@fabricorg/sdui-release 0.3.0 → 0.5.0

package/dist/index.cjs

@@ -20,23 +20,35 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // index.ts
 var index_exports = {};
 __export(index_exports, {
+  RELEASE_CHANNEL_POINTER_FORMAT_VERSION: () => RELEASE_CHANNEL_POINTER_FORMAT_VERSION,
   SDUI_COMPONENT_PACK_FORMAT_VERSION: () => SDUI_COMPONENT_PACK_FORMAT_VERSION,
   SDUI_DOCUMENT_FORMAT_VERSION: () => SDUI_DOCUMENT_FORMAT_VERSION,
   SDUI_DOCUMENT_JSON_SCHEMA: () => SDUI_DOCUMENT_JSON_SCHEMA,
   SDUI_RELEASE_FORMAT_VERSION: () => SDUI_RELEASE_FORMAT_VERSION,
   SDUI_RELEASE_JSON_SCHEMA: () => SDUI_RELEASE_JSON_SCHEMA,
+  SDUI_RELEASE_V3_FORMAT_VERSION: () => SDUI_RELEASE_V3_FORMAT_VERSION,
   SDUI_TOKEN_SET_FORMAT_VERSION: () => SDUI_TOKEN_SET_FORMAT_VERSION,
+  activateReleaseChannelPointer: () => activateReleaseChannelPointer,
+  assertReleaseChannelPointer: () => assertReleaseChannelPointer,
   assertSduiAuthorizationGrants: () => assertSduiAuthorizationGrants,
   assertSduiComponentPack: () => assertSduiComponentPack,
   assertSduiDocument: () => assertSduiDocument,
   assertSduiFragment: () => assertSduiFragment,
   assertSduiRelease: () => assertSduiRelease,
   assertSduiReleaseIntegrity: () => assertSduiReleaseIntegrity,
+  assertSduiReleaseV3: () => assertSduiReleaseV3,
   assertSduiReleaseValid: () => assertSduiReleaseValid,
   assertSduiTokenSet: () => assertSduiTokenSet,
+  canonicalizeJcs: () => canonicalizeJcs,
   computeReleaseDigest: () => computeReleaseDigest,
   createSduiChannel: () => createSduiChannel,
-  validateSduiRelease: () => validateSduiRelease
+  deriveAuthorizationGrants: () => deriveAuthorizationGrants,
+  parseCapabilityRef: () => parseCapabilityRef,
+  runSduiChannelChecks: () => runSduiChannelChecks,
+  sduiChannelChecks: () => sduiChannelChecks,
+  validateSduiRelease: () => validateSduiRelease,
+  verifySignedExperienceArtifact: () => verifySignedExperienceArtifact,
+  verifySignedExperienceRelease: () => verifySignedExperienceRelease
 });
 module.exports = __toCommonJS(index_exports);
 
@@ -66,8 +78,9 @@ function requireArray(value, path) {
   if (!Array.isArray(value)) fail(path, "must be an array");
   return value;
 }
+var CAPABILITY_REF = /^capability:\/\/([a-z][a-z0-9-]*)\/([a-z][a-z0-9._-]*(?:\/[a-z0-9._-]+)*)$/;
 function parseCapabilityRef(ref) {
-  const match = /^capability:\/\/([a-z][a-z0-9-]*)\/(.+)$/.exec(ref);
+  const match = CAPABILITY_REF.exec(ref);
   if (!match) return void 0;
   return { namespace: match[1], name: match[2] };
 }
@@ -202,8 +215,20 @@ function assertSduiDocument(value, path = "document") {
     });
   }
   const tokenSet = requireRecord(document.tokenSet, `${path}.tokenSet`);
-  requireString(tokenSet.name, `${path}.tokenSet.name`);
-  requireString(tokenSet.version, `${path}.tokenSet.version`);
+  assertTokenSetReference(tokenSet, `${path}.tokenSet`);
+  if (document.supportedTokenSets !== void 0) {
+    const seenTokenSets = /* @__PURE__ */ new Set();
+    requireArray(document.supportedTokenSets, `${path}.supportedTokenSets`).forEach((entry, index) => {
+      const supportedPath = `${path}.supportedTokenSets[${index}]`;
+      const supported = requireRecord(entry, supportedPath);
+      assertTokenSetReference(supported, supportedPath);
+      const identity = `${String(supported.name)}\0${String(supported.version)}`;
+      if (seenTokenSets.has(identity)) {
+        fail(supportedPath, `declares token set "${String(supported.name)}@${String(supported.version)}" a second time`);
+      }
+      seenTokenSets.add(identity);
+    });
+  }
   requireArray(document.componentPacks, `${path}.componentPacks`).forEach((entry, index) => {
     const pack = requireRecord(entry, `${path}.componentPacks[${index}]`);
     requireString(pack.pack, `${path}.componentPacks[${index}].pack`);
@@ -283,6 +308,14 @@ function assertSduiRelease(value, path = "release") {
     }
   });
 }
+function assertTokenSetReference(reference, path) {
+  if (!/^[a-z][a-z0-9-]*$/.test(requireString(reference.name, `${path}.name`))) {
+    fail(`${path}.name`, "must be lowercase letters, numbers and hyphens");
+  }
+  if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(requireString(reference.version, `${path}.version`))) {
+    fail(`${path}.version`, "must be a semver version");
+  }
+}
 
 // validate.ts
 var import_assembly2 = require("@fabricorg/assembly");
@@ -315,7 +348,7 @@ function canonicalFragmentGrants(fragments) {
   );
 }
 function releaseDigest(document, tokenSet, componentPacks, grants, assemblyDigest) {
-  const canonical = stableStringify({
+  const canonical2 = stableStringify({
     document: {
       formatVersion: document.formatVersion,
       name: document.name,
@@ -330,6 +363,16 @@ function releaseDigest(document, tokenSet, componentPacks, grants, assemblyDiges
         variants: [...document.variants].sort((left, right) => left.id < right.id ? -1 : left.id > right.id ? 1 : 0)
       } : {},
       tokenSet: document.tokenSet,
+      // Which brands a document may be promoted against is part of what was
+      // authored. Sorted, and omitted when absent so a document declaring
+      // none digests exactly as it did before the field existed.
+      ...document.supportedTokenSets?.length ? {
+        supportedTokenSets: [...document.supportedTokenSets].sort((left, right) => {
+          if (left.name !== right.name) return left.name < right.name ? -1 : 1;
+          if (left.version !== right.version) return left.version < right.version ? -1 : 1;
+          return 0;
+        })
+      } : {},
       componentPacks: [...document.componentPacks].sort((a, b) => {
         const key = (e) => `${e.namespace}/${e.pack}`;
         return key(a) < key(b) ? -1 : key(a) > key(b) ? 1 : 0;
@@ -355,7 +398,7 @@ function releaseDigest(document, tokenSet, componentPacks, grants, assemblyDiges
     },
     assemblyDigest
   });
-  return (0, import_node_crypto.createHash)("sha256").update(canonical).digest("hex");
+  return (0, import_node_crypto.createHash)("sha256").update(canonical2).digest("hex");
 }
 function computeReleaseDigest(document, tokenSet, componentPacks, grants, assemblyDigest) {
   return releaseDigest(document, tokenSet, componentPacks, grants, assemblyDigest);
@@ -379,19 +422,54 @@ function buildKnownViews(contracts) {
   const views = /* @__PURE__ */ new Set();
   for (const contract of contracts) {
     for (const view of contract.views) {
-      const name = view.name.startsWith(`${contract.namespace}/`) ? view.name.slice(contract.namespace.length + 1) : view.name;
-      views.add(`${contract.namespace}/${name}`);
+      views.add(`${contract.namespace}/${shortViewName(view.name, contract.namespace)}`);
     }
   }
   return views;
 }
-function buildKnownActionIntents(contracts) {
+function shortViewName(name, namespace) {
+  return name.startsWith(`${namespace}/`) ? name.slice(namespace.length + 1) : name;
+}
+function reportAmbiguousGrantedViews(contracts, grantedViews, add) {
+  const occurrences = /* @__PURE__ */ new Map();
+  for (const contract of contracts) {
+    for (const view of contract.views) {
+      const reference = `capability://${contract.namespace}/${shortViewName(view.name, contract.namespace)}`;
+      if (!grantedViews.has(reference)) continue;
+      occurrences.set(reference, [...occurrences.get(reference) ?? [], `${view.name}@${view.version}`]);
+    }
+  }
+  for (const [reference, declarations] of occurrences) {
+    if (declarations.length > 1) {
+      add(
+        "ambiguous_capability_reference",
+        `grants.views.${reference}`,
+        `"${reference}" is granted but addresses ${declarations.length} views (${declarations.join(", ")}); a versionless reference cannot pick one`
+      );
+    }
+  }
+}
+function buildKnownActionIntents(contracts, add, grantedIntents) {
   const intents = /* @__PURE__ */ new Set();
+  const occurrences = /* @__PURE__ */ new Map();
   for (const contract of contracts) {
     const experience = contract.extensions?.["fabric.experience/v1"];
     for (const intent of experience?.actionIntents ?? []) {
-      const shortName = intent.name.startsWith(`${contract.namespace}.`) ? intent.name.slice(contract.namespace.length + 1) : intent.name;
-      intents.add(`${contract.namespace}/${shortName}`);
+      const shortName2 = intent.name.startsWith(`${contract.namespace}.`) ? intent.name.slice(contract.namespace.length + 1) : intent.name;
+      const reference = `${contract.namespace}/${shortName2}`;
+      if (grantedIntents === void 0 || grantedIntents.has(`capability://${reference}`)) {
+        occurrences.set(reference, [...occurrences.get(reference) ?? [], intent.name]);
+      }
+      intents.add(reference);
+    }
+  }
+  for (const [reference, declarations] of occurrences) {
+    if (declarations.length > 1) {
+      add?.(
+        "ambiguous_capability_reference",
+        `contracts.actionIntents.${reference}`,
+        `"capability://${reference}" is declared ${declarations.length} times (${declarations.join(", ")}), so a route for it cannot be resolved`
+      );
     }
   }
   return intents;
@@ -585,18 +663,13 @@ function validateSduiRelease(input) {
   const add = (code, path, message) => {
     findings.push({ code, path, message });
   };
-  if (input.document.tokenSet.name !== input.tokenSet.name) {
-    add(
-      "missing_token_set",
-      "document.tokenSet.name",
-      `document references token set "${input.document.tokenSet.name}" but the provided set is "${input.tokenSet.name}"`
-    );
-  }
-  if (input.document.tokenSet.version !== input.tokenSet.version) {
+  const promotableTokenSets = [input.document.tokenSet, ...input.document.supportedTokenSets ?? []];
+  const promotedAgainst = promotableTokenSets.some((candidate) => candidate.name === input.tokenSet.name && candidate.version === input.tokenSet.version);
+  if (!promotedAgainst) {
     add(
       "missing_token_set",
-      "document.tokenSet.version",
-      `document references token set version "${input.document.tokenSet.version}" but the provided set is version "${input.tokenSet.version}"`
+      "document.tokenSet",
+      `document supports token sets [${promotableTokenSets.map((set) => `${set.name}@${set.version}`).join(", ")}] but the provided set is "${input.tokenSet.name}@${input.tokenSet.version}"`
     );
   }
   const packsByKey = /* @__PURE__ */ new Map();
@@ -712,9 +785,21 @@ function validateSduiRelease(input) {
   }
   const coreComponents = new Set(input.coreComponents ?? []);
   const knownViews = buildKnownViews(contracts);
-  const knownIntents = buildKnownActionIntents(contracts);
   const grantedViews = buildGrantedReferences(input.grants.views, "grants.views");
   const grantedIntents = buildGrantedReferences(input.grants.intents, "grants.intents");
+  const knownIntents = buildKnownActionIntents(contracts, add, grantedIntents);
+  reportAmbiguousGrantedViews(contracts, grantedViews, add);
+  const contractNamespaces = /* @__PURE__ */ new Set();
+  for (const contract of contracts) {
+    if (contractNamespaces.has(contract.namespace)) {
+      add(
+        "ambiguous_capability_reference",
+        `contracts.${contract.namespace}`,
+        `contract for "${contract.namespace}" is supplied more than once`
+      );
+    }
+    contractNamespaces.add(contract.namespace);
+  }
   validateIntentActionDeclarations(contracts, add);
   const fragmentGrants = /* @__PURE__ */ new Map();
   for (const [fragmentId, declared] of Object.entries(input.grants.fragments ?? {})) {
@@ -839,6 +924,221 @@ function collectCoreComponents(fragment) {
   }
   return used;
 }
+async function refusalReason(run, expect) {
+  try {
+    await run();
+    return null;
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return expect.test(message) ? message : null;
+  }
+}
+function sduiChannelChecks() {
+  return [
+    {
+      id: "fabric.sdui-channel.verified-release.v1",
+      async run(subject) {
+        assertSduiReleaseIntegrity(subject.validRelease);
+        const result = subject.channel.consume(subject.validRelease);
+        if (result.release.releaseDigest !== subject.validRelease.releaseDigest) {
+          throw new Error("channel returned a release other than the one it was given");
+        }
+        return [subject.validRelease.releaseDigest];
+      }
+    },
+    {
+      id: "fabric.sdui-channel.tampered-release-denial.v1",
+      async run(subject) {
+        const tampered = {
+          ...subject.validRelease,
+          document: { ...subject.validRelease.document, name: `${subject.validRelease.document.name}-tampered` }
+        };
+        const reason = await refusalReason(() => subject.channel.consume(tampered), /digest|integrity/i);
+        if (reason === null) {
+          throw new Error("channel did not refuse a release whose content no longer matches its digest, citing the digest");
+        }
+        for (const [label, mutate] of [
+          ["version", (release) => ({ ...release, document: { ...release.document, version: "9.9.9" } })],
+          ["grants", (release) => ({ ...release, grants: { ...release.grants, views: [...release.grants.views, "capability://smuggled/view"] } })],
+          ["assembly", (release) => ({ ...release, assemblyDigest: "f".repeat(64) })]
+        ]) {
+          const edited = mutate(subject.validRelease);
+          if (await refusalReason(() => subject.channel.consume(edited), /digest|integrity/i) === null) {
+            throw new Error(`channel accepted a release whose ${label} was edited after promotion`);
+          }
+        }
+        return ["tampered document refused", "edited version, grants and assembly refused"];
+      }
+    },
+    {
+      id: "fabric.sdui-channel.unpromoted-document-denial.v1",
+      async run(subject) {
+        const expected = /digest|integrity|release|formatVersion|must be/i;
+        const unpromoted = { document: subject.validRelease.document };
+        if (await refusalReason(() => subject.channel.consume(unpromoted), expected) === null) {
+          throw new Error("channel did not refuse a bare document that was never promoted, citing what was wrong with it");
+        }
+        const digestless = { ...subject.validRelease, releaseDigest: void 0 };
+        if (await refusalReason(() => subject.channel.consume(digestless), expected) === null) {
+          throw new Error("channel did not refuse a release carrying no digest, citing what was wrong with it");
+        }
+        return ["bare document refused", "digestless release refused"];
+      }
+    },
+    {
+      id: "fabric.sdui-channel.reports-missing-vocabulary.v1",
+      async run(subject) {
+        const used = collectCoreComponents(subject.validRelease.document.root);
+        for (const variant of subject.validRelease.document.variants ?? []) {
+          for (const component of collectCoreComponents(variant.root)) used.add(component);
+        }
+        if (!used.has(subject.unimplementedCoreComponent)) {
+          throw new Error(
+            `conformance subject is vacuous: validRelease never uses "${subject.unimplementedCoreComponent}", so the channel is never asked to report it`
+          );
+        }
+        if (subject.channel.coreComponents.includes(subject.unimplementedCoreComponent)) {
+          throw new Error(
+            `conformance subject is contradictory: the channel implements "${subject.unimplementedCoreComponent}"`
+          );
+        }
+        const result = subject.channel.consume(subject.validRelease);
+        if (result.compatible) {
+          throw new Error("channel reported compatible for a release using a component it does not implement");
+        }
+        if (!result.missingCoreComponents.includes(subject.unimplementedCoreComponent)) {
+          throw new Error("channel reported incompatible without naming the component it cannot render");
+        }
+        return [`missing: ${result.missingCoreComponents.join(", ")}`];
+      }
+    },
+    {
+      id: "fabric.sdui-channel.consumption-is-pure.v1",
+      async run(subject) {
+        const before = JSON.stringify(subject.validRelease);
+        subject.channel.consume(subject.validRelease);
+        subject.channel.consume(subject.validRelease);
+        if (JSON.stringify(subject.validRelease) !== before) {
+          throw new Error("channel mutated the release it consumed");
+        }
+        return ["release unchanged after two consumptions"];
+      }
+    }
+  ];
+}
+async function runSduiChannelChecks(subject) {
+  const checks = [];
+  for (const check of sduiChannelChecks()) {
+    try {
+      checks.push({ id: check.id, status: "passed", evidence: await check.run(subject) });
+    } catch (error) {
+      checks.push({
+        id: check.id,
+        status: "failed",
+        evidence: [],
+        error: error instanceof Error ? error.message : String(error)
+      });
+    }
+  }
+  return { passed: checks.every((check) => check.status === "passed"), checks };
+}
+
+// references.ts
+function collectDocumentReferences(document) {
+  const views = /* @__PURE__ */ new Set();
+  const intents = /* @__PURE__ */ new Set();
+  const trees = [document.root, ...(document.variants ?? []).map((variant) => variant.root)];
+  for (const tree of trees) walk(tree, views, intents);
+  return { views, intents };
+}
+function walk(fragment, views, intents) {
+  if (fragment.dataRef) views.add(fragment.dataRef);
+  for (const action of Object.values(fragment.actions ?? {})) {
+    intents.add(action.intent);
+    if (action.params) collectValues(action.params, views);
+  }
+  if (fragment.props) collectValues(fragment.props, views);
+  for (const child of fragment.children ?? []) walk(child, views, intents);
+}
+function collectValues(props, views) {
+  for (const value of Object.values(props)) collectValue(value, views);
+}
+function collectValue(value, views) {
+  if (value !== null && typeof value === "object" && !Array.isArray(value) && "$ref" in value) {
+    views.add(value.$ref);
+    for (const [key, sibling] of Object.entries(value)) {
+      if (key !== "$ref") collectValue(sibling, views);
+    }
+    return;
+  }
+  if (Array.isArray(value)) {
+    for (const item of value) collectValue(item, views);
+    return;
+  }
+  if (value !== null && typeof value === "object") collectValues(value, views);
+}
+
+// entitlements.ts
+function deriveAuthorizationGrants(contracts, held, options = {}) {
+  const undeclared = options.undeclaredRequirements ?? "withhold";
+  const bound = options.document ? collectDocumentReferences(options.document) : void 0;
+  const permissions = new Set(held.permissions ?? []);
+  const entitlements = new Set(held.entitlements ?? []);
+  const featureFlags = new Set(held.featureFlags ?? []);
+  const views = [];
+  const intents = [];
+  const withheld = [];
+  for (const contract of contracts) {
+    if (undeclared === "withhold" && !declaresAnyRequirement(contract)) {
+      withheld.push({ namespace: contract.namespace, missing: { kind: "permission", name: "(none declared)" } });
+      continue;
+    }
+    const missing = firstMissingRequirement(contract, { permissions, entitlements, featureFlags });
+    if (missing) {
+      withheld.push({ namespace: contract.namespace, missing });
+      continue;
+    }
+    for (const view of contract.views) {
+      const reference = `capability://${contract.namespace}/${shortName(view.name, contract.namespace, "/")}`;
+      if (!bound || bound.views.has(reference)) views.push(reference);
+    }
+    for (const intent of actionIntentsOf(contract)) {
+      const reference = `capability://${contract.namespace}/${shortName(intent.name, contract.namespace, ".")}`;
+      if (!bound || bound.intents.has(reference)) intents.push(reference);
+    }
+  }
+  return {
+    grants: { views: [...new Set(views)].sort(), intents: [...new Set(intents)].sort() },
+    withheld: withheld.sort((left, right) => left.namespace < right.namespace ? -1 : left.namespace > right.namespace ? 1 : 0)
+  };
+}
+function declaresAnyRequirement(contract) {
+  const requirements = contract.requirements;
+  return Boolean(
+    requirements && ((requirements.permissions?.length ?? 0) > 0 || (requirements.entitlements?.length ?? 0) > 0 || (requirements.featureFlags?.length ?? 0) > 0)
+  );
+}
+function firstMissingRequirement(contract, held) {
+  const requirements = contract.requirements;
+  for (const name of requirements?.permissions ?? []) {
+    if (!held.permissions.has(name)) return { kind: "permission", name };
+  }
+  for (const name of requirements?.entitlements ?? []) {
+    if (!held.entitlements.has(name)) return { kind: "entitlement", name };
+  }
+  for (const name of requirements?.featureFlags ?? []) {
+    if (!held.featureFlags.has(name)) return { kind: "featureFlag", name };
+  }
+  return void 0;
+}
+function actionIntentsOf(contract) {
+  const experience = contract.extensions?.["fabric.experience/v1"];
+  return experience?.actionIntents ?? [];
+}
+function shortName(name, namespace, separator) {
+  const prefix = `${namespace}${separator}`;
+  return name.startsWith(prefix) ? name.slice(prefix.length) : name;
+}
 
 // schemas.ts
 var SDUI_DOCUMENT_JSON_SCHEMA = {
@@ -870,24 +1170,280 @@ var SDUI_RELEASE_JSON_SCHEMA = {
     grants: { type: "object", required: ["views", "intents"] }
   }
 };
+
+// contracts.ts
+var SDUI_RELEASE_V3_FORMAT_VERSION = 3;
+var RELEASE_CHANNEL_POINTER_FORMAT_VERSION = 1;
+var encoder = new TextEncoder();
+var decoder = new TextDecoder("utf-8", { fatal: true });
+var HEX_DIGEST = /^[a-f0-9]{64}$/;
+function canonicalizeJcs(value) {
+  return canonical(value, 0);
+}
+function canonical(value, depth) {
+  if (depth > 64) throw new Error("Canonical JSON exceeds the maximum depth of 64.");
+  if (value === null) return "null";
+  if (typeof value === "boolean") return value ? "true" : "false";
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) throw new Error("Canonical JSON numbers must be finite.");
+    return Object.is(value, -0) ? "0" : JSON.stringify(value);
+  }
+  if (typeof value === "string") {
+    assertValidUnicode(value);
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value)) return `[${value.map((entry) => canonical(entry, depth + 1)).join(",")}]`;
+  if (typeof value !== "object") throw new Error(`Canonical JSON cannot encode ${typeof value}.`);
+  const record = value;
+  const keys = Object.keys(record).sort();
+  return `{${keys.map((key) => {
+    assertValidUnicode(key);
+    return `${JSON.stringify(key)}:${canonical(record[key], depth + 1)}`;
+  }).join(",")}}`;
+}
+function assertValidUnicode(value) {
+  for (let index = 0; index < value.length; index += 1) {
+    const code = value.charCodeAt(index);
+    if (code >= 55296 && code <= 56319) {
+      const next = value.charCodeAt(index + 1);
+      if (!(next >= 56320 && next <= 57343)) throw new Error("Canonical JSON contains an unpaired Unicode surrogate.");
+      index += 1;
+    } else if (code >= 56320 && code <= 57343) {
+      throw new Error("Canonical JSON contains an unpaired Unicode surrogate.");
+    }
+  }
+}
+async function verifySignedExperienceArtifact(input) {
+  const maxBytes = input.maxBytes ?? 1048576;
+  if (encoder.encode(input.compactJws).byteLength > maxBytes) {
+    throw new Error(`Signed experience artifact exceeds the ${maxBytes}-byte size limit.`);
+  }
+  const parts = input.compactJws.split(".");
+  if (parts.length !== 3 || parts.some((part) => part.length === 0)) throw new Error("Signed experience artifact must be a compact JWS.");
+  const header = parseSegment(parts[0], "protected header");
+  if (header.alg !== "ES256") throw new Error("Signed experience artifacts must use ES256.");
+  if (header.typ !== input.expectedType) throw new Error(`Signed experience artifact type must be ${input.expectedType}.`);
+  if (typeof header.kid !== "string" || !header.kid) throw new Error("Signed experience artifact requires a key id.");
+  const payloadBytes = decodeBase64Url(parts[1]);
+  const payload = parseJsonBytes(payloadBytes, "payload");
+  if (typeof payload.issuer !== "string" || !payload.issuer) throw new Error("Signed experience artifact requires an issuer.");
+  const key = await input.trust.resolveKey({ keyId: header.kid, issuer: payload.issuer, algorithm: "ES256" });
+  if (!key || key.algorithm !== "ES256") throw new Error("Signed experience artifact has no trusted key.");
+  const signature = decodeBase64Url(parts[2]);
+  if (signature.byteLength !== 64) throw new Error("ES256 signatures must be 64-byte JOSE signatures.");
+  const verified = await input.crypto.verify({
+    algorithm: "ES256",
+    key: key.key,
+    signingInput: encoder.encode(`${parts[0]}.${parts[1]}`),
+    signature
+  });
+  if (!verified) throw new Error("Signed experience artifact signature is invalid.");
+  return payload;
+}
+async function verifySignedExperienceRelease(input) {
+  const payload = await verifySignedExperienceArtifact({
+    compactJws: input.compactJws,
+    expectedType: "fabric-experience-release+jws",
+    crypto: input.crypto,
+    trust: input.trust,
+    ...input.maxBytes === void 0 ? {} : { maxBytes: input.maxBytes }
+  });
+  assertSduiReleaseV3(payload);
+  if (payload.issuer !== input.expected.issuer || payload.application !== input.expected.application || payload.assemblyDigest !== input.expected.assemblyDigest) {
+    throw new Error("Signed experience release does not match the expected issuer, application, and assembly.");
+  }
+  const { releaseDigest: releaseDigest2, ...body } = payload;
+  const digest = await input.crypto.digestSha256(encoder.encode(canonicalizeJcs(body)));
+  const expectedDigest = [...digest].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+  if (releaseDigest2 !== expectedDigest) throw new Error("Signed experience release digest does not match its canonical content.");
+  return payload;
+}
+function assertSduiReleaseV3(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("SDUI Release v3 must be an object.");
+  const release = value;
+  if (release.formatVersion !== SDUI_RELEASE_V3_FORMAT_VERSION || release.kind !== "experience-release") {
+    throw new Error("SDUI Release v3 has an unsupported format.");
+  }
+  for (const field of ["issuer", "application", "releaseDigest", "assemblyDigest"]) {
+    if (typeof release[field] !== "string" || !release[field]) throw new Error(`SDUI Release v3 ${field} is required.`);
+  }
+  if (!HEX_DIGEST.test(release.releaseDigest) || !HEX_DIGEST.test(release.assemblyDigest)) {
+    throw new Error("SDUI Release v3 digests must be lowercase SHA-256 values.");
+  }
+  if (!release.document || typeof release.document !== "object" || !release.tokenSet || typeof release.tokenSet !== "object" || !Array.isArray(release.componentPacks) || !release.routes || typeof release.routes !== "object" || !Array.isArray(release.routes.views) || !Array.isArray(release.routes.intents) || !Array.isArray(release.effectiveGrants)) {
+    throw new Error("SDUI Release v3 is structurally incomplete.");
+  }
+  const routes = release.routes;
+  assertUniqueRecords(routes.views, "view route", (route) => {
+    const record = assertRecord(route, "view route");
+    assertCapabilityReference(record.reference, "view route");
+    assertNonEmptyString(record.name, "view route name");
+    assertNonEmptyString(record.version, "view route version");
+    if (record.parameterSchemaDigest !== void 0) {
+      assertHexDigest(record.parameterSchemaDigest, "view route parameterSchemaDigest");
+    }
+    return record.reference;
+  });
+  assertUniqueRecords(routes.intents, "intent route", (route) => {
+    const record = assertRecord(route, "intent route");
+    assertCapabilityReference(record.reference, "intent route");
+    assertNonEmptyString(record.actionId, "intent route actionId");
+    if (!Number.isSafeInteger(record.version) || record.version < 1) {
+      throw new Error("SDUI Release v3 intent route version must be a positive integer.");
+    }
+    if (record.parameterSchemaDigest !== void 0) {
+      assertHexDigest(record.parameterSchemaDigest, "intent route parameterSchemaDigest");
+    }
+    return record.reference;
+  });
+  assertUniqueRecords(release.effectiveGrants, "effective grant", (grant) => {
+    const record = assertRecord(grant, "effective grant");
+    assertNonEmptyString(record.treeId, "effective grant treeId");
+    assertNonEmptyString(record.fragmentId, "effective grant fragmentId");
+    if (!Array.isArray(record.views) || !record.views.every((item) => typeof item === "string") || !Array.isArray(record.intents) || !record.intents.every((item) => typeof item === "string")) {
+      throw new Error("SDUI Release v3 effective grant routes must be string arrays.");
+    }
+    return `${record.treeId}\0${record.fragmentId}`;
+  });
+}
+function assertRecord(value, label) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`SDUI Release v3 ${label} must be an object.`);
+  return value;
+}
+function assertNonEmptyString(value, label) {
+  if (typeof value !== "string" || !value) throw new Error(`SDUI Release v3 ${label} is required.`);
+}
+function assertHexDigest(value, label) {
+  if (typeof value !== "string" || !HEX_DIGEST.test(value)) throw new Error(`SDUI Release v3 ${label} must be a lowercase SHA-256 value.`);
+}
+function assertCapabilityReference(value, label) {
+  if (typeof value !== "string" || !value.startsWith("capability://")) throw new Error(`SDUI Release v3 ${label} reference is invalid.`);
+}
+function assertUniqueRecords(values, label, identity) {
+  const seen = /* @__PURE__ */ new Set();
+  for (const value of values) {
+    const key = identity(value);
+    if (seen.has(key)) throw new Error(`SDUI Release v3 has a duplicate ${label}.`);
+    seen.add(key);
+  }
+}
+async function activateReleaseChannelPointer(input) {
+  const payload = await verifySignedExperienceArtifact({
+    compactJws: input.compactJws,
+    expectedType: "fabric-release-channel-pointer+jws",
+    crypto: input.crypto,
+    trust: input.trust
+  });
+  assertReleaseChannelPointer(payload);
+  if (payload.issuer !== input.expected.issuer || payload.application !== input.expected.application || payload.channel !== input.expected.channel) {
+    throw new Error("Release channel pointer does not match the expected issuer, application, and channel.");
+  }
+  const now = (input.now ?? /* @__PURE__ */ new Date()).getTime();
+  if (payload.notBefore !== void 0 && now < parseTimestamp(payload.notBefore, "notBefore")) {
+    throw new Error("Release channel pointer is not active yet.");
+  }
+  if (payload.expiresAt !== void 0 && now >= parseTimestamp(payload.expiresAt, "expiresAt")) {
+    throw new Error("Release channel pointer has expired.");
+  }
+  const generationKey = `${payload.issuer}:${payload.application}:${payload.channel}`;
+  const pointerDigestBytes = await input.crypto.digestSha256(encoder.encode(canonicalizeJcs(payload)));
+  const pointerDigest = [...pointerDigestBytes].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+  const current = await input.generations.get(generationKey);
+  if (current !== void 0 && payload.generation < current.generation) {
+    throw new Error("Release channel pointer is older than the accepted generation.");
+  }
+  if (current?.generation === payload.generation && current.pointerDigest !== pointerDigest) {
+    throw new Error("Release channel generation is already bound to a different signed pointer.");
+  }
+  if (current?.generation !== payload.generation) {
+    const accepted = await input.generations.acceptIfHigher(generationKey, payload.generation, pointerDigest);
+    if (!accepted) {
+      const raced = await input.generations.get(generationKey);
+      if (raced?.generation !== payload.generation || raced.pointerDigest !== pointerDigest) {
+        throw new Error("Release channel pointer lost an activation race to a different generation.");
+      }
+    }
+  }
+  return payload;
+}
+function assertReleaseChannelPointer(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("Release channel pointer must be an object.");
+  const pointer = value;
+  if (pointer.formatVersion !== RELEASE_CHANNEL_POINTER_FORMAT_VERSION || pointer.kind !== "release-channel-pointer") {
+    throw new Error("Release channel pointer has an unsupported format.");
+  }
+  for (const field of ["issuer", "application", "channel", "issuedAt"]) {
+    if (typeof pointer[field] !== "string" || !pointer[field]) throw new Error(`Release channel pointer ${field} is required.`);
+  }
+  if (!Number.isSafeInteger(pointer.generation) || pointer.generation < 0) throw new Error("Release channel pointer generation must be a non-negative safe integer.");
+  if (!HEX_DIGEST.test(String(pointer.activeReleaseDigest)) || !HEX_DIGEST.test(String(pointer.assemblyDigest))) {
+    throw new Error("Release channel pointer digests must be lowercase SHA-256 values.");
+  }
+  if (pointer.fallbackReleaseDigests !== void 0 && (!Array.isArray(pointer.fallbackReleaseDigests) || !pointer.fallbackReleaseDigests.every((digest) => typeof digest === "string" && HEX_DIGEST.test(digest)) || new Set(pointer.fallbackReleaseDigests).size !== pointer.fallbackReleaseDigests.length)) {
+    throw new Error("Release channel pointer fallbackReleaseDigests must contain unique lowercase SHA-256 values.");
+  }
+  parseTimestamp(pointer.issuedAt, "issuedAt");
+}
+function parseSegment(segment, label) {
+  return parseJsonBytes(decodeBase64Url(segment), label);
+}
+function parseJsonBytes(bytes, label) {
+  let value;
+  try {
+    value = JSON.parse(decoder.decode(bytes));
+  } catch {
+    throw new Error(`Signed experience artifact ${label} is not valid UTF-8 JSON.`);
+  }
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`Signed experience artifact ${label} must be an object.`);
+  return value;
+}
+function decodeBase64Url(value) {
+  if (!/^[A-Za-z0-9_-]+$/.test(value)) throw new Error("Signed experience artifact contains invalid base64url.");
+  const padded = value.replace(/-/g, "+").replace(/_/g, "/").padEnd(Math.ceil(value.length / 4) * 4, "=");
+  let binary;
+  try {
+    binary = atob(padded);
+  } catch {
+    throw new Error("Signed experience artifact contains invalid base64url.");
+  }
+  return Uint8Array.from(binary, (character) => character.charCodeAt(0));
+}
+function parseTimestamp(value, field) {
+  if (!/(?:Z|[+-]\d{2}:\d{2})$/.test(value)) throw new Error(`Release channel pointer ${field} must be RFC 3339 with an explicit offset.`);
+  const parsed = Date.parse(value);
+  if (Number.isNaN(parsed)) throw new Error(`Release channel pointer ${field} is invalid.`);
+  return parsed;
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  RELEASE_CHANNEL_POINTER_FORMAT_VERSION,
   SDUI_COMPONENT_PACK_FORMAT_VERSION,
   SDUI_DOCUMENT_FORMAT_VERSION,
   SDUI_DOCUMENT_JSON_SCHEMA,
   SDUI_RELEASE_FORMAT_VERSION,
   SDUI_RELEASE_JSON_SCHEMA,
+  SDUI_RELEASE_V3_FORMAT_VERSION,
   SDUI_TOKEN_SET_FORMAT_VERSION,
+  activateReleaseChannelPointer,
+  assertReleaseChannelPointer,
   assertSduiAuthorizationGrants,
   assertSduiComponentPack,
   assertSduiDocument,
   assertSduiFragment,
   assertSduiRelease,
   assertSduiReleaseIntegrity,
+  assertSduiReleaseV3,
   assertSduiReleaseValid,
   assertSduiTokenSet,
+  canonicalizeJcs,
   computeReleaseDigest,
   createSduiChannel,
-  validateSduiRelease
+  deriveAuthorizationGrants,
+  parseCapabilityRef,
+  runSduiChannelChecks,
+  sduiChannelChecks,
+  validateSduiRelease,
+  verifySignedExperienceArtifact,
+  verifySignedExperienceRelease
 });
 //# sourceMappingURL=index.cjs.map