@fabricorg/experience-runtime 0.2.0

package/dist/offline.js

@@ -0,0 +1,205 @@
+// offline.ts
+function createOfflineCaptureQueue(options) {
+  if (options.store.protection !== "encrypted-at-rest" && !options.allowEphemeralStore) {
+    throw new Error("Production offline capture requires an encrypted-at-rest store.");
+  }
+  if (!options.gateway.replay) throw new Error("Offline capture requires a gateway replay adapter.");
+  const fragments = indexFragments(options.plan.root);
+  const now = options.now ?? (() => /* @__PURE__ */ new Date());
+  return {
+    async capture(fragmentId, eventName, parameters, idempotencyKey) {
+      const fragment = fragments.get(fragmentId);
+      if (!fragment?.offlineEvents?.includes(eventName)) {
+        throw new Error(`Fragment event "${fragmentId}.${eventName}" is not offline-capturable.`);
+      }
+      if (!idempotencyKey || idempotencyKey.length > 256) throw new Error("Offline capture requires a bounded stable idempotency key.");
+      const capturedAt = now();
+      const captureExpiry = capturedAt.getTime() + (options.captureTtlMs ?? 864e5);
+      const planExpiry = Date.parse(options.plan.expiresAt);
+      if (!Number.isFinite(planExpiry) || planExpiry <= capturedAt.getTime()) throw new Error("Offline capture requires an unexpired render plan.");
+      const safeParameters = cloneOfflineParameters(parameters);
+      const captureId = options.nextCaptureId();
+      if (!captureId.trim()) throw new Error("Offline capture id is required.");
+      const record = {
+        captureId,
+        planId: options.plan.planId,
+        releaseDigest: options.plan.releaseDigest,
+        fragmentId,
+        eventName,
+        parameters: safeParameters,
+        idempotencyKey,
+        capturedAt: capturedAt.toISOString(),
+        expiresAt: new Date(Math.min(captureExpiry, planExpiry)).toISOString()
+      };
+      await options.store.put(record);
+      return record;
+    },
+    async replay() {
+      let completed = 0;
+      let failed = 0;
+      const parked = [];
+      const expired = [];
+      const reconciled = [];
+      for (const record of await options.store.list()) {
+        if (Date.parse(record.expiresAt) <= now().getTime()) {
+          await options.store.remove(record.captureId);
+          expired.push(record);
+          continue;
+        }
+        const request = {
+          planId: record.planId,
+          fragmentId: record.fragmentId,
+          eventName: record.eventName,
+          parameters: record.parameters,
+          idempotencyKey: record.idempotencyKey,
+          executionReason: "offline_replay",
+          capturedAt: record.capturedAt
+        };
+        try {
+          const outcome = await options.gateway.replay(request);
+          await options.store.remove(record.captureId);
+          const disposition = dispositionOf(outcome);
+          const actionInvocationId = typeof outcome?.actionInvocationId === "string" ? outcome.actionInvocationId : void 0;
+          if (disposition.kind === "attention") {
+            reconciled.push({
+              record,
+              status: disposition.status,
+              ...actionInvocationId === void 0 ? {} : { actionInvocationId },
+              certainty: disposition.certainty,
+              reason: disposition.reason
+            });
+          } else if (disposition.kind === "parked") {
+            parked.push({ record, ...actionInvocationId === void 0 ? {} : { actionInvocationId } });
+          } else {
+            completed += 1;
+          }
+        } catch (error) {
+          if (isSettledReplayFailure(error)) {
+            await options.store.remove(record.captureId);
+            reconciled.push({ record, status: "not_delivered", certainty: "refused", reason: messageOf(error) });
+          } else {
+            failed += 1;
+          }
+        }
+      }
+      return { completed, parked, failed, expired, reconciled };
+    }
+  };
+}
+function cloneOfflineParameters(parameters) {
+  let nodes = 0;
+  const visit = (value, depth, key) => {
+    nodes += 1;
+    if (nodes > 1e4 || depth > 20) throw new Error("Offline capture parameters exceed structural limits.");
+    if (key !== void 0 && /(?:authorization|bearer|cookie|credential|password|secret|token|claims?)/i.test(key)) {
+      throw new Error(`Offline capture parameters may not contain credential or claim field "${key}".`);
+    }
+    if (value === null || typeof value === "string" || typeof value === "boolean") return;
+    if (typeof value === "number" && Number.isFinite(value)) return;
+    if (Array.isArray(value)) {
+      value.forEach((entry) => visit(entry, depth + 1));
+      return;
+    }
+    if (value && typeof value === "object" && Object.getPrototypeOf(value) === Object.prototype) {
+      for (const [childKey, child] of Object.entries(value)) visit(child, depth + 1, childKey);
+      return;
+    }
+    throw new Error("Offline capture parameters must contain only portable JSON values.");
+  };
+  visit(parameters, 0);
+  const serialized = JSON.stringify(parameters);
+  if (new TextEncoder().encode(serialized).byteLength > 65536) throw new Error("Offline capture parameters exceed the 65536-byte limit.");
+  return structuredClone(parameters);
+}
+function indexFragments(root) {
+  const result = /* @__PURE__ */ new Map();
+  const visit = (fragment) => {
+    result.set(fragment.id, fragment);
+    for (const child of fragment.children ?? []) visit(child);
+  };
+  visit(root);
+  return result;
+}
+function createMemoryOfflineCaptureStore() {
+  const records = /* @__PURE__ */ new Map();
+  return {
+    protection: "ephemeral",
+    async put(record) {
+      if (records.has(record.captureId)) throw new Error(`Offline capture "${record.captureId}" already exists.`);
+      records.set(record.captureId, structuredClone(record));
+    },
+    async list() {
+      return [...records.values()].map((record) => structuredClone(record));
+    },
+    async remove(captureId) {
+      records.delete(captureId);
+    }
+  };
+}
+function messageOf(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+function dispositionOf(outcome) {
+  if (!outcome || typeof outcome !== "object") {
+    return {
+      kind: "attention",
+      status: "no_outcome",
+      certainty: "unknown",
+      reason: "the replay adapter returned no outcome, so whether the action was applied is unknown"
+    };
+  }
+  const status = typeof outcome.status === "string" ? outcome.status : "";
+  const reason = outcome.reconciliation?.message ?? outcome.reconciliation?.kind ?? (typeof outcome.error === "string" ? outcome.error : status);
+  switch (status) {
+    case "pending":
+    case "running":
+    case "completed":
+      return { kind: "delivered" };
+    case "waiting_for_approval":
+      return { kind: "parked" };
+    case "reconciliation_required":
+      return {
+        kind: "attention",
+        status,
+        certainty: outcome.adapterReconciliation === void 0 ? "refused" : "unknown",
+        reason
+      };
+    case "blocked_by_policy":
+    case "validation_failed":
+      return { kind: "attention", status, certainty: "refused", reason };
+    case "failed":
+      return { kind: "attention", status, certainty: "unknown", reason };
+    default:
+      return { kind: "attention", status: status || "unknown", certainty: "unknown", reason };
+  }
+}
+function isSettledReplayFailure(error) {
+  return [
+    // The action was never offline-eligible.
+    /not eligible for offline replay/i,
+    // The plan no longer grants, no longer exists, or was never this actor's.
+    /is not granted by the render plan/i,
+    // A plan minted against a superseded deployment. Same class as the
+    // assembly mismatch on the line below it, and equally permanent.
+    /does not match the registered action version/i,
+    /render plan was not found/i,
+    /render plan has expired/i,
+    /scope does not match/i,
+    /belongs to a different application assembly/i,
+    // A capture only gets older, so an age refusal can never come good. This
+    // one is independent of the capture TTL, so nothing else retires it.
+    /capturedAt is older than/i,
+    // Malformed beyond repair: passes the grammar, names no real instant.
+    /capturedAt is not a parseable instant/i,
+    /capturedAt must be an RFC 3339/i
+    // Deliberately absent: a capture dated in the future comes good as real
+    // time advances, and a gateway missing its replay window is a
+    // deployment mistake somebody will fix. Discarding either would destroy
+    // work that a clock correction or a config change would have replayed.
+  ].some((pattern) => pattern.test(messageOf(error)));
+}
+export {
+  createMemoryOfflineCaptureStore,
+  createOfflineCaptureQueue
+};
+//# sourceMappingURL=offline.js.map

package/dist/offline.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../offline.ts"],"sourcesContent":["import type {\n\tExperienceGatewayClient,\n\tExperienceInvocationOutcome,\n\tExperienceReplayRequest,\n\tRenderPlanFragment,\n\tScopedRenderPlan,\n} from \"./contracts\";\n\nexport interface OfflineCaptureRecord {\n\tcaptureId: string;\n\tplanId: string;\n\treleaseDigest: string;\n\tfragmentId: string;\n\teventName: string;\n\tparameters: Record<string, unknown>;\n\tidempotencyKey: string;\n\tcapturedAt: string;\n\texpiresAt: string;\n}\n\nexport interface OfflineCaptureStore {\n\tprotection: \"encrypted-at-rest\" | \"ephemeral\";\n\tput(record: OfflineCaptureRecord): Promise<void>;\n\tlist(): Promise<readonly OfflineCaptureRecord[]>;\n\tremove(captureId: string): Promise<void>;\n}\n\n/** A delivered capture whose outcome a person needs to see. */\nexport interface OfflineReconciliation {\n\trecord: OfflineCaptureRecord;\n\t/** The status the platform returned, so a caller can tell these apart. */\n\tstatus: string;\n\t/**\n\t * The invocation the platform recorded, when it got that far.\n\t *\n\t * `recordExternalReconciliation` needs it, so an outcome of `unknown` that\n\t * omits it cannot be reconciled from this summary — which is the whole\n\t * reason the entry exists.\n\t */\n\tactionInvocationId?: string;\n\t/**\n\t * Whether the effect is known not to have happened, or is simply unknown.\n\t * An adapter that timed out mid-charge is `unknown`: telling an operator it\n\t * was refused would be as wrong as telling them it succeeded.\n\t */\n\tcertainty: \"refused\" | \"unknown\";\n\treason: string;\n}\n\n/** A delivered capture waiting on a human. */\nexport interface OfflineParked {\n\trecord: OfflineCaptureRecord;\n\tactionInvocationId?: string;\n}\n\nexport interface OfflineReplaySummary {\n\t/** Delivered and progressing: the platform has the invocation. */\n\tcompleted: number;\n\t/**\n\t * Delivered and parked awaiting a human decision.\n\t *\n\t * Carries the records, because a bare count leaves nobody able to say which\n\t * action somebody now has to approve.\n\t */\n\tparked: OfflineParked[];\n\t/** Never delivered, and worth another attempt. Still queued. */\n\tfailed: number;\n\t/**\n\t * Outlived the capture TTL or the render plan before it could be sent.\n\t *\n\t * Also carries its records: a capture that expired never reached the\n\t * platform, so this is work the operator did that nobody has.\n\t */\n\texpired: OfflineCaptureRecord[];\n\t/**\n\t * Delivered, and something a person needs to see: refused, invalid, or an\n\t * outcome nobody can determine. Also covers a delivery that can never\n\t * succeed, since retrying one only delays the moment somebody is told.\n\t */\n\treconciled: OfflineReconciliation[];\n}\n\nexport interface OfflineCaptureQueue {\n\tcapture(fragmentId: string, eventName: string, parameters: Record<string, unknown>, idempotencyKey: string): Promise<OfflineCaptureRecord>;\n\treplay(): Promise<OfflineReplaySummary>;\n}\n\nexport function createOfflineCaptureQueue(options: {\n\tplan: ScopedRenderPlan;\n\tstore: OfflineCaptureStore;\n\tgateway: ExperienceGatewayClient;\n\tnextCaptureId(): string;\n\tnow?: () => Date;\n\tcaptureTtlMs?: number;\n\tallowEphemeralStore?: boolean;\n}): OfflineCaptureQueue {\n\tif (options.store.protection !== \"encrypted-at-rest\" && !options.allowEphemeralStore) {\n\t\tthrow new Error(\"Production offline capture requires an encrypted-at-rest store.\");\n\t}\n\tif (!options.gateway.replay) throw new Error(\"Offline capture requires a gateway replay adapter.\");\n\tconst fragments = indexFragments(options.plan.root);\n\tconst now = options.now ?? (() => new Date());\n\treturn {\n\t\tasync capture(fragmentId, eventName, parameters, idempotencyKey) {\n\t\t\tconst fragment = fragments.get(fragmentId);\n\t\t\tif (!fragment?.offlineEvents?.includes(eventName)) {\n\t\t\t\tthrow new Error(`Fragment event \"${fragmentId}.${eventName}\" is not offline-capturable.`);\n\t\t\t}\n\t\t\tif (!idempotencyKey || idempotencyKey.length > 256) throw new Error(\"Offline capture requires a bounded stable idempotency key.\");\n\t\t\tconst capturedAt = now();\n\t\t\tconst captureExpiry = capturedAt.getTime() + (options.captureTtlMs ?? 86_400_000);\n\t\t\tconst planExpiry = Date.parse(options.plan.expiresAt);\n\t\t\tif (!Number.isFinite(planExpiry) || planExpiry <= capturedAt.getTime()) throw new Error(\"Offline capture requires an unexpired render plan.\");\n\t\t\tconst safeParameters = cloneOfflineParameters(parameters);\n\t\t\tconst captureId = options.nextCaptureId();\n\t\t\tif (!captureId.trim()) throw new Error(\"Offline capture id is required.\");\n\t\t\tconst record: OfflineCaptureRecord = {\n\t\t\t\tcaptureId,\n\t\t\t\tplanId: options.plan.planId,\n\t\t\t\treleaseDigest: options.plan.releaseDigest,\n\t\t\t\tfragmentId,\n\t\t\t\teventName,\n\t\t\t\tparameters: safeParameters,\n\t\t\t\tidempotencyKey,\n\t\t\t\tcapturedAt: capturedAt.toISOString(),\n\t\t\t\texpiresAt: new Date(Math.min(captureExpiry, planExpiry)).toISOString(),\n\t\t\t};\n\t\t\tawait options.store.put(record);\n\t\t\treturn record;\n\t\t},\n\t\tasync replay() {\n\t\t\tlet completed = 0;\n\t\t\tlet failed = 0;\n\t\t\tconst parked: OfflineParked[] = [];\n\t\t\tconst expired: OfflineCaptureRecord[] = [];\n\t\t\tconst reconciled: OfflineReconciliation[] = [];\n\t\t\tfor (const record of await options.store.list()) {\n\t\t\t\tif (Date.parse(record.expiresAt) <= now().getTime()) {\n\t\t\t\t\tawait options.store.remove(record.captureId);\n\t\t\t\t\texpired.push(record);\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\t\t\t\tconst request: ExperienceReplayRequest = {\n\t\t\t\t\tplanId: record.planId,\n\t\t\t\t\tfragmentId: record.fragmentId,\n\t\t\t\t\teventName: record.eventName,\n\t\t\t\t\tparameters: record.parameters,\n\t\t\t\t\tidempotencyKey: record.idempotencyKey,\n\t\t\t\t\texecutionReason: \"offline_replay\",\n\t\t\t\t\tcapturedAt: record.capturedAt,\n\t\t\t\t};\n\t\t\t\ttry {\n\t\t\t\t\tconst outcome = await options.gateway.replay!(request);\n\n\t\t\t\t\t// Anything returned means the platform durably holds the\n\t\t\t\t\t// invocation, so the capture has done its job either way and\n\t\t\t\t\t// leaves the queue. What differs is whether a person needs to\n\t\t\t\t\t// hear about it, which is decided over the whole status set\n\t\t\t\t\t// rather than the two that were obviously refusals.\n\t\t\t\t\tawait options.store.remove(record.captureId);\n\t\t\t\t\tconst disposition = dispositionOf(outcome);\n\t\t\t\t\tconst actionInvocationId = typeof outcome?.actionInvocationId === \"string\"\n\t\t\t\t\t\t? outcome.actionInvocationId\n\t\t\t\t\t\t: undefined;\n\t\t\t\t\tif (disposition.kind === \"attention\") {\n\t\t\t\t\t\treconciled.push({\n\t\t\t\t\t\t\trecord,\n\t\t\t\t\t\t\tstatus: disposition.status,\n\t\t\t\t\t\t\t...(actionInvocationId === undefined ? {} : { actionInvocationId }),\n\t\t\t\t\t\t\tcertainty: disposition.certainty,\n\t\t\t\t\t\t\treason: disposition.reason,\n\t\t\t\t\t\t});\n\t\t\t\t\t} else if (disposition.kind === \"parked\") {\n\t\t\t\t\t\tparked.push({ record, ...(actionInvocationId === undefined ? {} : { actionInvocationId }) });\n\t\t\t\t\t} else {\n\t\t\t\t\t\tcompleted += 1;\n\t\t\t\t\t}\n\t\t\t\t} catch (error) {\n\t\t\t\t\t// Only genuine throws reach here: the plan expired, the\n\t\t\t\t\t// scope no longer matches, the event is not offline-eligible.\n\t\t\t\t\t// Those are settled, and retrying one only delays the moment\n\t\t\t\t\t// somebody is told. Anything unrecognised stays transient, so\n\t\t\t\t\t// an unfamiliar failure is retried rather than discarded.\n\t\t\t\t\tif (isSettledReplayFailure(error)) {\n\t\t\t\t\t\tawait options.store.remove(record.captureId);\n\t\t\t\t\t\t// Never delivered, and never will be. The effect certainly\n\t\t\t\t\t\t// did not happen, which is more than can be said for a\n\t\t\t\t\t\t// delivery whose outcome came back unknown.\n\t\t\t\t\t\treconciled.push({ record, status: \"not_delivered\", certainty: \"refused\", reason: messageOf(error) });\n\t\t\t\t\t} else {\n\t\t\t\t\t\tfailed += 1;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn { completed, parked, failed, expired, reconciled };\n\t\t},\n\t};\n}\n\nfunction cloneOfflineParameters(parameters: Record<string, unknown>): Record<string, unknown> {\n\tlet nodes = 0;\n\tconst visit = (value: unknown, depth: number, key?: string): void => {\n\t\tnodes += 1;\n\t\tif (nodes > 10_000 || depth > 20) throw new Error(\"Offline capture parameters exceed structural limits.\");\n\t\tif (key !== undefined && /(?:authorization|bearer|cookie|credential|password|secret|token|claims?)/i.test(key)) {\n\t\t\tthrow new Error(`Offline capture parameters may not contain credential or claim field \"${key}\".`);\n\t\t}\n\t\tif (value === null || typeof value === \"string\" || typeof value === \"boolean\") return;\n\t\tif (typeof value === \"number\" && Number.isFinite(value)) return;\n\t\tif (Array.isArray(value)) {\n\t\t\tvalue.forEach((entry) => visit(entry, depth + 1));\n\t\t\treturn;\n\t\t}\n\t\tif (value && typeof value === \"object\" && Object.getPrototypeOf(value) === Object.prototype) {\n\t\t\tfor (const [childKey, child] of Object.entries(value)) visit(child, depth + 1, childKey);\n\t\t\treturn;\n\t\t}\n\t\tthrow new Error(\"Offline capture parameters must contain only portable JSON values.\");\n\t};\n\tvisit(parameters, 0);\n\tconst serialized = JSON.stringify(parameters);\n\tif (new TextEncoder().encode(serialized).byteLength > 65_536) throw new Error(\"Offline capture parameters exceed the 65536-byte limit.\");\n\treturn structuredClone(parameters);\n}\n\nfunction indexFragments(root: RenderPlanFragment): Map<string, RenderPlanFragment> {\n\tconst result = new Map<string, RenderPlanFragment>();\n\tconst visit = (fragment: RenderPlanFragment): void => {\n\t\tresult.set(fragment.id, fragment);\n\t\tfor (const child of fragment.children ?? []) visit(child);\n\t};\n\tvisit(root);\n\treturn result;\n}\n\nexport function createMemoryOfflineCaptureStore(): OfflineCaptureStore {\n\tconst records = new Map<string, OfflineCaptureRecord>();\n\treturn {\n\t\tprotection: \"ephemeral\",\n\t\tasync put(record) {\n\t\t\tif (records.has(record.captureId)) throw new Error(`Offline capture \"${record.captureId}\" already exists.`);\n\t\t\trecords.set(record.captureId, structuredClone(record));\n\t\t},\n\t\tasync list() {\n\t\t\treturn [...records.values()].map((record) => structuredClone(record));\n\t\t},\n\t\tasync remove(captureId) {\n\t\t\trecords.delete(captureId);\n\t\t},\n\t};\n}\n\nfunction messageOf(error: unknown): string {\n\treturn error instanceof Error ? error.message : String(error);\n}\n\ntype ReplayDisposition =\n\t| { kind: \"delivered\" }\n\t| { kind: \"parked\" }\n\t| { kind: \"attention\"; status: string; certainty: \"refused\" | \"unknown\"; reason: string };\n\n/**\n * Read a returned outcome across the platform's whole status set.\n *\n * Enumerating the statuses that looked like refusals left the rest falling\n * through to \"applied\", which is how a validation failure got reported to an\n * operator as success. The switch covers every `ActionStatus`, and the default\n * arm surfaces anything else rather than counting it a success — the status\n * arrives as a string over a transport, so this is a runtime guarantee and not\n * a compile-time one.\n *\n * There is no \"already applied\" branch. A key that legitimately repeats returns\n * the original invocation without complaint, and a genuine idempotency conflict\n * means the key was reused for a materially different command, so that capture\n * was never applied and must not be discarded.\n */\nfunction dispositionOf(outcome: ExperienceInvocationOutcome | undefined): ReplayDisposition {\n\t// An adapter that returns nothing has told us nothing. Reading that as\n\t// success is the failure this whole switch exists to prevent, and an absent\n\t// outcome deserves at least the suspicion an empty one gets.\n\tif (!outcome || typeof outcome !== \"object\") {\n\t\treturn {\n\t\t\tkind: \"attention\",\n\t\t\tstatus: \"no_outcome\",\n\t\t\tcertainty: \"unknown\",\n\t\t\treason: \"the replay adapter returned no outcome, so whether the action was applied is unknown\",\n\t\t};\n\t}\n\tconst status = typeof outcome.status === \"string\" ? outcome.status : \"\";\n\tconst reason = outcome.reconciliation?.message\n\t\t?? outcome.reconciliation?.kind\n\t\t?? (typeof outcome.error === \"string\" ? outcome.error : status);\n\n\tswitch (status) {\n\t\tcase \"pending\":\n\t\tcase \"running\":\n\t\tcase \"completed\":\n\t\t\treturn { kind: \"delivered\" };\n\t\tcase \"waiting_for_approval\":\n\t\t\treturn { kind: \"parked\" };\n\t\tcase \"reconciliation_required\":\n\t\t\t// An adapter whose outcome could not be determined also arrives here.\n\t\t\t// The external effect may well have happened, so calling it refused\n\t\t\t// would be as wrong as calling it applied.\n\t\t\treturn {\n\t\t\t\tkind: \"attention\",\n\t\t\t\tstatus,\n\t\t\t\tcertainty: outcome.adapterReconciliation === undefined ? \"refused\" : \"unknown\",\n\t\t\t\treason,\n\t\t\t};\n\t\tcase \"blocked_by_policy\":\n\t\tcase \"validation_failed\":\n\t\t\t// Both are decided before any effect: policy refuses at the gate and\n\t\t\t// validation refuses the parameters.\n\t\t\treturn { kind: \"attention\", status, certainty: \"refused\", reason };\n\t\tcase \"failed\":\n\t\t\t// Not the same. A handler or adapter step can fail after earlier\n\t\t\t// steps succeeded and the domain transaction committed, so telling an\n\t\t\t// operator this was refused could be as wrong as calling it applied.\n\t\t\treturn { kind: \"attention\", status, certainty: \"unknown\", reason };\n\t\tdefault:\n\t\t\t// An unfamiliar status is surfaced rather than counted as success.\n\t\t\treturn { kind: \"attention\", status: status || \"unknown\", certainty: \"unknown\", reason };\n\t}\n}\n\n/**\n * A thrown failure the platform will never accept on a later attempt.\n *\n * Deliberately narrow, and matched on what the gateway and runtime actually\n * throw. Anything else is transient, because keeping a capture costs a retry\n * and discarding one costs the operator their work.\n */\nfunction isSettledReplayFailure(error: unknown): boolean {\n\treturn [\n\t\t// The action was never offline-eligible.\n\t\t/not eligible for offline replay/i,\n\t\t// The plan no longer grants, no longer exists, or was never this actor's.\n\t\t/is not granted by the render plan/i,\n\t\t// A plan minted against a superseded deployment. Same class as the\n\t\t// assembly mismatch on the line below it, and equally permanent.\n\t\t/does not match the registered action version/i,\n\t\t/render plan was not found/i,\n\t\t/render plan has expired/i,\n\t\t/scope does not match/i,\n\t\t/belongs to a different application assembly/i,\n\t\t// A capture only gets older, so an age refusal can never come good. This\n\t\t// one is independent of the capture TTL, so nothing else retires it.\n\t\t/capturedAt is older than/i,\n\t\t// Malformed beyond repair: passes the grammar, names no real instant.\n\t\t/capturedAt is not a parseable instant/i,\n\t\t/capturedAt must be an RFC 3339/i,\n\t\t// Deliberately absent: a capture dated in the future comes good as real\n\t\t// time advances, and a gateway missing its replay window is a\n\t\t// deployment mistake somebody will fix. Discarding either would destroy\n\t\t// work that a clock correction or a config change would have replayed.\n\t].some((pattern) => pattern.test(messageOf(error)));\n}\n"],"mappings":";AAuFO,SAAS,0BAA0B,SAQlB;AACvB,MAAI,QAAQ,MAAM,eAAe,uBAAuB,CAAC,QAAQ,qBAAqB;AACrF,UAAM,IAAI,MAAM,iEAAiE;AAAA,EAClF;AACA,MAAI,CAAC,QAAQ,QAAQ,OAAQ,OAAM,IAAI,MAAM,oDAAoD;AACjG,QAAM,YAAY,eAAe,QAAQ,KAAK,IAAI;AAClD,QAAM,MAAM,QAAQ,QAAQ,MAAM,oBAAI,KAAK;AAC3C,SAAO;AAAA,IACN,MAAM,QAAQ,YAAY,WAAW,YAAY,gBAAgB;AAChE,YAAM,WAAW,UAAU,IAAI,UAAU;AACzC,UAAI,CAAC,UAAU,eAAe,SAAS,SAAS,GAAG;AAClD,cAAM,IAAI,MAAM,mBAAmB,UAAU,IAAI,SAAS,8BAA8B;AAAA,MACzF;AACA,UAAI,CAAC,kBAAkB,eAAe,SAAS,IAAK,OAAM,IAAI,MAAM,4DAA4D;AAChI,YAAM,aAAa,IAAI;AACvB,YAAM,gBAAgB,WAAW,QAAQ,KAAK,QAAQ,gBAAgB;AACtE,YAAM,aAAa,KAAK,MAAM,QAAQ,KAAK,SAAS;AACpD,UAAI,CAAC,OAAO,SAAS,UAAU,KAAK,cAAc,WAAW,QAAQ,EAAG,OAAM,IAAI,MAAM,oDAAoD;AAC5I,YAAM,iBAAiB,uBAAuB,UAAU;AACxD,YAAM,YAAY,QAAQ,cAAc;AACxC,UAAI,CAAC,UAAU,KAAK,EAAG,OAAM,IAAI,MAAM,iCAAiC;AACxE,YAAM,SAA+B;AAAA,QACpC;AAAA,QACA,QAAQ,QAAQ,KAAK;AAAA,QACrB,eAAe,QAAQ,KAAK;AAAA,QAC5B;AAAA,QACA;AAAA,QACA,YAAY;AAAA,QACZ;AAAA,QACA,YAAY,WAAW,YAAY;AAAA,QACnC,WAAW,IAAI,KAAK,KAAK,IAAI,eAAe,UAAU,CAAC,EAAE,YAAY;AAAA,MACtE;AACA,YAAM,QAAQ,MAAM,IAAI,MAAM;AAC9B,aAAO;AAAA,IACR;AAAA,IACA,MAAM,SAAS;AACd,UAAI,YAAY;AAChB,UAAI,SAAS;AACb,YAAM,SAA0B,CAAC;AACjC,YAAM,UAAkC,CAAC;AACzC,YAAM,aAAsC,CAAC;AAC7C,iBAAW,UAAU,MAAM,QAAQ,MAAM,KAAK,GAAG;AAChD,YAAI,KAAK,MAAM,OAAO,SAAS,KAAK,IAAI,EAAE,QAAQ,GAAG;AACpD,gBAAM,QAAQ,MAAM,OAAO,OAAO,SAAS;AAC3C,kBAAQ,KAAK,MAAM;AACnB;AAAA,QACD;AACA,cAAM,UAAmC;AAAA,UACxC,QAAQ,OAAO;AAAA,UACf,YAAY,OAAO;AAAA,UACnB,WAAW,OAAO;AAAA,UAClB,YAAY,OAAO;AAAA,UACnB,gBAAgB,OAAO;AAAA,UACvB,iBAAiB;AAAA,UACjB,YAAY,OAAO;AAAA,QACpB;AACA,YAAI;AACH,gBAAM,UAAU,MAAM,QAAQ,QAAQ,OAAQ,OAAO;AAOrD,gBAAM,QAAQ,MAAM,OAAO,OAAO,SAAS;AAC3C,gBAAM,cAAc,cAAc,OAAO;AACzC,gBAAM,qBAAqB,OAAO,SAAS,uBAAuB,WAC/D,QAAQ,qBACR;AACH,cAAI,YAAY,SAAS,aAAa;AACrC,uBAAW,KAAK;AAAA,cACf;AAAA,cACA,QAAQ,YAAY;AAAA,cACpB,GAAI,uBAAuB,SAAY,CAAC,IAAI,EAAE,mBAAmB;AAAA,cACjE,WAAW,YAAY;AAAA,cACvB,QAAQ,YAAY;AAAA,YACrB,CAAC;AAAA,UACF,WAAW,YAAY,SAAS,UAAU;AACzC,mBAAO,KAAK,EAAE,QAAQ,GAAI,uBAAuB,SAAY,CAAC,IAAI,EAAE,mBAAmB,EAAG,CAAC;AAAA,UAC5F,OAAO;AACN,yBAAa;AAAA,UACd;AAAA,QACD,SAAS,OAAO;AAMf,cAAI,uBAAuB,KAAK,GAAG;AAClC,kBAAM,QAAQ,MAAM,OAAO,OAAO,SAAS;AAI3C,uBAAW,KAAK,EAAE,QAAQ,QAAQ,iBAAiB,WAAW,WAAW,QAAQ,UAAU,KAAK,EAAE,CAAC;AAAA,UACpG,OAAO;AACN,sBAAU;AAAA,UACX;AAAA,QACD;AAAA,MACD;AACA,aAAO,EAAE,WAAW,QAAQ,QAAQ,SAAS,WAAW;AAAA,IACzD;AAAA,EACD;AACD;AAEA,SAAS,uBAAuB,YAA8D;AAC7F,MAAI,QAAQ;AACZ,QAAM,QAAQ,CAAC,OAAgB,OAAe,QAAuB;AACpE,aAAS;AACT,QAAI,QAAQ,OAAU,QAAQ,GAAI,OAAM,IAAI,MAAM,sDAAsD;AACxG,QAAI,QAAQ,UAAa,4EAA4E,KAAK,GAAG,GAAG;AAC/G,YAAM,IAAI,MAAM,yEAAyE,GAAG,IAAI;AAAA,IACjG;AACA,QAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,OAAO,UAAU,UAAW;AAC/E,QAAI,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,EAAG;AACzD,QAAI,MAAM,QAAQ,KAAK,GAAG;AACzB,YAAM,QAAQ,CAAC,UAAU,MAAM,OAAO,QAAQ,CAAC,CAAC;AAChD;AAAA,IACD;AACA,QAAI,SAAS,OAAO,UAAU,YAAY,OAAO,eAAe,KAAK,MAAM,OAAO,WAAW;AAC5F,iBAAW,CAAC,UAAU,KAAK,KAAK,OAAO,QAAQ,KAAK,EAAG,OAAM,OAAO,QAAQ,GAAG,QAAQ;AACvF;AAAA,IACD;AACA,UAAM,IAAI,MAAM,oEAAoE;AAAA,EACrF;AACA,QAAM,YAAY,CAAC;AACnB,QAAM,aAAa,KAAK,UAAU,UAAU;AAC5C,MAAI,IAAI,YAAY,EAAE,OAAO,UAAU,EAAE,aAAa,MAAQ,OAAM,IAAI,MAAM,yDAAyD;AACvI,SAAO,gBAAgB,UAAU;AAClC;AAEA,SAAS,eAAe,MAA2D;AAClF,QAAM,SAAS,oBAAI,IAAgC;AACnD,QAAM,QAAQ,CAAC,aAAuC;AACrD,WAAO,IAAI,SAAS,IAAI,QAAQ;AAChC,eAAW,SAAS,SAAS,YAAY,CAAC,EAAG,OAAM,KAAK;AAAA,EACzD;AACA,QAAM,IAAI;AACV,SAAO;AACR;AAEO,SAAS,kCAAuD;AACtE,QAAM,UAAU,oBAAI,IAAkC;AACtD,SAAO;AAAA,IACN,YAAY;AAAA,IACZ,MAAM,IAAI,QAAQ;AACjB,UAAI,QAAQ,IAAI,OAAO,SAAS,EAAG,OAAM,IAAI,MAAM,oBAAoB,OAAO,SAAS,mBAAmB;AAC1G,cAAQ,IAAI,OAAO,WAAW,gBAAgB,MAAM,CAAC;AAAA,IACtD;AAAA,IACA,MAAM,OAAO;AACZ,aAAO,CAAC,GAAG,QAAQ,OAAO,CAAC,EAAE,IAAI,CAAC,WAAW,gBAAgB,MAAM,CAAC;AAAA,IACrE;AAAA,IACA,MAAM,OAAO,WAAW;AACvB,cAAQ,OAAO,SAAS;AAAA,IACzB;AAAA,EACD;AACD;AAEA,SAAS,UAAU,OAAwB;AAC1C,SAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAC7D;AAsBA,SAAS,cAAc,SAAqE;AAI3F,MAAI,CAAC,WAAW,OAAO,YAAY,UAAU;AAC5C,WAAO;AAAA,MACN,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,WAAW;AAAA,MACX,QAAQ;AAAA,IACT;AAAA,EACD;AACA,QAAM,SAAS,OAAO,QAAQ,WAAW,WAAW,QAAQ,SAAS;AACrE,QAAM,SAAS,QAAQ,gBAAgB,WACnC,QAAQ,gBAAgB,SACvB,OAAO,QAAQ,UAAU,WAAW,QAAQ,QAAQ;AAEzD,UAAQ,QAAQ;AAAA,IACf,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACJ,aAAO,EAAE,MAAM,YAAY;AAAA,IAC5B,KAAK;AACJ,aAAO,EAAE,MAAM,SAAS;AAAA,IACzB,KAAK;AAIJ,aAAO;AAAA,QACN,MAAM;AAAA,QACN;AAAA,QACA,WAAW,QAAQ,0BAA0B,SAAY,YAAY;AAAA,QACrE;AAAA,MACD;AAAA,IACD,KAAK;AAAA,IACL,KAAK;AAGJ,aAAO,EAAE,MAAM,aAAa,QAAQ,WAAW,WAAW,OAAO;AAAA,IAClE,KAAK;AAIJ,aAAO,EAAE,MAAM,aAAa,QAAQ,WAAW,WAAW,OAAO;AAAA,IAClE;AAEC,aAAO,EAAE,MAAM,aAAa,QAAQ,UAAU,WAAW,WAAW,WAAW,OAAO;AAAA,EACxF;AACD;AASA,SAAS,uBAAuB,OAAyB;AACxD,SAAO;AAAA;AAAA,IAEN;AAAA;AAAA,IAEA;AAAA;AAAA;AAAA,IAGA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA;AAAA;AAAA,IAGA;AAAA;AAAA,IAEA;AAAA,IACA;AAAA;AAAA;AAAA;AAAA;AAAA,EAKD,EAAE,KAAK,CAAC,YAAY,QAAQ,KAAK,UAAU,KAAK,CAAC,CAAC;AACnD;","names":[]}

package/dist/server.cjs

@@ -0,0 +1,244 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// server.ts
+var server_exports = {};
+__export(server_exports, {
+  createExperienceServerRuntime: () => createExperienceServerRuntime,
+  createMemoryExperiencePlanStore: () => createMemoryExperiencePlanStore,
+  experienceServerChecks: () => experienceServerChecks,
+  runExperienceServerChecks: () => runExperienceServerChecks
+});
+module.exports = __toCommonJS(server_exports);
+var import_contracts = require("@fabricorg/sdui-release/contracts");
+function experienceServerChecks() {
+  return [
+    {
+      id: "fabric.experience.plan-opaque.v1",
+      async run(subject) {
+        const plan = await subject.runtime.issuePlan(subject.issue);
+        const serialized = JSON.stringify(plan);
+        if (serialized.includes("capability://")) throw new Error("Public render plan exposes a capability reference.");
+        return [plan.planId];
+      }
+    },
+    {
+      id: "fabric.experience.scope-isolation.v1",
+      async run(subject) {
+        const plan = await subject.runtime.issuePlan(subject.issue);
+        try {
+          await subject.runtime.resolveIntent({
+            planId: plan.planId,
+            ...subject.intent,
+            scope: subject.wrongScope
+          });
+          throw new Error("Runtime accepted an intent from the wrong trusted scope.");
+        } catch (error) {
+          if (error instanceof Error && error.message === "Runtime accepted an intent from the wrong trusted scope.") throw error;
+        }
+        return ["wrong scope rejected"];
+      }
+    },
+    {
+      id: "fabric.experience.intent-resolution.v1",
+      async run(subject) {
+        const plan = await subject.runtime.issuePlan(subject.issue);
+        const resolved = await subject.runtime.resolveIntent({
+          planId: plan.planId,
+          ...subject.intent,
+          scope: subject.issue.scope
+        });
+        return [`${resolved.actionId}@${resolved.actionVersion}`];
+      }
+    }
+  ];
+}
+async function runExperienceServerChecks(subject, checks = experienceServerChecks()) {
+  const results = [];
+  for (const check of checks) {
+    try {
+      results.push({ id: check.id, status: "passed", evidence: await check.run(subject) });
+    } catch (error) {
+      results.push({ id: check.id, status: "failed", evidence: [], error: error instanceof Error ? error.message : String(error) });
+    }
+  }
+  return { passed: results.every((result) => result.status === "passed"), checks: results };
+}
+function createExperienceServerRuntime(options) {
+  const now = options.now ?? (() => /* @__PURE__ */ new Date());
+  return {
+    async issuePlan(input) {
+      const admitted = await options.resolveChannel({ application: input.application, channel: input.channel });
+      const pointer = await (0, import_contracts.activateReleaseChannelPointer)({
+        compactJws: admitted.pointerJws,
+        crypto: options.crypto,
+        trust: options.trust,
+        generations: options.generations,
+        expected: { issuer: options.issuer, application: input.application, channel: input.channel },
+        now: now()
+      });
+      const release = await (0, import_contracts.verifySignedExperienceRelease)({
+        compactJws: admitted.releaseJws,
+        crypto: options.crypto,
+        trust: options.trust,
+        expected: {
+          issuer: options.issuer,
+          application: input.application,
+          assemblyDigest: pointer.assemblyDigest
+        }
+      });
+      if (release.releaseDigest !== pointer.activeReleaseDigest) {
+        throw new Error("Selected experience release does not match the active release-channel pointer.");
+      }
+      const selected = selectTree(release, input.variantId);
+      const planId = options.nextOpaqueId();
+      if (!planId || /capability:\/\//.test(planId)) throw new Error("Experience plan id must be opaque.");
+      const intents = /* @__PURE__ */ new Map();
+      const views = /* @__PURE__ */ new Map();
+      const root = toRenderPlanFragment(selected.root, release, selected.treeId, intents, views);
+      const publicPlan = Object.freeze({
+        formatVersion: 1,
+        planId,
+        application: input.application,
+        channel: input.channel,
+        releaseDigest: release.releaseDigest,
+        assemblyDigest: release.assemblyDigest,
+        treeId: selected.treeId,
+        root,
+        tokenSet: { name: release.tokenSet.name, version: release.tokenSet.version },
+        expiresAt: new Date(now().getTime() + (input.ttlMs ?? 3e5)).toISOString()
+      });
+      if (JSON.stringify(publicPlan).includes("capability://")) {
+        throw new Error("Public render plan exposes a capability reference.");
+      }
+      await options.store.save({ publicPlan, scope: { ...input.scope }, intents, views });
+      return publicPlan;
+    },
+    async resolveIntent(input) {
+      const state = await options.store.load(input.planId);
+      if (!state) throw new Error("Experience render plan was not found.");
+      if (Date.parse(state.publicPlan.expiresAt) <= now().getTime()) throw new Error("Experience render plan has expired.");
+      if (!sameScope(state.scope, input.scope)) throw new Error("Experience render plan scope does not match trusted request scope.");
+      const intent = state.intents.get(`${input.fragmentId}\0${input.eventName}`);
+      if (!intent) throw new Error(`Fragment event "${input.fragmentId}.${input.eventName}" is not granted by the render plan.`);
+      return {
+        actionId: intent.route.actionId,
+        actionVersion: intent.route.version,
+        execution: intent.route.execution,
+        initiatingReleaseDigest: state.publicPlan.releaseDigest,
+        assemblyDigest: state.publicPlan.assemblyDigest
+      };
+    },
+    async resolveView(input) {
+      const state = await loadPlan(options.store, input.planId, input.scope, now());
+      const view = state.views.get(`${input.fragmentId}\0${input.bindingName}`);
+      if (!view) throw new Error(`Fragment binding "${input.fragmentId}.${input.bindingName}" is not granted by the render plan.`);
+      return {
+        name: view.route.name,
+        version: view.route.version,
+        initiatingReleaseDigest: state.publicPlan.releaseDigest,
+        assemblyDigest: state.publicPlan.assemblyDigest
+      };
+    }
+  };
+}
+function selectTree(release, variantId) {
+  if (variantId === void 0) return { treeId: "root", root: release.document.root };
+  const variant = release.document.variants?.find((candidate) => candidate.id === variantId);
+  if (!variant) throw new Error(`Variant "${variantId}" is not enumerated by the promoted release.`);
+  return { treeId: variant.id, root: variant.root };
+}
+function toRenderPlanFragment(fragment, release, treeId, intents, views) {
+  const effective = release.effectiveGrants.find((grant) => grant.treeId === treeId && grant.fragmentId === fragment.id);
+  if (!effective) throw new Error(`Promoted release has no effective grant for "${treeId}:${fragment.id}".`);
+  const events = [];
+  const offlineEvents = [];
+  const bindings = [];
+  if (fragment.dataRef !== void 0) {
+    if (!effective.views.includes(fragment.dataRef)) throw new Error(`Fragment data binding "${fragment.id}" exceeds its effective grants.`);
+    const route = release.routes.views.find((candidate) => candidate.reference === fragment.dataRef);
+    if (!route) throw new Error(`Fragment data binding "${fragment.id}" has no compiled view route.`);
+    views.set(`${fragment.id}\0$data`, { fragmentId: fragment.id, bindingName: "$data", route });
+    bindings.push("$data");
+  }
+  for (const [eventName, action] of Object.entries(fragment.actions ?? {})) {
+    if (!effective.intents.includes(action.intent)) throw new Error(`Fragment event "${fragment.id}.${eventName}" exceeds its effective grants.`);
+    const route = release.routes.intents.find((candidate) => candidate.reference === action.intent);
+    if (!route) throw new Error(`Fragment event "${fragment.id}.${eventName}" has no compiled intent route.`);
+    intents.set(`${fragment.id}\0${eventName}`, { fragmentId: fragment.id, eventName, route });
+    events.push(eventName);
+    if (route.execution?.connectivity === "offline-capturable") offlineEvents.push(eventName);
+  }
+  return Object.freeze({
+    id: fragment.id,
+    ...fragment.component === void 0 ? {} : { component: fragment.component },
+    ...fragment.props === void 0 ? {} : { props: stripCapabilityReferences(fragment.props) },
+    ...fragment.slot === void 0 ? {} : { slot: fragment.slot },
+    ...events.length === 0 ? {} : { events: Object.freeze(events.sort()) },
+    ...offlineEvents.length === 0 ? {} : { offlineEvents: Object.freeze(offlineEvents.sort()) },
+    ...bindings.length === 0 ? {} : { bindings: Object.freeze(bindings) },
+    ...fragment.children === void 0 ? {} : {
+      children: Object.freeze(fragment.children.map((child) => toRenderPlanFragment(child, release, treeId, intents, views)))
+    }
+  });
+}
+async function loadPlan(store, planId, scope, now) {
+  const state = await store.load(planId);
+  if (!state) throw new Error("Experience render plan was not found.");
+  if (Date.parse(state.publicPlan.expiresAt) <= now.getTime()) throw new Error("Experience render plan has expired.");
+  if (!sameScope(state.scope, scope)) throw new Error("Experience render plan scope does not match trusted request scope.");
+  return state;
+}
+function stripCapabilityReferences(value) {
+  const strip = (candidate) => {
+    if (Array.isArray(candidate)) return candidate.map(strip);
+    if (candidate && typeof candidate === "object") {
+      if ("$ref" in candidate) return void 0;
+      return Object.fromEntries(Object.entries(candidate).flatMap(([key, entry]) => {
+        const stripped = strip(entry);
+        return stripped === void 0 ? [] : [[key, stripped]];
+      }));
+    }
+    return candidate;
+  };
+  return strip(value);
+}
+function sameScope(left, right) {
+  return left.tenantId === right.tenantId && left.spaceId === right.spaceId && left.actorId === right.actorId && left.actorType === right.actorType;
+}
+function createMemoryExperiencePlanStore() {
+  const plans = /* @__PURE__ */ new Map();
+  return {
+    async save(state) {
+      if (plans.has(state.publicPlan.planId)) throw new Error(`Experience render plan "${state.publicPlan.planId}" already exists.`);
+      plans.set(state.publicPlan.planId, state);
+    },
+    async load(planId) {
+      return plans.get(planId) ?? null;
+    }
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  createExperienceServerRuntime,
+  createMemoryExperiencePlanStore,
+  experienceServerChecks,
+  runExperienceServerChecks
+});
+//# sourceMappingURL=server.cjs.map

package/dist/server.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../server.ts"],"sourcesContent":["import type {\n\tReleaseCryptoPort,\n\tReleaseGenerationStore,\n\tReleaseTrustStore,\n\tExperienceIntentRoute,\n\tExperienceViewRoute,\n\tSduiFragment,\n\tSduiFragmentValue,\n\tSduiReleaseV3,\n} from \"@fabricorg/sdui-release/contracts\";\nimport {\n\tactivateReleaseChannelPointer,\n\tverifySignedExperienceRelease,\n} from \"@fabricorg/sdui-release/contracts\";\nimport type {\n\tExperienceScope,\n\tRenderPlanFragment,\n\tScopedRenderPlan,\n} from \"./contracts\";\n\nexport type {\n\tExperienceScope,\n\tRenderPlanFragment,\n\tScopedRenderPlan,\n} from \"./contracts\";\n\nexport interface ExperiencePlanState {\n\tpublicPlan: ScopedRenderPlan;\n\tscope: ExperienceScope;\n\tintents: ReadonlyMap<string, {\n\t\tfragmentId: string;\n\t\teventName: string;\n\t\troute: ExperienceIntentRoute;\n\t}>;\n\tviews: ReadonlyMap<string, {\n\t\tfragmentId: string;\n\t\tbindingName: string;\n\t\troute: ExperienceViewRoute;\n\t}>;\n}\n\nexport interface ExperiencePlanStore {\n\tsave(state: ExperiencePlanState): Promise<void>;\n\tload(planId: string): Promise<ExperiencePlanState | null>;\n}\n\nexport interface IssueRenderPlanInput {\n\tapplication: string;\n\tchannel: string;\n\tscope: ExperienceScope;\n\tvariantId?: string;\n\tttlMs?: number;\n}\n\nexport interface ResolveIntentInput {\n\tplanId: string;\n\tfragmentId: string;\n\teventName: string;\n\tscope: ExperienceScope;\n}\n\nexport interface ResolvedExperienceIntent {\n\tactionId: `${string}.${string}`;\n\tactionVersion: number;\n\texecution: ExperienceIntentRoute[\"execution\"];\n\tinitiatingReleaseDigest: string;\n\tassemblyDigest: string;\n}\n\nexport interface ResolvedExperienceView {\n\tname: `${string}/${string}`;\n\tversion: string;\n\tinitiatingReleaseDigest: string;\n\tassemblyDigest: string;\n}\n\nexport interface ExperienceServerRuntime {\n\tissuePlan(input: IssueRenderPlanInput): Promise<ScopedRenderPlan>;\n\tresolveIntent(input: ResolveIntentInput): Promise<ResolvedExperienceIntent>;\n\tresolveView(input: {\n\t\tplanId: string;\n\t\tfragmentId: string;\n\t\tbindingName: string;\n\t\tscope: ExperienceScope;\n\t}): Promise<ResolvedExperienceView>;\n}\n\nexport interface ExperienceServerConformanceSubject {\n\truntime: ExperienceServerRuntime;\n\tissue: IssueRenderPlanInput;\n\tintent: { fragmentId: string; eventName: string };\n\twrongScope: ExperienceScope;\n}\n\nexport interface ExperienceServerCheck {\n\tid: \"fabric.experience.plan-opaque.v1\" | \"fabric.experience.scope-isolation.v1\" | \"fabric.experience.intent-resolution.v1\";\n\trun(subject: ExperienceServerConformanceSubject): Promise<string[]>;\n}\n\nexport function experienceServerChecks(): readonly ExperienceServerCheck[] {\n\treturn [\n\t\t{\n\t\t\tid: \"fabric.experience.plan-opaque.v1\",\n\t\t\tasync run(subject) {\n\t\t\t\tconst plan = await subject.runtime.issuePlan(subject.issue);\n\t\t\t\tconst serialized = JSON.stringify(plan);\n\t\t\t\tif (serialized.includes(\"capability://\")) throw new Error(\"Public render plan exposes a capability reference.\");\n\t\t\t\treturn [plan.planId];\n\t\t\t},\n\t\t},\n\t\t{\n\t\t\tid: \"fabric.experience.scope-isolation.v1\",\n\t\t\tasync run(subject) {\n\t\t\t\tconst plan = await subject.runtime.issuePlan(subject.issue);\n\t\t\t\ttry {\n\t\t\t\t\tawait subject.runtime.resolveIntent({\n\t\t\t\t\t\tplanId: plan.planId,\n\t\t\t\t\t\t...subject.intent,\n\t\t\t\t\t\tscope: subject.wrongScope,\n\t\t\t\t\t});\n\t\t\t\t\tthrow new Error(\"Runtime accepted an intent from the wrong trusted scope.\");\n\t\t\t\t} catch (error) {\n\t\t\t\t\tif (error instanceof Error && error.message === \"Runtime accepted an intent from the wrong trusted scope.\") throw error;\n\t\t\t\t}\n\t\t\t\treturn [\"wrong scope rejected\"];\n\t\t\t},\n\t\t},\n\t\t{\n\t\t\tid: \"fabric.experience.intent-resolution.v1\",\n\t\t\tasync run(subject) {\n\t\t\t\tconst plan = await subject.runtime.issuePlan(subject.issue);\n\t\t\t\tconst resolved = await subject.runtime.resolveIntent({\n\t\t\t\t\tplanId: plan.planId,\n\t\t\t\t\t...subject.intent,\n\t\t\t\t\tscope: subject.issue.scope,\n\t\t\t\t});\n\t\t\t\treturn [`${resolved.actionId}@${resolved.actionVersion}`];\n\t\t\t},\n\t\t},\n\t];\n}\n\nexport async function runExperienceServerChecks(\n\tsubject: ExperienceServerConformanceSubject,\n\tchecks: readonly ExperienceServerCheck[] = experienceServerChecks(),\n): Promise<{\n\tpassed: boolean;\n\tchecks: Array<{ id: ExperienceServerCheck[\"id\"]; status: \"passed\" | \"failed\"; evidence: string[]; error?: string }>;\n}> {\n\tconst results: Array<{ id: ExperienceServerCheck[\"id\"]; status: \"passed\" | \"failed\"; evidence: string[]; error?: string }> = [];\n\tfor (const check of checks) {\n\t\ttry {\n\t\t\tresults.push({ id: check.id, status: \"passed\", evidence: await check.run(subject) });\n\t\t} catch (error) {\n\t\t\tresults.push({ id: check.id, status: \"failed\", evidence: [], error: error instanceof Error ? error.message : String(error) });\n\t\t}\n\t}\n\treturn { passed: results.every((result) => result.status === \"passed\"), checks: results };\n}\n\nexport function createExperienceServerRuntime(options: {\n\tstore: ExperiencePlanStore;\n\tresolveChannel(input: { application: string; channel: string }): Promise<{\n\t\tpointerJws: string;\n\t\treleaseJws: string;\n\t}>;\n\tissuer: string;\n\tcrypto: ReleaseCryptoPort;\n\ttrust: ReleaseTrustStore;\n\tgenerations: ReleaseGenerationStore;\n\tnextOpaqueId(): string;\n\tnow?: () => Date;\n}): ExperienceServerRuntime {\n\tconst now = options.now ?? (() => new Date());\n\treturn {\n\t\tasync issuePlan(input) {\n\t\t\tconst admitted = await options.resolveChannel({ application: input.application, channel: input.channel });\n\t\t\tconst pointer = await activateReleaseChannelPointer({\n\t\t\t\tcompactJws: admitted.pointerJws,\n\t\t\t\tcrypto: options.crypto,\n\t\t\t\ttrust: options.trust,\n\t\t\t\tgenerations: options.generations,\n\t\t\t\texpected: { issuer: options.issuer, application: input.application, channel: input.channel },\n\t\t\t\tnow: now(),\n\t\t\t});\n\t\t\tconst release = await verifySignedExperienceRelease({\n\t\t\t\tcompactJws: admitted.releaseJws,\n\t\t\t\tcrypto: options.crypto,\n\t\t\t\ttrust: options.trust,\n\t\t\t\texpected: {\n\t\t\t\t\tissuer: options.issuer,\n\t\t\t\t\tapplication: input.application,\n\t\t\t\t\tassemblyDigest: pointer.assemblyDigest,\n\t\t\t\t},\n\t\t\t});\n\t\t\tif (release.releaseDigest !== pointer.activeReleaseDigest) {\n\t\t\t\tthrow new Error(\"Selected experience release does not match the active release-channel pointer.\");\n\t\t\t}\n\t\t\tconst selected = selectTree(release, input.variantId);\n\t\t\tconst planId = options.nextOpaqueId();\n\t\t\tif (!planId || /capability:\\/\\//.test(planId)) throw new Error(\"Experience plan id must be opaque.\");\n\t\t\tconst intents = new Map<string, ExperiencePlanState[\"intents\"] extends ReadonlyMap<string, infer Value> ? Value : never>();\n\t\t\tconst views = new Map<string, ExperiencePlanState[\"views\"] extends ReadonlyMap<string, infer Value> ? Value : never>();\n\t\t\tconst root = toRenderPlanFragment(selected.root, release, selected.treeId, intents, views);\n\t\t\tconst publicPlan: ScopedRenderPlan = Object.freeze({\n\t\t\t\tformatVersion: 1,\n\t\t\t\tplanId,\n\t\t\t\tapplication: input.application,\n\t\t\t\tchannel: input.channel,\n\t\t\t\treleaseDigest: release.releaseDigest,\n\t\t\t\tassemblyDigest: release.assemblyDigest,\n\t\t\t\ttreeId: selected.treeId,\n\t\t\t\troot,\n\t\t\t\ttokenSet: { name: release.tokenSet.name, version: release.tokenSet.version },\n\t\t\t\texpiresAt: new Date(now().getTime() + (input.ttlMs ?? 300_000)).toISOString(),\n\t\t\t});\n\t\t\tif (JSON.stringify(publicPlan).includes(\"capability://\")) {\n\t\t\t\tthrow new Error(\"Public render plan exposes a capability reference.\");\n\t\t\t}\n\t\t\tawait options.store.save({ publicPlan, scope: { ...input.scope }, intents, views });\n\t\t\treturn publicPlan;\n\t\t},\n\t\tasync resolveIntent(input) {\n\t\t\tconst state = await options.store.load(input.planId);\n\t\t\tif (!state) throw new Error(\"Experience render plan was not found.\");\n\t\t\tif (Date.parse(state.publicPlan.expiresAt) <= now().getTime()) throw new Error(\"Experience render plan has expired.\");\n\t\t\tif (!sameScope(state.scope, input.scope)) throw new Error(\"Experience render plan scope does not match trusted request scope.\");\n\t\t\tconst intent = state.intents.get(`${input.fragmentId}\\u0000${input.eventName}`);\n\t\t\tif (!intent) throw new Error(`Fragment event \"${input.fragmentId}.${input.eventName}\" is not granted by the render plan.`);\n\t\t\treturn {\n\t\t\t\tactionId: intent.route.actionId,\n\t\t\t\tactionVersion: intent.route.version,\n\t\t\t\texecution: intent.route.execution,\n\t\t\t\tinitiatingReleaseDigest: state.publicPlan.releaseDigest,\n\t\t\t\tassemblyDigest: state.publicPlan.assemblyDigest,\n\t\t\t};\n\t\t},\n\t\tasync resolveView(input) {\n\t\t\tconst state = await loadPlan(options.store, input.planId, input.scope, now());\n\t\t\tconst view = state.views.get(`${input.fragmentId}\\u0000${input.bindingName}`);\n\t\t\tif (!view) throw new Error(`Fragment binding \"${input.fragmentId}.${input.bindingName}\" is not granted by the render plan.`);\n\t\t\treturn {\n\t\t\t\tname: view.route.name,\n\t\t\t\tversion: view.route.version,\n\t\t\t\tinitiatingReleaseDigest: state.publicPlan.releaseDigest,\n\t\t\t\tassemblyDigest: state.publicPlan.assemblyDigest,\n\t\t\t};\n\t\t},\n\t};\n}\n\nfunction selectTree(release: SduiReleaseV3, variantId?: string): { treeId: string; root: SduiFragment } {\n\tif (variantId === undefined) return { treeId: \"root\", root: release.document.root };\n\tconst variant = release.document.variants?.find((candidate) => candidate.id === variantId);\n\tif (!variant) throw new Error(`Variant \"${variantId}\" is not enumerated by the promoted release.`);\n\treturn { treeId: variant.id, root: variant.root };\n}\n\nfunction toRenderPlanFragment(\n\tfragment: SduiFragment,\n\trelease: SduiReleaseV3,\n\ttreeId: string,\n\tintents: Map<string, { fragmentId: string; eventName: string; route: ExperienceIntentRoute }>,\n\tviews: Map<string, { fragmentId: string; bindingName: string; route: ExperienceViewRoute }>,\n): RenderPlanFragment {\n\tconst effective = release.effectiveGrants.find((grant) => grant.treeId === treeId && grant.fragmentId === fragment.id);\n\tif (!effective) throw new Error(`Promoted release has no effective grant for \"${treeId}:${fragment.id}\".`);\n\tconst events: string[] = [];\n\tconst offlineEvents: string[] = [];\n\tconst bindings: string[] = [];\n\tif (fragment.dataRef !== undefined) {\n\t\tif (!effective.views.includes(fragment.dataRef)) throw new Error(`Fragment data binding \"${fragment.id}\" exceeds its effective grants.`);\n\t\tconst route = release.routes.views.find((candidate) => candidate.reference === fragment.dataRef);\n\t\tif (!route) throw new Error(`Fragment data binding \"${fragment.id}\" has no compiled view route.`);\n\t\tviews.set(`${fragment.id}\\u0000$data`, { fragmentId: fragment.id, bindingName: \"$data\", route });\n\t\tbindings.push(\"$data\");\n\t}\n\tfor (const [eventName, action] of Object.entries(fragment.actions ?? {})) {\n\t\tif (!effective.intents.includes(action.intent)) throw new Error(`Fragment event \"${fragment.id}.${eventName}\" exceeds its effective grants.`);\n\t\tconst route = release.routes.intents.find((candidate) => candidate.reference === action.intent);\n\t\tif (!route) throw new Error(`Fragment event \"${fragment.id}.${eventName}\" has no compiled intent route.`);\n\t\tintents.set(`${fragment.id}\\u0000${eventName}`, { fragmentId: fragment.id, eventName, route });\n\t\tevents.push(eventName);\n\t\tif (route.execution?.connectivity === \"offline-capturable\") offlineEvents.push(eventName);\n\t}\n\treturn Object.freeze({\n\t\tid: fragment.id,\n\t\t...(fragment.component === undefined ? {} : { component: fragment.component }),\n\t\t...(fragment.props === undefined ? {} : { props: stripCapabilityReferences(fragment.props) }),\n\t\t...(fragment.slot === undefined ? {} : { slot: fragment.slot }),\n\t\t...(events.length === 0 ? {} : { events: Object.freeze(events.sort()) }),\n\t\t...(offlineEvents.length === 0 ? {} : { offlineEvents: Object.freeze(offlineEvents.sort()) }),\n\t\t...(bindings.length === 0 ? {} : { bindings: Object.freeze(bindings) }),\n\t\t...(fragment.children === undefined ? {} : {\n\t\t\tchildren: Object.freeze(fragment.children.map((child) => toRenderPlanFragment(child, release, treeId, intents, views))),\n\t\t}),\n\t});\n}\n\nasync function loadPlan(\n\tstore: ExperiencePlanStore,\n\tplanId: string,\n\tscope: ExperienceScope,\n\tnow: Date,\n): Promise<ExperiencePlanState> {\n\tconst state = await store.load(planId);\n\tif (!state) throw new Error(\"Experience render plan was not found.\");\n\tif (Date.parse(state.publicPlan.expiresAt) <= now.getTime()) throw new Error(\"Experience render plan has expired.\");\n\tif (!sameScope(state.scope, scope)) throw new Error(\"Experience render plan scope does not match trusted request scope.\");\n\treturn state;\n}\n\nfunction stripCapabilityReferences(value: Record<string, SduiFragmentValue>): Record<string, unknown> {\n\tconst strip = (candidate: SduiFragmentValue): unknown => {\n\t\tif (Array.isArray(candidate)) return candidate.map(strip);\n\t\tif (candidate && typeof candidate === \"object\") {\n\t\t\tif (\"$ref\" in candidate) return undefined;\n\t\t\treturn Object.fromEntries(Object.entries(candidate).flatMap(([key, entry]) => {\n\t\t\t\tconst stripped = strip(entry);\n\t\t\t\treturn stripped === undefined ? [] : [[key, stripped]];\n\t\t\t}));\n\t\t}\n\t\treturn candidate;\n\t};\n\treturn strip(value) as Record<string, unknown>;\n}\n\nfunction sameScope(left: ExperienceScope, right: ExperienceScope): boolean {\n\treturn left.tenantId === right.tenantId\n\t\t&& left.spaceId === right.spaceId\n\t\t&& left.actorId === right.actorId\n\t\t&& left.actorType === right.actorType;\n}\n\nexport function createMemoryExperiencePlanStore(): ExperiencePlanStore {\n\tconst plans = new Map<string, ExperiencePlanState>();\n\treturn {\n\t\tasync save(state) {\n\t\t\tif (plans.has(state.publicPlan.planId)) throw new Error(`Experience render plan \"${state.publicPlan.planId}\" already exists.`);\n\t\t\tplans.set(state.publicPlan.planId, state);\n\t\t},\n\t\tasync load(planId) {\n\t\t\treturn plans.get(planId) ?? null;\n\t\t},\n\t};\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAUA,uBAGO;AAsFA,SAAS,yBAA2D;AAC1E,SAAO;AAAA,IACN;AAAA,MACC,IAAI;AAAA,MACJ,MAAM,IAAI,SAAS;AAClB,cAAM,OAAO,MAAM,QAAQ,QAAQ,UAAU,QAAQ,KAAK;AAC1D,cAAM,aAAa,KAAK,UAAU,IAAI;AACtC,YAAI,WAAW,SAAS,eAAe,EAAG,OAAM,IAAI,MAAM,oDAAoD;AAC9G,eAAO,CAAC,KAAK,MAAM;AAAA,MACpB;AAAA,IACD;AAAA,IACA;AAAA,MACC,IAAI;AAAA,MACJ,MAAM,IAAI,SAAS;AAClB,cAAM,OAAO,MAAM,QAAQ,QAAQ,UAAU,QAAQ,KAAK;AAC1D,YAAI;AACH,gBAAM,QAAQ,QAAQ,cAAc;AAAA,YACnC,QAAQ,KAAK;AAAA,YACb,GAAG,QAAQ;AAAA,YACX,OAAO,QAAQ;AAAA,UAChB,CAAC;AACD,gBAAM,IAAI,MAAM,0DAA0D;AAAA,QAC3E,SAAS,OAAO;AACf,cAAI,iBAAiB,SAAS,MAAM,YAAY,2DAA4D,OAAM;AAAA,QACnH;AACA,eAAO,CAAC,sBAAsB;AAAA,MAC/B;AAAA,IACD;AAAA,IACA;AAAA,MACC,IAAI;AAAA,MACJ,MAAM,IAAI,SAAS;AAClB,cAAM,OAAO,MAAM,QAAQ,QAAQ,UAAU,QAAQ,KAAK;AAC1D,cAAM,WAAW,MAAM,QAAQ,QAAQ,cAAc;AAAA,UACpD,QAAQ,KAAK;AAAA,UACb,GAAG,QAAQ;AAAA,UACX,OAAO,QAAQ,MAAM;AAAA,QACtB,CAAC;AACD,eAAO,CAAC,GAAG,SAAS,QAAQ,IAAI,SAAS,aAAa,EAAE;AAAA,MACzD;AAAA,IACD;AAAA,EACD;AACD;AAEA,eAAsB,0BACrB,SACA,SAA2C,uBAAuB,GAIhE;AACF,QAAM,UAAuH,CAAC;AAC9H,aAAW,SAAS,QAAQ;AAC3B,QAAI;AACH,cAAQ,KAAK,EAAE,IAAI,MAAM,IAAI,QAAQ,UAAU,UAAU,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;AAAA,IACpF,SAAS,OAAO;AACf,cAAQ,KAAK,EAAE,IAAI,MAAM,IAAI,QAAQ,UAAU,UAAU,CAAC,GAAG,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,CAAC;AAAA,IAC7H;AAAA,EACD;AACA,SAAO,EAAE,QAAQ,QAAQ,MAAM,CAAC,WAAW,OAAO,WAAW,QAAQ,GAAG,QAAQ,QAAQ;AACzF;AAEO,SAAS,8BAA8B,SAYlB;AAC3B,QAAM,MAAM,QAAQ,QAAQ,MAAM,oBAAI,KAAK;AAC3C,SAAO;AAAA,IACN,MAAM,UAAU,OAAO;AACtB,YAAM,WAAW,MAAM,QAAQ,eAAe,EAAE,aAAa,MAAM,aAAa,SAAS,MAAM,QAAQ,CAAC;AACxG,YAAM,UAAU,UAAM,gDAA8B;AAAA,QACnD,YAAY,SAAS;AAAA,QACrB,QAAQ,QAAQ;AAAA,QAChB,OAAO,QAAQ;AAAA,QACf,aAAa,QAAQ;AAAA,QACrB,UAAU,EAAE,QAAQ,QAAQ,QAAQ,aAAa,MAAM,aAAa,SAAS,MAAM,QAAQ;AAAA,QAC3F,KAAK,IAAI;AAAA,MACV,CAAC;AACD,YAAM,UAAU,UAAM,gDAA8B;AAAA,QACnD,YAAY,SAAS;AAAA,QACrB,QAAQ,QAAQ;AAAA,QAChB,OAAO,QAAQ;AAAA,QACf,UAAU;AAAA,UACT,QAAQ,QAAQ;AAAA,UAChB,aAAa,MAAM;AAAA,UACnB,gBAAgB,QAAQ;AAAA,QACzB;AAAA,MACD,CAAC;AACD,UAAI,QAAQ,kBAAkB,QAAQ,qBAAqB;AAC1D,cAAM,IAAI,MAAM,gFAAgF;AAAA,MACjG;AACA,YAAM,WAAW,WAAW,SAAS,MAAM,SAAS;AACpD,YAAM,SAAS,QAAQ,aAAa;AACpC,UAAI,CAAC,UAAU,kBAAkB,KAAK,MAAM,EAAG,OAAM,IAAI,MAAM,oCAAoC;AACnG,YAAM,UAAU,oBAAI,IAAqG;AACzH,YAAM,QAAQ,oBAAI,IAAmG;AACrH,YAAM,OAAO,qBAAqB,SAAS,MAAM,SAAS,SAAS,QAAQ,SAAS,KAAK;AACzF,YAAM,aAA+B,OAAO,OAAO;AAAA,QAClD,eAAe;AAAA,QACf;AAAA,QACA,aAAa,MAAM;AAAA,QACnB,SAAS,MAAM;AAAA,QACf,eAAe,QAAQ;AAAA,QACvB,gBAAgB,QAAQ;AAAA,QACxB,QAAQ,SAAS;AAAA,QACjB;AAAA,QACA,UAAU,EAAE,MAAM,QAAQ,SAAS,MAAM,SAAS,QAAQ,SAAS,QAAQ;AAAA,QAC3E,WAAW,IAAI,KAAK,IAAI,EAAE,QAAQ,KAAK,MAAM,SAAS,IAAQ,EAAE,YAAY;AAAA,MAC7E,CAAC;AACD,UAAI,KAAK,UAAU,UAAU,EAAE,SAAS,eAAe,GAAG;AACzD,cAAM,IAAI,MAAM,oDAAoD;AAAA,MACrE;AACA,YAAM,QAAQ,MAAM,KAAK,EAAE,YAAY,OAAO,EAAE,GAAG,MAAM,MAAM,GAAG,SAAS,MAAM,CAAC;AAClF,aAAO;AAAA,IACR;AAAA,IACA,MAAM,cAAc,OAAO;AAC1B,YAAM,QAAQ,MAAM,QAAQ,MAAM,KAAK,MAAM,MAAM;AACnD,UAAI,CAAC,MAAO,OAAM,IAAI,MAAM,uCAAuC;AACnE,UAAI,KAAK,MAAM,MAAM,WAAW,SAAS,KAAK,IAAI,EAAE,QAAQ,EAAG,OAAM,IAAI,MAAM,qCAAqC;AACpH,UAAI,CAAC,UAAU,MAAM,OAAO,MAAM,KAAK,EAAG,OAAM,IAAI,MAAM,oEAAoE;AAC9H,YAAM,SAAS,MAAM,QAAQ,IAAI,GAAG,MAAM,UAAU,KAAS,MAAM,SAAS,EAAE;AAC9E,UAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,mBAAmB,MAAM,UAAU,IAAI,MAAM,SAAS,sCAAsC;AACzH,aAAO;AAAA,QACN,UAAU,OAAO,MAAM;AAAA,QACvB,eAAe,OAAO,MAAM;AAAA,QAC5B,WAAW,OAAO,MAAM;AAAA,QACxB,yBAAyB,MAAM,WAAW;AAAA,QAC1C,gBAAgB,MAAM,WAAW;AAAA,MAClC;AAAA,IACD;AAAA,IACA,MAAM,YAAY,OAAO;AACxB,YAAM,QAAQ,MAAM,SAAS,QAAQ,OAAO,MAAM,QAAQ,MAAM,OAAO,IAAI,CAAC;AAC5E,YAAM,OAAO,MAAM,MAAM,IAAI,GAAG,MAAM,UAAU,KAAS,MAAM,WAAW,EAAE;AAC5E,UAAI,CAAC,KAAM,OAAM,IAAI,MAAM,qBAAqB,MAAM,UAAU,IAAI,MAAM,WAAW,sCAAsC;AAC3H,aAAO;AAAA,QACN,MAAM,KAAK,MAAM;AAAA,QACjB,SAAS,KAAK,MAAM;AAAA,QACpB,yBAAyB,MAAM,WAAW;AAAA,QAC1C,gBAAgB,MAAM,WAAW;AAAA,MAClC;AAAA,IACD;AAAA,EACD;AACD;AAEA,SAAS,WAAW,SAAwB,WAA4D;AACvG,MAAI,cAAc,OAAW,QAAO,EAAE,QAAQ,QAAQ,MAAM,QAAQ,SAAS,KAAK;AAClF,QAAM,UAAU,QAAQ,SAAS,UAAU,KAAK,CAAC,cAAc,UAAU,OAAO,SAAS;AACzF,MAAI,CAAC,QAAS,OAAM,IAAI,MAAM,YAAY,SAAS,8CAA8C;AACjG,SAAO,EAAE,QAAQ,QAAQ,IAAI,MAAM,QAAQ,KAAK;AACjD;AAEA,SAAS,qBACR,UACA,SACA,QACA,SACA,OACqB;AACrB,QAAM,YAAY,QAAQ,gBAAgB,KAAK,CAAC,UAAU,MAAM,WAAW,UAAU,MAAM,eAAe,SAAS,EAAE;AACrH,MAAI,CAAC,UAAW,OAAM,IAAI,MAAM,gDAAgD,MAAM,IAAI,SAAS,EAAE,IAAI;AACzG,QAAM,SAAmB,CAAC;AAC1B,QAAM,gBAA0B,CAAC;AACjC,QAAM,WAAqB,CAAC;AAC5B,MAAI,SAAS,YAAY,QAAW;AACnC,QAAI,CAAC,UAAU,MAAM,SAAS,SAAS,OAAO,EAAG,OAAM,IAAI,MAAM,0BAA0B,SAAS,EAAE,iCAAiC;AACvI,UAAM,QAAQ,QAAQ,OAAO,MAAM,KAAK,CAAC,cAAc,UAAU,cAAc,SAAS,OAAO;AAC/F,QAAI,CAAC,MAAO,OAAM,IAAI,MAAM,0BAA0B,SAAS,EAAE,+BAA+B;AAChG,UAAM,IAAI,GAAG,SAAS,EAAE,WAAe,EAAE,YAAY,SAAS,IAAI,aAAa,SAAS,MAAM,CAAC;AAC/F,aAAS,KAAK,OAAO;AAAA,EACtB;AACA,aAAW,CAAC,WAAW,MAAM,KAAK,OAAO,QAAQ,SAAS,WAAW,CAAC,CAAC,GAAG;AACzE,QAAI,CAAC,UAAU,QAAQ,SAAS,OAAO,MAAM,EAAG,OAAM,IAAI,MAAM,mBAAmB,SAAS,EAAE,IAAI,SAAS,iCAAiC;AAC5I,UAAM,QAAQ,QAAQ,OAAO,QAAQ,KAAK,CAAC,cAAc,UAAU,cAAc,OAAO,MAAM;AAC9F,QAAI,CAAC,MAAO,OAAM,IAAI,MAAM,mBAAmB,SAAS,EAAE,IAAI,SAAS,iCAAiC;AACxG,YAAQ,IAAI,GAAG,SAAS,EAAE,KAAS,SAAS,IAAI,EAAE,YAAY,SAAS,IAAI,WAAW,MAAM,CAAC;AAC7F,WAAO,KAAK,SAAS;AACrB,QAAI,MAAM,WAAW,iBAAiB,qBAAsB,eAAc,KAAK,SAAS;AAAA,EACzF;AACA,SAAO,OAAO,OAAO;AAAA,IACpB,IAAI,SAAS;AAAA,IACb,GAAI,SAAS,cAAc,SAAY,CAAC,IAAI,EAAE,WAAW,SAAS,UAAU;AAAA,IAC5E,GAAI,SAAS,UAAU,SAAY,CAAC,IAAI,EAAE,OAAO,0BAA0B,SAAS,KAAK,EAAE;AAAA,IAC3F,GAAI,SAAS,SAAS,SAAY,CAAC,IAAI,EAAE,MAAM,SAAS,KAAK;AAAA,IAC7D,GAAI,OAAO,WAAW,IAAI,CAAC,IAAI,EAAE,QAAQ,OAAO,OAAO,OAAO,KAAK,CAAC,EAAE;AAAA,IACtE,GAAI,cAAc,WAAW,IAAI,CAAC,IAAI,EAAE,eAAe,OAAO,OAAO,cAAc,KAAK,CAAC,EAAE;AAAA,IAC3F,GAAI,SAAS,WAAW,IAAI,CAAC,IAAI,EAAE,UAAU,OAAO,OAAO,QAAQ,EAAE;AAAA,IACrE,GAAI,SAAS,aAAa,SAAY,CAAC,IAAI;AAAA,MAC1C,UAAU,OAAO,OAAO,SAAS,SAAS,IAAI,CAAC,UAAU,qBAAqB,OAAO,SAAS,QAAQ,SAAS,KAAK,CAAC,CAAC;AAAA,IACvH;AAAA,EACD,CAAC;AACF;AAEA,eAAe,SACd,OACA,QACA,OACA,KAC+B;AAC/B,QAAM,QAAQ,MAAM,MAAM,KAAK,MAAM;AACrC,MAAI,CAAC,MAAO,OAAM,IAAI,MAAM,uCAAuC;AACnE,MAAI,KAAK,MAAM,MAAM,WAAW,SAAS,KAAK,IAAI,QAAQ,EAAG,OAAM,IAAI,MAAM,qCAAqC;AAClH,MAAI,CAAC,UAAU,MAAM,OAAO,KAAK,EAAG,OAAM,IAAI,MAAM,oEAAoE;AACxH,SAAO;AACR;AAEA,SAAS,0BAA0B,OAAmE;AACrG,QAAM,QAAQ,CAAC,cAA0C;AACxD,QAAI,MAAM,QAAQ,SAAS,EAAG,QAAO,UAAU,IAAI,KAAK;AACxD,QAAI,aAAa,OAAO,cAAc,UAAU;AAC/C,UAAI,UAAU,UAAW,QAAO;AAChC,aAAO,OAAO,YAAY,OAAO,QAAQ,SAAS,EAAE,QAAQ,CAAC,CAAC,KAAK,KAAK,MAAM;AAC7E,cAAM,WAAW,MAAM,KAAK;AAC5B,eAAO,aAAa,SAAY,CAAC,IAAI,CAAC,CAAC,KAAK,QAAQ,CAAC;AAAA,MACtD,CAAC,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACR;AACA,SAAO,MAAM,KAAK;AACnB;AAEA,SAAS,UAAU,MAAuB,OAAiC;AAC1E,SAAO,KAAK,aAAa,MAAM,YAC3B,KAAK,YAAY,MAAM,WACvB,KAAK,YAAY,MAAM,WACvB,KAAK,cAAc,MAAM;AAC9B;AAEO,SAAS,kCAAuD;AACtE,QAAM,QAAQ,oBAAI,IAAiC;AACnD,SAAO;AAAA,IACN,MAAM,KAAK,OAAO;AACjB,UAAI,MAAM,IAAI,MAAM,WAAW,MAAM,EAAG,OAAM,IAAI,MAAM,2BAA2B,MAAM,WAAW,MAAM,mBAAmB;AAC7H,YAAM,IAAI,MAAM,WAAW,QAAQ,KAAK;AAAA,IACzC;AAAA,IACA,MAAM,KAAK,QAAQ;AAClB,aAAO,MAAM,IAAI,MAAM,KAAK;AAAA,IAC7B;AAAA,EACD;AACD;","names":[]}

package/dist/server.d.cts

@@ -0,0 +1,100 @@
+import { ExperienceIntentRoute, ExperienceViewRoute, ReleaseCryptoPort, ReleaseTrustStore, ReleaseGenerationStore } from '@fabricorg/sdui-release/contracts';
+import { ScopedRenderPlan, ExperienceScope } from './contracts.cjs';
+export { RenderPlanFragment } from './contracts.cjs';
+
+interface ExperiencePlanState {
+    publicPlan: ScopedRenderPlan;
+    scope: ExperienceScope;
+    intents: ReadonlyMap<string, {
+        fragmentId: string;
+        eventName: string;
+        route: ExperienceIntentRoute;
+    }>;
+    views: ReadonlyMap<string, {
+        fragmentId: string;
+        bindingName: string;
+        route: ExperienceViewRoute;
+    }>;
+}
+interface ExperiencePlanStore {
+    save(state: ExperiencePlanState): Promise<void>;
+    load(planId: string): Promise<ExperiencePlanState | null>;
+}
+interface IssueRenderPlanInput {
+    application: string;
+    channel: string;
+    scope: ExperienceScope;
+    variantId?: string;
+    ttlMs?: number;
+}
+interface ResolveIntentInput {
+    planId: string;
+    fragmentId: string;
+    eventName: string;
+    scope: ExperienceScope;
+}
+interface ResolvedExperienceIntent {
+    actionId: `${string}.${string}`;
+    actionVersion: number;
+    execution: ExperienceIntentRoute["execution"];
+    initiatingReleaseDigest: string;
+    assemblyDigest: string;
+}
+interface ResolvedExperienceView {
+    name: `${string}/${string}`;
+    version: string;
+    initiatingReleaseDigest: string;
+    assemblyDigest: string;
+}
+interface ExperienceServerRuntime {
+    issuePlan(input: IssueRenderPlanInput): Promise<ScopedRenderPlan>;
+    resolveIntent(input: ResolveIntentInput): Promise<ResolvedExperienceIntent>;
+    resolveView(input: {
+        planId: string;
+        fragmentId: string;
+        bindingName: string;
+        scope: ExperienceScope;
+    }): Promise<ResolvedExperienceView>;
+}
+interface ExperienceServerConformanceSubject {
+    runtime: ExperienceServerRuntime;
+    issue: IssueRenderPlanInput;
+    intent: {
+        fragmentId: string;
+        eventName: string;
+    };
+    wrongScope: ExperienceScope;
+}
+interface ExperienceServerCheck {
+    id: "fabric.experience.plan-opaque.v1" | "fabric.experience.scope-isolation.v1" | "fabric.experience.intent-resolution.v1";
+    run(subject: ExperienceServerConformanceSubject): Promise<string[]>;
+}
+declare function experienceServerChecks(): readonly ExperienceServerCheck[];
+declare function runExperienceServerChecks(subject: ExperienceServerConformanceSubject, checks?: readonly ExperienceServerCheck[]): Promise<{
+    passed: boolean;
+    checks: Array<{
+        id: ExperienceServerCheck["id"];
+        status: "passed" | "failed";
+        evidence: string[];
+        error?: string;
+    }>;
+}>;
+declare function createExperienceServerRuntime(options: {
+    store: ExperiencePlanStore;
+    resolveChannel(input: {
+        application: string;
+        channel: string;
+    }): Promise<{
+        pointerJws: string;
+        releaseJws: string;
+    }>;
+    issuer: string;
+    crypto: ReleaseCryptoPort;
+    trust: ReleaseTrustStore;
+    generations: ReleaseGenerationStore;
+    nextOpaqueId(): string;
+    now?: () => Date;
+}): ExperienceServerRuntime;
+declare function createMemoryExperiencePlanStore(): ExperiencePlanStore;
+
+export { type ExperiencePlanState, type ExperiencePlanStore, ExperienceScope, type ExperienceServerCheck, type ExperienceServerConformanceSubject, type ExperienceServerRuntime, type IssueRenderPlanInput, type ResolveIntentInput, type ResolvedExperienceIntent, type ResolvedExperienceView, ScopedRenderPlan, createExperienceServerRuntime, createMemoryExperiencePlanStore, experienceServerChecks, runExperienceServerChecks };