@fabricorg/platform 0.5.0 → 0.6.0

package/dist/chunk-YQEXO3IQ.cjs

@@ -0,0 +1,320 @@
+'use strict';
+
+var crypto = require('crypto');
+
+// privacy/engine.ts
+var ANONYMIZATION_POLICY_VERSION = "adr-026-platform-anonymization-v1";
+var DEFAULT_PRESERVED_SEMANTICS = [
+  "tenantId",
+  "spaceId",
+  "subjectType",
+  "subjectId",
+  "eventType",
+  "sequence",
+  "occurredAt",
+  "recordedAt",
+  "actionInvocationId",
+  "correlationId",
+  "causationId",
+  "financialDecisionFacts"
+];
+var FIELD_POLICIES = [
+  { match: "key", value: "password", method: "drop" },
+  { match: "key", value: "token", method: "drop" },
+  { match: "key", value: "apiKey", method: "drop" },
+  { match: "key", value: "authorization", method: "drop" },
+  { match: "key", value: "ssn", method: "nullify" },
+  { match: "key", value: "ssnLast4", method: "nullify" },
+  { match: "key", value: "socialSecurityNumber", method: "nullify" },
+  { match: "key", value: "dateOfBirth", method: "nullify" },
+  { match: "key", value: "dob", method: "nullify" },
+  { match: "key", value: "driverLicense", method: "nullify" },
+  { match: "key", value: "firstName", method: "tokenize" },
+  { match: "key", value: "middleName", method: "tokenize" },
+  { match: "key", value: "lastName", method: "tokenize" },
+  { match: "key", value: "fullName", method: "tokenize" },
+  { match: "key", value: "name", method: "tokenize" },
+  { match: "key", value: "email", method: "tokenize" },
+  { match: "key", value: "emailAddress", method: "tokenize" },
+  { match: "key", value: "phone", method: "tokenize" },
+  { match: "key", value: "phoneNumber", method: "tokenize" },
+  { match: "key", value: "mobilePhone", method: "tokenize" },
+  { match: "key", value: "homePhone", method: "tokenize" },
+  { match: "key", value: "workPhone", method: "tokenize" },
+  { match: "key", value: "street", method: "nullify" },
+  { match: "key", value: "streetAddress", method: "nullify" },
+  { match: "key", value: "address", method: "nullify" },
+  { match: "key", value: "mailingAddress", method: "nullify" },
+  { match: "key", value: "partnerLeadId", method: "tokenize" },
+  { match: "key", value: "externalLeadId", method: "tokenize" },
+  { match: "key", value: "loanApplicationId", method: "tokenize" },
+  { match: "key", value: "vin", method: "tokenize" },
+  { match: "key", value: "rawVin", method: "tokenize" }
+];
+var NORMALIZED_FIELD_POLICIES = FIELD_POLICIES.map((policy) => ({
+  ...policy,
+  value: normalizeKey(policy.value)
+}));
+function normalizeKey(key) {
+  return key.replace(/[^a-zA-Z0-9]/g, "").toLowerCase();
+}
+function stableChecksum(value) {
+  return crypto.createHash("sha256").update(JSON.stringify(value)).digest("hex");
+}
+function stableScopedToken(value, context, fieldPath) {
+  const scope = `${context.tenantId}:${context.spaceId ?? "global"}:${fieldPath}`;
+  return `tok_${crypto.createHash("sha256").update(`${context.policyVersion ?? ANONYMIZATION_POLICY_VERSION}:${scope}:${String(value)}`).digest("hex").slice(0, 24)}`;
+}
+function maskValue(value) {
+  if (value === null || value === void 0) {
+    return null;
+  }
+  const stringValue = String(value);
+  if (stringValue.length <= 4) {
+    return "****";
+  }
+  return `${"*".repeat(Math.max(stringValue.length - 4, 4))}${stringValue.slice(-4)}`;
+}
+function generalizeValue(value) {
+  if (typeof value === "number") {
+    return Math.round(value / 1e3) * 1e3;
+  }
+  if (typeof value === "string" && /^\d{5}(?:-\d{4})?$/.test(value)) {
+    return `${value.slice(0, 3)}**`;
+  }
+  return null;
+}
+function applyMethod(value, method, context, path) {
+  switch (method) {
+    case "drop":
+      return void 0;
+    case "nullify":
+      return null;
+    case "mask":
+      return maskValue(value);
+    case "hash":
+      return `sha256_${stableChecksum(value)}`;
+    case "tokenize":
+      return stableScopedToken(value, context, path);
+    case "generalize":
+      return generalizeValue(value);
+  }
+}
+function policyForPath(path, key) {
+  const normalizedPath = normalizeKey(path);
+  const normalizedKey = key ? normalizeKey(key) : void 0;
+  return NORMALIZED_FIELD_POLICIES.find((policy) => {
+    if (policy.match === "key") {
+      return policy.value === normalizedKey;
+    }
+    return policy.value === normalizedPath;
+  });
+}
+function isPlainObject(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value) && !(value instanceof Date);
+}
+function anonymizeRecursive(value, context, dataClass, path, redactedFields, key) {
+  const fieldPolicy = policyForPath(path, key);
+  if (fieldPolicy && value !== null && value !== void 0) {
+    redactedFields.push({
+      fieldPath: path,
+      method: fieldPolicy.method,
+      policyVersion: context.policyVersion ?? ANONYMIZATION_POLICY_VERSION,
+      jobId: context.jobId,
+      redactedAt: (context.redactedAt ?? /* @__PURE__ */ new Date()).toISOString(),
+      reason: context.reason,
+      dataClass,
+      beforeChecksum: stableChecksum(value)
+    });
+    return applyMethod(value, fieldPolicy.method, context, path);
+  }
+  if (Array.isArray(value)) {
+    return value.map(
+      (item, index) => anonymizeRecursive(item, context, dataClass, `${path}[${index}]`, redactedFields)
+    );
+  }
+  if (!isPlainObject(value)) {
+    return value;
+  }
+  const result = {};
+  for (const [childKey, childValue] of Object.entries(value)) {
+    if (childKey === "_privacy") {
+      result[childKey] = childValue;
+      continue;
+    }
+    const anonymized = anonymizeRecursive(
+      childValue,
+      context,
+      dataClass,
+      `${path}.${childKey}`,
+      redactedFields,
+      childKey
+    );
+    if (anonymized !== void 0) {
+      result[childKey] = anonymized;
+    }
+  }
+  return result;
+}
+function buildMetadata(context, dataClass, redactedFields) {
+  return {
+    redactionState: "anonymized",
+    policyVersion: context.policyVersion ?? ANONYMIZATION_POLICY_VERSION,
+    jobId: context.jobId,
+    redactedAt: (context.redactedAt ?? /* @__PURE__ */ new Date()).toISOString(),
+    reason: context.reason,
+    dataClass,
+    redactedFields,
+    preservedSemantics: DEFAULT_PRESERVED_SEMANTICS
+  };
+}
+var FieldRedactor = class {
+  redactField(value, method, context, path) {
+    return applyMethod(value, method, context, path);
+  }
+  mask(value) {
+    return maskValue(value);
+  }
+  hash(value) {
+    return `sha256_${stableChecksum(value)}`;
+  }
+  tokenize(value, context, path) {
+    return stableScopedToken(value, context, path);
+  }
+  generalize(value) {
+    return generalizeValue(value);
+  }
+};
+var AnonymizationEngine = class {
+  anonymizeJsonValue(value, context, dataClass) {
+    return this.anonymizeJsonValueAtPath(value, context, dataClass, "$");
+  }
+  anonymizeJsonValueAtPath(value, context, dataClass, basePath) {
+    const redactedFields = [];
+    const anonymizedValue = anonymizeRecursive(
+      value,
+      context,
+      dataClass,
+      basePath,
+      redactedFields
+    );
+    return {
+      value: anonymizedValue,
+      metadata: buildMetadata(context, dataClass, redactedFields)
+    };
+  }
+  anonymizeAssetEventPayload(event, context) {
+    const result = this.anonymizeJsonValue(event.payload, context, "asset_event");
+    const payload = isPlainObject(result.value) ? { ...result.value, _privacy: result.metadata } : { value: result.value, _privacy: result.metadata };
+    return { value: payload, metadata: result.metadata };
+  }
+  anonymizeEvidencePacket(packet, context) {
+    const result = this.anonymizeJsonValue(packet.packet, context, "evidence_packet");
+    const redactionMetadata = {
+      ...isPlainObject(packet.redactionMetadata) ? packet.redactionMetadata : {},
+      lifecycleAnonymization: result.metadata
+    };
+    const anonymizedPacket = isPlainObject(result.value) ? { ...result.value, _privacy: result.metadata } : { value: result.value, _privacy: result.metadata };
+    return {
+      value: {
+        packet: anonymizedPacket,
+        redactionMetadata,
+        checksum: stableChecksum({ packet: anonymizedPacket, redactionMetadata })
+      },
+      metadata: result.metadata
+    };
+  }
+  buildAnonymizationLifecycleEvidence(input) {
+    const assetEvents = input.assetEvents ?? [];
+    const readModels = input.readModels ?? [];
+    const evidencePackets = input.evidencePackets ?? [];
+    const redactedFields = [
+      ...assetEvents.flatMap((item) => item.metadata.redactedFields),
+      ...readModels.flatMap((item) => item.metadata.redactedFields),
+      ...evidencePackets.flatMap((item) => item.metadata.redactedFields)
+    ];
+    return {
+      eventType: "AnonymizationApplied",
+      policyVersion: input.context.policyVersion ?? ANONYMIZATION_POLICY_VERSION,
+      jobId: input.context.jobId,
+      reason: input.context.reason,
+      appliedAt: (input.context.redactedAt ?? /* @__PURE__ */ new Date()).toISOString(),
+      tenantId: input.context.tenantId,
+      spaceId: input.context.spaceId ?? null,
+      counts: {
+        assetEvents: assetEvents.length,
+        readModels: readModels.length,
+        evidencePackets: evidencePackets.length,
+        redactedFields: redactedFields.length
+      },
+      records: [
+        ...assetEvents.map((item) => ({
+          recordClass: "asset_event",
+          recordId: item.event.id,
+          subjectType: item.event.subjectType,
+          subjectId: item.event.subjectId,
+          fieldManifest: item.metadata.redactedFields.map(
+            ({ fieldPath, method, beforeChecksum }) => ({
+              fieldPath,
+              method,
+              beforeChecksum
+            })
+          )
+        })),
+        ...readModels.map((item) => ({
+          recordClass: "read_model",
+          recordId: item.record.id,
+          subjectType: item.modelKind,
+          subjectId: item.record.id,
+          fieldManifest: item.metadata.redactedFields.map(
+            ({ fieldPath, method, beforeChecksum }) => ({
+              fieldPath,
+              method,
+              beforeChecksum
+            })
+          )
+        })),
+        ...evidencePackets.map((item) => ({
+          recordClass: "evidence_packet",
+          recordId: item.packet.id,
+          fieldManifest: item.metadata.redactedFields.map(
+            ({ fieldPath, method, beforeChecksum }) => ({
+              fieldPath,
+              method,
+              beforeChecksum
+            })
+          )
+        }))
+      ],
+      preservedSemantics: DEFAULT_PRESERVED_SEMANTICS
+    };
+  }
+};
+
+// privacy/index.ts
+var PLATFORM_PRIVACY_POLICY_VERSION = "fabric-platform-privacy-v1";
+var defaultEngine = new AnonymizationEngine();
+function anonymizeJsonValue(value, context, dataClass) {
+  return defaultEngine.anonymizeJsonValue(value, context, dataClass);
+}
+function anonymizeAssetEventPayload(event, context) {
+  return defaultEngine.anonymizeAssetEventPayload(event, context);
+}
+function anonymizeEvidencePacket(packet, context) {
+  return defaultEngine.anonymizeEvidencePacket(packet, context);
+}
+function buildAnonymizationLifecycleEvidence(input) {
+  return defaultEngine.buildAnonymizationLifecycleEvidence(input);
+}
+
+exports.ANONYMIZATION_POLICY_VERSION = ANONYMIZATION_POLICY_VERSION;
+exports.AnonymizationEngine = AnonymizationEngine;
+exports.FieldRedactor = FieldRedactor;
+exports.PLATFORM_PRIVACY_POLICY_VERSION = PLATFORM_PRIVACY_POLICY_VERSION;
+exports.anonymizeAssetEventPayload = anonymizeAssetEventPayload;
+exports.anonymizeEvidencePacket = anonymizeEvidencePacket;
+exports.anonymizeJsonValue = anonymizeJsonValue;
+exports.buildAnonymizationLifecycleEvidence = buildAnonymizationLifecycleEvidence;
+exports.stableChecksum = stableChecksum;
+//# sourceMappingURL=chunk-YQEXO3IQ.cjs.map
+//# sourceMappingURL=chunk-YQEXO3IQ.cjs.map

package/dist/chunk-YQEXO3IQ.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../privacy/engine.ts","../privacy/index.ts"],"names":["createHash"],"mappings":";;;;;AAWO,IAAM,4BAAA,GAA+B;AA2D5C,IAAM,2BAAA,GAA8B;AAAA,EACnC,UAAA;AAAA,EACA,SAAA;AAAA,EACA,aAAA;AAAA,EACA,WAAA;AAAA,EACA,WAAA;AAAA,EACA,UAAA;AAAA,EACA,YAAA;AAAA,EACA,YAAA;AAAA,EACA,oBAAA;AAAA,EACA,eAAA;AAAA,EACA,aAAA;AAAA,EACA;AACD,CAAA;AAEA,IAAM,cAAA,GAAgC;AAAA,EACrC,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,UAAA,EAAY,QAAQ,MAAA,EAAO;AAAA,EAClD,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,OAAA,EAAS,QAAQ,MAAA,EAAO;AAAA,EAC/C,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,QAAA,EAAU,QAAQ,MAAA,EAAO;AAAA,EAChD,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,eAAA,EAAiB,QAAQ,MAAA,EAAO;AAAA,EACvD,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,QAAQ,SAAA,EAAU;AAAA,EAChD,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,UAAA,EAAY,QAAQ,SAAA,EAAU;AAAA,EACrD,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,sBAAA,EAAwB,QAAQ,SAAA,EAAU;AAAA,EACjE,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,aAAA,EAAe,QAAQ,SAAA,EAAU;AAAA,EACxD,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,QAAQ,SAAA,EAAU;AAAA,EAChD,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,eAAA,EAAiB,QAAQ,SAAA,EAAU;AAAA,EAC1D,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,WAAA,EAAa,QAAQ,UAAA,EAAW;AAAA,EACvD,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,YAAA,EAAc,QAAQ,UAAA,EAAW;AAAA,EACxD,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,UAAA,EAAY,QAAQ,UAAA,EAAW;AAAA,EACtD,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,UAAA,EAAY,QAAQ,UAAA,EAAW;AAAA,EACtD,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,QAAQ,UAAA,EAAW;AAAA,EAClD,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,OAAA,EAAS,QAAQ,UAAA,EAAW;AAAA,EACnD,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,cAAA,EAAgB,QAAQ,UAAA,EAAW;AAAA,EAC1D,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,OAAA,EAAS,QAAQ,UAAA,EAAW;AAAA,EACnD,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,aAAA,EAAe,QAAQ,UAAA,EAAW;AAAA,EACzD,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,aAAA,EAAe,QAAQ,UAAA,EAAW;AAAA,EACzD,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,WAAA,EAAa,QAAQ,UAAA,EAAW;AAAA,EACvD,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,WAAA,EAAa,QAAQ,UAAA,EAAW;AAAA,EACvD,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,QAAA,EAAU,QAAQ,SAAA,EAAU;AAAA,EACnD,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,eAAA,EAAiB,QAAQ,SAAA,EAAU;AAAA,EAC1D,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,SAAA,EAAW,QAAQ,SAAA,EAAU;AAAA,EACpD,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,gBAAA,EAAkB,QAAQ,SAAA,EAAU;AAAA,EAC3D,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,eAAA,EAAiB,QAAQ,UAAA,EAAW;AAAA,EAC3D,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,gBAAA,EAAkB,QAAQ,UAAA,EAAW;AAAA,EAC5D,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,mBAAA,EAAqB,QAAQ,UAAA,EAAW;AAAA,EAC/D,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,QAAQ,UAAA,EAAW;AAAA,EACjD,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,QAAA,EAAU,QAAQ,UAAA;AAC1C,CAAA;AAEA,IAAM,yBAAA,GAA4B,cAAA,CAAe,GAAA,CAAI,CAAC,MAAA,MAAY;AAAA,EACjE,GAAG,MAAA;AAAA,EACH,KAAA,EAAO,YAAA,CAAa,MAAA,CAAO,KAAK;AACjC,CAAA,CAAE,CAAA;AAEF,SAAS,aAAa,GAAA,EAAqB;AAC1C,EAAA,OAAO,GAAA,CAAI,OAAA,CAAQ,eAAA,EAAiB,EAAE,EAAE,WAAA,EAAY;AACrD;AAEO,SAAS,eAAe,KAAA,EAAwB;AACtD,EAAA,OAAOA,iBAAA,CAAW,QAAQ,CAAA,CAAE,MAAA,CAAO,IAAA,CAAK,UAAU,KAAK,CAAC,CAAA,CAAE,MAAA,CAAO,KAAK,CAAA;AACvE;AAEA,SAAS,iBAAA,CACR,KAAA,EACA,OAAA,EACA,SAAA,EACS;AACT,EAAA,MAAM,KAAA,GAAQ,GAAG,OAAA,CAAQ,QAAQ,IAAI,OAAA,CAAQ,OAAA,IAAW,QAAQ,CAAA,CAAA,EAAI,SAAS,CAAA,CAAA;AAC7E,EAAA,OAAO,CAAA,IAAA,EAAOA,kBAAW,QAAQ,CAAA,CAC/B,OAAO,CAAA,EAAG,OAAA,CAAQ,aAAA,IAAiB,4BAA4B,CAAA,CAAA,EAAI,KAAK,IAAI,MAAA,CAAO,KAAK,CAAC,CAAA,CAAE,CAAA,CAC3F,MAAA,CAAO,KAAK,CAAA,CACZ,KAAA,CAAM,CAAA,EAAG,EAAE,CAAC,CAAA,CAAA;AACf;AAEA,SAAS,UAAU,KAAA,EAA+B;AACjD,EAAA,IAAI,KAAA,KAAU,IAAA,IAAQ,KAAA,KAAU,MAAA,EAAW;AAC1C,IAAA,OAAO,IAAA;AAAA,EACR;AAEA,EAAA,MAAM,WAAA,GAAc,OAAO,KAAK,CAAA;AAChC,EAAA,IAAI,WAAA,CAAY,UAAU,CAAA,EAAG;AAC5B,IAAA,OAAO,MAAA;AAAA,EACR;AAEA,EAAA,OAAO,CAAA,EAAG,GAAA,CAAI,MAAA,CAAO,IAAA,CAAK,IAAI,WAAA,CAAY,MAAA,GAAS,CAAA,EAAG,CAAC,CAAC,CAAC,CAAA,EAAG,WAAA,CAAY,KAAA,CAAM,EAAE,CAAC,CAAA,CAAA;AAClF;AAEA,SAAS,gBAAgB,KAAA,EAAyB;AACjD,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC9B,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,KAAA,GAAQ,GAAI,CAAA,GAAI,GAAA;AAAA,EACnC;AAEA,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,oBAAA,CAAqB,IAAA,CAAK,KAAK,CAAA,EAAG;AAClE,IAAA,OAAO,CAAA,EAAG,KAAA,CAAM,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,EAAA,CAAA;AAAA,EAC5B;AAEA,EAAA,OAAO,IAAA;AACR;AAEA,SAAS,WAAA,CACR,KAAA,EACA,MAAA,EACA,OAAA,EACA,IAAA,EACU;AACV,EAAA,QAAQ,MAAA;AAAQ,IACf,KAAK,MAAA;AACJ,MAAA,OAAO,MAAA;AAAA,IACR,KAAK,SAAA;AACJ,MAAA,OAAO,IAAA;AAAA,IACR,KAAK,MAAA;AACJ,MAAA,OAAO,UAAU,KAAK,CAAA;AAAA,IACvB,KAAK,MAAA;AACJ,MAAA,OAAO,CAAA,OAAA,EAAU,cAAA,CAAe,KAAK,CAAC,CAAA,CAAA;AAAA,IACvC,KAAK,UAAA;AACJ,MAAA,OAAO,iBAAA,CAAkB,KAAA,EAAO,OAAA,EAAS,IAAI,CAAA;AAAA,IAC9C,KAAK,YAAA;AACJ,MAAA,OAAO,gBAAgB,KAAK,CAAA;AAAA;AAE/B;AAEA,SAAS,aAAA,CAAc,MAAc,GAAA,EAAuC;AAC3E,EAAA,MAAM,cAAA,GAAiB,aAAa,IAAI,CAAA;AACxC,EAAA,MAAM,aAAA,GAAgB,GAAA,GAAM,YAAA,CAAa,GAAG,CAAA,GAAI,MAAA;AAEhD,EAAA,OAAO,yBAAA,CAA0B,IAAA,CAAK,CAAC,MAAA,KAAW;AACjD,IAAA,IAAI,MAAA,CAAO,UAAU,KAAA,EAAO;AAC3B,MAAA,OAAO,OAAO,KAAA,KAAU,aAAA;AAAA,IACzB;AAEA,IAAA,OAAO,OAAO,KAAA,KAAU,cAAA;AAAA,EACzB,CAAC,CAAA;AACF;AAEA,SAAS,cAAc,KAAA,EAAqC;AAC3D,EAAA,OACC,OAAA,CAAQ,KAAK,CAAA,IAAK,OAAO,KAAA,KAAU,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,IAAK,EAAE,KAAA,YAAiB,IAAA,CAAA;AAE7F;AAEA,SAAS,mBACR,KAAA,EACA,OAAA,EACA,SAAA,EACA,IAAA,EACA,gBACA,GAAA,EACU;AACV,EAAA,MAAM,WAAA,GAAc,aAAA,CAAc,IAAA,EAAM,GAAG,CAAA;AAC3C,EAAA,IAAI,WAAA,IAAe,KAAA,KAAU,IAAA,IAAQ,KAAA,KAAU,MAAA,EAAW;AACzD,IAAA,cAAA,CAAe,IAAA,CAAK;AAAA,MACnB,SAAA,EAAW,IAAA;AAAA,MACX,QAAQ,WAAA,CAAY,MAAA;AAAA,MACpB,aAAA,EAAe,QAAQ,aAAA,IAAiB,4BAAA;AAAA,MACxC,OAAO,OAAA,CAAQ,KAAA;AAAA,MACf,aAAa,OAAA,CAAQ,UAAA,oBAAc,IAAI,IAAA,IAAQ,WAAA,EAAY;AAAA,MAC3D,QAAQ,OAAA,CAAQ,MAAA;AAAA,MAChB,SAAA;AAAA,MACA,cAAA,EAAgB,eAAe,KAAK;AAAA,KACpC,CAAA;AAED,IAAA,OAAO,WAAA,CAAY,KAAA,EAAO,WAAA,CAAY,MAAA,EAAQ,SAAS,IAAI,CAAA;AAAA,EAC5D;AAEA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACzB,IAAA,OAAO,KAAA,CAAM,GAAA;AAAA,MAAI,CAAC,IAAA,EAAM,KAAA,KACvB,kBAAA,CAAmB,IAAA,EAAM,OAAA,EAAS,SAAA,EAAW,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,KAAK,CAAA,CAAA,CAAA,EAAK,cAAc;AAAA,KACjF;AAAA,EACD;AAEA,EAAA,IAAI,CAAC,aAAA,CAAc,KAAK,CAAA,EAAG;AAC1B,IAAA,OAAO,KAAA;AAAA,EACR;AAEA,EAAA,MAAM,SAAqB,EAAC;AAC5B,EAAA,KAAA,MAAW,CAAC,QAAA,EAAU,UAAU,KAAK,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA,EAAG;AAC3D,IAAA,IAAI,aAAa,UAAA,EAAY;AAC5B,MAAA,MAAA,CAAO,QAAQ,CAAA,GAAI,UAAA;AACnB,MAAA;AAAA,IACD;AAEA,IAAA,MAAM,UAAA,GAAa,kBAAA;AAAA,MAClB,UAAA;AAAA,MACA,OAAA;AAAA,MACA,SAAA;AAAA,MACA,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,QAAQ,CAAA,CAAA;AAAA,MACnB,cAAA;AAAA,MACA;AAAA,KACD;AAEA,IAAA,IAAI,eAAe,MAAA,EAAW;AAC7B,MAAA,MAAA,CAAO,QAAQ,CAAA,GAAI,UAAA;AAAA,IACpB;AAAA,EACD;AAEA,EAAA,OAAO,MAAA;AACR;AAEA,SAAS,aAAA,CACR,OAAA,EACA,SAAA,EACA,cAAA,EACwB;AACxB,EAAA,OAAO;AAAA,IACN,cAAA,EAAgB,YAAA;AAAA,IAChB,aAAA,EAAe,QAAQ,aAAA,IAAiB,4BAAA;AAAA,IACxC,OAAO,OAAA,CAAQ,KAAA;AAAA,IACf,aAAa,OAAA,CAAQ,UAAA,oBAAc,IAAI,IAAA,IAAQ,WAAA,EAAY;AAAA,IAC3D,QAAQ,OAAA,CAAQ,MAAA;AAAA,IAChB,SAAA;AAAA,IACA,cAAA;AAAA,IACA,kBAAA,EAAoB;AAAA,GACrB;AACD;AAEO,IAAM,gBAAN,MAAoB;AAAA,EAC1B,WAAA,CAAY,KAAA,EAAgB,MAAA,EAAyB,OAAA,EAA+B,IAAA,EAAuB;AAC1G,IAAA,OAAO,WAAA,CAAY,KAAA,EAAO,MAAA,EAAQ,OAAA,EAAS,IAAI,CAAA;AAAA,EAChD;AAAA,EAEA,KAAK,KAAA,EAA+B;AACnC,IAAA,OAAO,UAAU,KAAK,CAAA;AAAA,EACvB;AAAA,EAEA,KAAK,KAAA,EAAwB;AAC5B,IAAA,OAAO,CAAA,OAAA,EAAU,cAAA,CAAe,KAAK,CAAC,CAAA,CAAA;AAAA,EACvC;AAAA,EAEA,QAAA,CAAS,KAAA,EAAgB,OAAA,EAA+B,IAAA,EAAsB;AAC7E,IAAA,OAAO,iBAAA,CAAkB,KAAA,EAAO,OAAA,EAAS,IAAI,CAAA;AAAA,EAC9C;AAAA,EAEA,WAAW,KAAA,EAAyB;AACnC,IAAA,OAAO,gBAAgB,KAAK,CAAA;AAAA,EAC7B;AACD;AAEO,IAAM,sBAAN,MAA0B;AAAA,EAChC,kBAAA,CACC,KAAA,EACA,OAAA,EACA,SAAA,EAC8B;AAC9B,IAAA,OAAO,IAAA,CAAK,wBAAA,CAAyB,KAAA,EAAO,OAAA,EAAS,WAAW,GAAG,CAAA;AAAA,EACpE;AAAA,EAEA,wBAAA,CACC,KAAA,EACA,OAAA,EACA,SAAA,EACA,QAAA,EAC8B;AAC9B,IAAA,MAAM,iBAA+C,EAAC;AACtD,IAAA,MAAM,eAAA,GAAkB,kBAAA;AAAA,MACvB,KAAA;AAAA,MACA,OAAA;AAAA,MACA,SAAA;AAAA,MACA,QAAA;AAAA,MACA;AAAA,KACD;AAEA,IAAA,OAAO;AAAA,MACN,KAAA,EAAO,eAAA;AAAA,MACP,QAAA,EAAU,aAAA,CAAc,OAAA,EAAS,SAAA,EAAW,cAAc;AAAA,KAC3D;AAAA,EACD;AAAA,EAEA,0BAAA,CACC,OACA,OAAA,EAC+B;AAC/B,IAAA,MAAM,SAAS,IAAA,CAAK,kBAAA,CAAmB,KAAA,CAAM,OAAA,EAAS,SAAS,aAAa,CAAA;AAC5E,IAAA,MAAM,UAAU,aAAA,CAAc,MAAA,CAAO,KAAK,CAAA,GACvC,EAAE,GAAG,MAAA,CAAO,KAAA,EAAO,UAAU,MAAA,CAAO,QAAA,KACpC,EAAE,KAAA,EAAO,OAAO,KAAA,EAAO,QAAA,EAAU,OAAO,QAAA,EAAS;AAEpD,IAAA,OAAO,EAAE,KAAA,EAAO,OAAA,EAAS,QAAA,EAAU,OAAO,QAAA,EAAS;AAAA,EACpD;AAAA,EAEA,uBAAA,CACC,QACA,OAAA,EAC6F;AAC7F,IAAA,MAAM,SAAS,IAAA,CAAK,kBAAA,CAAmB,MAAA,CAAO,MAAA,EAAQ,SAAS,iBAAiB,CAAA;AAChF,IAAA,MAAM,iBAAA,GAAoB;AAAA,MACzB,GAAI,aAAA,CAAc,MAAA,CAAO,iBAAiB,CAAA,GAAI,MAAA,CAAO,oBAAoB,EAAC;AAAA,MAC1E,wBAAwB,MAAA,CAAO;AAAA,KAChC;AACA,IAAA,MAAM,mBAAmB,aAAA,CAAc,MAAA,CAAO,KAAK,CAAA,GAChD,EAAE,GAAG,MAAA,CAAO,KAAA,EAAO,UAAU,MAAA,CAAO,QAAA,KACpC,EAAE,KAAA,EAAO,OAAO,KAAA,EAAO,QAAA,EAAU,OAAO,QAAA,EAAS;AAEpD,IAAA,OAAO;AAAA,MACN,KAAA,EAAO;AAAA,QACN,MAAA,EAAQ,gBAAA;AAAA,QACR,iBAAA;AAAA,QACA,UAAU,cAAA,CAAe,EAAE,MAAA,EAAQ,gBAAA,EAAkB,mBAAmB;AAAA,OACzE;AAAA,MACA,UAAU,MAAA,CAAO;AAAA,KAClB;AAAA,EACD;AAAA,EAEA,oCAAoC,KAAA,EASD;AAClC,IAAA,MAAM,WAAA,GAAc,KAAA,CAAM,WAAA,IAAe,EAAC;AAC1C,IAAA,MAAM,UAAA,GAAa,KAAA,CAAM,UAAA,IAAc,EAAC;AACxC,IAAA,MAAM,eAAA,GAAkB,KAAA,CAAM,eAAA,IAAmB,EAAC;AAClD,IAAA,MAAM,cAAA,GAAiB;AAAA,MACtB,GAAG,WAAA,CAAY,OAAA,CAAQ,CAAC,IAAA,KAAS,IAAA,CAAK,SAAS,cAAc,CAAA;AAAA,MAC7D,GAAG,UAAA,CAAW,OAAA,CAAQ,CAAC,IAAA,KAAS,IAAA,CAAK,SAAS,cAAc,CAAA;AAAA,MAC5D,GAAG,eAAA,CAAgB,OAAA,CAAQ,CAAC,IAAA,KAAS,IAAA,CAAK,SAAS,cAAc;AAAA,KAClE;AAEA,IAAA,OAAO;AAAA,MACN,SAAA,EAAW,sBAAA;AAAA,MACX,aAAA,EAAe,KAAA,CAAM,OAAA,CAAQ,aAAA,IAAiB,4BAAA;AAAA,MAC9C,KAAA,EAAO,MAAM,OAAA,CAAQ,KAAA;AAAA,MACrB,MAAA,EAAQ,MAAM,OAAA,CAAQ,MAAA;AAAA,MACtB,YAAY,KAAA,CAAM,OAAA,CAAQ,8BAAc,IAAI,IAAA,IAAQ,WAAA,EAAY;AAAA,MAChE,QAAA,EAAU,MAAM,OAAA,CAAQ,QAAA;AAAA,MACxB,OAAA,EAAS,KAAA,CAAM,OAAA,CAAQ,OAAA,IAAW,IAAA;AAAA,MAClC,MAAA,EAAQ;AAAA,QACP,aAAa,WAAA,CAAY,MAAA;AAAA,QACzB,YAAY,UAAA,CAAW,MAAA;AAAA,QACvB,iBAAiB,eAAA,CAAgB,MAAA;AAAA,QACjC,gBAAgB,cAAA,CAAe;AAAA,OAChC;AAAA,MACA,OAAA,EAAS;AAAA,QACR,GAAG,WAAA,CAAY,GAAA,CAAI,CAAC,IAAA,MAAU;AAAA,UAC7B,WAAA,EAAa,aAAA;AAAA,UACb,QAAA,EAAU,KAAK,KAAA,CAAM,EAAA;AAAA,UACrB,WAAA,EAAa,KAAK,KAAA,CAAM,WAAA;AAAA,UACxB,SAAA,EAAW,KAAK,KAAA,CAAM,SAAA;AAAA,UACtB,aAAA,EAAe,IAAA,CAAK,QAAA,CAAS,cAAA,CAAe,GAAA;AAAA,YAC3C,CAAC,EAAE,SAAA,EAAW,MAAA,EAAQ,gBAAe,MAAO;AAAA,cAC3C,SAAA;AAAA,cACA,MAAA;AAAA,cACA;AAAA,aACD;AAAA;AACD,SACD,CAAE,CAAA;AAAA,QACF,GAAG,UAAA,CAAW,GAAA,CAAI,CAAC,IAAA,MAAU;AAAA,UAC5B,WAAA,EAAa,YAAA;AAAA,UACb,QAAA,EAAU,KAAK,MAAA,CAAO,EAAA;AAAA,UACtB,aAAa,IAAA,CAAK,SAAA;AAAA,UAClB,SAAA,EAAW,KAAK,MAAA,CAAO,EAAA;AAAA,UACvB,aAAA,EAAe,IAAA,CAAK,QAAA,CAAS,cAAA,CAAe,GAAA;AAAA,YAC3C,CAAC,EAAE,SAAA,EAAW,MAAA,EAAQ,gBAAe,MAAO;AAAA,cAC3C,SAAA;AAAA,cACA,MAAA;AAAA,cACA;AAAA,aACD;AAAA;AACD,SACD,CAAE,CAAA;AAAA,QACF,GAAG,eAAA,CAAgB,GAAA,CAAI,CAAC,IAAA,MAAU;AAAA,UACjC,WAAA,EAAa,iBAAA;AAAA,UACb,QAAA,EAAU,KAAK,MAAA,CAAO,EAAA;AAAA,UACtB,aAAA,EAAe,IAAA,CAAK,QAAA,CAAS,cAAA,CAAe,GAAA;AAAA,YAC3C,CAAC,EAAE,SAAA,EAAW,MAAA,EAAQ,gBAAe,MAAO;AAAA,cAC3C,SAAA;AAAA,cACA,MAAA;AAAA,cACA;AAAA,aACD;AAAA;AACD,SACD,CAAE;AAAA,OACH;AAAA,MACA,kBAAA,EAAoB;AAAA,KACrB;AAAA,EACD;AACD;;;AC/bO,IAAM,+BAAA,GAAkC;AAqB/C,IAAM,aAAA,GAAgB,IAAI,mBAAA,EAAoB;AAEvC,SAAS,kBAAA,CACf,KAAA,EACA,OAAA,EACA,SAAA,EACgD;AAChD,EAAA,OAAO,aAAA,CAAc,kBAAA,CAAmB,KAAA,EAAO,OAAA,EAAS,SAAS,CAAA;AAClE;AAEO,SAAS,0BAAA,CACf,OACA,OAAA,EACiD;AACjD,EAAA,OAAO,aAAA,CAAc,0BAAA,CAA2B,KAAA,EAAO,OAAO,CAAA;AAC/D;AAEO,SAAS,uBAAA,CACf,QACA,OAAA,EAC+G;AAC/G,EAAA,OAAO,aAAA,CAAc,uBAAA,CAAwB,MAAA,EAAQ,OAAO,CAAA;AAC7D;AAEO,SAAS,oCAAoC,KAAA,EASjB;AAClC,EAAA,OAAO,aAAA,CAAc,oCAAoC,KAAK,CAAA;AAC/D","file":"chunk-YQEXO3IQ.cjs","sourcesContent":["import { createHash } from \"node:crypto\";\n\nimport type {\n\tAnonymizationContext,\n\tAnonymizationFieldMetadata,\n\tAnonymizationMetadata,\n\tAnonymizationResult,\n\tPlatformDataClass,\n\tRedactionMethod,\n} from \"./index\";\n\nexport const ANONYMIZATION_POLICY_VERSION = \"adr-026-platform-anonymization-v1\";\n\ntype JsonObject = Record<string, unknown>;\n\ninterface FieldPolicy {\n\tmethod: RedactionMethod;\n\tmatch: \"key\" | \"path\";\n\tvalue: string;\n}\n\nexport interface AssetEventLike {\n\tid: string;\n\ttenantId: string;\n\tspaceId: string;\n\teventType: string;\n\tsubjectType: string;\n\tsubjectId: string;\n\tactionInvocationId: string;\n\tpayload: unknown;\n\tsequence: number;\n\toccurredAt: Date;\n\trecordedAt: Date;\n\tcorrelationId: string;\n\tcausationId?: string | null;\n}\n\nexport interface EvidencePacketLike {\n\tid: string;\n\tpacket: unknown;\n\tredactionMetadata: unknown;\n\tchecksum: string;\n}\n\nexport interface AnonymizationLifecycleEvidence {\n\teventType: \"AnonymizationApplied\";\n\tpolicyVersion: string;\n\tjobId: string;\n\treason: string;\n\tappliedAt: string;\n\ttenantId: string;\n\tspaceId: string | null;\n\tcounts: {\n\t\tassetEvents: number;\n\t\treadModels: number;\n\t\tevidencePackets: number;\n\t\tredactedFields: number;\n\t};\n\trecords: Array<{\n\t\trecordClass: PlatformDataClass;\n\t\trecordId: string;\n\t\tsubjectType?: string;\n\t\tsubjectId?: string;\n\t\tfieldManifest: Array<\n\t\t\tPick<AnonymizationFieldMetadata, \"fieldPath\" | \"method\" | \"beforeChecksum\">\n\t\t>;\n\t}>;\n\tpreservedSemantics: string[];\n}\n\nconst DEFAULT_PRESERVED_SEMANTICS = [\n\t\"tenantId\",\n\t\"spaceId\",\n\t\"subjectType\",\n\t\"subjectId\",\n\t\"eventType\",\n\t\"sequence\",\n\t\"occurredAt\",\n\t\"recordedAt\",\n\t\"actionInvocationId\",\n\t\"correlationId\",\n\t\"causationId\",\n\t\"financialDecisionFacts\",\n];\n\nconst FIELD_POLICIES: FieldPolicy[] = [\n\t{ match: \"key\", value: \"password\", method: \"drop\" },\n\t{ match: \"key\", value: \"token\", method: \"drop\" },\n\t{ match: \"key\", value: \"apiKey\", method: \"drop\" },\n\t{ match: \"key\", value: \"authorization\", method: \"drop\" },\n\t{ match: \"key\", value: \"ssn\", method: \"nullify\" },\n\t{ match: \"key\", value: \"ssnLast4\", method: \"nullify\" },\n\t{ match: \"key\", value: \"socialSecurityNumber\", method: \"nullify\" },\n\t{ match: \"key\", value: \"dateOfBirth\", method: \"nullify\" },\n\t{ match: \"key\", value: \"dob\", method: \"nullify\" },\n\t{ match: \"key\", value: \"driverLicense\", method: \"nullify\" },\n\t{ match: \"key\", value: \"firstName\", method: \"tokenize\" },\n\t{ match: \"key\", value: \"middleName\", method: \"tokenize\" },\n\t{ match: \"key\", value: \"lastName\", method: \"tokenize\" },\n\t{ match: \"key\", value: \"fullName\", method: \"tokenize\" },\n\t{ match: \"key\", value: \"name\", method: \"tokenize\" },\n\t{ match: \"key\", value: \"email\", method: \"tokenize\" },\n\t{ match: \"key\", value: \"emailAddress\", method: \"tokenize\" },\n\t{ match: \"key\", value: \"phone\", method: \"tokenize\" },\n\t{ match: \"key\", value: \"phoneNumber\", method: \"tokenize\" },\n\t{ match: \"key\", value: \"mobilePhone\", method: \"tokenize\" },\n\t{ match: \"key\", value: \"homePhone\", method: \"tokenize\" },\n\t{ match: \"key\", value: \"workPhone\", method: \"tokenize\" },\n\t{ match: \"key\", value: \"street\", method: \"nullify\" },\n\t{ match: \"key\", value: \"streetAddress\", method: \"nullify\" },\n\t{ match: \"key\", value: \"address\", method: \"nullify\" },\n\t{ match: \"key\", value: \"mailingAddress\", method: \"nullify\" },\n\t{ match: \"key\", value: \"partnerLeadId\", method: \"tokenize\" },\n\t{ match: \"key\", value: \"externalLeadId\", method: \"tokenize\" },\n\t{ match: \"key\", value: \"loanApplicationId\", method: \"tokenize\" },\n\t{ match: \"key\", value: \"vin\", method: \"tokenize\" },\n\t{ match: \"key\", value: \"rawVin\", method: \"tokenize\" },\n];\n\nconst NORMALIZED_FIELD_POLICIES = FIELD_POLICIES.map((policy) => ({\n\t...policy,\n\tvalue: normalizeKey(policy.value),\n}));\n\nfunction normalizeKey(key: string): string {\n\treturn key.replace(/[^a-zA-Z0-9]/g, \"\").toLowerCase();\n}\n\nexport function stableChecksum(value: unknown): string {\n\treturn createHash(\"sha256\").update(JSON.stringify(value)).digest(\"hex\");\n}\n\nfunction stableScopedToken(\n\tvalue: unknown,\n\tcontext: AnonymizationContext,\n\tfieldPath: string,\n): string {\n\tconst scope = `${context.tenantId}:${context.spaceId ?? \"global\"}:${fieldPath}`;\n\treturn `tok_${createHash(\"sha256\")\n\t\t.update(`${context.policyVersion ?? ANONYMIZATION_POLICY_VERSION}:${scope}:${String(value)}`)\n\t\t.digest(\"hex\")\n\t\t.slice(0, 24)}`;\n}\n\nfunction maskValue(value: unknown): string | null {\n\tif (value === null || value === undefined) {\n\t\treturn null;\n\t}\n\n\tconst stringValue = String(value);\n\tif (stringValue.length <= 4) {\n\t\treturn \"****\";\n\t}\n\n\treturn `${\"*\".repeat(Math.max(stringValue.length - 4, 4))}${stringValue.slice(-4)}`;\n}\n\nfunction generalizeValue(value: unknown): unknown {\n\tif (typeof value === \"number\") {\n\t\treturn Math.round(value / 1000) * 1000;\n\t}\n\n\tif (typeof value === \"string\" && /^\\d{5}(?:-\\d{4})?$/.test(value)) {\n\t\treturn `${value.slice(0, 3)}**`;\n\t}\n\n\treturn null;\n}\n\nfunction applyMethod(\n\tvalue: unknown,\n\tmethod: RedactionMethod,\n\tcontext: AnonymizationContext,\n\tpath: string,\n): unknown {\n\tswitch (method) {\n\t\tcase \"drop\":\n\t\t\treturn undefined;\n\t\tcase \"nullify\":\n\t\t\treturn null;\n\t\tcase \"mask\":\n\t\t\treturn maskValue(value);\n\t\tcase \"hash\":\n\t\t\treturn `sha256_${stableChecksum(value)}`;\n\t\tcase \"tokenize\":\n\t\t\treturn stableScopedToken(value, context, path);\n\t\tcase \"generalize\":\n\t\t\treturn generalizeValue(value);\n\t}\n}\n\nfunction policyForPath(path: string, key?: string): FieldPolicy | undefined {\n\tconst normalizedPath = normalizeKey(path);\n\tconst normalizedKey = key ? normalizeKey(key) : undefined;\n\n\treturn NORMALIZED_FIELD_POLICIES.find((policy) => {\n\t\tif (policy.match === \"key\") {\n\t\t\treturn policy.value === normalizedKey;\n\t\t}\n\n\t\treturn policy.value === normalizedPath;\n\t});\n}\n\nfunction isPlainObject(value: unknown): value is JsonObject {\n\treturn (\n\t\tBoolean(value) && typeof value === \"object\" && !Array.isArray(value) && !(value instanceof Date)\n\t);\n}\n\nfunction anonymizeRecursive(\n\tvalue: unknown,\n\tcontext: AnonymizationContext,\n\tdataClass: PlatformDataClass,\n\tpath: string,\n\tredactedFields: AnonymizationFieldMetadata[],\n\tkey?: string,\n): unknown {\n\tconst fieldPolicy = policyForPath(path, key);\n\tif (fieldPolicy && value !== null && value !== undefined) {\n\t\tredactedFields.push({\n\t\t\tfieldPath: path,\n\t\t\tmethod: fieldPolicy.method,\n\t\t\tpolicyVersion: context.policyVersion ?? ANONYMIZATION_POLICY_VERSION,\n\t\t\tjobId: context.jobId,\n\t\t\tredactedAt: (context.redactedAt ?? new Date()).toISOString(),\n\t\t\treason: context.reason,\n\t\t\tdataClass,\n\t\t\tbeforeChecksum: stableChecksum(value),\n\t\t});\n\n\t\treturn applyMethod(value, fieldPolicy.method, context, path);\n\t}\n\n\tif (Array.isArray(value)) {\n\t\treturn value.map((item, index) =>\n\t\t\tanonymizeRecursive(item, context, dataClass, `${path}[${index}]`, redactedFields),\n\t\t);\n\t}\n\n\tif (!isPlainObject(value)) {\n\t\treturn value;\n\t}\n\n\tconst result: JsonObject = {};\n\tfor (const [childKey, childValue] of Object.entries(value)) {\n\t\tif (childKey === \"_privacy\") {\n\t\t\tresult[childKey] = childValue;\n\t\t\tcontinue;\n\t\t}\n\n\t\tconst anonymized = anonymizeRecursive(\n\t\t\tchildValue,\n\t\t\tcontext,\n\t\t\tdataClass,\n\t\t\t`${path}.${childKey}`,\n\t\t\tredactedFields,\n\t\t\tchildKey,\n\t\t);\n\n\t\tif (anonymized !== undefined) {\n\t\t\tresult[childKey] = anonymized;\n\t\t}\n\t}\n\n\treturn result;\n}\n\nfunction buildMetadata(\n\tcontext: AnonymizationContext,\n\tdataClass: PlatformDataClass,\n\tredactedFields: AnonymizationFieldMetadata[],\n): AnonymizationMetadata {\n\treturn {\n\t\tredactionState: \"anonymized\",\n\t\tpolicyVersion: context.policyVersion ?? ANONYMIZATION_POLICY_VERSION,\n\t\tjobId: context.jobId,\n\t\tredactedAt: (context.redactedAt ?? new Date()).toISOString(),\n\t\treason: context.reason,\n\t\tdataClass,\n\t\tredactedFields,\n\t\tpreservedSemantics: DEFAULT_PRESERVED_SEMANTICS,\n\t};\n}\n\nexport class FieldRedactor {\n\tredactField(value: unknown, method: RedactionMethod, context: AnonymizationContext, path: string): unknown {\n\t\treturn applyMethod(value, method, context, path);\n\t}\n\n\tmask(value: unknown): string | null {\n\t\treturn maskValue(value);\n\t}\n\n\thash(value: unknown): string {\n\t\treturn `sha256_${stableChecksum(value)}`;\n\t}\n\n\ttokenize(value: unknown, context: AnonymizationContext, path: string): string {\n\t\treturn stableScopedToken(value, context, path);\n\t}\n\n\tgeneralize(value: unknown): unknown {\n\t\treturn generalizeValue(value);\n\t}\n}\n\nexport class AnonymizationEngine {\n\tanonymizeJsonValue<TValue>(\n\t\tvalue: TValue,\n\t\tcontext: AnonymizationContext,\n\t\tdataClass: PlatformDataClass,\n\t): AnonymizationResult<TValue> {\n\t\treturn this.anonymizeJsonValueAtPath(value, context, dataClass, \"$\");\n\t}\n\n\tanonymizeJsonValueAtPath<TValue>(\n\t\tvalue: TValue,\n\t\tcontext: AnonymizationContext,\n\t\tdataClass: PlatformDataClass,\n\t\tbasePath: string,\n\t): AnonymizationResult<TValue> {\n\t\tconst redactedFields: AnonymizationFieldMetadata[] = [];\n\t\tconst anonymizedValue = anonymizeRecursive(\n\t\t\tvalue,\n\t\t\tcontext,\n\t\t\tdataClass,\n\t\t\tbasePath,\n\t\t\tredactedFields,\n\t\t) as TValue;\n\n\t\treturn {\n\t\t\tvalue: anonymizedValue,\n\t\t\tmetadata: buildMetadata(context, dataClass, redactedFields),\n\t\t};\n\t}\n\n\tanonymizeAssetEventPayload(\n\t\tevent: AssetEventLike,\n\t\tcontext: AnonymizationContext,\n\t): AnonymizationResult<unknown> {\n\t\tconst result = this.anonymizeJsonValue(event.payload, context, \"asset_event\");\n\t\tconst payload = isPlainObject(result.value)\n\t\t\t? { ...result.value, _privacy: result.metadata }\n\t\t\t: { value: result.value, _privacy: result.metadata };\n\n\t\treturn { value: payload, metadata: result.metadata };\n\t}\n\n\tanonymizeEvidencePacket(\n\t\tpacket: EvidencePacketLike,\n\t\tcontext: AnonymizationContext,\n\t): AnonymizationResult<Pick<EvidencePacketLike, \"packet\" | \"redactionMetadata\" | \"checksum\">> {\n\t\tconst result = this.anonymizeJsonValue(packet.packet, context, \"evidence_packet\");\n\t\tconst redactionMetadata = {\n\t\t\t...(isPlainObject(packet.redactionMetadata) ? packet.redactionMetadata : {}),\n\t\t\tlifecycleAnonymization: result.metadata,\n\t\t};\n\t\tconst anonymizedPacket = isPlainObject(result.value)\n\t\t\t? { ...result.value, _privacy: result.metadata }\n\t\t\t: { value: result.value, _privacy: result.metadata };\n\n\t\treturn {\n\t\t\tvalue: {\n\t\t\t\tpacket: anonymizedPacket,\n\t\t\t\tredactionMetadata,\n\t\t\t\tchecksum: stableChecksum({ packet: anonymizedPacket, redactionMetadata }),\n\t\t\t},\n\t\t\tmetadata: result.metadata,\n\t\t};\n\t}\n\n\tbuildAnonymizationLifecycleEvidence(input: {\n\t\tcontext: AnonymizationContext;\n\t\tassetEvents?: Array<{ event: AssetEventLike; metadata: AnonymizationMetadata }>;\n\t\treadModels?: Array<{\n\t\t\tmodelKind: string;\n\t\t\trecord: JsonObject & { id: string };\n\t\t\tmetadata: AnonymizationMetadata;\n\t\t}>;\n\t\tevidencePackets?: Array<{ packet: EvidencePacketLike; metadata: AnonymizationMetadata }>;\n\t}): AnonymizationLifecycleEvidence {\n\t\tconst assetEvents = input.assetEvents ?? [];\n\t\tconst readModels = input.readModels ?? [];\n\t\tconst evidencePackets = input.evidencePackets ?? [];\n\t\tconst redactedFields = [\n\t\t\t...assetEvents.flatMap((item) => item.metadata.redactedFields),\n\t\t\t...readModels.flatMap((item) => item.metadata.redactedFields),\n\t\t\t...evidencePackets.flatMap((item) => item.metadata.redactedFields),\n\t\t];\n\n\t\treturn {\n\t\t\teventType: \"AnonymizationApplied\",\n\t\t\tpolicyVersion: input.context.policyVersion ?? ANONYMIZATION_POLICY_VERSION,\n\t\t\tjobId: input.context.jobId,\n\t\t\treason: input.context.reason,\n\t\t\tappliedAt: (input.context.redactedAt ?? new Date()).toISOString(),\n\t\t\ttenantId: input.context.tenantId,\n\t\t\tspaceId: input.context.spaceId ?? null,\n\t\t\tcounts: {\n\t\t\t\tassetEvents: assetEvents.length,\n\t\t\t\treadModels: readModels.length,\n\t\t\t\tevidencePackets: evidencePackets.length,\n\t\t\t\tredactedFields: redactedFields.length,\n\t\t\t},\n\t\t\trecords: [\n\t\t\t\t...assetEvents.map((item) => ({\n\t\t\t\t\trecordClass: \"asset_event\" as PlatformDataClass,\n\t\t\t\t\trecordId: item.event.id,\n\t\t\t\t\tsubjectType: item.event.subjectType,\n\t\t\t\t\tsubjectId: item.event.subjectId,\n\t\t\t\t\tfieldManifest: item.metadata.redactedFields.map(\n\t\t\t\t\t\t({ fieldPath, method, beforeChecksum }) => ({\n\t\t\t\t\t\t\tfieldPath,\n\t\t\t\t\t\t\tmethod,\n\t\t\t\t\t\t\tbeforeChecksum,\n\t\t\t\t\t\t}),\n\t\t\t\t\t),\n\t\t\t\t})),\n\t\t\t\t...readModels.map((item) => ({\n\t\t\t\t\trecordClass: \"read_model\" as PlatformDataClass,\n\t\t\t\t\trecordId: item.record.id,\n\t\t\t\t\tsubjectType: item.modelKind,\n\t\t\t\t\tsubjectId: item.record.id,\n\t\t\t\t\tfieldManifest: item.metadata.redactedFields.map(\n\t\t\t\t\t\t({ fieldPath, method, beforeChecksum }) => ({\n\t\t\t\t\t\t\tfieldPath,\n\t\t\t\t\t\t\tmethod,\n\t\t\t\t\t\t\tbeforeChecksum,\n\t\t\t\t\t\t}),\n\t\t\t\t\t),\n\t\t\t\t})),\n\t\t\t\t...evidencePackets.map((item) => ({\n\t\t\t\t\trecordClass: \"evidence_packet\" as PlatformDataClass,\n\t\t\t\t\trecordId: item.packet.id,\n\t\t\t\t\tfieldManifest: item.metadata.redactedFields.map(\n\t\t\t\t\t\t({ fieldPath, method, beforeChecksum }) => ({\n\t\t\t\t\t\t\tfieldPath,\n\t\t\t\t\t\t\tmethod,\n\t\t\t\t\t\t\tbeforeChecksum,\n\t\t\t\t\t\t}),\n\t\t\t\t\t),\n\t\t\t\t})),\n\t\t\t],\n\t\t\tpreservedSemantics: DEFAULT_PRESERVED_SEMANTICS,\n\t\t};\n\t}\n}\n","export const PLATFORM_PRIVACY_POLICY_VERSION = \"fabric-platform-privacy-v1\";\n\nexport type RedactionMethod = \"nullify\" | \"mask\" | \"hash\" | \"tokenize\" | \"generalize\" | \"drop\";\n\nexport { ANONYMIZATION_POLICY_VERSION } from \"./engine\";\nexport {\n\tAnonymizationEngine,\n\tFieldRedactor,\n\tstableChecksum,\n\ttype AssetEventLike,\n\ttype EvidencePacketLike,\n\ttype AnonymizationLifecycleEvidence,\n} from \"./engine\";\n\nimport {\n\tAnonymizationEngine,\n\ttype AssetEventLike,\n\ttype EvidencePacketLike,\n\ttype AnonymizationLifecycleEvidence,\n} from \"./engine\";\n\nconst defaultEngine = new AnonymizationEngine();\n\nexport function anonymizeJsonValue<TValue>(\n\tvalue: TValue,\n\tcontext: import(\"./index\").AnonymizationContext,\n\tdataClass: import(\"./index\").PlatformDataClass,\n): import(\"./index\").AnonymizationResult<TValue> {\n\treturn defaultEngine.anonymizeJsonValue(value, context, dataClass);\n}\n\nexport function anonymizeAssetEventPayload(\n\tevent: AssetEventLike,\n\tcontext: import(\"./index\").AnonymizationContext,\n): import(\"./index\").AnonymizationResult<unknown> {\n\treturn defaultEngine.anonymizeAssetEventPayload(event, context);\n}\n\nexport function anonymizeEvidencePacket(\n\tpacket: EvidencePacketLike,\n\tcontext: import(\"./index\").AnonymizationContext,\n): import(\"./index\").AnonymizationResult<Pick<EvidencePacketLike, \"packet\" | \"redactionMetadata\" | \"checksum\">> {\n\treturn defaultEngine.anonymizeEvidencePacket(packet, context);\n}\n\nexport function buildAnonymizationLifecycleEvidence(input: {\n\tcontext: import(\"./index\").AnonymizationContext;\n\tassetEvents?: Array<{ event: AssetEventLike; metadata: import(\"./index\").AnonymizationMetadata }>;\n\treadModels?: Array<{\n\t\tmodelKind: string;\n\t\trecord: Record<string, unknown> & { id: string };\n\t\tmetadata: import(\"./index\").AnonymizationMetadata;\n\t}>;\n\tevidencePackets?: Array<{ packet: EvidencePacketLike; metadata: import(\"./index\").AnonymizationMetadata }>;\n}): AnonymizationLifecycleEvidence {\n\treturn defaultEngine.buildAnonymizationLifecycleEvidence(input);\n}\n\nexport type PlatformDataClass =\n\t| \"asset_event\"\n\t| \"read_model\"\n\t| \"raw_payload\"\n\t| \"evidence_packet\"\n\t| \"action_evidence\"\n\t| \"access_event\";\n\nexport interface RedactionRule {\n\tfieldPath: string;\n\tmethod: RedactionMethod;\n\treason: string;\n\tdataClass?: PlatformDataClass;\n}\n\nexport interface DataClassificationRule {\n\tfieldPath: string;\n\tclassification: string;\n\tcontainsDirectIdentifier?: boolean;\n\tcontainsSensitiveData?: boolean;\n}\n\nexport interface AnonymizationContext {\n\ttenantId: string;\n\tspaceId?: string | null;\n\tjobId: string;\n\treason: string;\n\tredactedAt?: Date;\n\tpolicyVersion?: string;\n}\n\nexport interface AnonymizationFieldMetadata {\n\tfieldPath: string;\n\tmethod: RedactionMethod;\n\tpolicyVersion: string;\n\tjobId: string;\n\tredactedAt: string;\n\treason: string;\n\tdataClass: PlatformDataClass;\n\tbeforeChecksum: string;\n}\n\nexport interface AnonymizationMetadata {\n\tredactionState: \"anonymized\";\n\tpolicyVersion: string;\n\tjobId: string;\n\tredactedAt: string;\n\treason: string;\n\tdataClass: PlatformDataClass;\n\tredactedFields: AnonymizationFieldMetadata[];\n\tpreservedSemantics: string[];\n}\n\nexport interface AnonymizationResult<TValue> {\n\tvalue: TValue;\n\tmetadata: AnonymizationMetadata;\n}\n\nexport interface AnalyticsDataContractSource {\n\tname: string;\n\tprivacyClass:\n\t\t| \"raw\"\n\t\t| \"operational_pii\"\n\t\t| \"tenant_scoped_tokenized\"\n\t\t| \"anonymized\"\n\t\t| \"aggregated\"\n\t\t| \"differentially_minimized\";\n\tcontainsDirectIdentifiers?: boolean;\n\tcontainsGloballyStablePersonTokens?: boolean;\n\tanonymizationPolicyVersion?: string;\n\tminimumGroupSize?: number;\n}\n\nexport interface AnalyticsDataContract {\n\tcontractId: string;\n\tstatus: \"draft\" | \"accepted\" | \"deprecated\";\n\tcrossTenant: boolean;\n\tacceptedBy?: string;\n\tacceptedAt?: string;\n\tadrReference?: string;\n\tsources: AnalyticsDataContractSource[];\n}\n\nexport interface AnalyticsEligibilityDecision {\n\teligible: boolean;\n\tpolicyVersion: string;\n\treasons: string[];\n}\n\nexport interface RetentionRule {\n\tdataClass: PlatformDataClass;\n\tretainForDays: number;\n\tafterRetention: \"delete\" | \"anonymize\" | \"archive\";\n\tlegalHoldExempt?: boolean;\n}\n"]}

package/dist/index.cjs

@@ -1,77 +1,22 @@
 'use strict';
 
-var chunkLHCSVEFT_cjs = require('./chunk-LHCSVEFT.cjs');
-var chunkQ3WYIWCN_cjs = require('./chunk-Q3WYIWCN.cjs');
-var chunkYZKUEC2J_cjs = require('./chunk-YZKUEC2J.cjs');
-var chunkNPVIFZQV_cjs = require('./chunk-NPVIFZQV.cjs');
-require('./chunk-PG5LYTUX.cjs');
-var chunkLZSE6QGQ_cjs = require('./chunk-LZSE6QGQ.cjs');
 var chunkOWJ3PPNH_cjs = require('./chunk-OWJ3PPNH.cjs');
 var chunkQETQGAXJ_cjs = require('./chunk-QETQGAXJ.cjs');
 var chunkSQXWXN5U_cjs = require('./chunk-SQXWXN5U.cjs');
+var chunkYQEXO3IQ_cjs = require('./chunk-YQEXO3IQ.cjs');
+var chunkQ3WYIWCN_cjs = require('./chunk-Q3WYIWCN.cjs');
 var chunkUV252FLT_cjs = require('./chunk-UV252FLT.cjs');
+var chunkYZKUEC2J_cjs = require('./chunk-YZKUEC2J.cjs');
 var chunkRMI3BIND_cjs = require('./chunk-RMI3BIND.cjs');
+var chunkNPVIFZQV_cjs = require('./chunk-NPVIFZQV.cjs');
+var chunkF3E5SXPN_cjs = require('./chunk-F3E5SXPN.cjs');
 var chunkEO4VSB2O_cjs = require('./chunk-EO4VSB2O.cjs');
 var chunkJAXDEK5Z_cjs = require('./chunk-JAXDEK5Z.cjs');
+require('./chunk-PG5LYTUX.cjs');
+var chunkLZSE6QGQ_cjs = require('./chunk-LZSE6QGQ.cjs');
 
 
 
-Object.defineProperty(exports, "PLATFORM_PRIVACY_POLICY_VERSION", {
-  enumerable: true,
-  get: function () { return chunkLHCSVEFT_cjs.PLATFORM_PRIVACY_POLICY_VERSION; }
-});
-Object.defineProperty(exports, "replayEvents", {
-  enumerable: true,
-  get: function () { return chunkQ3WYIWCN_cjs.replayEvents; }
-});
-Object.defineProperty(exports, "createDeterministicIdFactory", {
-  enumerable: true,
-  get: function () { return chunkYZKUEC2J_cjs.createDeterministicIdFactory; }
-});
-Object.defineProperty(exports, "createFakeActionContext", {
-  enumerable: true,
-  get: function () { return chunkYZKUEC2J_cjs.createFakeActionContext; }
-});
-Object.defineProperty(exports, "createInMemoryAdapterRegistry", {
-  enumerable: true,
-  get: function () { return chunkYZKUEC2J_cjs.createInMemoryAdapterRegistry; }
-});
-Object.defineProperty(exports, "AdapterRegistry", {
-  enumerable: true,
-  get: function () { return chunkNPVIFZQV_cjs.AdapterRegistry; }
-});
-Object.defineProperty(exports, "MissingAdapterRegistrationError", {
-  enumerable: true,
-  get: function () { return chunkNPVIFZQV_cjs.MissingAdapterRegistrationError; }
-});
-Object.defineProperty(exports, "executeWithAdapterRetry", {
-  enumerable: true,
-  get: function () { return chunkNPVIFZQV_cjs.executeWithAdapterRetry; }
-});
-Object.defineProperty(exports, "getRetryDelayMs", {
-  enumerable: true,
-  get: function () { return chunkNPVIFZQV_cjs.getRetryDelayMs; }
-});
-Object.defineProperty(exports, "resolveAdapterRetryPolicy", {
-  enumerable: true,
-  get: function () { return chunkNPVIFZQV_cjs.resolveAdapterRetryPolicy; }
-});
-Object.defineProperty(exports, "FABRIC_ID_PREFIXES", {
-  enumerable: true,
-  get: function () { return chunkLZSE6QGQ_cjs.FABRIC_ID_PREFIXES; }
-});
-Object.defineProperty(exports, "createFabricId", {
-  enumerable: true,
-  get: function () { return chunkLZSE6QGQ_cjs.createFabricId; }
-});
-Object.defineProperty(exports, "isFabricId", {
-  enumerable: true,
-  get: function () { return chunkLZSE6QGQ_cjs.isFabricId; }
-});
-Object.defineProperty(exports, "parseFabricId", {
-  enumerable: true,
-  get: function () { return chunkLZSE6QGQ_cjs.parseFabricId; }
-});
 Object.defineProperty(exports, "createModuleRegistry", {
   enumerable: true,
   get: function () { return chunkOWJ3PPNH_cjs.createModuleRegistry; }
@@ -160,6 +105,46 @@ Object.defineProperty(exports, "validatePolicyGuidance", {
   enumerable: true,
   get: function () { return chunkSQXWXN5U_cjs.validatePolicyGuidance; }
 });
+Object.defineProperty(exports, "ANONYMIZATION_POLICY_VERSION", {
+  enumerable: true,
+  get: function () { return chunkYQEXO3IQ_cjs.ANONYMIZATION_POLICY_VERSION; }
+});
+Object.defineProperty(exports, "AnonymizationEngine", {
+  enumerable: true,
+  get: function () { return chunkYQEXO3IQ_cjs.AnonymizationEngine; }
+});
+Object.defineProperty(exports, "FieldRedactor", {
+  enumerable: true,
+  get: function () { return chunkYQEXO3IQ_cjs.FieldRedactor; }
+});
+Object.defineProperty(exports, "PLATFORM_PRIVACY_POLICY_VERSION", {
+  enumerable: true,
+  get: function () { return chunkYQEXO3IQ_cjs.PLATFORM_PRIVACY_POLICY_VERSION; }
+});
+Object.defineProperty(exports, "anonymizeAssetEventPayload", {
+  enumerable: true,
+  get: function () { return chunkYQEXO3IQ_cjs.anonymizeAssetEventPayload; }
+});
+Object.defineProperty(exports, "anonymizeEvidencePacket", {
+  enumerable: true,
+  get: function () { return chunkYQEXO3IQ_cjs.anonymizeEvidencePacket; }
+});
+Object.defineProperty(exports, "anonymizeJsonValue", {
+  enumerable: true,
+  get: function () { return chunkYQEXO3IQ_cjs.anonymizeJsonValue; }
+});
+Object.defineProperty(exports, "buildAnonymizationLifecycleEvidence", {
+  enumerable: true,
+  get: function () { return chunkYQEXO3IQ_cjs.buildAnonymizationLifecycleEvidence; }
+});
+Object.defineProperty(exports, "stableChecksum", {
+  enumerable: true,
+  get: function () { return chunkYQEXO3IQ_cjs.stableChecksum; }
+});
+Object.defineProperty(exports, "replayEvents", {
+  enumerable: true,
+  get: function () { return chunkQ3WYIWCN_cjs.replayEvents; }
+});
 Object.defineProperty(exports, "getAllowedTransitions", {
   enumerable: true,
   get: function () { return chunkUV252FLT_cjs.getAllowedTransitions; }
@@ -184,6 +169,18 @@ Object.defineProperty(exports, "validateTransition", {
   enumerable: true,
   get: function () { return chunkUV252FLT_cjs.validateTransition; }
 });
+Object.defineProperty(exports, "createDeterministicIdFactory", {
+  enumerable: true,
+  get: function () { return chunkYZKUEC2J_cjs.createDeterministicIdFactory; }
+});
+Object.defineProperty(exports, "createFakeActionContext", {
+  enumerable: true,
+  get: function () { return chunkYZKUEC2J_cjs.createFakeActionContext; }
+});
+Object.defineProperty(exports, "createInMemoryAdapterRegistry", {
+  enumerable: true,
+  get: function () { return chunkYZKUEC2J_cjs.createInMemoryAdapterRegistry; }
+});
 Object.defineProperty(exports, "ACTOR_TYPES", {
   enumerable: true,
   get: function () { return chunkRMI3BIND_cjs.ACTOR_TYPES; }
@@ -224,6 +221,30 @@ Object.defineProperty(exports, "resolveRegisteredAction", {
   enumerable: true,
   get: function () { return chunkRMI3BIND_cjs.resolveRegisteredAction; }
 });
+Object.defineProperty(exports, "AdapterRegistry", {
+  enumerable: true,
+  get: function () { return chunkNPVIFZQV_cjs.AdapterRegistry; }
+});
+Object.defineProperty(exports, "MissingAdapterRegistrationError", {
+  enumerable: true,
+  get: function () { return chunkNPVIFZQV_cjs.MissingAdapterRegistrationError; }
+});
+Object.defineProperty(exports, "executeWithAdapterRetry", {
+  enumerable: true,
+  get: function () { return chunkNPVIFZQV_cjs.executeWithAdapterRetry; }
+});
+Object.defineProperty(exports, "getRetryDelayMs", {
+  enumerable: true,
+  get: function () { return chunkNPVIFZQV_cjs.getRetryDelayMs; }
+});
+Object.defineProperty(exports, "resolveAdapterRetryPolicy", {
+  enumerable: true,
+  get: function () { return chunkNPVIFZQV_cjs.resolveAdapterRetryPolicy; }
+});
+Object.defineProperty(exports, "AgentActionPolicyRegistry", {
+  enumerable: true,
+  get: function () { return chunkF3E5SXPN_cjs.AgentActionPolicyRegistry; }
+});
 Object.defineProperty(exports, "denormalizeDisplaySnapshot", {
   enumerable: true,
   get: function () { return chunkEO4VSB2O_cjs.denormalizeDisplaySnapshot; }
@@ -268,5 +289,21 @@ Object.defineProperty(exports, "registerSubjectType", {
   enumerable: true,
   get: function () { return chunkJAXDEK5Z_cjs.registerSubjectType; }
 });
+Object.defineProperty(exports, "FABRIC_ID_PREFIXES", {
+  enumerable: true,
+  get: function () { return chunkLZSE6QGQ_cjs.FABRIC_ID_PREFIXES; }
+});
+Object.defineProperty(exports, "createFabricId", {
+  enumerable: true,
+  get: function () { return chunkLZSE6QGQ_cjs.createFabricId; }
+});
+Object.defineProperty(exports, "isFabricId", {
+  enumerable: true,
+  get: function () { return chunkLZSE6QGQ_cjs.isFabricId; }
+});
+Object.defineProperty(exports, "parseFabricId", {
+  enumerable: true,
+  get: function () { return chunkLZSE6QGQ_cjs.parseFabricId; }
+});
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map

package/dist/index.d.cts

@@ -8,6 +8,7 @@ export { DataPolicyComparisonOperator, DataPolicyCondition, DataPolicyConditionR
 export { StateClass, StateDefinition, StateMachineDatabaseClient, StateMachineDefinition, TransitionContext, getAllowedTransitions, getEntityStateClass, registerStateMachine, registerStateMachineIfMissing, resolveStateMachine, validateTransition } from './state-machines/index.cjs';
 export { ReplayEventsOptions, ReplayEventsResult, ReplayScope, ReplaySnapshot, ReplayWarning, ReplayWarningCode, ReplayableAssetEvent, replayEvents } from './projections/index.cjs';
 export { CachedDisplayDescriptor, DisplayContext, DisplayDatabaseClient, DisplayDescriptor, DisplayRenderer, DisplayRendererRegistration, denormalizeDisplaySnapshot, registerDisplayRenderer, renderEventDisplay, resolveDisplayRenderer } from './displays/index.cjs';
-export { AnalyticsDataContract, AnalyticsDataContractSource, AnalyticsEligibilityDecision, AnonymizationContext, AnonymizationFieldMetadata, AnonymizationMetadata, AnonymizationResult, DataClassificationRule, PLATFORM_PRIVACY_POLICY_VERSION, PlatformDataClass, RedactionMethod, RedactionRule, RetentionRule } from './privacy/index.cjs';
+export { ANONYMIZATION_POLICY_VERSION, AnalyticsDataContract, AnalyticsDataContractSource, AnalyticsEligibilityDecision, AnonymizationContext, AnonymizationEngine, AnonymizationFieldMetadata, AnonymizationLifecycleEvidence, AnonymizationMetadata, AnonymizationResult, AssetEventLike, DataClassificationRule, EvidencePacketLike, FieldRedactor, PLATFORM_PRIVACY_POLICY_VERSION, PlatformDataClass, RedactionMethod, RedactionRule, RetentionRule, anonymizeAssetEventPayload, anonymizeEvidencePacket, anonymizeJsonValue, buildAnonymizationLifecycleEvidence, stableChecksum } from './privacy/index.cjs';
 export { EvidenceGenerationContext, EvidencePacketEnvelope, EvidencePacketReference, EvidencePacketStatus, EvidencePacketSubject, EvidenceRenderer } from './evidence/index.cjs';
+export { AgentActionPolicyContext, AgentActionPolicyDecision, AgentActionPolicyDefinition, AgentActionPolicyEvaluator, AgentActionPolicyRegistry, AgentActionRiskTier, AgentActionRoute } from './agent-hitl/index.cjs';
 export { FakeActionContextOptions, createDeterministicIdFactory, createFakeActionContext, createInMemoryAdapterRegistry } from './testing/index.cjs';

package/dist/index.d.ts

@@ -8,6 +8,7 @@ export { DataPolicyComparisonOperator, DataPolicyCondition, DataPolicyConditionR
 export { StateClass, StateDefinition, StateMachineDatabaseClient, StateMachineDefinition, TransitionContext, getAllowedTransitions, getEntityStateClass, registerStateMachine, registerStateMachineIfMissing, resolveStateMachine, validateTransition } from './state-machines/index.js';
 export { ReplayEventsOptions, ReplayEventsResult, ReplayScope, ReplaySnapshot, ReplayWarning, ReplayWarningCode, ReplayableAssetEvent, replayEvents } from './projections/index.js';
 export { CachedDisplayDescriptor, DisplayContext, DisplayDatabaseClient, DisplayDescriptor, DisplayRenderer, DisplayRendererRegistration, denormalizeDisplaySnapshot, registerDisplayRenderer, renderEventDisplay, resolveDisplayRenderer } from './displays/index.js';
-export { AnalyticsDataContract, AnalyticsDataContractSource, AnalyticsEligibilityDecision, AnonymizationContext, AnonymizationFieldMetadata, AnonymizationMetadata, AnonymizationResult, DataClassificationRule, PLATFORM_PRIVACY_POLICY_VERSION, PlatformDataClass, RedactionMethod, RedactionRule, RetentionRule } from './privacy/index.js';
+export { ANONYMIZATION_POLICY_VERSION, AnalyticsDataContract, AnalyticsDataContractSource, AnalyticsEligibilityDecision, AnonymizationContext, AnonymizationEngine, AnonymizationFieldMetadata, AnonymizationLifecycleEvidence, AnonymizationMetadata, AnonymizationResult, AssetEventLike, DataClassificationRule, EvidencePacketLike, FieldRedactor, PLATFORM_PRIVACY_POLICY_VERSION, PlatformDataClass, RedactionMethod, RedactionRule, RetentionRule, anonymizeAssetEventPayload, anonymizeEvidencePacket, anonymizeJsonValue, buildAnonymizationLifecycleEvidence, stableChecksum } from './privacy/index.js';
 export { EvidenceGenerationContext, EvidencePacketEnvelope, EvidencePacketReference, EvidencePacketStatus, EvidencePacketSubject, EvidenceRenderer } from './evidence/index.js';
+export { AgentActionPolicyContext, AgentActionPolicyDecision, AgentActionPolicyDefinition, AgentActionPolicyEvaluator, AgentActionPolicyRegistry, AgentActionRiskTier, AgentActionRoute } from './agent-hitl/index.js';
 export { FakeActionContextOptions, createDeterministicIdFactory, createFakeActionContext, createInMemoryAdapterRegistry } from './testing/index.js';

package/dist/index.js

@@ -1,15 +1,16 @@
-export { PLATFORM_PRIVACY_POLICY_VERSION } from './chunk-N24NLCZ6.js';
-export { replayEvents } from './chunk-JSTGOT6P.js';
-export { createDeterministicIdFactory, createFakeActionContext, createInMemoryAdapterRegistry } from './chunk-IFMZPLM4.js';
-export { AdapterRegistry, MissingAdapterRegistrationError, executeWithAdapterRetry, getRetryDelayMs, resolveAdapterRetryPolicy } from './chunk-3ZW5USXF.js';
-import './chunk-OZLZHISS.js';
-export { FABRIC_ID_PREFIXES, createFabricId, isFabricId, parseFabricId } from './chunk-RALMUSOX.js';
 export { createModuleRegistry, getEventTypeName, getModuleDependencyNamespace, getObjectTypeName, registerFabricModule, registerFabricModules, validateModuleNamespace } from './chunk-IEVF52SU.js';
 export { assertObjectType, getRegisteredObjectTypes, isValidObjectType, registerObjectType } from './chunk-I35B576X.js';
 export { aggregatePolicyOutcomes, assertPolicyId, evaluatePolicyDefinition, evaluatePolicyDefinitions, evaluateRegisteredPolicies, getRegisteredPolicyIds, registerPolicy, registerPolicyIfMissing, resolvePolicy, validateDataPolicyDefinition, validatePolicyGuidance } from './chunk-HO4FICHH.js';
+export { ANONYMIZATION_POLICY_VERSION, AnonymizationEngine, FieldRedactor, PLATFORM_PRIVACY_POLICY_VERSION, anonymizeAssetEventPayload, anonymizeEvidencePacket, anonymizeJsonValue, buildAnonymizationLifecycleEvidence, stableChecksum } from './chunk-X7WC4AYC.js';
+export { replayEvents } from './chunk-JSTGOT6P.js';
 export { getAllowedTransitions, getEntityStateClass, registerStateMachine, registerStateMachineIfMissing, resolveStateMachine, validateTransition } from './chunk-T2JLSZN6.js';
+export { createDeterministicIdFactory, createFakeActionContext, createInMemoryAdapterRegistry } from './chunk-IFMZPLM4.js';
 export { ACTOR_TYPES, assertActionId, assertActorType, getRegisteredActionIds, isActorType, isRegisteredActionId, registerAction, registerActionIfMissing, resolveAction, resolveRegisteredAction } from './chunk-BJYRMUN2.js';
+export { AdapterRegistry, MissingAdapterRegistrationError, executeWithAdapterRetry, getRetryDelayMs, resolveAdapterRetryPolicy } from './chunk-3ZW5USXF.js';
+export { AgentActionPolicyRegistry } from './chunk-OFCCZ27Z.js';
 export { denormalizeDisplaySnapshot, registerDisplayRenderer, renderEventDisplay, resolveDisplayRenderer } from './chunk-O5WVBQ7P.js';
 export { createEventTypeRegistry, getRegisteredEventTypes, getRegisteredSubjectTypes, isValidEventType, isValidSubjectType, registerEventType, registerSubjectType } from './chunk-4YQOGV7H.js';
+import './chunk-OZLZHISS.js';
+export { FABRIC_ID_PREFIXES, createFabricId, isFabricId, parseFabricId } from './chunk-RALMUSOX.js';
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map