@fabricorg/gen-conformance 1.0.6 → 1.0.7

package/dist/index.cjs

@@ -1,341 +1,367 @@
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key2 of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key2) && key2 !== except)
-        __defProp(to, key2, { get: () => from[key2], enumerable: !(desc = __getOwnPropDesc(from, key2)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-
-// index.ts
-var index_exports = {};
-__export(index_exports, {
-  MODULE_CONFORMANCE_CHECKS: () => MODULE_CONFORMANCE_CHECKS,
-  PHASE_1_CONFORMANCE_CHECKS: () => PHASE_1_CONFORMANCE_CHECKS,
-  PLATFORM_CONFORMANCE_CHECKS: () => PLATFORM_CONFORMANCE_CHECKS,
-  buildModuleConformancePlan: () => buildModuleConformancePlan,
-  conformanceGenerator: () => conformanceGenerator,
-  createCertificationResult: () => createCertificationResult,
-  moduleConformanceChecks: () => moduleConformanceChecks
-});
-module.exports = __toCommonJS(index_exports);
-var import_compiler = require("@fabricorg/compiler");
-var MODULE_CONFORMANCE_CHECKS = [
-  "fabric.idempotency.same-command-replay.v1",
-  "fabric.idempotency.conflicting-payload.v1",
-  "fabric.idempotency.concurrent-submission.v1",
-  "fabric.authorization.governing-moment.v1",
-  "fabric.authorization.offline-replay.v1",
-  "fabric.events.compatibility.v1",
-  "fabric.provenance.propagation.v1",
-  "fabric.consumers.tolerant-envelope.v1"
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+let _fabricorg_compiler = require("@fabricorg/compiler");
+//#region index.ts
+/** Checks a single module's own behaviour, verifiable against a governed host. */
+const MODULE_CONFORMANCE_CHECKS = [
+	"fabric.idempotency.same-command-replay.v1",
+	"fabric.idempotency.conflicting-payload.v1",
+	"fabric.idempotency.concurrent-submission.v1",
+	"fabric.authorization.governing-moment.v1",
+	"fabric.authorization.offline-replay.v1",
+	"fabric.events.compatibility.v1",
+	"fabric.provenance.propagation.v1",
+	"fabric.consumers.tolerant-envelope.v1"
 ];
-var PLATFORM_CONFORMANCE_CHECKS = [
-  "fabric.documentation.parity.v1",
-  "fabric.documentation.llms-contract.v1"
-];
-var PHASE_1_CONFORMANCE_CHECKS = [...MODULE_CONFORMANCE_CHECKS, ...PLATFORM_CONFORMANCE_CHECKS];
+/**
+* Checks that belong to a repository rather than a module. They are certification
+* evidence like any other check, but no per-module suite can produce them.
+*/
+const PLATFORM_CONFORMANCE_CHECKS = ["fabric.documentation.parity.v1", "fabric.documentation.llms-contract.v1"];
+const PHASE_1_CONFORMANCE_CHECKS = [...MODULE_CONFORMANCE_CHECKS, ...PLATFORM_CONFORMANCE_CHECKS];
 var ConformanceFailure = class extends Error {
-  name = "ConformanceFailure";
+	name = "ConformanceFailure";
 };
 function expect(condition, message) {
-  if (!condition) throw new ConformanceFailure(message);
+	if (!condition) throw new ConformanceFailure(message);
 }
-var idempotentActions = (plan) => plan.actions.filter((action) => action.idempotency !== "prohibited" && action.idempotent);
-var key = (label, action) => `conformance:${label}:${action.actionId}`;
-var conflictReason = (conflict) => conflict.code ?? conflict.message;
+const idempotentActions = (plan) => plan.actions.filter((action) => action.idempotency !== "prohibited" && action.idempotent);
+const key = (label, action) => `conformance:${label}:${action.actionId}`;
+const conflictReason = (conflict) => conflict.code ?? conflict.message;
 async function conflictOf(run) {
-  try {
-    await run();
-    return { thrown: false, message: "" };
-  } catch (error) {
-    const code = error.code;
-    return { thrown: true, ...code ? { code } : {}, message: error instanceof Error ? error.message : String(error) };
-  }
+	try {
+		await run();
+		return {
+			thrown: false,
+			message: ""
+		};
+	} catch (error) {
+		const code = error.code;
+		return {
+			thrown: true,
+			...code ? { code } : {},
+			message: error instanceof Error ? error.message : String(error)
+		};
+	}
 }
+/**
+* Runs a check against every eligible action, not just the first. A module whose
+* first action conforms and whose second does not must fail, or certification
+* means nothing for the rest of the module.
+*/
 async function forEachAction(actions, reason, body) {
-  if (actions.length === 0) return { status: "not-applicable", reason };
-  const evidence = [];
-  for (const action of actions) evidence.push(...await body(action));
-  return { status: "passed", evidence };
+	if (actions.length === 0) return {
+		status: "not-applicable",
+		reason
+	};
+	const evidence = [];
+	for (const action of actions) evidence.push(...await body(action));
+	return {
+		status: "passed",
+		evidence
+	};
 }
 function moduleConformanceChecks() {
-  return [
-    {
-      id: "fabric.idempotency.same-command-replay.v1",
-      title: "replaying one command key with the same payload does not re-execute",
-      run: (harness, plan) => forEachAction(idempotentActions(plan), "module declares no idempotent action", async (action) => {
-        const input = { actionId: action.actionId, parameters: harness.parameters(action.actionId), idempotencyKey: key("replay", action) };
-        const first = await harness.submit(input);
-        const before = await harness.sideEffects?.(action.actionId);
-        const second = await harness.submit(input);
-        expect(first.actionInvocationId === second.actionInvocationId, `replay of ${action.actionId} produced a second invocation ${second.actionInvocationId} for key ${input.idempotencyKey}`);
-        const after = await harness.sideEffects?.(action.actionId);
-        if (before !== void 0 && after !== void 0) {
-          expect(after === before, `replay of ${action.actionId} returned the original invocation but produced ${after - before} further effects; the handler ran again`);
-        }
-        return [`invocation:${first.actionInvocationId}`, `key:${input.idempotencyKey}`, `effects:${after ?? "unobserved"}`];
-      })
-    },
-    {
-      id: "fabric.idempotency.conflicting-payload.v1",
-      title: "reusing a command key with an altered payload is refused",
-      run: (harness, plan) => forEachAction(idempotentActions(plan), "module declares no idempotent action", async (action) => {
-        const idempotencyKey = key("conflict", action);
-        const parameters = harness.parameters(action.actionId);
-        await harness.submit({ actionId: action.actionId, parameters, idempotencyKey });
-        const conflict = await conflictOf(() => harness.submit({
-          actionId: action.actionId,
-          parameters: { ...parameters, "x-conformance-altered": true },
-          idempotencyKey
-        }));
-        expect(conflict.thrown, `altered payload reusing key ${idempotencyKey} was accepted instead of refused`);
-        expect(
-          conflict.code === "IDEMPOTENCY_CONFLICT" || /idempotenc/i.test(conflict.message),
-          `altered payload for ${action.actionId} was refused, but not as an idempotency conflict: ${conflict.message}`
-        );
-        return [`key:${idempotencyKey}`, `refusal:${conflictReason(conflict)}`];
-      })
-    },
-    {
-      id: "fabric.idempotency.concurrent-submission.v1",
-      title: "concurrent identical submissions collapse to one invocation",
-      run: (harness, plan) => forEachAction(idempotentActions(plan), "module declares no idempotent action", async (action) => {
-        const input = { actionId: action.actionId, parameters: harness.parameters(action.actionId), idempotencyKey: key("concurrent", action) };
-        const before = await harness.sideEffects?.(action.actionId);
-        const results = await Promise.all([harness.submit(input), harness.submit(input), harness.submit(input)]);
-        const ids = new Set(results.map((result) => result.actionInvocationId));
-        expect(ids.size === 1, `concurrent submissions of ${action.actionId} produced ${ids.size} invocations: ${[...ids].join(", ")}`);
-        const after = await harness.sideEffects?.(action.actionId);
-        if (before !== void 0 && after !== void 0) {
-          const executions = after - before;
-          expect(executions <= 1, `${results.length} concurrent submissions of ${action.actionId} collapsed to one invocation but produced ${executions} executions' worth of effects`);
-        }
-        return [`invocation:${[...ids][0]}`, `attempts:${results.length}`, `effects:${after ?? "unobserved"}`];
-      })
-    },
-    {
-      id: "fabric.authorization.governing-moment.v1",
-      title: "an authorization binding must match the action's declared governing moment",
-      run: (harness, plan) => forEachAction(
-        plan.actions.filter((action) => action.authorityMoment !== void 0),
-        "module declares no action with an authority moment",
-        async (action) => {
-          const mismatched = action.authorityMoment === "capture" ? "execution" : "capture";
-          const rejection = await conflictOf(() => harness.submit({
-            actionId: action.actionId,
-            parameters: harness.parameters(action.actionId),
-            authorizationBinding: { governingMoment: mismatched, capturedAt: new Date(Date.now() - 6e4).toISOString() }
-          }));
-          expect(rejection.thrown, `a binding declaring governingMoment "${mismatched}" was accepted for ${action.actionId}, governed at "${action.authorityMoment}"`);
-          expect(
-            /governingmoment|governing moment/i.test(conflictReason(rejection)),
-            `the binding for ${action.actionId} was refused, but not for its governing moment: ${conflictReason(rejection)}`
-          );
-          return [`action:${action.actionId}`, `declared:${action.authorityMoment}`, `refused:${mismatched}`];
-        }
-      )
-    },
-    {
-      id: "fabric.authorization.offline-replay.v1",
-      title: "an offline capture replayed after authority is withdrawn is refused into reconciliation",
-      run: (harness, plan) => forEachAction(
-        plan.actions.filter((action) => action.connectivity === "offline-capturable" && action.authorityMoment !== void 0 && action.authorityMoment !== "capture"),
-        "module declares no offline-capturable action governed at execution",
-        async (action) => {
-          await harness.revokeAuthority(action.actionId);
-          const replay = await harness.submit({
-            actionId: action.actionId,
-            parameters: harness.parameters(action.actionId),
-            idempotencyKey: key("offline-replay", action),
-            executionReason: "offline_replay"
-          });
-          expect(
-            replay.status === "reconciliation_required",
-            `replay of ${action.actionId} after authority withdrawal returned status "${replay.status}" instead of reconciliation_required`
-          );
-          expect(replay.reconciliation !== void 0, `reconciliation_required was returned for ${action.actionId} without a reconciliation outcome`);
-          return [`action:${action.actionId}`, `reconciliation:${replay.reconciliation?.kind}`];
-        }
-      )
-    },
-    {
-      id: "fabric.events.compatibility.v1",
-      title: "every consumed event version is one the module still declares",
-      async run(_harness, plan) {
-        if (plan.views.length === 0) return { status: "not-applicable", reason: "module declares no views" };
-        const declared = new Map(plan.eventTypes.map((event) => [event.eventType, event.schemaVersion]));
-        const evidence = [];
-        for (const view of plan.views) {
-          for (const consumption of view.consumes) {
-            const current = declared.get(consumption.eventType);
-            if (current === void 0) continue;
-            expect(
-              consumption.schemaVersions.includes(current),
-              `view ${view.name}@${view.version} consumes ${consumption.eventType} at [${consumption.schemaVersions.join(", ")}] but the module now emits version ${current}`
-            );
-            evidence.push(`${view.name}@${view.version}:${consumption.eventType}=${current}`);
-          }
-        }
-        if (evidence.length === 0) return { status: "not-applicable", reason: "no view consumes an event this module declares" };
-        return { status: "passed", evidence };
-      }
-    },
-    {
-      id: "fabric.provenance.propagation.v1",
-      title: "submission provenance reaches the events the action emits",
-      run: (harness, plan) => forEachAction(
-        plan.actions.filter((action) => action.mutatesDomain),
-        "module declares no domain-mutating action",
-        async (action) => {
-          const correlationId = `conformance-corr-${action.actionId}`;
-          const submitted = await harness.submit({
-            actionId: action.actionId,
-            parameters: harness.parameters(action.actionId),
-            correlationId,
-            // Audit attributes are allowlisted per application, so provenance identity is asserted on correlation alone.
-            provenance: { source: "system", correlationId }
-          });
-          const emitted = (await harness.events()).filter((event) => event.actionInvocationId === submitted.actionInvocationId);
-          expect(emitted.length > 0, `action ${action.actionId} mutates domain but emitted no events`);
-          for (const event of emitted) {
-            expect(event.correlationId === correlationId, `event ${event.eventType} carried correlationId ${String(event.correlationId)} instead of ${correlationId}`);
-          }
-          return [`invocation:${submitted.actionInvocationId}`, `events:${emitted.length}`, `correlationId:${correlationId}`];
-        }
-      )
-    },
-    {
-      id: "fabric.consumers.tolerant-envelope.v1",
-      title: "emitted envelopes are complete, and a consumer tolerates fields it does not know",
-      run: (harness, plan) => forEachAction(
-        plan.actions.filter((action) => action.mutatesDomain),
-        "module declares no domain-mutating action",
-        async (action) => {
-          const submitted = await harness.submit({
-            actionId: action.actionId,
-            parameters: harness.parameters(action.actionId),
-            idempotencyKey: key("envelope", action)
-          });
-          const emitted = (await harness.events()).filter((event) => event.actionInvocationId === submitted.actionInvocationId);
-          expect(emitted.length > 0, `action ${action.actionId} mutates domain but emitted no events`);
-          const required = ["eventType", "tenantId", "spaceId", "subjectType", "subjectId", "sequence", "correlationId"];
-          for (const event of emitted) {
-            for (const field of required) {
-              expect(event[field] !== void 0 && event[field] !== null, `event ${event.eventType} omits the canonical envelope field "${field}"`);
-            }
-          }
-          const evidence = emitted.map((event) => `${event.eventType}@${event.sequence}`);
-          if (!harness.acceptsEnvelope) return [...evidence, "consumer:unobserved"];
-          for (const event of emitted) {
-            const extended = { ...event, "x-conformance-unknown": true, consistency: "provisional-until-reconciled" };
-            const accepted = await harness.acceptsEnvelope(extended);
-            expect(accepted, `a consumer rejected ${event.eventType} once it carried a field it did not recognise; additive event changes would break it`);
-          }
-          return [...evidence, `consumer:tolerated:${emitted.length}`];
-        }
-      )
-    }
-  ];
+	return [
+		{
+			id: "fabric.idempotency.same-command-replay.v1",
+			title: "replaying one command key with the same payload does not re-execute",
+			run: (harness, plan) => forEachAction(idempotentActions(plan), "module declares no idempotent action", async (action) => {
+				const input = {
+					actionId: action.actionId,
+					parameters: harness.parameters(action.actionId),
+					idempotencyKey: key("replay", action)
+				};
+				const first = await harness.submit(input);
+				const before = await harness.sideEffects?.(action.actionId);
+				const second = await harness.submit(input);
+				expect(first.actionInvocationId === second.actionInvocationId, `replay of ${action.actionId} produced a second invocation ${second.actionInvocationId} for key ${input.idempotencyKey}`);
+				const after = await harness.sideEffects?.(action.actionId);
+				if (before !== void 0 && after !== void 0) expect(after === before, `replay of ${action.actionId} returned the original invocation but produced ${after - before} further effects; the handler ran again`);
+				return [
+					`invocation:${first.actionInvocationId}`,
+					`key:${input.idempotencyKey}`,
+					`effects:${after ?? "unobserved"}`
+				];
+			})
+		},
+		{
+			id: "fabric.idempotency.conflicting-payload.v1",
+			title: "reusing a command key with an altered payload is refused",
+			run: (harness, plan) => forEachAction(idempotentActions(plan), "module declares no idempotent action", async (action) => {
+				const idempotencyKey = key("conflict", action);
+				const parameters = harness.parameters(action.actionId);
+				await harness.submit({
+					actionId: action.actionId,
+					parameters,
+					idempotencyKey
+				});
+				const conflict = await conflictOf(() => harness.submit({
+					actionId: action.actionId,
+					parameters: {
+						...parameters,
+						"x-conformance-altered": true
+					},
+					idempotencyKey
+				}));
+				expect(conflict.thrown, `altered payload reusing key ${idempotencyKey} was accepted instead of refused`);
+				expect(conflict.code === "IDEMPOTENCY_CONFLICT" || /idempotenc/i.test(conflict.message), `altered payload for ${action.actionId} was refused, but not as an idempotency conflict: ${conflict.message}`);
+				return [`key:${idempotencyKey}`, `refusal:${conflictReason(conflict)}`];
+			})
+		},
+		{
+			id: "fabric.idempotency.concurrent-submission.v1",
+			title: "concurrent identical submissions collapse to one invocation",
+			run: (harness, plan) => forEachAction(idempotentActions(plan), "module declares no idempotent action", async (action) => {
+				const input = {
+					actionId: action.actionId,
+					parameters: harness.parameters(action.actionId),
+					idempotencyKey: key("concurrent", action)
+				};
+				const before = await harness.sideEffects?.(action.actionId);
+				const results = await Promise.all([
+					harness.submit(input),
+					harness.submit(input),
+					harness.submit(input)
+				]);
+				const ids = new Set(results.map((result) => result.actionInvocationId));
+				expect(ids.size === 1, `concurrent submissions of ${action.actionId} produced ${ids.size} invocations: ${[...ids].join(", ")}`);
+				const after = await harness.sideEffects?.(action.actionId);
+				if (before !== void 0 && after !== void 0) {
+					const executions = after - before;
+					expect(executions <= 1, `${results.length} concurrent submissions of ${action.actionId} collapsed to one invocation but produced ${executions} executions' worth of effects`);
+				}
+				return [
+					`invocation:${[...ids][0]}`,
+					`attempts:${results.length}`,
+					`effects:${after ?? "unobserved"}`
+				];
+			})
+		},
+		{
+			id: "fabric.authorization.governing-moment.v1",
+			title: "an authorization binding must match the action's declared governing moment",
+			run: (harness, plan) => forEachAction(plan.actions.filter((action) => action.authorityMoment !== void 0), "module declares no action with an authority moment", async (action) => {
+				const mismatched = action.authorityMoment === "capture" ? "execution" : "capture";
+				const rejection = await conflictOf(() => harness.submit({
+					actionId: action.actionId,
+					parameters: harness.parameters(action.actionId),
+					authorizationBinding: {
+						governingMoment: mismatched,
+						capturedAt: (/* @__PURE__ */ new Date(Date.now() - 6e4)).toISOString()
+					}
+				}));
+				expect(rejection.thrown, `a binding declaring governingMoment "${mismatched}" was accepted for ${action.actionId}, governed at "${action.authorityMoment}"`);
+				expect(/governingmoment|governing moment/i.test(conflictReason(rejection)), `the binding for ${action.actionId} was refused, but not for its governing moment: ${conflictReason(rejection)}`);
+				return [
+					`action:${action.actionId}`,
+					`declared:${action.authorityMoment}`,
+					`refused:${mismatched}`
+				];
+			})
+		},
+		{
+			id: "fabric.authorization.offline-replay.v1",
+			title: "an offline capture replayed after authority is withdrawn is refused into reconciliation",
+			run: (harness, plan) => forEachAction(plan.actions.filter((action) => action.connectivity === "offline-capturable" && action.authorityMoment !== void 0 && action.authorityMoment !== "capture"), "module declares no offline-capturable action governed at execution", async (action) => {
+				await harness.revokeAuthority(action.actionId);
+				const replay = await harness.submit({
+					actionId: action.actionId,
+					parameters: harness.parameters(action.actionId),
+					idempotencyKey: key("offline-replay", action),
+					executionReason: "offline_replay"
+				});
+				expect(replay.status === "reconciliation_required", `replay of ${action.actionId} after authority withdrawal returned status "${replay.status}" instead of reconciliation_required`);
+				expect(replay.reconciliation !== void 0, `reconciliation_required was returned for ${action.actionId} without a reconciliation outcome`);
+				return [`action:${action.actionId}`, `reconciliation:${replay.reconciliation?.kind}`];
+			})
+		},
+		{
+			id: "fabric.events.compatibility.v1",
+			title: "every consumed event version is one the module still declares",
+			async run(_harness, plan) {
+				if (plan.views.length === 0) return {
+					status: "not-applicable",
+					reason: "module declares no views"
+				};
+				const declared = new Map(plan.eventTypes.map((event) => [event.eventType, event.schemaVersion]));
+				const evidence = [];
+				for (const view of plan.views) for (const consumption of view.consumes) {
+					const current = declared.get(consumption.eventType);
+					if (current === void 0) continue;
+					expect(consumption.schemaVersions.includes(current), `view ${view.name}@${view.version} consumes ${consumption.eventType} at [${consumption.schemaVersions.join(", ")}] but the module now emits version ${current}`);
+					evidence.push(`${view.name}@${view.version}:${consumption.eventType}=${current}`);
+				}
+				if (evidence.length === 0) return {
+					status: "not-applicable",
+					reason: "no view consumes an event this module declares"
+				};
+				return {
+					status: "passed",
+					evidence
+				};
+			}
+		},
+		{
+			id: "fabric.provenance.propagation.v1",
+			title: "submission provenance reaches the events the action emits",
+			run: (harness, plan) => forEachAction(plan.actions.filter((action) => action.mutatesDomain), "module declares no domain-mutating action", async (action) => {
+				const correlationId = `conformance-corr-${action.actionId}`;
+				const submitted = await harness.submit({
+					actionId: action.actionId,
+					parameters: harness.parameters(action.actionId),
+					correlationId,
+					provenance: {
+						source: "system",
+						correlationId
+					}
+				});
+				const emitted = (await harness.events()).filter((event) => event.actionInvocationId === submitted.actionInvocationId);
+				expect(emitted.length > 0, `action ${action.actionId} mutates domain but emitted no events`);
+				for (const event of emitted) expect(event.correlationId === correlationId, `event ${event.eventType} carried correlationId ${String(event.correlationId)} instead of ${correlationId}`);
+				return [
+					`invocation:${submitted.actionInvocationId}`,
+					`events:${emitted.length}`,
+					`correlationId:${correlationId}`
+				];
+			})
+		},
+		{
+			id: "fabric.consumers.tolerant-envelope.v1",
+			title: "emitted envelopes are complete, and a consumer tolerates fields it does not know",
+			run: (harness, plan) => forEachAction(plan.actions.filter((action) => action.mutatesDomain), "module declares no domain-mutating action", async (action) => {
+				const submitted = await harness.submit({
+					actionId: action.actionId,
+					parameters: harness.parameters(action.actionId),
+					idempotencyKey: key("envelope", action)
+				});
+				const emitted = (await harness.events()).filter((event) => event.actionInvocationId === submitted.actionInvocationId);
+				expect(emitted.length > 0, `action ${action.actionId} mutates domain but emitted no events`);
+				const required = [
+					"eventType",
+					"tenantId",
+					"spaceId",
+					"subjectType",
+					"subjectId",
+					"sequence",
+					"correlationId"
+				];
+				for (const event of emitted) for (const field of required) expect(event[field] !== void 0 && event[field] !== null, `event ${event.eventType} omits the canonical envelope field "${field}"`);
+				const evidence = emitted.map((event) => `${event.eventType}@${event.sequence}`);
+				if (!harness.acceptsEnvelope) return [...evidence, "consumer:unobserved"];
+				for (const event of emitted) {
+					const extended = {
+						...event,
+						"x-conformance-unknown": true,
+						consistency: "provisional-until-reconciled"
+					};
+					expect(await harness.acceptsEnvelope(extended), `a consumer rejected ${event.eventType} once it carried a field it did not recognise; additive event changes would break it`);
+				}
+				return [...evidence, `consumer:tolerated:${emitted.length}`];
+			})
+		}
+	];
 }
 function createCertificationResult(input) {
-  const results = new Map(input.checks.map((check) => [check.id, check]));
-  if (results.size !== input.checks.length) throw new Error("Certification evidence contains duplicate check identifiers.");
-  const missing = PHASE_1_CONFORMANCE_CHECKS.filter((id) => !results.has(id));
-  if (missing.length) throw new Error(`Certification evidence is missing mandatory checks: ${missing.join(", ")}`);
-  if (!/^[0-9a-f]{64}$/.test(input.manifestDigest)) throw new Error("Certification manifestDigest must be a lowercase SHA-256 digest.");
-  const generatorDigests = Object.entries(input.generatorDigests);
-  if (!generatorDigests.length || generatorDigests.some(([, digest]) => !/^[0-9a-f]{64}$/.test(digest))) throw new Error("Certification generatorDigests must contain SHA-256 evidence.");
-  if (input.checks.some((check) => check.status === "passed" && check.evidence.length === 0)) throw new Error("Passed certification checks require evidence references.");
-  return { ...input, formatVersion: 1, checks: [...input.checks].sort((a, b) => a.id.localeCompare(b.id)), passed: input.checks.every((check) => check.status === "passed") };
+	const results = new Map(input.checks.map((check) => [check.id, check]));
+	if (results.size !== input.checks.length) throw new Error("Certification evidence contains duplicate check identifiers.");
+	const missing = PHASE_1_CONFORMANCE_CHECKS.filter((id) => !results.has(id));
+	if (missing.length) throw new Error(`Certification evidence is missing mandatory checks: ${missing.join(", ")}`);
+	if (!/^[0-9a-f]{64}$/.test(input.manifestDigest)) throw new Error("Certification manifestDigest must be a lowercase SHA-256 digest.");
+	const generatorDigests = Object.entries(input.generatorDigests);
+	if (!generatorDigests.length || generatorDigests.some(([, digest]) => !/^[0-9a-f]{64}$/.test(digest))) throw new Error("Certification generatorDigests must contain SHA-256 evidence.");
+	if (input.checks.some((check) => check.status === "passed" && check.evidence.length === 0)) throw new Error("Passed certification checks require evidence references.");
+	return {
+		...input,
+		formatVersion: 1,
+		checks: [...input.checks].sort((a, b) => a.id.localeCompare(b.id)),
+		passed: input.checks.every((check) => check.status === "passed")
+	};
 }
-function buildModuleConformancePlan(module2, manifestDigest) {
-  return {
-    formatVersion: 1,
-    module: module2.namespace,
-    manifestDigest,
-    requiredChecks: MODULE_CONFORMANCE_CHECKS,
-    platformChecks: PLATFORM_CONFORMANCE_CHECKS,
-    actions: module2.actions.map((action) => ({
-      actionId: action.actionId,
-      version: action.version,
-      mutatesDomain: action.mutatesDomain,
-      idempotent: action.idempotent,
-      ...action.execution?.idempotency ? { idempotency: action.execution.idempotency } : {},
-      ...action.execution?.authorityMoment ? { authorityMoment: action.execution.authorityMoment } : {},
-      ...action.execution?.connectivity ? { connectivity: action.execution.connectivity } : {},
-      ...action.execution?.consistency ? { consistency: action.execution.consistency } : {}
-    })),
-    views: module2.views.map((view) => ({
-      name: view.name,
-      version: view.version,
-      ...view.parameterSchema ? { parameterSchema: view.parameterSchema } : {},
-      consumes: view.consumes.map((consumption) => ({ eventType: consumption.eventType, schemaVersions: [...consumption.schemaVersions] }))
-    })),
-    eventTypes: module2.eventTypes.map((event) => ({ eventType: event.eventType, schemaVersion: event.schemaVersion }))
-  };
+function buildModuleConformancePlan(module, manifestDigest) {
+	return {
+		formatVersion: 1,
+		module: module.namespace,
+		manifestDigest,
+		requiredChecks: MODULE_CONFORMANCE_CHECKS,
+		platformChecks: PLATFORM_CONFORMANCE_CHECKS,
+		actions: module.actions.map((action) => ({
+			actionId: action.actionId,
+			version: action.version,
+			mutatesDomain: action.mutatesDomain,
+			idempotent: action.idempotent,
+			...action.execution?.idempotency ? { idempotency: action.execution.idempotency } : {},
+			...action.execution?.authorityMoment ? { authorityMoment: action.execution.authorityMoment } : {},
+			...action.execution?.connectivity ? { connectivity: action.execution.connectivity } : {},
+			...action.execution?.consistency ? { consistency: action.execution.consistency } : {}
+		})),
+		views: module.views.map((view) => ({
+			name: view.name,
+			version: view.version,
+			...view.parameterSchema ? { parameterSchema: view.parameterSchema } : {},
+			consumes: view.consumes.map((consumption) => ({
+				eventType: consumption.eventType,
+				schemaVersions: [...consumption.schemaVersions]
+			}))
+		})),
+		eventTypes: module.eventTypes.map((event) => ({
+			eventType: event.eventType,
+			schemaVersion: event.schemaVersion
+		}))
+	};
 }
 function suiteSource(plan, generator) {
-  return [
-    `// Generated by ${generator.name}@${generator.version}. Do not edit.`,
-    `// Manifest digest: ${plan.manifestDigest}`,
-    `// Supply ./conformance.harness with a createConformanceHarness() factory returning a fresh, isolated harness.`,
-    'import { expect, it } from "vitest";',
-    'import { moduleConformanceChecks, type ModuleConformancePlan } from "@fabricorg/gen-conformance";',
-    'import { createConformanceHarness } from "./conformance.harness";',
-    "",
-    `export const plan: ModuleConformancePlan = ${JSON.stringify(plan, null, 2)};`,
-    "",
-    "for (const check of moduleConformanceChecks()) {",
-    "  it(`${check.id} \u2014 ${check.title}`, async () => {",
-    "    const outcome = await check.run(await createConformanceHarness(), plan);",
-    '    expect(["passed", "not-applicable"]).toContain(outcome.status);',
-    "  });",
-    "}",
-    ""
-  ].join("\n");
+	return [
+		`// Generated by ${generator.name}@${generator.version}. Do not edit.`,
+		`// Manifest digest: ${plan.manifestDigest}`,
+		`// Supply ./conformance.harness with a createConformanceHarness() factory returning a fresh, isolated harness.`,
+		"import { expect, it } from \"vitest\";",
+		"import { moduleConformanceChecks, type ModuleConformancePlan } from \"@fabricorg/gen-conformance\";",
+		"import { createConformanceHarness } from \"./conformance.harness\";",
+		"",
+		`export const plan: ModuleConformancePlan = ${JSON.stringify(plan, null, 2)};`,
+		"",
+		"for (const check of moduleConformanceChecks()) {",
+		"  it(`${check.id} — ${check.title}`, async () => {",
+		"    const outcome = await check.run(await createConformanceHarness(), plan);",
+		"    expect([\"passed\", \"not-applicable\"]).toContain(outcome.status);",
+		"  });",
+		"}",
+		""
+	].join("\n");
 }
-var conformanceGenerator = {
-  name: "@fabricorg/gen-conformance",
-  version: "1.0.6",
-  generate(ir) {
-    return ir.modules.flatMap((module2) => {
-      const plan = buildModuleConformancePlan(module2, ir.manifestDigest);
-      return [
-        {
-          path: `${module2.namespace}/conformance-plan.json`,
-          content: (0, import_compiler.stableStringify)({
-            ...plan,
-            generator: { name: conformanceGenerator.name, version: conformanceGenerator.version },
-            compilerVersion: ir.compilerVersion
-          })
-        },
-        {
-          path: `${module2.namespace}/conformance.test.ts`,
-          content: suiteSource(plan, { name: conformanceGenerator.name, version: conformanceGenerator.version })
-        }
-      ];
-    });
-  }
+const conformanceGenerator = {
+	name: "@fabricorg/gen-conformance",
+	version: "1.0.7",
+	generate(ir) {
+		return ir.modules.flatMap((module) => {
+			const plan = buildModuleConformancePlan(module, ir.manifestDigest);
+			return [{
+				path: `${module.namespace}/conformance-plan.json`,
+				content: (0, _fabricorg_compiler.stableStringify)({
+					...plan,
+					generator: {
+						name: conformanceGenerator.name,
+						version: conformanceGenerator.version
+					},
+					compilerVersion: ir.compilerVersion
+				})
+			}, {
+				path: `${module.namespace}/conformance.test.ts`,
+				content: suiteSource(plan, {
+					name: conformanceGenerator.name,
+					version: conformanceGenerator.version
+				})
+			}];
+		});
+	}
 };
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  MODULE_CONFORMANCE_CHECKS,
-  PHASE_1_CONFORMANCE_CHECKS,
-  PLATFORM_CONFORMANCE_CHECKS,
-  buildModuleConformancePlan,
-  conformanceGenerator,
-  createCertificationResult,
-  moduleConformanceChecks
-});
+//#endregion
+exports.MODULE_CONFORMANCE_CHECKS = MODULE_CONFORMANCE_CHECKS;
+exports.PHASE_1_CONFORMANCE_CHECKS = PHASE_1_CONFORMANCE_CHECKS;
+exports.PLATFORM_CONFORMANCE_CHECKS = PLATFORM_CONFORMANCE_CHECKS;
+exports.buildModuleConformancePlan = buildModuleConformancePlan;
+exports.conformanceGenerator = conformanceGenerator;
+exports.createCertificationResult = createCertificationResult;
+exports.moduleConformanceChecks = moduleConformanceChecks;
+
 //# sourceMappingURL=index.cjs.map