read(input) {\n\t\t\tconst claims = await options.identity.verify(input.context.credential);\n\t\t\tif (!claims) throw new Error(\"Experience request credential is not authenticated.\");\n\t\t\tassertActorClaimsCoverScope(claims, {\n\t\t\t\ttenantId: input.context.tenantId,\n\t\t\t\tspaceId: input.context.spaceId,\n\t\t\t}, now());\n\t\t\tconst scope: ExperienceScope = {\n\t\t\t\ttenantId: input.context.tenantId,\n\t\t\t\tspaceId: input.context.spaceId,\n\t\t\t\tactorId: claims.subject,\n\t\t\t\tactorType: claims.actorType,\n\t\t\t};\n\t\t\tconst resolved = await options.runtime.resolveView({\n\t\t\t\tplanId: input.request.planId,\n\t\t\t\tfragmentId: input.request.fragmentId,\n\t\t\t\tbindingName: input.request.bindingName,\n\t\t\t\tscope,\n\t\t\t});\n\t\t\tif (resolved.assemblyDigest !== options.assemblyDigest) {\n\t\t\t\tthrow new Error(\"Experience render plan belongs to a different application assembly.\");\n\t\t\t}\n\t\t\tconst result = await options.projectionHost.project({\n\t\t\t\tview: { name: resolved.name, version: resolved.version },\n\t\t\t\tscope: { tenantId: scope.tenantId, spaceId: scope.spaceId },\n\t\t\t\tactor: { id: scope.actorId, type: claims.actorType },\n\t\t\t\tparameters: input.request.parameters,\n\t\t\t});\n\t\t\treturn {\n\t\t\t\tdata: result.state,\n\t\t\t\tevidence: {\n\t\t\t\t\treleaseDigest: resolved.initiatingReleaseDigest,\n\t\t\t\t\tassemblyDigest: resolved.assemblyDigest,\n\t\t\t\t\teventCursor: result.eventCursor,\n\t\t\t\t\tsource: result.source,\n\t\t\t\t},\n\t\t\t};\n\t\t},\n\t};\n}\n\n/** RFC 3339 with a mandatory offset, so an instant means the same thing everywhere. */\nconst RFC3339 = /^\\d{4}-\\d{2}-\\d{2}[Tt]\\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)?(?:[Zz]|[+-]\\d{2}:\\d{2})$/;\n\n/**\n * A supplied capture moment is client-reported, so it is bounded here rather\n * than trusted.\n *\n * Deferring the lower bound to the Host looked safe and is not: the Host checks\n * staleness only when the capture-authority adapter supplied an `expiresAt`,\n * and skips the execution-time expiry check entirely when the action's\n * authority moment is `capture`. With an adapter that omits `expiresAt` there\n * is no lower bound at all, and the value is written into durable evidence and\n * handed to the authority adapter regardless. A gateway that accepts replay\n * must therefore say how old a capture may be.\n */\nfunction assertCaptureMoment(capturedAt: string, now: Date, maxAgeMs: number | undefined): string {\n\tif (!RFC3339.test(capturedAt)) {\n\t\tthrow new Error(\"Offline replay capturedAt must be an RFC 3339 instant with an explicit offset.\");\n\t}\n\tconst parsed = Date.parse(capturedAt);\n\tif (Number.isNaN(parsed)) throw new Error(\"Offline replay capturedAt is not a parseable instant.\");\n\tif (parsed > now.getTime()) throw new Error(\"Offline replay capturedAt is in the future.\");\n\tif (maxAgeMs === undefined) {\n\t\tthrow new Error(\"Gateway accepts offline replay but declares no maxOfflineReplayAgeMs, so a capture has no lower bound.\");\n\t}\n\tif (now.getTime() - parsed > maxAgeMs) {\n\t\tthrow new Error(`Offline replay capturedAt is older than the ${maxAgeMs}ms this gateway accepts.`);\n\t}\n\treturn new Date(parsed).toISOString();\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAKA,2BAAiC;AAEjC,mBAGO;AAqEA,SAAS,0BAA6D;AAC5E,SAAO;AAAA,IACN;AAAA,MACC,IAAI;AAAA,MACJ,MAAM,IAAI,SAAS;AAClB,cAAM,SAAS,QAAQ,SAAS,kBAAkB;AAClD,cAAM,SAAS,MAAM,QAAQ,QAAQ,OAAO,QAAQ,WAAW;AAC/D,YAAI,CAAC,OAAO,mBAAoB,OAAM,IAAI,MAAM,oDAAoD;AACpG,cAAM,YAAY,QAAQ,SAAS,kBAAkB,IAAI;AACzD,YAAI,cAAc,GAAG;AACpB,gBAAM,IAAI;AAAA,YACT,2CAA2C,SAAS;AAAA,UACrD;AAAA,QACD;AACA,eAAO,CAAC,OAAO,kBAAkB;AAAA,MAClC;AAAA,IACD;AAAA,IACA;AAAA,MACC,IAAI;AAAA,MACJ,MAAM,IAAI,SAAS;AAClB,cAAM,SAAS,QAAQ,SAAS,gBAAgB;AAChD,cAAM,QAAQ,QAAQ,KAAK,QAAQ,SAAS;AAC5C,cAAM,YAAY,QAAQ,SAAS,gBAAgB,IAAI;AACvD,YAAI,cAAc,GAAG;AACpB,gBAAM,IAAI;AAAA,YACT,+BAA+B,SAAS;AAAA,UACzC;AAAA,QACD;AACA,eAAO,CAAC,oCAAoC;AAAA,MAC7C;AAAA,IACD;AAAA,IACA;AAAA,MACC,IAAI;AAAA,MACJ,MAAM,IAAI,SAAS;AAClB,YAAI,WAAW;AACf,YAAI;AAAE,gBAAM,QAAQ,QAAQ,OAAO,QAAQ,YAAY;AAAA,QAAG,QAAQ;AAAE,qBAAW;AAAA,QAAM;AACrF,YAAI,CAAC,SAAU,OAAM,IAAI,MAAM,4DAA4D;AAC3F,eAAO,CAAC,8BAA8B;AAAA,MACvC;AAAA,IACD;AAAA,EACD;AACD;AAEA,eAAsB,2BACrB,SACA,SAA4C,wBAAwB,GACiF;AACrJ,QAAM,UAAwH,CAAC;AAC/H,aAAW,SAAS,QAAQ;AAC3B,QAAI;AAAE,cAAQ,KAAK,EAAE,IAAI,MAAM,IAAI,QAAQ,UAAU,UAAU,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;AAAA,IAAG,SACrF,OAAO;AAAE,cAAQ,KAAK,EAAE,IAAI,MAAM,IAAI,QAAQ,UAAU,UAAU,CAAC,GAAG,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,CAAC;AAAA,IAAG;AAAA,EAChJ;AACA,SAAO,EAAE,QAAQ,QAAQ,MAAM,CAAC,WAAW,OAAO,WAAW,QAAQ,GAAG,QAAQ,QAAQ;AACzF;AAaO,SAAS,kCAA6D;AAC5E,QAAM,WAAW,oBAAI,QAAmC;AACxD,SAAO;AAAA,IACN,KAAK,OAAO,eAAe;AAC1B,eAAS,IAAI,OAAO,aAAa;AAAA,IAClC;AAAA,IACA,QAAQ,OAAO;AACd,aAAO,SAAS,IAAI,KAAK;AAAA,IAC1B;AAAA,IACA,QAAQ,OAAO;AACd,eAAS,OAAO,KAAK;AAAA,IACtB;AAAA,EACD;AACD;AAEO,SAAS,wBAAwB,SA0BlB;AACrB,QAAM,MAAM,QAAQ,QAAQ,MAAM,oBAAI,KAAK;AAC3C,SAAO;AAAA,IACN,MAAM,OAAO,OAAO;AACnB,YAAM,SAAS,MAAM,QAAQ,SAAS,OAAO,MAAM,QAAQ,UAAU;AACrE,UAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,qDAAqD;AAClF,oDAA4B,QAAQ;AAAA,QACnC,UAAU,MAAM,QAAQ;AAAA,QACxB,SAAS,MAAM,QAAQ;AAAA,MACxB,GAAG,IAAI,CAAC;AACR,YAAM,QAAyB;AAAA,QAC9B,UAAU,MAAM,QAAQ;AAAA,QACxB,SAAS,MAAM,QAAQ;AAAA,QACvB,SAAS,OAAO;AAAA,QAChB,WAAW,OAAO;AAAA,MACnB;AACA,YAAM,WAAW,MAAM,QAAQ,QAAQ,cAAc;AAAA,QACpD,QAAQ,MAAM,QAAQ;AAAA,QACtB,YAAY,MAAM,QAAQ;AAAA,QAC1B,WAAW,MAAM,QAAQ;AAAA,QACzB;AAAA,MACD,CAAC;AACD,UAAI,SAAS,mBAAmB,QAAQ,gBAAgB;AACvD,cAAM,IAAI,MAAM,qEAAqE;AAAA,MACtF;AACA,UAAI,QAAQ,cAAc,SAAS,QAAQ,MAAM,SAAS,eAAe;AACxE,cAAM,IAAI,MAAM,gCAAgC,SAAS,QAAQ,iDAAiD;AAAA,MACnH;AACA,UAAI,SAAS,WAAW,gBAAgB,cAAc,CAAC,MAAM,QAAQ,gBAAgB;AACpF,cAAM,IAAI,MAAM,WAAW,SAAS,QAAQ,gCAAgC;AAAA,MAC7E;AACA,UAAI,MAAM,oBAAoB,oBAAoB,SAAS,WAAW,iBAAiB,sBAAsB;AAC5G,cAAM,IAAI,MAAM,WAAW,SAAS,QAAQ,uCAAuC;AAAA,MACpF;AACA,YAAM,gBAAgB,QAAQ,kBAAkB;AAIhD,UAAI;AACJ,UAAI,MAAM,oBAAoB,kBAAkB;AAI/C,cAAM,WAAW,MAAM,cAClB,MAAM,QAA4C;AACvD,YAAI,OAAO,aAAa,UAAU;AACjC,gBAAM,IAAI,MAAM,yFAAyF;AAAA,QAC1G;AACA,qBAAa,oBAAoB,UAAU,IAAI,GAAG,QAAQ,qBAAqB;AAAA,MAChF,OAAO;AACN,qBAAa,IAAI,EAAE,YAAY;AAAA,MAChC;AACA,YAAM,sBAAkB,uCAAiB,MAAM,QAAQ,UAAU;AACjE,YAAM,oBAAoB,SAAS,WAAW,oBAAoB,YAC/D,MAAM,QAAQ,mBAAmB;AAAA,QAClC,UAAU,SAAS;AAAA,QACnB;AAAA,QACA,YAAY,MAAM,QAAQ;AAAA,QAC1B;AAAA,QACA;AAAA,MACD,CAAC,IACC;AACH,UAAI,SAAS,WAAW,oBAAoB,aAAa,CAAC,mBAAmB;AAC5E,cAAM,IAAI,MAAM,WAAW,SAAS,QAAQ,iDAAiD;AAAA,MAC9F;AACA,YAAM,aAAgC;AAAA,QACrC,UAAU,SAAS;AAAA,QACnB,YAAY,MAAM,QAAQ;AAAA,QAC1B,UAAU,MAAM;AAAA,QAChB,SAAS,MAAM;AAAA,QACf,SAAS,MAAM;AAAA,QACf,WAAW,OAAO;AAAA,QAClB;AAAA,QACA,YAAY;AAAA,UACX,QAAQ;AAAA,UACR;AAAA,UACA,GAAI,SAAS,WAAW,gBAAgB,eACrC,CAAC,IACD,EAAE,iBAAiB,EAAE,8BAA8B,MAAM,QAAQ,WAAW,EAAE;AAAA,QAClF;AAAA,QACA,GAAI,MAAM,QAAQ,mBAAmB,SAAY,CAAC,IAAI,EAAE,gBAAgB,MAAM,QAAQ,eAAe;AAAA,QACrG,GAAI,MAAM,oBAAoB,SAAY,CAAC,IAAI,EAAE,iBAAiB,MAAM,gBAAgB;AAAA,QACxF,GAAI,sBAAsB,SAAY,CAAC,IAAI;AAAA,UAC1C,wBAAwB,kBAAkB;AAAA,UAC1C,sBAAsB;AAAA,YACrB,IAAI,kBAAkB;AAAA,YACtB,iBAAiB;AAAA,YACjB;AAAA,YACA,GAAI,kBAAkB,cAAc,SAAY,CAAC,IAAI,EAAE,WAAW,kBAAkB,UAAU;AAAA,YAC9F,UAAU,MAAM;AAAA,YAChB,SAAS,MAAM;AAAA,YACf,UAAU,SAAS;AAAA,YACnB;AAAA,UACD;AAAA,QACD;AAAA,MACD;AACA,cAAQ,SAAS,KAAK,YAAY,SAAS,uBAAuB;AAClE,UAAI;AACH,eAAO,MAAM,QAAQ,KAAK,aAAa,UAAU;AAAA,MAClD,UAAE;AACD,gBAAQ,SAAS,QAAQ,UAAU;AAAA,MACpC;AAAA,IACD;AAAA,IACA,MAAM,KAAK,OAAO;AACjB,YAAM,SAAS,MAAM,QAAQ,SAAS,OAAO,MAAM,QAAQ,UAAU;AACrE,UAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,qDAAqD;AAClF,oDAA4B,QAAQ;AAAA,QACnC,UAAU,MAAM,QAAQ;AAAA,QACxB,SAAS,MAAM,QAAQ;AAAA,MACxB,GAAG,IAAI,CAAC;AACR,YAAM,QAAyB;AAAA,QAC9B,UAAU,MAAM,QAAQ;AAAA,QACxB,SAAS,MAAM,QAAQ;AAAA,QACvB,SAAS,OAAO;AAAA,QAChB,WAAW,OAAO;AAAA,MACnB;AACA,YAAM,WAAW,MAAM,QAAQ,QAAQ,YAAY;AAAA,QAClD,QAAQ,MAAM,QAAQ;AAAA,QACtB,YAAY,MAAM,QAAQ;AAAA,QAC1B,aAAa,MAAM,QAAQ;AAAA,QAC3B;AAAA,MACD,CAAC;AACD,UAAI,SAAS,mBAAmB,QAAQ,gBAAgB;AACvD,cAAM,IAAI,MAAM,qEAAqE;AAAA,MACtF;AACA,YAAM,SAAS,MAAM,QAAQ,eAAe,QAAQ;AAAA,QACnD,MAAM,EAAE,MAAM,SAAS,MAAM,SAAS,SAAS,QAAQ;AAAA,QACvD,OAAO,EAAE,UAAU,MAAM,UAAU,SAAS,MAAM,QAAQ;AAAA,QAC1D,OAAO,EAAE,IAAI,MAAM,SAAS,MAAM,OAAO,UAAU;AAAA,QACnD,YAAY,MAAM,QAAQ;AAAA,MAC3B,CAAC;AACD,aAAO;AAAA,QACN,MAAM,OAAO;AAAA,QACb,UAAU;AAAA,UACT,eAAe,SAAS;AAAA,UACxB,gBAAgB,SAAS;AAAA,UACzB,aAAa,OAAO;AAAA,UACpB,QAAQ,OAAO;AAAA,QAChB;AAAA,MACD;AAAA,IACD;AAAA,EACD;AACD;AAGA,IAAM,UAAU;AAchB,SAAS,oBAAoB,YAAoB,KAAW,UAAsC;AACjG,MAAI,CAAC,QAAQ,KAAK,UAAU,GAAG;AAC9B,UAAM,IAAI,MAAM,gFAAgF;AAAA,EACjG;AACA,QAAM,SAAS,KAAK,MAAM,UAAU;AACpC,MAAI,OAAO,MAAM,MAAM,EAAG,OAAM,IAAI,MAAM,uDAAuD;AACjG,MAAI,SAAS,IAAI,QAAQ,EAAG,OAAM,IAAI,MAAM,6CAA6C;AACzF,MAAI,aAAa,QAAW;AAC3B,UAAM,IAAI,MAAM,wGAAwG;AAAA,EACzH;AACA,MAAI,IAAI,QAAQ,IAAI,SAAS,UAAU;AACtC,UAAM,IAAI,MAAM,+CAA+C,QAAQ,0BAA0B;AAAA,EAClG;AACA,SAAO,IAAI,KAAK,MAAM,EAAE,YAAY;AACrC;","names":[]}

package/dist/index.d.cts

@@ -0,0 +1,114 @@
+import { SubmitActionResult, SubmitActionInput, GovernedActionHost } from '@fabricorg/platform-host';
+import { ProjectionHost } from '@fabricorg/projection-host';
+import { IdentityPort } from '@fabricorg/ports';
+import { ExperienceIntentRequest, ExperienceReadRequest } from '@fabricorg/experience-runtime';
+import { ExperienceServerRuntime, ExperienceScope } from '@fabricorg/experience-runtime/server';
+
+interface TrustedExperienceRequestContext {
+    /** Presented only to IdentityPort and never persisted or forwarded. */
+    credential: string;
+    tenantId: string;
+    spaceId: string;
+}
+interface ExperienceGateway {
+    invoke(input: {
+        context: TrustedExperienceRequestContext;
+        request: ExperienceIntentRequest;
+        executionReason?: "initial" | "offline_replay";
+        /**
+         * When the operator acted, for a replay. Required whenever
+         * `executionReason` is `offline_replay`: reading it through an untyped
+         * cast made omitting it the easy mistake, and omitting it silently
+         * stamped receipt time into durable capture evidence.
+         */
+        capturedAt?: string;
+    }): Promise<SubmitActionResult>;
+    read(input: {
+        context: TrustedExperienceRequestContext;
+        request: ExperienceReadRequest;
+    }): Promise<{
+        data: unknown;
+        evidence: {
+            releaseDigest: string;
+            assemblyDigest: string;
+            eventCursor: string | null;
+            source: "cache" | "replay";
+        };
+    }>;
+}
+interface ExperienceGatewayConformanceSubject {
+    gateway: ExperienceGateway;
+    validIntent: Parameters<ExperienceGateway["invoke"]>[0];
+    deniedIntent: Parameters<ExperienceGateway["invoke"]>[0];
+    validRead: Parameters<ExperienceGateway["read"]>[0];
+    /**
+     * What the governed hosts actually saw.
+     *
+     * A returned invocation id proves only that a string was produced. The
+     * point of a gateway is that mutations reach `PlatformHost.submitAction` and
+     * reads reach `ProjectionHost.project`; a replacement that fabricates an id
+     * and queries the database directly satisfies every observable contract
+     * except this one, so the subject has to report the calls.
+     */
+    observed: {
+        submitActionCount(): number;
+        projectionCount(): number;
+    };
+}
+interface ExperienceGatewayCheck {
+    id: "fabric.experience.gateway-host-routing.v1" | "fabric.experience.gateway-scope-denial.v1" | "fabric.experience.gateway-projection-routing.v1";
+    run(subject: ExperienceGatewayConformanceSubject): Promise<string[]>;
+}
+declare function experienceGatewayChecks(): readonly ExperienceGatewayCheck[];
+declare function runExperienceGatewayChecks(subject: ExperienceGatewayConformanceSubject, checks?: readonly ExperienceGatewayCheck[]): Promise<{
+    passed: boolean;
+    checks: Array<{
+        id: ExperienceGatewayCheck["id"];
+        status: "passed" | "failed";
+        evidence: string[];
+        error?: string;
+    }>;
+}>;
+interface InitiatingReleaseEvidence {
+    bind(input: SubmitActionInput, releaseDigest: string): void;
+    resolve(input: SubmitActionInput): string | undefined;
+    release(input: SubmitActionInput): void;
+}
+/**
+ * Creates an instance-scoped, non-serializable evidence seam. The Host's
+ * `composition.resolveInitiatingReleaseDigest` reads this WeakMap using the
+ * exact submission object. A browser field cannot populate or forge it.
+ */
+declare function createInitiatingReleaseEvidence(): InitiatingReleaseEvidence;
+declare function createExperienceGateway(options: {
+    identity: IdentityPort;
+    runtime: ExperienceServerRuntime;
+    host: Pick<GovernedActionHost, "submitAction">;
+    projectionHost: Pick<ProjectionHost, "project">;
+    evidence: InitiatingReleaseEvidence;
+    assemblyDigest: string;
+    actionVersion(actionId: `${string}.${string}`): number | undefined;
+    nextCorrelationId(): string;
+    /**
+     * How old an offline capture may be and still replay.
+     *
+     * Required to accept replay at all. The Host's own staleness check is
+     * conditional on the capture-authority adapter supplying an `expiresAt`, and
+     * is skipped entirely for actions governed at capture time, so without this
+     * a client-reported instant has no lower bound.
+     */
+    maxOfflineReplayAgeMs?: number;
+    captureAuthority?(input: {
+        actionId: `${string}.${string}`;
+        scope: ExperienceScope;
+        parameters: Record<string, unknown>;
+        parameterDigest: string;
+        capturedAt: string;
+    }): Promise<{
+        id: string;
+        expiresAt?: string;
+    }>;
+    now?: () => Date;
+}): ExperienceGateway;
+
+export { type ExperienceGateway, type ExperienceGatewayCheck, type ExperienceGatewayConformanceSubject, type InitiatingReleaseEvidence, type TrustedExperienceRequestContext, createExperienceGateway, createInitiatingReleaseEvidence, experienceGatewayChecks, runExperienceGatewayChecks };

package/dist/index.d.ts

@@ -0,0 +1,114 @@
+import { SubmitActionResult, SubmitActionInput, GovernedActionHost } from '@fabricorg/platform-host';
+import { ProjectionHost } from '@fabricorg/projection-host';
+import { IdentityPort } from '@fabricorg/ports';
+import { ExperienceIntentRequest, ExperienceReadRequest } from '@fabricorg/experience-runtime';
+import { ExperienceServerRuntime, ExperienceScope } from '@fabricorg/experience-runtime/server';
+
+interface TrustedExperienceRequestContext {
+    /** Presented only to IdentityPort and never persisted or forwarded. */
+    credential: string;
+    tenantId: string;
+    spaceId: string;
+}
+interface ExperienceGateway {
+    invoke(input: {
+        context: TrustedExperienceRequestContext;
+        request: ExperienceIntentRequest;
+        executionReason?: "initial" | "offline_replay";
+        /**
+         * When the operator acted, for a replay. Required whenever
+         * `executionReason` is `offline_replay`: reading it through an untyped
+         * cast made omitting it the easy mistake, and omitting it silently
+         * stamped receipt time into durable capture evidence.
+         */
+        capturedAt?: string;
+    }): Promise<SubmitActionResult>;
+    read(input: {
+        context: TrustedExperienceRequestContext;
+        request: ExperienceReadRequest;
+    }): Promise<{
+        data: unknown;
+        evidence: {
+            releaseDigest: string;
+            assemblyDigest: string;
+            eventCursor: string | null;
+            source: "cache" | "replay";
+        };
+    }>;
+}
+interface ExperienceGatewayConformanceSubject {
+    gateway: ExperienceGateway;
+    validIntent: Parameters<ExperienceGateway["invoke"]>[0];
+    deniedIntent: Parameters<ExperienceGateway["invoke"]>[0];
+    validRead: Parameters<ExperienceGateway["read"]>[0];
+    /**
+     * What the governed hosts actually saw.
+     *
+     * A returned invocation id proves only that a string was produced. The
+     * point of a gateway is that mutations reach `PlatformHost.submitAction` and
+     * reads reach `ProjectionHost.project`; a replacement that fabricates an id
+     * and queries the database directly satisfies every observable contract
+     * except this one, so the subject has to report the calls.
+     */
+    observed: {
+        submitActionCount(): number;
+        projectionCount(): number;
+    };
+}
+interface ExperienceGatewayCheck {
+    id: "fabric.experience.gateway-host-routing.v1" | "fabric.experience.gateway-scope-denial.v1" | "fabric.experience.gateway-projection-routing.v1";
+    run(subject: ExperienceGatewayConformanceSubject): Promise<string[]>;
+}
+declare function experienceGatewayChecks(): readonly ExperienceGatewayCheck[];
+declare function runExperienceGatewayChecks(subject: ExperienceGatewayConformanceSubject, checks?: readonly ExperienceGatewayCheck[]): Promise<{
+    passed: boolean;
+    checks: Array<{
+        id: ExperienceGatewayCheck["id"];
+        status: "passed" | "failed";
+        evidence: string[];
+        error?: string;
+    }>;
+}>;
+interface InitiatingReleaseEvidence {
+    bind(input: SubmitActionInput, releaseDigest: string): void;
+    resolve(input: SubmitActionInput): string | undefined;
+    release(input: SubmitActionInput): void;
+}
+/**
+ * Creates an instance-scoped, non-serializable evidence seam. The Host's
+ * `composition.resolveInitiatingReleaseDigest` reads this WeakMap using the
+ * exact submission object. A browser field cannot populate or forge it.
+ */
+declare function createInitiatingReleaseEvidence(): InitiatingReleaseEvidence;
+declare function createExperienceGateway(options: {
+    identity: IdentityPort;
+    runtime: ExperienceServerRuntime;
+    host: Pick<GovernedActionHost, "submitAction">;
+    projectionHost: Pick<ProjectionHost, "project">;
+    evidence: InitiatingReleaseEvidence;
+    assemblyDigest: string;
+    actionVersion(actionId: `${string}.${string}`): number | undefined;
+    nextCorrelationId(): string;
+    /**
+     * How old an offline capture may be and still replay.
+     *
+     * Required to accept replay at all. The Host's own staleness check is
+     * conditional on the capture-authority adapter supplying an `expiresAt`, and
+     * is skipped entirely for actions governed at capture time, so without this
+     * a client-reported instant has no lower bound.
+     */
+    maxOfflineReplayAgeMs?: number;
+    captureAuthority?(input: {
+        actionId: `${string}.${string}`;
+        scope: ExperienceScope;
+        parameters: Record<string, unknown>;
+        parameterDigest: string;
+        capturedAt: string;
+    }): Promise<{
+        id: string;
+        expiresAt?: string;
+    }>;
+    now?: () => Date;
+}): ExperienceGateway;
+
+export { type ExperienceGateway, type ExperienceGatewayCheck, type ExperienceGatewayConformanceSubject, type InitiatingReleaseEvidence, type TrustedExperienceRequestContext, createExperienceGateway, createInitiatingReleaseEvidence, experienceGatewayChecks, runExperienceGatewayChecks };

package/dist/index.js

@@ -0,0 +1,231 @@
+// index.ts
+import { digestParameters } from "@fabricorg/platform-host";
+import {
+  assertActorClaimsCoverScope
+} from "@fabricorg/ports";
+function experienceGatewayChecks() {
+  return [
+    {
+      id: "fabric.experience.gateway-host-routing.v1",
+      async run(subject) {
+        const before = subject.observed.submitActionCount();
+        const result = await subject.gateway.invoke(subject.validIntent);
+        if (!result.actionInvocationId) throw new Error("Gateway did not return a governed Host invocation.");
+        const submitted = subject.observed.submitActionCount() - before;
+        if (submitted !== 1) {
+          throw new Error(
+            `Gateway returned an invocation id after ${submitted} calls to PlatformHost.submitAction; a mutation must reach the Host exactly once.`
+          );
+        }
+        return [result.actionInvocationId];
+      }
+    },
+    {
+      id: "fabric.experience.gateway-projection-routing.v1",
+      async run(subject) {
+        const before = subject.observed.projectionCount();
+        await subject.gateway.read(subject.validRead);
+        const projected = subject.observed.projectionCount() - before;
+        if (projected !== 1) {
+          throw new Error(
+            `Gateway served a read after ${projected} calls to ProjectionHost.project; a read must go through the projection host.`
+          );
+        }
+        return ["read routed through ProjectionHost"];
+      }
+    },
+    {
+      id: "fabric.experience.gateway-scope-denial.v1",
+      async run(subject) {
+        let rejected = false;
+        try {
+          await subject.gateway.invoke(subject.deniedIntent);
+        } catch {
+          rejected = true;
+        }
+        if (!rejected) throw new Error("Gateway accepted an intent outside trusted identity scope.");
+        return ["out-of-scope intent rejected"];
+      }
+    }
+  ];
+}
+async function runExperienceGatewayChecks(subject, checks = experienceGatewayChecks()) {
+  const results = [];
+  for (const check of checks) {
+    try {
+      results.push({ id: check.id, status: "passed", evidence: await check.run(subject) });
+    } catch (error) {
+      results.push({ id: check.id, status: "failed", evidence: [], error: error instanceof Error ? error.message : String(error) });
+    }
+  }
+  return { passed: results.every((result) => result.status === "passed"), checks: results };
+}
+function createInitiatingReleaseEvidence() {
+  const evidence = /* @__PURE__ */ new WeakMap();
+  return {
+    bind(input, releaseDigest) {
+      evidence.set(input, releaseDigest);
+    },
+    resolve(input) {
+      return evidence.get(input);
+    },
+    release(input) {
+      evidence.delete(input);
+    }
+  };
+}
+function createExperienceGateway(options) {
+  const now = options.now ?? (() => /* @__PURE__ */ new Date());
+  return {
+    async invoke(input) {
+      const claims = await options.identity.verify(input.context.credential);
+      if (!claims) throw new Error("Experience request credential is not authenticated.");
+      assertActorClaimsCoverScope(claims, {
+        tenantId: input.context.tenantId,
+        spaceId: input.context.spaceId
+      }, now());
+      const scope = {
+        tenantId: input.context.tenantId,
+        spaceId: input.context.spaceId,
+        actorId: claims.subject,
+        actorType: claims.actorType
+      };
+      const resolved = await options.runtime.resolveIntent({
+        planId: input.request.planId,
+        fragmentId: input.request.fragmentId,
+        eventName: input.request.eventName,
+        scope
+      });
+      if (resolved.assemblyDigest !== options.assemblyDigest) {
+        throw new Error("Experience render plan belongs to a different application assembly.");
+      }
+      if (options.actionVersion(resolved.actionId) !== resolved.actionVersion) {
+        throw new Error(`Experience intent route for "${resolved.actionId}" does not match the registered action version.`);
+      }
+      if (resolved.execution?.idempotency === "required" && !input.request.idempotencyKey) {
+        throw new Error(`Action "${resolved.actionId}" requires an idempotency key.`);
+      }
+      if (input.executionReason === "offline_replay" && resolved.execution?.connectivity !== "offline-capturable") {
+        throw new Error(`Action "${resolved.actionId}" is not eligible for offline replay.`);
+      }
+      const correlationId = options.nextCorrelationId();
+      let capturedAt;
+      if (input.executionReason === "offline_replay") {
+        const supplied = input.capturedAt ?? input.request.capturedAt;
+        if (typeof supplied !== "string") {
+          throw new Error("Offline replay requires capturedAt; receipt time cannot attest when the operator acted.");
+        }
+        capturedAt = assertCaptureMoment(supplied, now(), options.maxOfflineReplayAgeMs);
+      } else {
+        capturedAt = now().toISOString();
+      }
+      const parameterDigest = digestParameters(input.request.parameters);
+      const capturedAuthority = resolved.execution?.authorityMoment === "capture" ? await options.captureAuthority?.({
+        actionId: resolved.actionId,
+        scope,
+        parameters: input.request.parameters,
+        parameterDigest,
+        capturedAt
+      }) : void 0;
+      if (resolved.execution?.authorityMoment === "capture" && !capturedAuthority) {
+        throw new Error(`Action "${resolved.actionId}" requires a trusted capture-authority adapter.`);
+      }
+      const submission = {
+        actionId: resolved.actionId,
+        parameters: input.request.parameters,
+        tenantId: scope.tenantId,
+        spaceId: scope.spaceId,
+        actorId: scope.actorId,
+        actorType: claims.actorType,
+        correlationId,
+        provenance: {
+          source: "ui",
+          correlationId,
+          ...resolved.execution?.sensitivity === "restricted" ? {} : { auditAttributes: { "fabric.experience.fragment": input.request.fragmentId } }
+        },
+        ...input.request.idempotencyKey === void 0 ? {} : { idempotencyKey: input.request.idempotencyKey },
+        ...input.executionReason === void 0 ? {} : { executionReason: input.executionReason },
+        ...capturedAuthority === void 0 ? {} : {
+          authorizationBindingId: capturedAuthority.id,
+          authorizationBinding: {
+            id: capturedAuthority.id,
+            governingMoment: "capture",
+            capturedAt,
+            ...capturedAuthority.expiresAt === void 0 ? {} : { expiresAt: capturedAuthority.expiresAt },
+            tenantId: scope.tenantId,
+            actorId: scope.actorId,
+            actionId: resolved.actionId,
+            parameterDigest
+          }
+        }
+      };
+      options.evidence.bind(submission, resolved.initiatingReleaseDigest);
+      try {
+        return await options.host.submitAction(submission);
+      } finally {
+        options.evidence.release(submission);
+      }
+    },
+    async read(input) {
+      const claims = await options.identity.verify(input.context.credential);
+      if (!claims) throw new Error("Experience request credential is not authenticated.");
+      assertActorClaimsCoverScope(claims, {
+        tenantId: input.context.tenantId,
+        spaceId: input.context.spaceId
+      }, now());
+      const scope = {
+        tenantId: input.context.tenantId,
+        spaceId: input.context.spaceId,
+        actorId: claims.subject,
+        actorType: claims.actorType
+      };
+      const resolved = await options.runtime.resolveView({
+        planId: input.request.planId,
+        fragmentId: input.request.fragmentId,
+        bindingName: input.request.bindingName,
+        scope
+      });
+      if (resolved.assemblyDigest !== options.assemblyDigest) {
+        throw new Error("Experience render plan belongs to a different application assembly.");
+      }
+      const result = await options.projectionHost.project({
+        view: { name: resolved.name, version: resolved.version },
+        scope: { tenantId: scope.tenantId, spaceId: scope.spaceId },
+        actor: { id: scope.actorId, type: claims.actorType },
+        parameters: input.request.parameters
+      });
+      return {
+        data: result.state,
+        evidence: {
+          releaseDigest: resolved.initiatingReleaseDigest,
+          assemblyDigest: resolved.assemblyDigest,
+          eventCursor: result.eventCursor,
+          source: result.source
+        }
+      };
+    }
+  };
+}
+var RFC3339 = /^\d{4}-\d{2}-\d{2}[Tt]\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:[Zz]|[+-]\d{2}:\d{2})$/;
+function assertCaptureMoment(capturedAt, now, maxAgeMs) {
+  if (!RFC3339.test(capturedAt)) {
+    throw new Error("Offline replay capturedAt must be an RFC 3339 instant with an explicit offset.");
+  }
+  const parsed = Date.parse(capturedAt);
+  if (Number.isNaN(parsed)) throw new Error("Offline replay capturedAt is not a parseable instant.");
+  if (parsed > now.getTime()) throw new Error("Offline replay capturedAt is in the future.");
+  if (maxAgeMs === void 0) {
+    throw new Error("Gateway accepts offline replay but declares no maxOfflineReplayAgeMs, so a capture has no lower bound.");
+  }
+  if (now.getTime() - parsed > maxAgeMs) {
+    throw new Error(`Offline replay capturedAt is older than the ${maxAgeMs}ms this gateway accepts.`);
+  }
+  return new Date(parsed).toISOString();
+}
+export {
+  createExperienceGateway,
+  createInitiatingReleaseEvidence,
+  experienceGatewayChecks,
+  runExperienceGatewayChecks
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../index.ts"],"sourcesContent":["import type {\n\tGovernedActionHost,\n\tSubmitActionInput,\n\tSubmitActionResult,\n} from \"@fabricorg/platform-host\";\nimport { digestParameters } from \"@fabricorg/platform-host\";\nimport type { ProjectionHost } from \"@fabricorg/projection-host\";\nimport {\n\tassertActorClaimsCoverScope,\n\ttype IdentityPort,\n} from \"@fabricorg/ports\";\nimport type { ExperienceIntentRequest, ExperienceReadRequest } from \"@fabricorg/experience-runtime\";\nimport type {\n\tExperienceScope,\n\tExperienceServerRuntime,\n} from \"@fabricorg/experience-runtime/server\";\n\nexport interface TrustedExperienceRequestContext {\n\t/** Presented only to IdentityPort and never persisted or forwarded. */\n\tcredential: string;\n\ttenantId: string;\n\tspaceId: string;\n}\n\nexport interface ExperienceGateway {\n\tinvoke(input: {\n\t\tcontext: TrustedExperienceRequestContext;\n\t\trequest: ExperienceIntentRequest;\n\t\texecutionReason?: \"initial\" | \"offline_replay\";\n\t\t/**\n\t\t * When the operator acted, for a replay. Required whenever\n\t\t * `executionReason` is `offline_replay`: reading it through an untyped\n\t\t * cast made omitting it the easy mistake, and omitting it silently\n\t\t * stamped receipt time into durable capture evidence.\n\t\t */\n\t\tcapturedAt?: string;\n\t}): Promise<SubmitActionResult>;\n\tread(input: {\n\t\tcontext: TrustedExperienceRequestContext;\n\t\trequest: ExperienceReadRequest;\n\t}): Promise<{\n\t\tdata: unknown;\n\t\tevidence: {\n\t\t\treleaseDigest: string;\n\t\t\tassemblyDigest: string;\n\t\t\teventCursor: string | null;\n\t\t\tsource: \"cache\" | \"replay\";\n\t\t};\n\t}>;\n}\n\nexport interface ExperienceGatewayConformanceSubject {\n\tgateway: ExperienceGateway;\n\tvalidIntent: Parameters<ExperienceGateway[\"invoke\"]>[0];\n\tdeniedIntent: Parameters<ExperienceGateway[\"invoke\"]>[0];\n\tvalidRead: Parameters<ExperienceGateway[\"read\"]>[0];\n\t/**\n\t * What the governed hosts actually saw.\n\t *\n\t * A returned invocation id proves only that a string was produced. The\n\t * point of a gateway is that mutations reach `PlatformHost.submitAction` and\n\t * reads reach `ProjectionHost.project`; a replacement that fabricates an id\n\t * and queries the database directly satisfies every observable contract\n\t * except this one, so the subject has to report the calls.\n\t */\n\tobserved: {\n\t\tsubmitActionCount(): number;\n\t\tprojectionCount(): number;\n\t};\n}\n\nexport interface ExperienceGatewayCheck {\n\tid:\n\t\t| \"fabric.experience.gateway-host-routing.v1\"\n\t\t| \"fabric.experience.gateway-scope-denial.v1\"\n\t\t| \"fabric.experience.gateway-projection-routing.v1\";\n\trun(subject: ExperienceGatewayConformanceSubject): Promise<string[]>;\n}\n\nexport function experienceGatewayChecks(): readonly ExperienceGatewayCheck[] {\n\treturn [\n\t\t{\n\t\t\tid: \"fabric.experience.gateway-host-routing.v1\",\n\t\t\tasync run(subject) {\n\t\t\t\tconst before = subject.observed.submitActionCount();\n\t\t\t\tconst result = await subject.gateway.invoke(subject.validIntent);\n\t\t\t\tif (!result.actionInvocationId) throw new Error(\"Gateway did not return a governed Host invocation.\");\n\t\t\t\tconst submitted = subject.observed.submitActionCount() - before;\n\t\t\t\tif (submitted !== 1) {\n\t\t\t\t\tthrow new Error(\n\t\t\t\t\t\t`Gateway returned an invocation id after ${submitted} calls to PlatformHost.submitAction; a mutation must reach the Host exactly once.`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\treturn [result.actionInvocationId];\n\t\t\t},\n\t\t},\n\t\t{\n\t\t\tid: \"fabric.experience.gateway-projection-routing.v1\",\n\t\t\tasync run(subject) {\n\t\t\t\tconst before = subject.observed.projectionCount();\n\t\t\t\tawait subject.gateway.read(subject.validRead);\n\t\t\t\tconst projected = subject.observed.projectionCount() - before;\n\t\t\t\tif (projected !== 1) {\n\t\t\t\t\tthrow new Error(\n\t\t\t\t\t\t`Gateway served a read after ${projected} calls to ProjectionHost.project; a read must go through the projection host.`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\treturn [\"read routed through ProjectionHost\"];\n\t\t\t},\n\t\t},\n\t\t{\n\t\t\tid: \"fabric.experience.gateway-scope-denial.v1\",\n\t\t\tasync run(subject) {\n\t\t\t\tlet rejected = false;\n\t\t\t\ttry { await subject.gateway.invoke(subject.deniedIntent); } catch { rejected = true; }\n\t\t\t\tif (!rejected) throw new Error(\"Gateway accepted an intent outside trusted identity scope.\");\n\t\t\t\treturn [\"out-of-scope intent rejected\"];\n\t\t\t},\n\t\t},\n\t];\n}\n\nexport async function runExperienceGatewayChecks(\n\tsubject: ExperienceGatewayConformanceSubject,\n\tchecks: readonly ExperienceGatewayCheck[] = experienceGatewayChecks(),\n): Promise<{ passed: boolean; checks: Array<{ id: ExperienceGatewayCheck[\"id\"]; status: \"passed\" | \"failed\"; evidence: string[]; error?: string }> }> {\n\tconst results: Array<{ id: ExperienceGatewayCheck[\"id\"]; status: \"passed\" | \"failed\"; evidence: string[]; error?: string }> = [];\n\tfor (const check of checks) {\n\t\ttry { results.push({ id: check.id, status: \"passed\", evidence: await check.run(subject) }); }\n\t\tcatch (error) { results.push({ id: check.id, status: \"failed\", evidence: [], error: error instanceof Error ? error.message : String(error) }); }\n\t}\n\treturn { passed: results.every((result) => result.status === \"passed\"), checks: results };\n}\n\nexport interface InitiatingReleaseEvidence {\n\tbind(input: SubmitActionInput, releaseDigest: string): void;\n\tresolve(input: SubmitActionInput): string | undefined;\n\trelease(input: SubmitActionInput): void;\n}\n\n/**\n * Creates an instance-scoped, non-serializable evidence seam. The Host's\n * `composition.resolveInitiatingReleaseDigest` reads this WeakMap using the\n * exact submission object. A browser field cannot populate or forge it.\n */\nexport function createInitiatingReleaseEvidence(): InitiatingReleaseEvidence {\n\tconst evidence = new WeakMap<SubmitActionInput, string>();\n\treturn {\n\t\tbind(input, releaseDigest) {\n\t\t\tevidence.set(input, releaseDigest);\n\t\t},\n\t\tresolve(input) {\n\t\t\treturn evidence.get(input);\n\t\t},\n\t\trelease(input) {\n\t\t\tevidence.delete(input);\n\t\t},\n\t};\n}\n\nexport function createExperienceGateway(options: {\n\tidentity: IdentityPort;\n\truntime: ExperienceServerRuntime;\n\thost: Pick<GovernedActionHost, \"submitAction\">;\n\tprojectionHost: Pick<ProjectionHost, \"project\">;\n\tevidence: InitiatingReleaseEvidence;\n\tassemblyDigest: string;\n\tactionVersion(actionId: `${string}.${string}`): number | undefined;\n\tnextCorrelationId(): string;\n\t/**\n\t * How old an offline capture may be and still replay.\n\t *\n\t * Required to accept replay at all. The Host's own staleness check is\n\t * conditional on the capture-authority adapter supplying an `expiresAt`, and\n\t * is skipped entirely for actions governed at capture time, so without this\n\t * a client-reported instant has no lower bound.\n\t */\n\tmaxOfflineReplayAgeMs?: number;\n\tcaptureAuthority?(input: {\n\t\tactionId: `${string}.${string}`;\n\t\tscope: ExperienceScope;\n\t\tparameters: Record<string, unknown>;\n\t\tparameterDigest: string;\n\t\tcapturedAt: string;\n\t}): Promise<{ id: string; expiresAt?: string }>;\n\tnow?: () => Date;\n}): ExperienceGateway {\n\tconst now = options.now ?? (() => new Date());\n\treturn {\n\t\tasync invoke(input) {\n\t\t\tconst claims = await options.identity.verify(input.context.credential);\n\t\t\tif (!claims) throw new Error(\"Experience request credential is not authenticated.\");\n\t\t\tassertActorClaimsCoverScope(claims, {\n\t\t\t\ttenantId: input.context.tenantId,\n\t\t\t\tspaceId: input.context.spaceId,\n\t\t\t}, now());\n\t\t\tconst scope: ExperienceScope = {\n\t\t\t\ttenantId: input.context.tenantId,\n\t\t\t\tspaceId: input.context.spaceId,\n\t\t\t\tactorId: claims.subject,\n\t\t\t\tactorType: claims.actorType,\n\t\t\t};\n\t\t\tconst resolved = await options.runtime.resolveIntent({\n\t\t\t\tplanId: input.request.planId,\n\t\t\t\tfragmentId: input.request.fragmentId,\n\t\t\t\teventName: input.request.eventName,\n\t\t\t\tscope,\n\t\t\t});\n\t\t\tif (resolved.assemblyDigest !== options.assemblyDigest) {\n\t\t\t\tthrow new Error(\"Experience render plan belongs to a different application assembly.\");\n\t\t\t}\n\t\t\tif (options.actionVersion(resolved.actionId) !== resolved.actionVersion) {\n\t\t\t\tthrow new Error(`Experience intent route for \"${resolved.actionId}\" does not match the registered action version.`);\n\t\t\t}\n\t\t\tif (resolved.execution?.idempotency === \"required\" && !input.request.idempotencyKey) {\n\t\t\t\tthrow new Error(`Action \"${resolved.actionId}\" requires an idempotency key.`);\n\t\t\t}\n\t\t\tif (input.executionReason === \"offline_replay\" && resolved.execution?.connectivity !== \"offline-capturable\") {\n\t\t\t\tthrow new Error(`Action \"${resolved.actionId}\" is not eligible for offline replay.`);\n\t\t\t}\n\t\t\tconst correlationId = options.nextCorrelationId();\n\t\t\t// A replay attests when the operator acted, not when the network came\n\t\t\t// back. Stamping receipt time would make capture-authority evidence\n\t\t\t// describe a moment nobody was there for.\n\t\t\tlet capturedAt: string;\n\t\t\tif (input.executionReason === \"offline_replay\") {\n\t\t\t\t// Accept it from either position, but require it: a replay with no\n\t\t\t\t// capture moment cannot be evidenced, and defaulting to receipt\n\t\t\t\t// time would attest a moment nobody was there for.\n\t\t\t\tconst supplied = input.capturedAt\n\t\t\t\t\t?? (input.request as Partial<{ capturedAt: string }>).capturedAt;\n\t\t\t\tif (typeof supplied !== \"string\") {\n\t\t\t\t\tthrow new Error(\"Offline replay requires capturedAt; receipt time cannot attest when the operator acted.\");\n\t\t\t\t}\n\t\t\t\tcapturedAt = assertCaptureMoment(supplied, now(), options.maxOfflineReplayAgeMs);\n\t\t\t} else {\n\t\t\t\tcapturedAt = now().toISOString();\n\t\t\t}\n\t\t\tconst parameterDigest = digestParameters(input.request.parameters);\n\t\t\tconst capturedAuthority = resolved.execution?.authorityMoment === \"capture\"\n\t\t\t\t? await options.captureAuthority?.({\n\t\t\t\t\tactionId: resolved.actionId,\n\t\t\t\t\tscope,\n\t\t\t\t\tparameters: input.request.parameters,\n\t\t\t\t\tparameterDigest,\n\t\t\t\t\tcapturedAt,\n\t\t\t\t})\n\t\t\t\t: undefined;\n\t\t\tif (resolved.execution?.authorityMoment === \"capture\" && !capturedAuthority) {\n\t\t\t\tthrow new Error(`Action \"${resolved.actionId}\" requires a trusted capture-authority adapter.`);\n\t\t\t}\n\t\t\tconst submission: SubmitActionInput = {\n\t\t\t\tactionId: resolved.actionId,\n\t\t\t\tparameters: input.request.parameters,\n\t\t\t\ttenantId: scope.tenantId,\n\t\t\t\tspaceId: scope.spaceId,\n\t\t\t\tactorId: scope.actorId,\n\t\t\t\tactorType: claims.actorType,\n\t\t\t\tcorrelationId,\n\t\t\t\tprovenance: {\n\t\t\t\t\tsource: \"ui\",\n\t\t\t\t\tcorrelationId,\n\t\t\t\t\t...(resolved.execution?.sensitivity === \"restricted\"\n\t\t\t\t\t\t? {}\n\t\t\t\t\t\t: { auditAttributes: { \"fabric.experience.fragment\": input.request.fragmentId } }),\n\t\t\t\t},\n\t\t\t\t...(input.request.idempotencyKey === undefined ? {} : { idempotencyKey: input.request.idempotencyKey }),\n\t\t\t\t...(input.executionReason === undefined ? {} : { executionReason: input.executionReason }),\n\t\t\t\t...(capturedAuthority === undefined ? {} : {\n\t\t\t\t\tauthorizationBindingId: capturedAuthority.id,\n\t\t\t\t\tauthorizationBinding: {\n\t\t\t\t\t\tid: capturedAuthority.id,\n\t\t\t\t\t\tgoverningMoment: \"capture\",\n\t\t\t\t\t\tcapturedAt,\n\t\t\t\t\t\t...(capturedAuthority.expiresAt === undefined ? {} : { expiresAt: capturedAuthority.expiresAt }),\n\t\t\t\t\t\ttenantId: scope.tenantId,\n\t\t\t\t\t\tactorId: scope.actorId,\n\t\t\t\t\t\tactionId: resolved.actionId,\n\t\t\t\t\t\tparameterDigest,\n\t\t\t\t\t},\n\t\t\t\t}),\n\t\t\t};\n\t\t\toptions.evidence.bind(submission, resolved.initiatingReleaseDigest);\n\t\t\ttry {\n\t\t\t\treturn await options.host.submitAction(submission);\n\t\t\t} finally {\n\t\t\t\toptions.evidence.release(submission);\n\t\t\t}\n\t\t},\n\t\tasync read(input) {\n\t\t\tconst claims = await options.identity.verify(input.context.credential);\n\t\t\tif (!claims) throw new Error(\"Experience request credential is not authenticated.\");\n\t\t\tassertActorClaimsCoverScope(claims, {\n\t\t\t\ttenantId: input.context.tenantId,\n\t\t\t\tspaceId: input.context.spaceId,\n\t\t\t}, now());\n\t\t\tconst scope: ExperienceScope = {\n\t\t\t\ttenantId: input.context.tenantId,\n\t\t\t\tspaceId: input.context.spaceId,\n\t\t\t\tactorId: claims.subject,\n\t\t\t\tactorType: claims.actorType,\n\t\t\t};\n\t\t\tconst resolved = await options.runtime.resolveView({\n\t\t\t\tplanId: input.request.planId,\n\t\t\t\tfragmentId: input.request.fragmentId,\n\t\t\t\tbindingName: input.request.bindingName,\n\t\t\t\tscope,\n\t\t\t});\n\t\t\tif (resolved.assemblyDigest !== options.assemblyDigest) {\n\t\t\t\tthrow new Error(\"Experience render plan belongs to a different application assembly.\");\n\t\t\t}\n\t\t\tconst result = await options.projectionHost.project({\n\t\t\t\tview: { name: resolved.name, version: resolved.version },\n\t\t\t\tscope: { tenantId: scope.tenantId, spaceId: scope.spaceId },\n\t\t\t\tactor: { id: scope.actorId, type: claims.actorType },\n\t\t\t\tparameters: input.request.parameters,\n\t\t\t});\n\t\t\treturn {\n\t\t\t\tdata: result.state,\n\t\t\t\tevidence: {\n\t\t\t\t\treleaseDigest: resolved.initiatingReleaseDigest,\n\t\t\t\t\tassemblyDigest: resolved.assemblyDigest,\n\t\t\t\t\teventCursor: result.eventCursor,\n\t\t\t\t\tsource: result.source,\n\t\t\t\t},\n\t\t\t};\n\t\t},\n\t};\n}\n\n/** RFC 3339 with a mandatory offset, so an instant means the same thing everywhere. */\nconst RFC3339 = /^\\d{4}-\\d{2}-\\d{2}[Tt]\\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)?(?:[Zz]|[+-]\\d{2}:\\d{2})$/;\n\n/**\n * A supplied capture moment is client-reported, so it is bounded here rather\n * than trusted.\n *\n * Deferring the lower bound to the Host looked safe and is not: the Host checks\n * staleness only when the capture-authority adapter supplied an `expiresAt`,\n * and skips the execution-time expiry check entirely when the action's\n * authority moment is `capture`. With an adapter that omits `expiresAt` there\n * is no lower bound at all, and the value is written into durable evidence and\n * handed to the authority adapter regardless. A gateway that accepts replay\n * must therefore say how old a capture may be.\n */\nfunction assertCaptureMoment(capturedAt: string, now: Date, maxAgeMs: number | undefined): string {\n\tif (!RFC3339.test(capturedAt)) {\n\t\tthrow new Error(\"Offline replay capturedAt must be an RFC 3339 instant with an explicit offset.\");\n\t}\n\tconst parsed = Date.parse(capturedAt);\n\tif (Number.isNaN(parsed)) throw new Error(\"Offline replay capturedAt is not a parseable instant.\");\n\tif (parsed > now.getTime()) throw new Error(\"Offline replay capturedAt is in the future.\");\n\tif (maxAgeMs === undefined) {\n\t\tthrow new Error(\"Gateway accepts offline replay but declares no maxOfflineReplayAgeMs, so a capture has no lower bound.\");\n\t}\n\tif (now.getTime() - parsed > maxAgeMs) {\n\t\tthrow new Error(`Offline replay capturedAt is older than the ${maxAgeMs}ms this gateway accepts.`);\n\t}\n\treturn new Date(parsed).toISOString();\n}\n"],"mappings":";AAKA,SAAS,wBAAwB;AAEjC;AAAA,EACC;AAAA,OAEM;AAqEA,SAAS,0BAA6D;AAC5E,SAAO;AAAA,IACN;AAAA,MACC,IAAI;AAAA,MACJ,MAAM,IAAI,SAAS;AAClB,cAAM,SAAS,QAAQ,SAAS,kBAAkB;AAClD,cAAM,SAAS,MAAM,QAAQ,QAAQ,OAAO,QAAQ,WAAW;AAC/D,YAAI,CAAC,OAAO,mBAAoB,OAAM,IAAI,MAAM,oDAAoD;AACpG,cAAM,YAAY,QAAQ,SAAS,kBAAkB,IAAI;AACzD,YAAI,cAAc,GAAG;AACpB,gBAAM,IAAI;AAAA,YACT,2CAA2C,SAAS;AAAA,UACrD;AAAA,QACD;AACA,eAAO,CAAC,OAAO,kBAAkB;AAAA,MAClC;AAAA,IACD;AAAA,IACA;AAAA,MACC,IAAI;AAAA,MACJ,MAAM,IAAI,SAAS;AAClB,cAAM,SAAS,QAAQ,SAAS,gBAAgB;AAChD,cAAM,QAAQ,QAAQ,KAAK,QAAQ,SAAS;AAC5C,cAAM,YAAY,QAAQ,SAAS,gBAAgB,IAAI;AACvD,YAAI,cAAc,GAAG;AACpB,gBAAM,IAAI;AAAA,YACT,+BAA+B,SAAS;AAAA,UACzC;AAAA,QACD;AACA,eAAO,CAAC,oCAAoC;AAAA,MAC7C;AAAA,IACD;AAAA,IACA;AAAA,MACC,IAAI;AAAA,MACJ,MAAM,IAAI,SAAS;AAClB,YAAI,WAAW;AACf,YAAI;AAAE,gBAAM,QAAQ,QAAQ,OAAO,QAAQ,YAAY;AAAA,QAAG,QAAQ;AAAE,qBAAW;AAAA,QAAM;AACrF,YAAI,CAAC,SAAU,OAAM,IAAI,MAAM,4DAA4D;AAC3F,eAAO,CAAC,8BAA8B;AAAA,MACvC;AAAA,IACD;AAAA,EACD;AACD;AAEA,eAAsB,2BACrB,SACA,SAA4C,wBAAwB,GACiF;AACrJ,QAAM,UAAwH,CAAC;AAC/H,aAAW,SAAS,QAAQ;AAC3B,QAAI;AAAE,cAAQ,KAAK,EAAE,IAAI,MAAM,IAAI,QAAQ,UAAU,UAAU,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;AAAA,IAAG,SACrF,OAAO;AAAE,cAAQ,KAAK,EAAE,IAAI,MAAM,IAAI,QAAQ,UAAU,UAAU,CAAC,GAAG,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,CAAC;AAAA,IAAG;AAAA,EAChJ;AACA,SAAO,EAAE,QAAQ,QAAQ,MAAM,CAAC,WAAW,OAAO,WAAW,QAAQ,GAAG,QAAQ,QAAQ;AACzF;AAaO,SAAS,kCAA6D;AAC5E,QAAM,WAAW,oBAAI,QAAmC;AACxD,SAAO;AAAA,IACN,KAAK,OAAO,eAAe;AAC1B,eAAS,IAAI,OAAO,aAAa;AAAA,IAClC;AAAA,IACA,QAAQ,OAAO;AACd,aAAO,SAAS,IAAI,KAAK;AAAA,IAC1B;AAAA,IACA,QAAQ,OAAO;AACd,eAAS,OAAO,KAAK;AAAA,IACtB;AAAA,EACD;AACD;AAEO,SAAS,wBAAwB,SA0BlB;AACrB,QAAM,MAAM,QAAQ,QAAQ,MAAM,oBAAI,KAAK;AAC3C,SAAO;AAAA,IACN,MAAM,OAAO,OAAO;AACnB,YAAM,SAAS,MAAM,QAAQ,SAAS,OAAO,MAAM,QAAQ,UAAU;AACrE,UAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,qDAAqD;AAClF,kCAA4B,QAAQ;AAAA,QACnC,UAAU,MAAM,QAAQ;AAAA,QACxB,SAAS,MAAM,QAAQ;AAAA,MACxB,GAAG,IAAI,CAAC;AACR,YAAM,QAAyB;AAAA,QAC9B,UAAU,MAAM,QAAQ;AAAA,QACxB,SAAS,MAAM,QAAQ;AAAA,QACvB,SAAS,OAAO;AAAA,QAChB,WAAW,OAAO;AAAA,MACnB;AACA,YAAM,WAAW,MAAM,QAAQ,QAAQ,cAAc;AAAA,QACpD,QAAQ,MAAM,QAAQ;AAAA,QACtB,YAAY,MAAM,QAAQ;AAAA,QAC1B,WAAW,MAAM,QAAQ;AAAA,QACzB;AAAA,MACD,CAAC;AACD,UAAI,SAAS,mBAAmB,QAAQ,gBAAgB;AACvD,cAAM,IAAI,MAAM,qEAAqE;AAAA,MACtF;AACA,UAAI,QAAQ,cAAc,SAAS,QAAQ,MAAM,SAAS,eAAe;AACxE,cAAM,IAAI,MAAM,gCAAgC,SAAS,QAAQ,iDAAiD;AAAA,MACnH;AACA,UAAI,SAAS,WAAW,gBAAgB,cAAc,CAAC,MAAM,QAAQ,gBAAgB;AACpF,cAAM,IAAI,MAAM,WAAW,SAAS,QAAQ,gCAAgC;AAAA,MAC7E;AACA,UAAI,MAAM,oBAAoB,oBAAoB,SAAS,WAAW,iBAAiB,sBAAsB;AAC5G,cAAM,IAAI,MAAM,WAAW,SAAS,QAAQ,uCAAuC;AAAA,MACpF;AACA,YAAM,gBAAgB,QAAQ,kBAAkB;AAIhD,UAAI;AACJ,UAAI,MAAM,oBAAoB,kBAAkB;AAI/C,cAAM,WAAW,MAAM,cAClB,MAAM,QAA4C;AACvD,YAAI,OAAO,aAAa,UAAU;AACjC,gBAAM,IAAI,MAAM,yFAAyF;AAAA,QAC1G;AACA,qBAAa,oBAAoB,UAAU,IAAI,GAAG,QAAQ,qBAAqB;AAAA,MAChF,OAAO;AACN,qBAAa,IAAI,EAAE,YAAY;AAAA,MAChC;AACA,YAAM,kBAAkB,iBAAiB,MAAM,QAAQ,UAAU;AACjE,YAAM,oBAAoB,SAAS,WAAW,oBAAoB,YAC/D,MAAM,QAAQ,mBAAmB;AAAA,QAClC,UAAU,SAAS;AAAA,QACnB;AAAA,QACA,YAAY,MAAM,QAAQ;AAAA,QAC1B;AAAA,QACA;AAAA,MACD,CAAC,IACC;AACH,UAAI,SAAS,WAAW,oBAAoB,aAAa,CAAC,mBAAmB;AAC5E,cAAM,IAAI,MAAM,WAAW,SAAS,QAAQ,iDAAiD;AAAA,MAC9F;AACA,YAAM,aAAgC;AAAA,QACrC,UAAU,SAAS;AAAA,QACnB,YAAY,MAAM,QAAQ;AAAA,QAC1B,UAAU,MAAM;AAAA,QAChB,SAAS,MAAM;AAAA,QACf,SAAS,MAAM;AAAA,QACf,WAAW,OAAO;AAAA,QAClB;AAAA,QACA,YAAY;AAAA,UACX,QAAQ;AAAA,UACR;AAAA,UACA,GAAI,SAAS,WAAW,gBAAgB,eACrC,CAAC,IACD,EAAE,iBAAiB,EAAE,8BAA8B,MAAM,QAAQ,WAAW,EAAE;AAAA,QAClF;AAAA,QACA,GAAI,MAAM,QAAQ,mBAAmB,SAAY,CAAC,IAAI,EAAE,gBAAgB,MAAM,QAAQ,eAAe;AAAA,QACrG,GAAI,MAAM,oBAAoB,SAAY,CAAC,IAAI,EAAE,iBAAiB,MAAM,gBAAgB;AAAA,QACxF,GAAI,sBAAsB,SAAY,CAAC,IAAI;AAAA,UAC1C,wBAAwB,kBAAkB;AAAA,UAC1C,sBAAsB;AAAA,YACrB,IAAI,kBAAkB;AAAA,YACtB,iBAAiB;AAAA,YACjB;AAAA,YACA,GAAI,kBAAkB,cAAc,SAAY,CAAC,IAAI,EAAE,WAAW,kBAAkB,UAAU;AAAA,YAC9F,UAAU,MAAM;AAAA,YAChB,SAAS,MAAM;AAAA,YACf,UAAU,SAAS;AAAA,YACnB;AAAA,UACD;AAAA,QACD;AAAA,MACD;AACA,cAAQ,SAAS,KAAK,YAAY,SAAS,uBAAuB;AAClE,UAAI;AACH,eAAO,MAAM,QAAQ,KAAK,aAAa,UAAU;AAAA,MAClD,UAAE;AACD,gBAAQ,SAAS,QAAQ,UAAU;AAAA,MACpC;AAAA,IACD;AAAA,IACA,MAAM,KAAK,OAAO;AACjB,YAAM,SAAS,MAAM,QAAQ,SAAS,OAAO,MAAM,QAAQ,UAAU;AACrE,UAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,qDAAqD;AAClF,kCAA4B,QAAQ;AAAA,QACnC,UAAU,MAAM,QAAQ;AAAA,QACxB,SAAS,MAAM,QAAQ;AAAA,MACxB,GAAG,IAAI,CAAC;AACR,YAAM,QAAyB;AAAA,QAC9B,UAAU,MAAM,QAAQ;AAAA,QACxB,SAAS,MAAM,QAAQ;AAAA,QACvB,SAAS,OAAO;AAAA,QAChB,WAAW,OAAO;AAAA,MACnB;AACA,YAAM,WAAW,MAAM,QAAQ,QAAQ,YAAY;AAAA,QAClD,QAAQ,MAAM,QAAQ;AAAA,QACtB,YAAY,MAAM,QAAQ;AAAA,QAC1B,aAAa,MAAM,QAAQ;AAAA,QAC3B;AAAA,MACD,CAAC;AACD,UAAI,SAAS,mBAAmB,QAAQ,gBAAgB;AACvD,cAAM,IAAI,MAAM,qEAAqE;AAAA,MACtF;AACA,YAAM,SAAS,MAAM,QAAQ,eAAe,QAAQ;AAAA,QACnD,MAAM,EAAE,MAAM,SAAS,MAAM,SAAS,SAAS,QAAQ;AAAA,QACvD,OAAO,EAAE,UAAU,MAAM,UAAU,SAAS,MAAM,QAAQ;AAAA,QAC1D,OAAO,EAAE,IAAI,MAAM,SAAS,MAAM,OAAO,UAAU;AAAA,QACnD,YAAY,MAAM,QAAQ;AAAA,MAC3B,CAAC;AACD,aAAO;AAAA,QACN,MAAM,OAAO;AAAA,QACb,UAAU;AAAA,UACT,eAAe,SAAS;AAAA,UACxB,gBAAgB,SAAS;AAAA,UACzB,aAAa,OAAO;AAAA,UACpB,QAAQ,OAAO;AAAA,QAChB;AAAA,MACD;AAAA,IACD;AAAA,EACD;AACD;AAGA,IAAM,UAAU;AAchB,SAAS,oBAAoB,YAAoB,KAAW,UAAsC;AACjG,MAAI,CAAC,QAAQ,KAAK,UAAU,GAAG;AAC9B,UAAM,IAAI,MAAM,gFAAgF;AAAA,EACjG;AACA,QAAM,SAAS,KAAK,MAAM,UAAU;AACpC,MAAI,OAAO,MAAM,MAAM,EAAG,OAAM,IAAI,MAAM,uDAAuD;AACjG,MAAI,SAAS,IAAI,QAAQ,EAAG,OAAM,IAAI,MAAM,6CAA6C;AACzF,MAAI,aAAa,QAAW;AAC3B,UAAM,IAAI,MAAM,wGAAwG;AAAA,EACzH;AACA,MAAI,IAAI,QAAQ,IAAI,SAAS,UAAU;AACtC,UAAM,IAAI,MAAM,+CAA+C,QAAQ,0BAA0B;AAAA,EAClG;AACA,SAAO,IAAI,KAAK,MAAM,EAAE,YAAY;AACrC;","names":[]}

package/package.json

@@ -0,0 +1,57 @@
+{
+  "name": "@fabricorg/experience-gateway",
+  "version": "1.0.0",
+  "description": "Trusted server adapter from scoped experience plans to governed Fabric Hosts.",
+  "license": "MIT",
+  "type": "module",
+  "sideEffects": false,
+  "main": "./dist/index.cjs",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
+      },
+      "require": {
+        "types": "./dist/index.d.cts",
+        "default": "./dist/index.cjs"
+      }
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "CHANGELOG.md",
+    "LICENSE"
+  ],
+  "dependencies": {
+    "@fabricorg/experience-runtime": "^0.2.0"
+  },
+  "peerDependencies": {
+    "@fabricorg/platform-host": "^7.0.0",
+    "@fabricorg/projection-host": "^1.1.0",
+    "@fabricorg/ports": "^0.4.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.0",
+    "tsup": "^8.5.0",
+    "typescript": "^5.7.3",
+    "vitest": "^4.1.5",
+    "@fabricorg/platform-host": "^7.0.0",
+    "@fabricorg/projection-host": "^1.1.0",
+    "@fabricorg/ports": "^0.4.0"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "clean": "rm -rf dist tsconfig.tsbuildinfo",
+    "build": "tsup",
+    "type-check": "tsc --noEmit",
+    "test": "vitest run"
+  }
+}