@fabricorg/sdui-release 0.5.0 → 0.7.0

package/CHANGELOG.md

@@ -1,5 +1,72 @@
 # Changelog
 
+## 0.7.0
+
+### Minor Changes
+
+- 8436c64: Close what a seventh review found in the previous follow-up, two of them regressions it introduced.
+
+  **An idempotency conflict is settled, but which way depends on why.** The previous release treated
+  every conflict as "never applied" and reported it refused. Only a `parameters` or `actor` conflict
+  means that. An `authority_binding` or `action_version` conflict means the _original_ invocation
+  exists and may well have applied — the capture-authority adapter mints a fresh binding on every
+  attempt, so a first attempt whose response was lost conflicts with itself on the second. Deleting that
+  capture and calling it refused was the worst available answer; it is now surfaced as `unknown` under
+  status `conflict_prior_invocation`.
+
+  **A policy block or validation failure is now `unknown`, not `refused`.** Within one attempt both are
+  decided before any effect. On a recovery re-execution the worker skips adapter steps that already
+  succeeded, then re-evaluates policy with a fresh clock and re-parses parameters against a possibly
+  newer action, and either can flip after effects committed. Unlike the authority path, the host
+  persists no execution reason for these, so the client cannot tell first delivery from recovery; it
+  errs toward a person checking. The precise fix is for the host to persist `executionReason` on failed
+  invocations, which is a store change and is recorded rather than attempted here.
+
+  **`failed` means "never delivered" again.** A store fault after a successful delivery was being counted
+  in it; it now lives only in `storeFailures`. The 0.3.0 changelog's disclosure misdescribed what 0.2.0
+  had changed — `parked` never shipped as a count; only `expired` did — and it is corrected in place.
+
+  Every validation pass now sees a duplicated contract once, so one root cause produces one finding
+  rather than one per copy. `deriveAuthorizationGrants` no longer emits a reference for an intent whose
+  action the contract does not declare, matching what promotion resolves. A superseded comment above
+  `PORT_ID` that asserted the claim the fix retracted is removed.
+
+## 0.6.0
+
+### Minor Changes
+
+- 4780974: Close what a sixth review found in the previously unreviewed fix batch, and disclose a breaking change
+  that batch shipped under a minor.
+
+  **Disclosure, first.** `experience-runtime@0.2.0` changed `OfflineReplaySummary.expired` from a
+  count to an array of records — breaking for a 0.1.0 consumer, for whom `if (summary.expired)` becomes
+  permanently true. (`parked` was introduced and reshaped inside the 0.2.0 window and never shipped as
+  a count, so no published consumer could have depended on it.) The 0.2.0 changelog did disclose the
+  change, but one of its four aggregated entries still described counts. This release adds
+  `storeFailures`, a **required** field on the returned summary: source-breaking for anything that
+  constructs an `OfflineReplaySummary` or implements the exported `OfflineCaptureQueue`, which a test
+  double may. Treat the shape as changed.
+
+  **Offline replay.** An authority refusal on a _recovery_ re-execution lands after adapter steps
+  already committed, since the lease worker re-runs authorization but skips succeeded steps rather
+  than undoing them; it is now reported as `unknown`, not `refused`, using the `executionReason` the
+  platform persists. A store that throws mid-replay now degrades one record instead of rejecting the
+  batch and losing every entry already removed. An idempotency conflict is settled — the key was reused
+  for a different command and retrying yields the same conflict forever — so it reaches a person rather
+  than looping. An action-version mismatch is transient, since it fires mid-rollout. An adapter
+  returning nothing keeps the capture queued rather than draining the queue into `unknown`.
+
+  **Release validation.** A grant that no supplied capability publishes now fails validation instead of
+  dying at promotion with "route missing"; ambiguity was scoped to granted references and had covered
+  only the two-or-more case. A contract supplied twice yields exactly one finding — the previous fix
+  still reported each of its granted views as declared twice, and the changelog claimed otherwise. An
+  intent whose action the contract does not declare no longer counts toward ambiguity, matching what
+  promotion resolves.
+
+  **Ports.** `PORT_ID` accepts any segment shape a manifest permits after the first dot, so every
+  namespaced name a capability can declare is a name a port can define. Dotless names remain
+  undefinable by design.
+
 ## 0.5.0
 
 ### Minor Changes

package/dist/index.cjs

@@ -454,7 +454,9 @@ function buildKnownActionIntents(contracts, add, grantedIntents) {
   const occurrences = /* @__PURE__ */ new Map();
   for (const contract of contracts) {
     const experience = contract.extensions?.["fabric.experience/v1"];
+    const declaredActions = new Set(contract.actions.map((action) => action.actionId));
     for (const intent of experience?.actionIntents ?? []) {
+      if (!declaredActions.has(intent.actionId)) continue;
       const shortName2 = intent.name.startsWith(`${contract.namespace}.`) ? intent.name.slice(contract.namespace.length + 1) : intent.name;
       const reference = `${contract.namespace}/${shortName2}`;
       if (grantedIntents === void 0 || grantedIntents.has(`capability://${reference}`)) {
@@ -713,6 +715,25 @@ function validateSduiRelease(input) {
       ...resolved.remote ? { remote: resolved.remote } : {}
     });
   }
+  const contractNamespaces = /* @__PURE__ */ new Set();
+  const distinctContracts = contracts.filter((contract) => {
+    if (contractNamespaces.has(contract.namespace)) {
+      add(
+        "ambiguous_capability_reference",
+        `contracts.${contract.namespace}`,
+        `contract for "${contract.namespace}" is supplied more than once`
+      );
+      return false;
+    }
+    contractNamespaces.add(contract.namespace);
+    return true;
+  });
+  const seenDocumentNamespaces = /* @__PURE__ */ new Set();
+  const distinctDocuments = input.contracts.filter((document) => {
+    if (seenDocumentNamespaces.has(document.capability.namespace)) return false;
+    seenDocumentNamespaces.add(document.capability.namespace);
+    return true;
+  });
   {
     for (const pack of resolvedPacks) {
       const approved = input.assembly.componentPacks.find(
@@ -764,7 +785,7 @@ function validateSduiRelease(input) {
         );
       }
     }
-    for (const document of input.contracts) {
+    for (const document of distinctDocuments) {
       const approved = input.assembly.capabilities.find(
         (capability) => capability.namespace === document.capability.namespace && capability.usageContractDigest === (0, import_assembly2.computeUsageContractDocumentDigest)(document)
       );
@@ -784,23 +805,32 @@ function validateSduiRelease(input) {
     }
   }
   const coreComponents = new Set(input.coreComponents ?? []);
-  const knownViews = buildKnownViews(contracts);
+  const knownViews = buildKnownViews(distinctContracts);
   const grantedViews = buildGrantedReferences(input.grants.views, "grants.views");
   const grantedIntents = buildGrantedReferences(input.grants.intents, "grants.intents");
-  const knownIntents = buildKnownActionIntents(contracts, add, grantedIntents);
-  reportAmbiguousGrantedViews(contracts, grantedViews, add);
-  const contractNamespaces = /* @__PURE__ */ new Set();
-  for (const contract of contracts) {
-    if (contractNamespaces.has(contract.namespace)) {
+  const knownIntents = buildKnownActionIntents(distinctContracts, add, grantedIntents);
+  reportAmbiguousGrantedViews(distinctContracts, grantedViews, add);
+  for (const reference of grantedViews) {
+    const parsed = parseCapabilityRef(reference);
+    if (parsed && !knownViews.has(`${parsed.namespace}/${parsed.name}`)) {
       add(
-        "ambiguous_capability_reference",
-        `contracts.${contract.namespace}`,
-        `contract for "${contract.namespace}" is supplied more than once`
+        "unauthorized_data_ref",
+        `grants.views.${reference}`,
+        `release grants "${reference}", which no supplied capability publishes; promotion would fail to route it`
+      );
+    }
+  }
+  for (const reference of grantedIntents) {
+    const parsed = parseCapabilityRef(reference);
+    if (parsed && !knownIntents.has(`${parsed.namespace}/${parsed.name}`)) {
+      add(
+        "mutation_bypass",
+        `grants.intents.${reference}`,
+        `release grants "${reference}", which no supplied capability declares as an intent backed by a declared action; promotion would fail to route it`
       );
     }
-    contractNamespaces.add(contract.namespace);
   }
-  validateIntentActionDeclarations(contracts, add);
+  validateIntentActionDeclarations(distinctContracts, add);
   const fragmentGrants = /* @__PURE__ */ new Map();
   for (const [fragmentId, declared] of Object.entries(input.grants.fragments ?? {})) {
     for (const view of declared.views ?? []) {
@@ -1102,7 +1132,9 @@ function deriveAuthorizationGrants(contracts, held, options = {}) {
       const reference = `capability://${contract.namespace}/${shortName(view.name, contract.namespace, "/")}`;
       if (!bound || bound.views.has(reference)) views.push(reference);
     }
+    const declaredActions = new Set(contract.actions.map((action) => action.actionId));
     for (const intent of actionIntentsOf(contract)) {
+      if (!declaredActions.has(intent.actionId)) continue;
       const reference = `capability://${contract.namespace}/${shortName(intent.name, contract.namespace, ".")}`;
       if (!bound || bound.intents.has(reference)) intents.push(reference);
     }