@fabricorg/sdui-release 0.5.0 → 0.7.0

package/dist/index.js

@@ -416,7 +416,9 @@ function buildKnownActionIntents(contracts, add, grantedIntents) {
   const occurrences = /* @__PURE__ */ new Map();
   for (const contract of contracts) {
     const experience = contract.extensions?.["fabric.experience/v1"];
+    const declaredActions = new Set(contract.actions.map((action) => action.actionId));
     for (const intent of experience?.actionIntents ?? []) {
+      if (!declaredActions.has(intent.actionId)) continue;
       const shortName2 = intent.name.startsWith(`${contract.namespace}.`) ? intent.name.slice(contract.namespace.length + 1) : intent.name;
       const reference = `${contract.namespace}/${shortName2}`;
       if (grantedIntents === void 0 || grantedIntents.has(`capability://${reference}`)) {
@@ -675,6 +677,25 @@ function validateSduiRelease(input) {
       ...resolved.remote ? { remote: resolved.remote } : {}
     });
   }
+  const contractNamespaces = /* @__PURE__ */ new Set();
+  const distinctContracts = contracts.filter((contract) => {
+    if (contractNamespaces.has(contract.namespace)) {
+      add(
+        "ambiguous_capability_reference",
+        `contracts.${contract.namespace}`,
+        `contract for "${contract.namespace}" is supplied more than once`
+      );
+      return false;
+    }
+    contractNamespaces.add(contract.namespace);
+    return true;
+  });
+  const seenDocumentNamespaces = /* @__PURE__ */ new Set();
+  const distinctDocuments = input.contracts.filter((document) => {
+    if (seenDocumentNamespaces.has(document.capability.namespace)) return false;
+    seenDocumentNamespaces.add(document.capability.namespace);
+    return true;
+  });
   {
     for (const pack of resolvedPacks) {
       const approved = input.assembly.componentPacks.find(
@@ -726,7 +747,7 @@ function validateSduiRelease(input) {
         );
       }
     }
-    for (const document of input.contracts) {
+    for (const document of distinctDocuments) {
       const approved = input.assembly.capabilities.find(
         (capability) => capability.namespace === document.capability.namespace && capability.usageContractDigest === computeUsageContractDocumentDigest(document)
       );
@@ -746,23 +767,32 @@ function validateSduiRelease(input) {
     }
   }
   const coreComponents = new Set(input.coreComponents ?? []);
-  const knownViews = buildKnownViews(contracts);
+  const knownViews = buildKnownViews(distinctContracts);
   const grantedViews = buildGrantedReferences(input.grants.views, "grants.views");
   const grantedIntents = buildGrantedReferences(input.grants.intents, "grants.intents");
-  const knownIntents = buildKnownActionIntents(contracts, add, grantedIntents);
-  reportAmbiguousGrantedViews(contracts, grantedViews, add);
-  const contractNamespaces = /* @__PURE__ */ new Set();
-  for (const contract of contracts) {
-    if (contractNamespaces.has(contract.namespace)) {
+  const knownIntents = buildKnownActionIntents(distinctContracts, add, grantedIntents);
+  reportAmbiguousGrantedViews(distinctContracts, grantedViews, add);
+  for (const reference of grantedViews) {
+    const parsed = parseCapabilityRef(reference);
+    if (parsed && !knownViews.has(`${parsed.namespace}/${parsed.name}`)) {
       add(
-        "ambiguous_capability_reference",
-        `contracts.${contract.namespace}`,
-        `contract for "${contract.namespace}" is supplied more than once`
+        "unauthorized_data_ref",
+        `grants.views.${reference}`,
+        `release grants "${reference}", which no supplied capability publishes; promotion would fail to route it`
+      );
+    }
+  }
+  for (const reference of grantedIntents) {
+    const parsed = parseCapabilityRef(reference);
+    if (parsed && !knownIntents.has(`${parsed.namespace}/${parsed.name}`)) {
+      add(
+        "mutation_bypass",
+        `grants.intents.${reference}`,
+        `release grants "${reference}", which no supplied capability declares as an intent backed by a declared action; promotion would fail to route it`
       );
     }
-    contractNamespaces.add(contract.namespace);
   }
-  validateIntentActionDeclarations(contracts, add);
+  validateIntentActionDeclarations(distinctContracts, add);
   const fragmentGrants = /* @__PURE__ */ new Map();
   for (const [fragmentId, declared] of Object.entries(input.grants.fragments ?? {})) {
     for (const view of declared.views ?? []) {
@@ -1064,7 +1094,9 @@ function deriveAuthorizationGrants(contracts, held, options = {}) {
       const reference = `capability://${contract.namespace}/${shortName(view.name, contract.namespace, "/")}`;
       if (!bound || bound.views.has(reference)) views.push(reference);
     }
+    const declaredActions = new Set(contract.actions.map((action) => action.actionId));
     for (const intent of actionIntentsOf(contract)) {
+      if (!declaredActions.has(intent.actionId)) continue;
       const reference = `capability://${contract.namespace}/${shortName(intent.name, contract.namespace, ".")}`;
       if (!bound || bound.intents.has(reference)) intents.push(reference);
     }