@fabricorg/sdui-release 0.6.0 → 0.7.1

package/CHANGELOG.md

@@ -1,5 +1,42 @@
 # Changelog
 
+## 0.7.1
+
+### Patch Changes
+
+- e41c1f5: `deriveAuthorizationGrants` stopped emitting intents whose action the contract does not declare, on the grounds that such a grant is one validation refuses and promotion could never have routed. The view loop three lines above had the same defect and was not fixed: a view published at two versions, which is a first-class pattern, produced one versionless reference that validation reports as `ambiguous_capability_reference` and promotion cannot route. Those views are now left out of `grants.views` and reported in a new `unaddressable` list on the result, with the reference and the versions that made it unaddressable.
+
+## 0.7.0
+
+### Minor Changes
+
+- 8436c64: Close what a seventh review found in the previous follow-up, two of them regressions it introduced.
+
+  **An idempotency conflict is settled, but which way depends on why.** The previous release treated
+  every conflict as "never applied" and reported it refused. Only a `parameters` or `actor` conflict
+  means that. An `authority_binding` or `action_version` conflict means the _original_ invocation
+  exists and may well have applied — the capture-authority adapter mints a fresh binding on every
+  attempt, so a first attempt whose response was lost conflicts with itself on the second. Deleting that
+  capture and calling it refused was the worst available answer; it is now surfaced as `unknown` under
+  status `conflict_prior_invocation`.
+
+  **A policy block or validation failure is now `unknown`, not `refused`.** Within one attempt both are
+  decided before any effect. On a recovery re-execution the worker skips adapter steps that already
+  succeeded, then re-evaluates policy with a fresh clock and re-parses parameters against a possibly
+  newer action, and either can flip after effects committed. Unlike the authority path, the host
+  persists no execution reason for these, so the client cannot tell first delivery from recovery; it
+  errs toward a person checking. The precise fix is for the host to persist `executionReason` on failed
+  invocations, which is a store change and is recorded rather than attempted here.
+
+  **`failed` means "never delivered" again.** A store fault after a successful delivery was being counted
+  in it; it now lives only in `storeFailures`. The 0.3.0 changelog's disclosure misdescribed what 0.2.0
+  had changed — `parked` never shipped as a count; only `expired` did — and it is corrected in place.
+
+  Every validation pass now sees a duplicated contract once, so one root cause produces one finding
+  rather than one per copy. `deriveAuthorizationGrants` no longer emits a reference for an intent whose
+  action the contract does not declare, matching what promotion resolves. A superseded comment above
+  `PORT_ID` that asserted the claim the fix retracted is removed.
+
 ## 0.6.0
 
 ### Minor Changes
@@ -7,11 +44,14 @@
 - 4780974: Close what a sixth review found in the previously unreviewed fix batch, and disclose a breaking change
   that batch shipped under a minor.
 
-  **Disclosure, first.** `experience-runtime@0.2.0` changed `OfflineReplaySummary.parked` and
-  `expired` from counts to arrays of records. That is breaking for any consumer of 0.1.0 — `parked > 0`
-  becomes permanently false and `if (expired)` permanently true — and its changelog described the
-  counts as still present. This release adds `storeFailures` to the same summary; treat the shape as
-  having changed at 0.2.0.
+  **Disclosure, first.** `experience-runtime@0.2.0` changed `OfflineReplaySummary.expired` from a
+  count to an array of records — breaking for a 0.1.0 consumer, for whom `if (summary.expired)` becomes
+  permanently true. (`parked` was introduced and reshaped inside the 0.2.0 window and never shipped as
+  a count, so no published consumer could have depended on it.) The 0.2.0 changelog did disclose the
+  change, but one of its four aggregated entries still described counts. This release adds
+  `storeFailures`, a **required** field on the returned summary: source-breaking for anything that
+  constructs an `OfflineReplaySummary` or implements the exported `OfflineCaptureQueue`, which a test
+  double may. Treat the shape as changed.
 
   **Offline replay.** An authority refusal on a _recovery_ re-execution lands after adapter steps
   already committed, since the lease worker re-runs authorization but skips succeeded steps rather

package/dist/index.cjs

@@ -715,6 +715,25 @@ function validateSduiRelease(input) {
       ...resolved.remote ? { remote: resolved.remote } : {}
     });
   }
+  const contractNamespaces = /* @__PURE__ */ new Set();
+  const distinctContracts = contracts.filter((contract) => {
+    if (contractNamespaces.has(contract.namespace)) {
+      add(
+        "ambiguous_capability_reference",
+        `contracts.${contract.namespace}`,
+        `contract for "${contract.namespace}" is supplied more than once`
+      );
+      return false;
+    }
+    contractNamespaces.add(contract.namespace);
+    return true;
+  });
+  const seenDocumentNamespaces = /* @__PURE__ */ new Set();
+  const distinctDocuments = input.contracts.filter((document) => {
+    if (seenDocumentNamespaces.has(document.capability.namespace)) return false;
+    seenDocumentNamespaces.add(document.capability.namespace);
+    return true;
+  });
   {
     for (const pack of resolvedPacks) {
       const approved = input.assembly.componentPacks.find(
@@ -766,7 +785,7 @@ function validateSduiRelease(input) {
         );
       }
     }
-    for (const document of input.contracts) {
+    for (const document of distinctDocuments) {
       const approved = input.assembly.capabilities.find(
         (capability) => capability.namespace === document.capability.namespace && capability.usageContractDigest === (0, import_assembly2.computeUsageContractDocumentDigest)(document)
       );
@@ -786,22 +805,9 @@ function validateSduiRelease(input) {
     }
   }
   const coreComponents = new Set(input.coreComponents ?? []);
-  const knownViews = buildKnownViews(contracts);
+  const knownViews = buildKnownViews(distinctContracts);
   const grantedViews = buildGrantedReferences(input.grants.views, "grants.views");
   const grantedIntents = buildGrantedReferences(input.grants.intents, "grants.intents");
-  const contractNamespaces = /* @__PURE__ */ new Set();
-  const distinctContracts = contracts.filter((contract) => {
-    if (contractNamespaces.has(contract.namespace)) {
-      add(
-        "ambiguous_capability_reference",
-        `contracts.${contract.namespace}`,
-        `contract for "${contract.namespace}" is supplied more than once`
-      );
-      return false;
-    }
-    contractNamespaces.add(contract.namespace);
-    return true;
-  });
   const knownIntents = buildKnownActionIntents(distinctContracts, add, grantedIntents);
   reportAmbiguousGrantedViews(distinctContracts, grantedViews, add);
   for (const reference of grantedViews) {
@@ -820,11 +826,11 @@ function validateSduiRelease(input) {
       add(
         "mutation_bypass",
         `grants.intents.${reference}`,
-        `release grants "${reference}", which no supplied capability declares as an intent; promotion would fail to route it`
+        `release grants "${reference}", which no supplied capability declares as an intent backed by a declared action; promotion would fail to route it`
       );
     }
   }
-  validateIntentActionDeclarations(contracts, add);
+  validateIntentActionDeclarations(distinctContracts, add);
   const fragmentGrants = /* @__PURE__ */ new Map();
   for (const [fragmentId, declared] of Object.entries(input.grants.fragments ?? {})) {
     for (const view of declared.views ?? []) {
@@ -1126,7 +1132,9 @@ function deriveAuthorizationGrants(contracts, held, options = {}) {
       const reference = `capability://${contract.namespace}/${shortName(view.name, contract.namespace, "/")}`;
       if (!bound || bound.views.has(reference)) views.push(reference);
     }
+    const declaredActions = new Set(contract.actions.map((action) => action.actionId));
     for (const intent of actionIntentsOf(contract)) {
+      if (!declaredActions.has(intent.actionId)) continue;
       const reference = `capability://${contract.namespace}/${shortName(intent.name, contract.namespace, ".")}`;
       if (!bound || bound.intents.has(reference)) intents.push(reference);
     }