@fabricorg/sdui-release 0.3.0 → 0.5.0

package/dist/contracts-4fL-Yh38.d.ts

@@ -0,0 +1,399 @@
+import { PortableJsonSchema, ActionExecutionContract } from '@fabricorg/platform';
+import { UsageContractDocument } from '@fabricorg/gen-capability';
+import { AssemblyLockfile } from '@fabricorg/assembly';
+
+/**
+ * Version of the SDUI document contract. A vertical negotiates on this, not on
+ * this package's version, and it moves only when the serialized shape changes.
+ */
+declare const SDUI_DOCUMENT_FORMAT_VERSION: 1;
+/**
+ * Version of the SDUI token-set contract.
+ */
+declare const SDUI_TOKEN_SET_FORMAT_VERSION: 1;
+/**
+ * Version of the SDUI component-pack contract.
+ */
+declare const SDUI_COMPONENT_PACK_FORMAT_VERSION: 1;
+/**
+ * Version of the promoted SDUI release contract.
+ */
+declare const SDUI_RELEASE_FORMAT_VERSION: 2;
+/**
+ * A capability read reference embedded in fragment props. The `capability://`
+ * scheme ties a data binding to a published view; the host resolves it through
+ * `ProjectionHost`, never through a direct query.
+ */
+interface SduiCapabilityRef {
+    $ref: `capability://${string}`;
+}
+/**
+ * A value that may appear in fragment props: a JSON literal, an array, an
+ * object, or a `capability://` read reference. Direct mutation endpoints,
+ * API URLs, or code strings are not valid fragment values.
+ */
+type SduiFragmentValue = string | number | boolean | null | SduiFragmentValue[] | SduiCapabilityRef | {
+    [key: string]: SduiFragmentValue;
+};
+/**
+ * An action declared on a fragment. The `intent` must be a `capability://`
+ * reference to a published action intent; the host dispatches it through
+ * `PlatformHost`, preserving governance. A bare endpoint URL, function name,
+ * or inline script is a mutation bypass and is rejected.
+ */
+interface SduiActionRef {
+    intent: `capability://${string}`;
+    params?: Record<string, SduiFragmentValue>;
+}
+/**
+ * A node in an SDUI document tree. A fragment either renders a component from
+ * a declared pack, binds data from a capability view, or both. Actions on a
+ * fragment are always capability action-intent references — never direct
+ * mutations.
+ */
+interface SduiFragment {
+    /** Unique identifier within the document. */
+    id: string;
+    /** Namespaced component (`pack.Component`) or a core component name. */
+    component?: string;
+    /** Props for the component; values may be literals or capability refs. */
+    props?: Record<string, SduiFragmentValue>;
+    /** Named slot this fragment fills in its parent component. */
+    slot?: string;
+    /** A capability view reference for data-driven fragments. */
+    dataRef?: `capability://${string}`;
+    /** Action handlers; every entry must be a capability action-intent reference. */
+    actions?: Record<string, SduiActionRef>;
+    /** Child fragments. */
+    children?: SduiFragment[];
+}
+type SduiTokenType = "color" | "spacing" | "fontSize" | "fontWeight" | "radius" | "border" | "shadow";
+interface SduiToken {
+    type: SduiTokenType;
+    value: string;
+    description?: string;
+}
+/**
+ * A versioned set of design tokens. Tokens are semantic, not literal CSS — a
+ * renderer maps them to its own platform. Two channels consuming the same
+ * token set apply the same visual intent through different renderings.
+ */
+interface SduiTokenSet {
+    formatVersion: typeof SDUI_TOKEN_SET_FORMAT_VERSION;
+    name: string;
+    version: string;
+    tokens: Record<string, SduiToken>;
+}
+interface SduiComponentDefinition {
+    /** Roles this component implements (for adoption-binding validation). */
+    implements?: string[];
+    /** JSON Schema for component props. */
+    propsSchema?: PortableJsonSchema;
+    /** Named slots this component accepts. */
+    slots?: string[];
+}
+/**
+ * A versioned pack of SDUI components. Compatible with the adoption-bindings
+ * `ComponentPackManifest` but adds prop schemas and slot declarations so a
+ * document can be validated without a renderer.
+ */
+interface SduiComponentPack {
+    formatVersion: typeof SDUI_COMPONENT_PACK_FORMAT_VERSION;
+    pack: string;
+    namespace: string;
+    version: string;
+    /** SHA-256 digest of the published component-pack artifact. */
+    artifactDigest: string;
+    /**
+     * Where this pack is loaded from when it is delivered as a federated
+     * remote. The artifact digest identifies the pack that was reviewed; this
+     * is what a shell actually executes, so validation requires the two to be
+     * locked together or the review covers something other than what runs.
+     */
+    remote?: SduiComponentPackRemote;
+    components: Record<string, SduiComponentDefinition>;
+}
+/** Delivery binding for a federated component pack. */
+interface SduiComponentPackRemote {
+    /** Remote entry URL the shell loads. */
+    entry: string;
+    /** Subresource-integrity value for that entry, e.g. `sha384-…`. */
+    integrity: string;
+    /** Exposed module path keyed by the component name it provides. */
+    exposes: Record<string, string>;
+}
+interface SduiComponentPackReference {
+    pack: string;
+    namespace: string;
+    /** Semver range, e.g. `^1.0.0`. */
+    range: string;
+}
+interface SduiTokenSetReference {
+    name: string;
+    version: string;
+}
+/**
+ * A versioned SDUI document: a tree of fragments, a token-set reference, and
+ * the component packs it depends on. This is the build-time input; the release
+ * is the validated, resolved output.
+ */
+interface SduiDocument {
+    formatVersion: typeof SDUI_DOCUMENT_FORMAT_VERSION;
+    name: string;
+    version: string;
+    /** The tree rendered when no variant is selected. */
+    root: SduiFragment;
+    /**
+     * Alternative trees a compositor may select at request time, for experiment
+     * arms and personalization. Every variant is enumerated here and validated
+     * against the same grants as `root`, and all of them are covered by the
+     * release digest.
+     *
+     * Enumeration is what makes selection safe. A selector that can produce a
+     * tree outside this set cannot be validated at promotion, so "selection may
+     * never widen grants" would be unenforceable rather than merely unenforced.
+     */
+    variants?: SduiVariant[];
+    /** The token set this document is authored against. */
+    tokenSet: SduiTokenSetReference;
+    /**
+     * Other token sets this same document may be promoted against, so one
+     * authored document serves several brands without forking.
+     *
+     * Each promotion still pins exactly one resolved token set, and the release
+     * digest still identifies precisely what a viewer receives. Carrying several
+     * token sets inside a single release would author once at the cost of that
+     * property, which is much harder to get back than it is to keep.
+     */
+    supportedTokenSets?: SduiTokenSetReference[];
+    componentPacks: SduiComponentPackReference[];
+}
+/** One selectable alternative to a document's default tree. */
+interface SduiVariant {
+    /** Stable key the compositor matches on. Unique within the document. */
+    id: string;
+    /** The audience or experiment arm this arm serves. */
+    description?: string;
+    root: SduiFragment;
+}
+interface ResolvedSduiComponentPack {
+    pack: string;
+    namespace: string;
+    version: string;
+    range: string;
+    artifactDigest: string;
+    /**
+     * The locked delivery binding, carried onto the release so the digest
+     * identifies which remote a channel is expected to load. Omitting it would
+     * let two releases differing only in their remote share a digest.
+     */
+    remote?: SduiComponentPackRemote;
+}
+/**
+ * A promoted, validated, immutable SDUI release. It bundles a document, a
+ * resolved token set, and locked component packs. Two channels (web, mobile,
+ * CLI) can consume the same release and render it through their own renderers
+ * while reads and actions remain capability references.
+ */
+interface SduiRelease {
+    formatVersion: typeof SDUI_RELEASE_FORMAT_VERSION;
+    /** SHA-256 of the canonical document, token set, resolved packs, grants, and assembly identity. */
+    releaseDigest: string;
+    /** Approved application assembly this release was validated against. */
+    assemblyDigest: string;
+    document: SduiDocument;
+    tokenSet: SduiTokenSet;
+    componentPacks: ResolvedSduiComponentPack[];
+    grants: SduiAuthorizationGrants;
+}
+type SduiFindingCode = "unknown_component" | "incompatible_pack" | "unauthorized_data_ref" | "denied_view_ref" | "mutation_bypass" | "denied_intent_ref" | "intent_action_not_found" | "invalid_fragment" | "invalid_action_ref" | "unknown_token" | "duplicate_fragment_id" | "invalid_token_set" | "invalid_component_pack" | "invalid_document" | "missing_token_set" | "missing_component_pack" | "component_pack_not_in_assembly" | "capability_contract_not_in_assembly" | "duplicate_variant_id" | "fragment_grant_exceeds_release" | "remote_not_locked" | "ambiguous_capability_reference";
+interface SduiFinding {
+    code: SduiFindingCode;
+    path: string;
+    message: string;
+}
+interface SduiValidationResult {
+    valid: boolean;
+    findings: SduiFinding[];
+    release: SduiRelease | undefined;
+}
+/**
+ * Explicit capability references authorized for an SDUI release.
+ *
+ * The presence of a view or action in a supplied usage contract proves that
+ * the capability publishes it, not that this document may use it. The
+ * experience host must therefore provide both grant lists explicitly.
+ */
+interface SduiAuthorizationGrants {
+    /** Full `capability://namespace/view` references allowed in data bindings. */
+    views: readonly string[];
+    /** Full `capability://namespace/intent` references allowed in actions. */
+    intents: readonly string[];
+    /**
+     * Per-fragment narrowing, keyed by fragment id.
+     *
+     * The release-wide lists above are the ceiling. A listed fragment may use
+     * only the references named for it, and the narrowing is inherited by that
+     * fragment's children, so a page assembled from several teams' fragments
+     * gets least privilege rather than the union of everything any of them
+     * needs. A fragment entry can only ever narrow: naming a reference outside
+     * the release-wide list is an authoring error and is reported rather than
+     * silently granted.
+     *
+     * Keys are fragment ids, which are unique within a tree but may repeat
+     * across variants, so two variants using the same fragment id share one
+     * entry. Give them distinct ids when they need distinct narrowing. This
+     * cannot widen either fragment, since narrowing stays an intersection.
+     */
+    fragments?: Record<string, SduiFragmentGrants>;
+}
+/** References one fragment subtree may use, drawn from the release-wide lists. */
+interface SduiFragmentGrants {
+    views?: readonly string[];
+    intents?: readonly string[];
+}
+interface SduiValidationInput {
+    document: SduiDocument;
+    tokenSet: SduiTokenSet;
+    /** Available component packs for version resolution. */
+    componentPacks: SduiComponentPack[];
+    /** Capability contracts available for data-ref and action validation. */
+    contracts: UsageContractDocument[];
+    /**
+     * Explicit authorization grants for every capability view and action
+     * reference used by the document. Contract membership alone never grants
+     * access.
+     */
+    grants: SduiAuthorizationGrants;
+    /** Approved resolved application composition. */
+    assembly: AssemblyLockfile;
+    /** Core component vocabulary every renderer implements. */
+    coreComponents?: readonly string[];
+}
+
+declare const SDUI_RELEASE_V3_FORMAT_VERSION: 3;
+declare const RELEASE_CHANNEL_POINTER_FORMAT_VERSION: 1;
+interface ExperienceViewRoute {
+    reference: `capability://${string}`;
+    name: `${string}/${string}`;
+    version: string;
+    parameterSchema?: PortableJsonSchema;
+    parameterSchemaDigest?: string;
+}
+interface ExperienceIntentRoute {
+    reference: `capability://${string}`;
+    actionId: `${string}.${string}`;
+    version: number;
+    parameterSchema?: PortableJsonSchema;
+    parameterSchemaDigest?: string;
+    execution?: ActionExecutionContract;
+}
+interface EffectiveFragmentGrant {
+    treeId: "root" | string;
+    fragmentId: string;
+    views: readonly string[];
+    intents: readonly string[];
+}
+interface SduiReleaseV3 {
+    formatVersion: typeof SDUI_RELEASE_V3_FORMAT_VERSION;
+    kind: "experience-release";
+    issuer: string;
+    application: string;
+    releaseDigest: string;
+    assemblyDigest: string;
+    document: SduiDocument;
+    tokenSet: SduiTokenSet;
+    componentPacks: ResolvedSduiComponentPack[];
+    routes: {
+        views: ExperienceViewRoute[];
+        intents: ExperienceIntentRoute[];
+    };
+    effectiveGrants: EffectiveFragmentGrant[];
+}
+interface ReleaseChannelPointer {
+    formatVersion: typeof RELEASE_CHANNEL_POINTER_FORMAT_VERSION;
+    kind: "release-channel-pointer";
+    issuer: string;
+    application: string;
+    channel: string;
+    generation: number;
+    activeReleaseDigest: string;
+    assemblyDigest: string;
+    issuedAt: string;
+    notBefore?: string;
+    expiresAt?: string;
+    fallbackReleaseDigests?: readonly string[];
+}
+interface ReleaseVerificationKey {
+    keyId: string;
+    algorithm: "ES256";
+    key: unknown;
+}
+interface ReleaseTrustStore {
+    resolveKey(input: {
+        keyId: string;
+        issuer: string;
+        algorithm: "ES256";
+    }): ReleaseVerificationKey | undefined | Promise<ReleaseVerificationKey | undefined>;
+}
+interface ReleaseCryptoPort {
+    verify(input: {
+        algorithm: "ES256";
+        key: unknown;
+        signingInput: Uint8Array;
+        signature: Uint8Array;
+    }): Promise<boolean>;
+    digestSha256(bytes: Uint8Array): Promise<Uint8Array>;
+}
+interface ReleaseGenerationStore {
+    get(key: string): Promise<{
+        generation: number;
+        pointerDigest: string;
+    } | undefined>;
+    /**
+     * Atomically accepts `generation` only when it is greater than the stored
+     * value for `key`. Implementations must compare and write in one operation.
+     */
+    acceptIfHigher(key: string, generation: number, pointerDigest: string): Promise<boolean>;
+}
+interface VerifySignedExperienceArtifactInput {
+    compactJws: string;
+    expectedType: "fabric-experience-release+jws" | "fabric-release-channel-pointer+jws";
+    crypto: ReleaseCryptoPort;
+    trust: ReleaseTrustStore;
+    maxBytes?: number;
+}
+/**
+ * RFC 8785 JSON Canonicalization Scheme for values already restricted to the
+ * JSON data model. Invalid Unicode, non-finite numbers and non-JSON values are
+ * rejected rather than normalized differently by another runtime.
+ */
+declare function canonicalizeJcs(value: unknown): string;
+declare function verifySignedExperienceArtifact(input: VerifySignedExperienceArtifactInput): Promise<Record<string, unknown>>;
+declare function verifySignedExperienceRelease(input: {
+    compactJws: string;
+    crypto: ReleaseCryptoPort;
+    trust: ReleaseTrustStore;
+    expected: {
+        issuer: string;
+        application: string;
+        assemblyDigest: string;
+    };
+    maxBytes?: number;
+}): Promise<SduiReleaseV3>;
+declare function assertSduiReleaseV3(value: unknown): asserts value is SduiReleaseV3;
+declare function activateReleaseChannelPointer(input: {
+    compactJws: string;
+    crypto: ReleaseCryptoPort;
+    trust: ReleaseTrustStore;
+    generations: ReleaseGenerationStore;
+    expected: {
+        issuer: string;
+        application: string;
+        channel: string;
+    };
+    now?: Date;
+}): Promise<ReleaseChannelPointer>;
+declare function assertReleaseChannelPointer(value: unknown): asserts value is ReleaseChannelPointer;
+
+export { type SduiFragmentValue as A, type SduiReleaseV3 as B, type SduiToken as C, type SduiTokenSetReference as D, type EffectiveFragmentGrant as E, type SduiTokenType as F, activateReleaseChannelPointer as G, assertReleaseChannelPointer as H, assertSduiReleaseV3 as I, canonicalizeJcs as J, verifySignedExperienceArtifact as K, verifySignedExperienceRelease as L, type ResolvedSduiComponentPack as R, type SduiAuthorizationGrants as S, type VerifySignedExperienceArtifactInput as V, type SduiComponentPack as a, type SduiDocument as b, type SduiFragment as c, type SduiRelease as d, type SduiTokenSet as e, type SduiValidationInput as f, type SduiValidationResult as g, type ExperienceIntentRoute as h, type ExperienceViewRoute as i, RELEASE_CHANNEL_POINTER_FORMAT_VERSION as j, type ReleaseChannelPointer as k, type ReleaseCryptoPort as l, type ReleaseGenerationStore as m, type ReleaseTrustStore as n, type ReleaseVerificationKey as o, SDUI_COMPONENT_PACK_FORMAT_VERSION as p, SDUI_DOCUMENT_FORMAT_VERSION as q, SDUI_RELEASE_FORMAT_VERSION as r, SDUI_RELEASE_V3_FORMAT_VERSION as s, SDUI_TOKEN_SET_FORMAT_VERSION as t, type SduiActionRef as u, type SduiCapabilityRef as v, type SduiComponentDefinition as w, type SduiComponentPackReference as x, type SduiFinding as y, type SduiFindingCode as z };

package/dist/contracts.cjs

@@ -0,0 +1,286 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// contracts.ts
+var contracts_exports = {};
+__export(contracts_exports, {
+  RELEASE_CHANNEL_POINTER_FORMAT_VERSION: () => RELEASE_CHANNEL_POINTER_FORMAT_VERSION,
+  SDUI_RELEASE_V3_FORMAT_VERSION: () => SDUI_RELEASE_V3_FORMAT_VERSION,
+  activateReleaseChannelPointer: () => activateReleaseChannelPointer,
+  assertReleaseChannelPointer: () => assertReleaseChannelPointer,
+  assertSduiReleaseV3: () => assertSduiReleaseV3,
+  canonicalizeJcs: () => canonicalizeJcs,
+  verifySignedExperienceArtifact: () => verifySignedExperienceArtifact,
+  verifySignedExperienceRelease: () => verifySignedExperienceRelease
+});
+module.exports = __toCommonJS(contracts_exports);
+var SDUI_RELEASE_V3_FORMAT_VERSION = 3;
+var RELEASE_CHANNEL_POINTER_FORMAT_VERSION = 1;
+var encoder = new TextEncoder();
+var decoder = new TextDecoder("utf-8", { fatal: true });
+var HEX_DIGEST = /^[a-f0-9]{64}$/;
+function canonicalizeJcs(value) {
+  return canonical(value, 0);
+}
+function canonical(value, depth) {
+  if (depth > 64) throw new Error("Canonical JSON exceeds the maximum depth of 64.");
+  if (value === null) return "null";
+  if (typeof value === "boolean") return value ? "true" : "false";
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) throw new Error("Canonical JSON numbers must be finite.");
+    return Object.is(value, -0) ? "0" : JSON.stringify(value);
+  }
+  if (typeof value === "string") {
+    assertValidUnicode(value);
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value)) return `[${value.map((entry) => canonical(entry, depth + 1)).join(",")}]`;
+  if (typeof value !== "object") throw new Error(`Canonical JSON cannot encode ${typeof value}.`);
+  const record = value;
+  const keys = Object.keys(record).sort();
+  return `{${keys.map((key) => {
+    assertValidUnicode(key);
+    return `${JSON.stringify(key)}:${canonical(record[key], depth + 1)}`;
+  }).join(",")}}`;
+}
+function assertValidUnicode(value) {
+  for (let index = 0; index < value.length; index += 1) {
+    const code = value.charCodeAt(index);
+    if (code >= 55296 && code <= 56319) {
+      const next = value.charCodeAt(index + 1);
+      if (!(next >= 56320 && next <= 57343)) throw new Error("Canonical JSON contains an unpaired Unicode surrogate.");
+      index += 1;
+    } else if (code >= 56320 && code <= 57343) {
+      throw new Error("Canonical JSON contains an unpaired Unicode surrogate.");
+    }
+  }
+}
+async function verifySignedExperienceArtifact(input) {
+  const maxBytes = input.maxBytes ?? 1048576;
+  if (encoder.encode(input.compactJws).byteLength > maxBytes) {
+    throw new Error(`Signed experience artifact exceeds the ${maxBytes}-byte size limit.`);
+  }
+  const parts = input.compactJws.split(".");
+  if (parts.length !== 3 || parts.some((part) => part.length === 0)) throw new Error("Signed experience artifact must be a compact JWS.");
+  const header = parseSegment(parts[0], "protected header");
+  if (header.alg !== "ES256") throw new Error("Signed experience artifacts must use ES256.");
+  if (header.typ !== input.expectedType) throw new Error(`Signed experience artifact type must be ${input.expectedType}.`);
+  if (typeof header.kid !== "string" || !header.kid) throw new Error("Signed experience artifact requires a key id.");
+  const payloadBytes = decodeBase64Url(parts[1]);
+  const payload = parseJsonBytes(payloadBytes, "payload");
+  if (typeof payload.issuer !== "string" || !payload.issuer) throw new Error("Signed experience artifact requires an issuer.");
+  const key = await input.trust.resolveKey({ keyId: header.kid, issuer: payload.issuer, algorithm: "ES256" });
+  if (!key || key.algorithm !== "ES256") throw new Error("Signed experience artifact has no trusted key.");
+  const signature = decodeBase64Url(parts[2]);
+  if (signature.byteLength !== 64) throw new Error("ES256 signatures must be 64-byte JOSE signatures.");
+  const verified = await input.crypto.verify({
+    algorithm: "ES256",
+    key: key.key,
+    signingInput: encoder.encode(`${parts[0]}.${parts[1]}`),
+    signature
+  });
+  if (!verified) throw new Error("Signed experience artifact signature is invalid.");
+  return payload;
+}
+async function verifySignedExperienceRelease(input) {
+  const payload = await verifySignedExperienceArtifact({
+    compactJws: input.compactJws,
+    expectedType: "fabric-experience-release+jws",
+    crypto: input.crypto,
+    trust: input.trust,
+    ...input.maxBytes === void 0 ? {} : { maxBytes: input.maxBytes }
+  });
+  assertSduiReleaseV3(payload);
+  if (payload.issuer !== input.expected.issuer || payload.application !== input.expected.application || payload.assemblyDigest !== input.expected.assemblyDigest) {
+    throw new Error("Signed experience release does not match the expected issuer, application, and assembly.");
+  }
+  const { releaseDigest, ...body } = payload;
+  const digest = await input.crypto.digestSha256(encoder.encode(canonicalizeJcs(body)));
+  const expectedDigest = [...digest].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+  if (releaseDigest !== expectedDigest) throw new Error("Signed experience release digest does not match its canonical content.");
+  return payload;
+}
+function assertSduiReleaseV3(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("SDUI Release v3 must be an object.");
+  const release = value;
+  if (release.formatVersion !== SDUI_RELEASE_V3_FORMAT_VERSION || release.kind !== "experience-release") {
+    throw new Error("SDUI Release v3 has an unsupported format.");
+  }
+  for (const field of ["issuer", "application", "releaseDigest", "assemblyDigest"]) {
+    if (typeof release[field] !== "string" || !release[field]) throw new Error(`SDUI Release v3 ${field} is required.`);
+  }
+  if (!HEX_DIGEST.test(release.releaseDigest) || !HEX_DIGEST.test(release.assemblyDigest)) {
+    throw new Error("SDUI Release v3 digests must be lowercase SHA-256 values.");
+  }
+  if (!release.document || typeof release.document !== "object" || !release.tokenSet || typeof release.tokenSet !== "object" || !Array.isArray(release.componentPacks) || !release.routes || typeof release.routes !== "object" || !Array.isArray(release.routes.views) || !Array.isArray(release.routes.intents) || !Array.isArray(release.effectiveGrants)) {
+    throw new Error("SDUI Release v3 is structurally incomplete.");
+  }
+  const routes = release.routes;
+  assertUniqueRecords(routes.views, "view route", (route) => {
+    const record = assertRecord(route, "view route");
+    assertCapabilityReference(record.reference, "view route");
+    assertNonEmptyString(record.name, "view route name");
+    assertNonEmptyString(record.version, "view route version");
+    if (record.parameterSchemaDigest !== void 0) {
+      assertHexDigest(record.parameterSchemaDigest, "view route parameterSchemaDigest");
+    }
+    return record.reference;
+  });
+  assertUniqueRecords(routes.intents, "intent route", (route) => {
+    const record = assertRecord(route, "intent route");
+    assertCapabilityReference(record.reference, "intent route");
+    assertNonEmptyString(record.actionId, "intent route actionId");
+    if (!Number.isSafeInteger(record.version) || record.version < 1) {
+      throw new Error("SDUI Release v3 intent route version must be a positive integer.");
+    }
+    if (record.parameterSchemaDigest !== void 0) {
+      assertHexDigest(record.parameterSchemaDigest, "intent route parameterSchemaDigest");
+    }
+    return record.reference;
+  });
+  assertUniqueRecords(release.effectiveGrants, "effective grant", (grant) => {
+    const record = assertRecord(grant, "effective grant");
+    assertNonEmptyString(record.treeId, "effective grant treeId");
+    assertNonEmptyString(record.fragmentId, "effective grant fragmentId");
+    if (!Array.isArray(record.views) || !record.views.every((item) => typeof item === "string") || !Array.isArray(record.intents) || !record.intents.every((item) => typeof item === "string")) {
+      throw new Error("SDUI Release v3 effective grant routes must be string arrays.");
+    }
+    return `${record.treeId}\0${record.fragmentId}`;
+  });
+}
+function assertRecord(value, label) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`SDUI Release v3 ${label} must be an object.`);
+  return value;
+}
+function assertNonEmptyString(value, label) {
+  if (typeof value !== "string" || !value) throw new Error(`SDUI Release v3 ${label} is required.`);
+}
+function assertHexDigest(value, label) {
+  if (typeof value !== "string" || !HEX_DIGEST.test(value)) throw new Error(`SDUI Release v3 ${label} must be a lowercase SHA-256 value.`);
+}
+function assertCapabilityReference(value, label) {
+  if (typeof value !== "string" || !value.startsWith("capability://")) throw new Error(`SDUI Release v3 ${label} reference is invalid.`);
+}
+function assertUniqueRecords(values, label, identity) {
+  const seen = /* @__PURE__ */ new Set();
+  for (const value of values) {
+    const key = identity(value);
+    if (seen.has(key)) throw new Error(`SDUI Release v3 has a duplicate ${label}.`);
+    seen.add(key);
+  }
+}
+async function activateReleaseChannelPointer(input) {
+  const payload = await verifySignedExperienceArtifact({
+    compactJws: input.compactJws,
+    expectedType: "fabric-release-channel-pointer+jws",
+    crypto: input.crypto,
+    trust: input.trust
+  });
+  assertReleaseChannelPointer(payload);
+  if (payload.issuer !== input.expected.issuer || payload.application !== input.expected.application || payload.channel !== input.expected.channel) {
+    throw new Error("Release channel pointer does not match the expected issuer, application, and channel.");
+  }
+  const now = (input.now ?? /* @__PURE__ */ new Date()).getTime();
+  if (payload.notBefore !== void 0 && now < parseTimestamp(payload.notBefore, "notBefore")) {
+    throw new Error("Release channel pointer is not active yet.");
+  }
+  if (payload.expiresAt !== void 0 && now >= parseTimestamp(payload.expiresAt, "expiresAt")) {
+    throw new Error("Release channel pointer has expired.");
+  }
+  const generationKey = `${payload.issuer}:${payload.application}:${payload.channel}`;
+  const pointerDigestBytes = await input.crypto.digestSha256(encoder.encode(canonicalizeJcs(payload)));
+  const pointerDigest = [...pointerDigestBytes].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+  const current = await input.generations.get(generationKey);
+  if (current !== void 0 && payload.generation < current.generation) {
+    throw new Error("Release channel pointer is older than the accepted generation.");
+  }
+  if (current?.generation === payload.generation && current.pointerDigest !== pointerDigest) {
+    throw new Error("Release channel generation is already bound to a different signed pointer.");
+  }
+  if (current?.generation !== payload.generation) {
+    const accepted = await input.generations.acceptIfHigher(generationKey, payload.generation, pointerDigest);
+    if (!accepted) {
+      const raced = await input.generations.get(generationKey);
+      if (raced?.generation !== payload.generation || raced.pointerDigest !== pointerDigest) {
+        throw new Error("Release channel pointer lost an activation race to a different generation.");
+      }
+    }
+  }
+  return payload;
+}
+function assertReleaseChannelPointer(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("Release channel pointer must be an object.");
+  const pointer = value;
+  if (pointer.formatVersion !== RELEASE_CHANNEL_POINTER_FORMAT_VERSION || pointer.kind !== "release-channel-pointer") {
+    throw new Error("Release channel pointer has an unsupported format.");
+  }
+  for (const field of ["issuer", "application", "channel", "issuedAt"]) {
+    if (typeof pointer[field] !== "string" || !pointer[field]) throw new Error(`Release channel pointer ${field} is required.`);
+  }
+  if (!Number.isSafeInteger(pointer.generation) || pointer.generation < 0) throw new Error("Release channel pointer generation must be a non-negative safe integer.");
+  if (!HEX_DIGEST.test(String(pointer.activeReleaseDigest)) || !HEX_DIGEST.test(String(pointer.assemblyDigest))) {
+    throw new Error("Release channel pointer digests must be lowercase SHA-256 values.");
+  }
+  if (pointer.fallbackReleaseDigests !== void 0 && (!Array.isArray(pointer.fallbackReleaseDigests) || !pointer.fallbackReleaseDigests.every((digest) => typeof digest === "string" && HEX_DIGEST.test(digest)) || new Set(pointer.fallbackReleaseDigests).size !== pointer.fallbackReleaseDigests.length)) {
+    throw new Error("Release channel pointer fallbackReleaseDigests must contain unique lowercase SHA-256 values.");
+  }
+  parseTimestamp(pointer.issuedAt, "issuedAt");
+}
+function parseSegment(segment, label) {
+  return parseJsonBytes(decodeBase64Url(segment), label);
+}
+function parseJsonBytes(bytes, label) {
+  let value;
+  try {
+    value = JSON.parse(decoder.decode(bytes));
+  } catch {
+    throw new Error(`Signed experience artifact ${label} is not valid UTF-8 JSON.`);
+  }
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`Signed experience artifact ${label} must be an object.`);
+  return value;
+}
+function decodeBase64Url(value) {
+  if (!/^[A-Za-z0-9_-]+$/.test(value)) throw new Error("Signed experience artifact contains invalid base64url.");
+  const padded = value.replace(/-/g, "+").replace(/_/g, "/").padEnd(Math.ceil(value.length / 4) * 4, "=");
+  let binary;
+  try {
+    binary = atob(padded);
+  } catch {
+    throw new Error("Signed experience artifact contains invalid base64url.");
+  }
+  return Uint8Array.from(binary, (character) => character.charCodeAt(0));
+}
+function parseTimestamp(value, field) {
+  if (!/(?:Z|[+-]\d{2}:\d{2})$/.test(value)) throw new Error(`Release channel pointer ${field} must be RFC 3339 with an explicit offset.`);
+  const parsed = Date.parse(value);
+  if (Number.isNaN(parsed)) throw new Error(`Release channel pointer ${field} is invalid.`);
+  return parsed;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  RELEASE_CHANNEL_POINTER_FORMAT_VERSION,
+  SDUI_RELEASE_V3_FORMAT_VERSION,
+  activateReleaseChannelPointer,
+  assertReleaseChannelPointer,
+  assertSduiReleaseV3,
+  canonicalizeJcs,
+  verifySignedExperienceArtifact,
+  verifySignedExperienceRelease
+});
+//# sourceMappingURL=contracts.cjs.map