@fabricorg/platform 1.10.0 → 1.10.2

package/dist/engine-BqScuhrT.cjs

@@ -0,0 +1,246 @@
+let crypto = require("crypto");
+//#region privacy/engine.ts
+const ANONYMIZATION_POLICY_VERSION = "adr-026-platform-anonymization-v1";
+function normalizeKey(key) {
+	return key.replace(/[^a-zA-Z0-9]/g, "").toLowerCase();
+}
+function stableChecksum(value) {
+	return (0, crypto.createHash)("sha256").update(JSON.stringify(value)).digest("hex");
+}
+function stableScopedToken(value, context, fieldPath) {
+	const scope = `${context.tenantId}:${context.spaceId ?? "global"}:${fieldPath}`;
+	return `tok_${(0, crypto.createHash)("sha256").update(`${context.policyVersion ?? "adr-026-platform-anonymization-v1"}:${scope}:${String(value)}`).digest("hex").slice(0, 24)}`;
+}
+function maskValue(value) {
+	if (value === null || value === void 0) return null;
+	const stringValue = String(value);
+	if (stringValue.length <= 4) return "****";
+	return `${"*".repeat(Math.max(stringValue.length - 4, 4))}${stringValue.slice(-4)}`;
+}
+function generalizeValue(value) {
+	if (typeof value === "number") return Math.round(value / 1e3) * 1e3;
+	if (typeof value === "string" && /^\d{5}(?:-\d{4})?$/.test(value)) return `${value.slice(0, 3)}**`;
+	return null;
+}
+function applyMethod(value, method, context, path) {
+	switch (method) {
+		case "drop": return;
+		case "nullify": return null;
+		case "mask": return maskValue(value);
+		case "hash": return `sha256_${stableChecksum(value)}`;
+		case "tokenize": return stableScopedToken(value, context, path);
+		case "generalize": return generalizeValue(value);
+	}
+}
+function policyForPath(policies, path, key) {
+	const normalizedPath = normalizeKey(path);
+	const normalizedKey = key ? normalizeKey(key) : void 0;
+	return policies.find((policy) => {
+		const normalizedValue = normalizeKey(policy.value);
+		if (policy.match === "key") return normalizedValue === normalizedKey;
+		return normalizedValue === normalizedPath;
+	});
+}
+function isPlainObject(value) {
+	return Boolean(value) && typeof value === "object" && !Array.isArray(value) && !(value instanceof Date);
+}
+function anonymizeRecursive(value, context, dataClass, path, redactedFields, policies, key) {
+	const fieldPolicy = policyForPath(policies, path, key);
+	if (fieldPolicy && value !== null && value !== void 0) {
+		redactedFields.push({
+			fieldPath: path,
+			method: fieldPolicy.method,
+			policyVersion: context.policyVersion ?? "adr-026-platform-anonymization-v1",
+			jobId: context.jobId,
+			redactedAt: (context.redactedAt ?? /* @__PURE__ */ new Date()).toISOString(),
+			reason: context.reason,
+			dataClass,
+			beforeChecksum: stableChecksum(value)
+		});
+		return applyMethod(value, fieldPolicy.method, context, path);
+	}
+	if (Array.isArray(value)) return value.map((item, index) => anonymizeRecursive(item, context, dataClass, `${path}[${index}]`, redactedFields, policies));
+	if (!isPlainObject(value)) return value;
+	const result = {};
+	for (const [childKey, childValue] of Object.entries(value)) {
+		if (childKey === "_privacy") {
+			result[childKey] = childValue;
+			continue;
+		}
+		const anonymized = anonymizeRecursive(childValue, context, dataClass, `${path}.${childKey}`, redactedFields, policies, childKey);
+		if (anonymized !== void 0) result[childKey] = anonymized;
+	}
+	return result;
+}
+function buildMetadata(context, dataClass, redactedFields, preservedSemantics) {
+	return {
+		redactionState: "anonymized",
+		policyVersion: context.policyVersion ?? "adr-026-platform-anonymization-v1",
+		jobId: context.jobId,
+		redactedAt: (context.redactedAt ?? /* @__PURE__ */ new Date()).toISOString(),
+		reason: context.reason,
+		dataClass,
+		redactedFields,
+		preservedSemantics: [...preservedSemantics]
+	};
+}
+var FieldRedactor = class {
+	redactField(value, method, context, path) {
+		return applyMethod(value, method, context, path);
+	}
+	mask(value) {
+		return maskValue(value);
+	}
+	hash(value) {
+		return `sha256_${stableChecksum(value)}`;
+	}
+	tokenize(value, context, path) {
+		return stableScopedToken(value, context, path);
+	}
+	generalize(value) {
+		return generalizeValue(value);
+	}
+};
+var AnonymizationEngine = class {
+	#policy;
+	constructor(policy) {
+		this.#policy = {
+			fields: policy.fields.map((field) => ({ ...field })),
+			preservedSemantics: [...policy.preservedSemantics ?? []]
+		};
+	}
+	anonymizeJsonValue(value, context, dataClass) {
+		return this.anonymizeJsonValueAtPath(value, context, dataClass, "$");
+	}
+	anonymizeJsonValueAtPath(value, context, dataClass, basePath) {
+		const redactedFields = [];
+		return {
+			value: anonymizeRecursive(value, context, dataClass, basePath, redactedFields, this.#policy.fields),
+			metadata: buildMetadata(context, dataClass, redactedFields, this.#policy.preservedSemantics ?? [])
+		};
+	}
+	anonymizeAssetEventPayload(event, context) {
+		const result = this.anonymizeJsonValue(event.payload, context, "asset_event");
+		return {
+			value: isPlainObject(result.value) ? {
+				...result.value,
+				_privacy: result.metadata
+			} : {
+				value: result.value,
+				_privacy: result.metadata
+			},
+			metadata: result.metadata
+		};
+	}
+	anonymizeEvidencePacket(packet, context) {
+		const result = this.anonymizeJsonValue(packet.packet, context, "evidence_packet");
+		const redactionMetadata = {
+			...isPlainObject(packet.redactionMetadata) ? packet.redactionMetadata : {},
+			lifecycleAnonymization: result.metadata
+		};
+		const anonymizedPacket = isPlainObject(result.value) ? {
+			...result.value,
+			_privacy: result.metadata
+		} : {
+			value: result.value,
+			_privacy: result.metadata
+		};
+		return {
+			value: {
+				packet: anonymizedPacket,
+				redactionMetadata,
+				checksum: stableChecksum({
+					packet: anonymizedPacket,
+					redactionMetadata
+				})
+			},
+			metadata: result.metadata
+		};
+	}
+	buildAnonymizationLifecycleEvidence(input) {
+		const assetEvents = input.assetEvents ?? [];
+		const readModels = input.readModels ?? [];
+		const evidencePackets = input.evidencePackets ?? [];
+		const redactedFields = [
+			...assetEvents.flatMap((item) => item.metadata.redactedFields),
+			...readModels.flatMap((item) => item.metadata.redactedFields),
+			...evidencePackets.flatMap((item) => item.metadata.redactedFields)
+		];
+		return {
+			eventType: "AnonymizationApplied",
+			policyVersion: input.context.policyVersion ?? "adr-026-platform-anonymization-v1",
+			jobId: input.context.jobId,
+			reason: input.context.reason,
+			appliedAt: (input.context.redactedAt ?? /* @__PURE__ */ new Date()).toISOString(),
+			tenantId: input.context.tenantId,
+			spaceId: input.context.spaceId ?? null,
+			counts: {
+				assetEvents: assetEvents.length,
+				readModels: readModels.length,
+				evidencePackets: evidencePackets.length,
+				redactedFields: redactedFields.length
+			},
+			records: [
+				...assetEvents.map((item) => ({
+					recordClass: "asset_event",
+					recordId: item.event.id,
+					subjectType: item.event.subjectType,
+					subjectId: item.event.subjectId,
+					fieldManifest: item.metadata.redactedFields.map(({ fieldPath, method, beforeChecksum }) => ({
+						fieldPath,
+						method,
+						beforeChecksum
+					}))
+				})),
+				...readModels.map((item) => ({
+					recordClass: "read_model",
+					recordId: item.record.id,
+					subjectType: item.modelKind,
+					subjectId: item.record.id,
+					fieldManifest: item.metadata.redactedFields.map(({ fieldPath, method, beforeChecksum }) => ({
+						fieldPath,
+						method,
+						beforeChecksum
+					}))
+				})),
+				...evidencePackets.map((item) => ({
+					recordClass: "evidence_packet",
+					recordId: item.packet.id,
+					fieldManifest: item.metadata.redactedFields.map(({ fieldPath, method, beforeChecksum }) => ({
+						fieldPath,
+						method,
+						beforeChecksum
+					}))
+				}))
+			],
+			preservedSemantics: [...this.#policy.preservedSemantics ?? []]
+		};
+	}
+};
+//#endregion
+Object.defineProperty(exports, "ANONYMIZATION_POLICY_VERSION", {
+	enumerable: true,
+	get: function() {
+		return ANONYMIZATION_POLICY_VERSION;
+	}
+});
+Object.defineProperty(exports, "AnonymizationEngine", {
+	enumerable: true,
+	get: function() {
+		return AnonymizationEngine;
+	}
+});
+Object.defineProperty(exports, "FieldRedactor", {
+	enumerable: true,
+	get: function() {
+		return FieldRedactor;
+	}
+});
+Object.defineProperty(exports, "stableChecksum", {
+	enumerable: true,
+	get: function() {
+		return stableChecksum;
+	}
+});
+
+//# sourceMappingURL=engine-BqScuhrT.cjs.map

package/dist/engine-BqScuhrT.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine-BqScuhrT.cjs","names":["createHash"],"sources":["../privacy/engine.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\n\nimport type {\n\tAnonymizationContext,\n\tAnonymizationFieldMetadata,\n\tAnonymizationMetadata,\n\tAnonymizationResult,\n\tPlatformDataClass,\n\tRedactionMethod,\n} from \"./index\";\n\nexport const ANONYMIZATION_POLICY_VERSION = \"adr-026-platform-anonymization-v1\";\n\ntype JsonObject = Record<string, unknown>;\n\nexport interface AnonymizationFieldPolicy {\n\tmethod: RedactionMethod;\n\tmatch: \"key\" | \"path\";\n\tvalue: string;\n}\n\nexport interface AnonymizationPolicy {\n\tfields: readonly AnonymizationFieldPolicy[];\n\tpreservedSemantics?: readonly string[];\n}\n\nexport interface AssetEventLike {\n\tid: string;\n\ttenantId: string;\n\tspaceId: string;\n\teventType: string;\n\tsubjectType: string;\n\tsubjectId: string;\n\tactionInvocationId: string;\n\tpayload: unknown;\n\tsequence: number;\n\toccurredAt: Date;\n\trecordedAt: Date;\n\tcorrelationId: string;\n\tcausationId?: string | null;\n}\n\nexport interface EvidencePacketLike {\n\tid: string;\n\tpacket: unknown;\n\tredactionMetadata: unknown;\n\tchecksum: string;\n}\n\nexport interface AnonymizationLifecycleEvidence {\n\teventType: \"AnonymizationApplied\";\n\tpolicyVersion: string;\n\tjobId: string;\n\treason: string;\n\tappliedAt: string;\n\ttenantId: string;\n\tspaceId: string | null;\n\tcounts: {\n\t\tassetEvents: number;\n\t\treadModels: number;\n\t\tevidencePackets: number;\n\t\tredactedFields: number;\n\t};\n\trecords: Array<{\n\t\trecordClass: PlatformDataClass;\n\t\trecordId: string;\n\t\tsubjectType?: string;\n\t\tsubjectId?: string;\n\t\tfieldManifest: Array<\n\t\t\tPick<AnonymizationFieldMetadata, \"fieldPath\" | \"method\" | \"beforeChecksum\">\n\t\t>;\n\t}>;\n\tpreservedSemantics: string[];\n}\n\nfunction normalizeKey(key: string): string {\n\treturn key.replace(/[^a-zA-Z0-9]/g, \"\").toLowerCase();\n}\n\nexport function stableChecksum(value: unknown): string {\n\treturn createHash(\"sha256\").update(JSON.stringify(value)).digest(\"hex\");\n}\n\nfunction stableScopedToken(\n\tvalue: unknown,\n\tcontext: AnonymizationContext,\n\tfieldPath: string,\n): string {\n\tconst scope = `${context.tenantId}:${context.spaceId ?? \"global\"}:${fieldPath}`;\n\treturn `tok_${createHash(\"sha256\")\n\t\t.update(`${context.policyVersion ?? ANONYMIZATION_POLICY_VERSION}:${scope}:${String(value)}`)\n\t\t.digest(\"hex\")\n\t\t.slice(0, 24)}`;\n}\n\nfunction maskValue(value: unknown): string | null {\n\tif (value === null || value === undefined) {\n\t\treturn null;\n\t}\n\n\tconst stringValue = String(value);\n\tif (stringValue.length <= 4) {\n\t\treturn \"****\";\n\t}\n\n\treturn `${\"*\".repeat(Math.max(stringValue.length - 4, 4))}${stringValue.slice(-4)}`;\n}\n\nfunction generalizeValue(value: unknown): unknown {\n\tif (typeof value === \"number\") {\n\t\treturn Math.round(value / 1000) * 1000;\n\t}\n\n\tif (typeof value === \"string\" && /^\\d{5}(?:-\\d{4})?$/.test(value)) {\n\t\treturn `${value.slice(0, 3)}**`;\n\t}\n\n\treturn null;\n}\n\nfunction applyMethod(\n\tvalue: unknown,\n\tmethod: RedactionMethod,\n\tcontext: AnonymizationContext,\n\tpath: string,\n): unknown {\n\tswitch (method) {\n\t\tcase \"drop\":\n\t\t\treturn undefined;\n\t\tcase \"nullify\":\n\t\t\treturn null;\n\t\tcase \"mask\":\n\t\t\treturn maskValue(value);\n\t\tcase \"hash\":\n\t\t\treturn `sha256_${stableChecksum(value)}`;\n\t\tcase \"tokenize\":\n\t\t\treturn stableScopedToken(value, context, path);\n\t\tcase \"generalize\":\n\t\t\treturn generalizeValue(value);\n\t}\n}\n\nfunction policyForPath(policies: readonly AnonymizationFieldPolicy[], path: string, key?: string): AnonymizationFieldPolicy | undefined {\n\tconst normalizedPath = normalizeKey(path);\n\tconst normalizedKey = key ? normalizeKey(key) : undefined;\n\n\treturn policies.find((policy) => {\n\t\tconst normalizedValue = normalizeKey(policy.value);\n\t\tif (policy.match === \"key\") {\n\t\t\treturn normalizedValue === normalizedKey;\n\t\t}\n\n\t\treturn normalizedValue === normalizedPath;\n\t});\n}\n\nfunction isPlainObject(value: unknown): value is JsonObject {\n\treturn (\n\t\tBoolean(value) && typeof value === \"object\" && !Array.isArray(value) && !(value instanceof Date)\n\t);\n}\n\nfunction anonymizeRecursive(\n\tvalue: unknown,\n\tcontext: AnonymizationContext,\n\tdataClass: PlatformDataClass,\n\tpath: string,\n\tredactedFields: AnonymizationFieldMetadata[],\n\tpolicies: readonly AnonymizationFieldPolicy[],\n\tkey?: string,\n): unknown {\n\tconst fieldPolicy = policyForPath(policies, path, key);\n\tif (fieldPolicy && value !== null && value !== undefined) {\n\t\tredactedFields.push({\n\t\t\tfieldPath: path,\n\t\t\tmethod: fieldPolicy.method,\n\t\t\tpolicyVersion: context.policyVersion ?? ANONYMIZATION_POLICY_VERSION,\n\t\t\tjobId: context.jobId,\n\t\t\tredactedAt: (context.redactedAt ?? new Date()).toISOString(),\n\t\t\treason: context.reason,\n\t\t\tdataClass,\n\t\t\tbeforeChecksum: stableChecksum(value),\n\t\t});\n\n\t\treturn applyMethod(value, fieldPolicy.method, context, path);\n\t}\n\n\tif (Array.isArray(value)) {\n\t\treturn value.map((item, index) =>\n\t\t\tanonymizeRecursive(item, context, dataClass, `${path}[${index}]`, redactedFields, policies),\n\t\t);\n\t}\n\n\tif (!isPlainObject(value)) {\n\t\treturn value;\n\t}\n\n\tconst result: JsonObject = {};\n\tfor (const [childKey, childValue] of Object.entries(value)) {\n\t\tif (childKey === \"_privacy\") {\n\t\t\tresult[childKey] = childValue;\n\t\t\tcontinue;\n\t\t}\n\n\t\tconst anonymized = anonymizeRecursive(\n\t\t\tchildValue,\n\t\t\tcontext,\n\t\t\tdataClass,\n\t\t\t`${path}.${childKey}`,\n\t\t\tredactedFields,\n\t\t\tpolicies,\n\t\t\tchildKey,\n\t\t);\n\n\t\tif (anonymized !== undefined) {\n\t\t\tresult[childKey] = anonymized;\n\t\t}\n\t}\n\n\treturn result;\n}\n\nfunction buildMetadata(\n\tcontext: AnonymizationContext,\n\tdataClass: PlatformDataClass,\n\tredactedFields: AnonymizationFieldMetadata[],\n\tpreservedSemantics: readonly string[],\n): AnonymizationMetadata {\n\treturn {\n\t\tredactionState: \"anonymized\",\n\t\tpolicyVersion: context.policyVersion ?? ANONYMIZATION_POLICY_VERSION,\n\t\tjobId: context.jobId,\n\t\tredactedAt: (context.redactedAt ?? new Date()).toISOString(),\n\t\treason: context.reason,\n\t\tdataClass,\n\t\tredactedFields,\n\t\tpreservedSemantics: [...preservedSemantics],\n\t};\n}\n\nexport class FieldRedactor {\n\tredactField(value: unknown, method: RedactionMethod, context: AnonymizationContext, path: string): unknown {\n\t\treturn applyMethod(value, method, context, path);\n\t}\n\n\tmask(value: unknown): string | null {\n\t\treturn maskValue(value);\n\t}\n\n\thash(value: unknown): string {\n\t\treturn `sha256_${stableChecksum(value)}`;\n\t}\n\n\ttokenize(value: unknown, context: AnonymizationContext, path: string): string {\n\t\treturn stableScopedToken(value, context, path);\n\t}\n\n\tgeneralize(value: unknown): unknown {\n\t\treturn generalizeValue(value);\n\t}\n}\n\nexport class AnonymizationEngine {\n\treadonly #policy: AnonymizationPolicy;\n\n\tconstructor(policy: AnonymizationPolicy) {\n\t\tthis.#policy = {\n\t\t\tfields: policy.fields.map((field) => ({ ...field })),\n\t\t\tpreservedSemantics: [...(policy.preservedSemantics ?? [])],\n\t\t};\n\t}\n\n\tanonymizeJsonValue<TValue>(\n\t\tvalue: TValue,\n\t\tcontext: AnonymizationContext,\n\t\tdataClass: PlatformDataClass,\n\t): AnonymizationResult<TValue> {\n\t\treturn this.anonymizeJsonValueAtPath(value, context, dataClass, \"$\");\n\t}\n\n\tanonymizeJsonValueAtPath<TValue>(\n\t\tvalue: TValue,\n\t\tcontext: AnonymizationContext,\n\t\tdataClass: PlatformDataClass,\n\t\tbasePath: string,\n\t): AnonymizationResult<TValue> {\n\t\tconst redactedFields: AnonymizationFieldMetadata[] = [];\n\t\tconst anonymizedValue = anonymizeRecursive(\n\t\t\tvalue,\n\t\t\tcontext,\n\t\t\tdataClass,\n\t\t\tbasePath,\n\t\t\tredactedFields,\n\t\t\tthis.#policy.fields,\n\t\t) as TValue;\n\n\t\treturn {\n\t\t\tvalue: anonymizedValue,\n\t\t\tmetadata: buildMetadata(context, dataClass, redactedFields, this.#policy.preservedSemantics ?? []),\n\t\t};\n\t}\n\n\tanonymizeAssetEventPayload(\n\t\tevent: AssetEventLike,\n\t\tcontext: AnonymizationContext,\n\t): AnonymizationResult<unknown> {\n\t\tconst result = this.anonymizeJsonValue(event.payload, context, \"asset_event\");\n\t\tconst payload = isPlainObject(result.value)\n\t\t\t? { ...result.value, _privacy: result.metadata }\n\t\t\t: { value: result.value, _privacy: result.metadata };\n\n\t\treturn { value: payload, metadata: result.metadata };\n\t}\n\n\tanonymizeEvidencePacket(\n\t\tpacket: EvidencePacketLike,\n\t\tcontext: AnonymizationContext,\n\t): AnonymizationResult<Pick<EvidencePacketLike, \"packet\" | \"redactionMetadata\" | \"checksum\">> {\n\t\tconst result = this.anonymizeJsonValue(packet.packet, context, \"evidence_packet\");\n\t\tconst redactionMetadata = {\n\t\t\t...(isPlainObject(packet.redactionMetadata) ? packet.redactionMetadata : {}),\n\t\t\tlifecycleAnonymization: result.metadata,\n\t\t};\n\t\tconst anonymizedPacket = isPlainObject(result.value)\n\t\t\t? { ...result.value, _privacy: result.metadata }\n\t\t\t: { value: result.value, _privacy: result.metadata };\n\n\t\treturn {\n\t\t\tvalue: {\n\t\t\t\tpacket: anonymizedPacket,\n\t\t\t\tredactionMetadata,\n\t\t\t\tchecksum: stableChecksum({ packet: anonymizedPacket, redactionMetadata }),\n\t\t\t},\n\t\t\tmetadata: result.metadata,\n\t\t};\n\t}\n\n\tbuildAnonymizationLifecycleEvidence(input: {\n\t\tcontext: AnonymizationContext;\n\t\tassetEvents?: Array<{ event: AssetEventLike; metadata: AnonymizationMetadata }>;\n\t\treadModels?: Array<{\n\t\t\tmodelKind: string;\n\t\t\trecord: JsonObject & { id: string };\n\t\t\tmetadata: AnonymizationMetadata;\n\t\t}>;\n\t\tevidencePackets?: Array<{ packet: EvidencePacketLike; metadata: AnonymizationMetadata }>;\n\t}): AnonymizationLifecycleEvidence {\n\t\tconst assetEvents = input.assetEvents ?? [];\n\t\tconst readModels = input.readModels ?? [];\n\t\tconst evidencePackets = input.evidencePackets ?? [];\n\t\tconst redactedFields = [\n\t\t\t...assetEvents.flatMap((item) => item.metadata.redactedFields),\n\t\t\t...readModels.flatMap((item) => item.metadata.redactedFields),\n\t\t\t...evidencePackets.flatMap((item) => item.metadata.redactedFields),\n\t\t];\n\n\t\treturn {\n\t\t\teventType: \"AnonymizationApplied\",\n\t\t\tpolicyVersion: input.context.policyVersion ?? ANONYMIZATION_POLICY_VERSION,\n\t\t\tjobId: input.context.jobId,\n\t\t\treason: input.context.reason,\n\t\t\tappliedAt: (input.context.redactedAt ?? new Date()).toISOString(),\n\t\t\ttenantId: input.context.tenantId,\n\t\t\tspaceId: input.context.spaceId ?? null,\n\t\t\tcounts: {\n\t\t\t\tassetEvents: assetEvents.length,\n\t\t\t\treadModels: readModels.length,\n\t\t\t\tevidencePackets: evidencePackets.length,\n\t\t\t\tredactedFields: redactedFields.length,\n\t\t\t},\n\t\t\trecords: [\n\t\t\t\t...assetEvents.map((item) => ({\n\t\t\t\t\trecordClass: \"asset_event\" as PlatformDataClass,\n\t\t\t\t\trecordId: item.event.id,\n\t\t\t\t\tsubjectType: item.event.subjectType,\n\t\t\t\t\tsubjectId: item.event.subjectId,\n\t\t\t\t\tfieldManifest: item.metadata.redactedFields.map(\n\t\t\t\t\t\t({ fieldPath, method, beforeChecksum }) => ({\n\t\t\t\t\t\t\tfieldPath,\n\t\t\t\t\t\t\tmethod,\n\t\t\t\t\t\t\tbeforeChecksum,\n\t\t\t\t\t\t}),\n\t\t\t\t\t),\n\t\t\t\t})),\n\t\t\t\t...readModels.map((item) => ({\n\t\t\t\t\trecordClass: \"read_model\" as PlatformDataClass,\n\t\t\t\t\trecordId: item.record.id,\n\t\t\t\t\tsubjectType: item.modelKind,\n\t\t\t\t\tsubjectId: item.record.id,\n\t\t\t\t\tfieldManifest: item.metadata.redactedFields.map(\n\t\t\t\t\t\t({ fieldPath, method, beforeChecksum }) => ({\n\t\t\t\t\t\t\tfieldPath,\n\t\t\t\t\t\t\tmethod,\n\t\t\t\t\t\t\tbeforeChecksum,\n\t\t\t\t\t\t}),\n\t\t\t\t\t),\n\t\t\t\t})),\n\t\t\t\t...evidencePackets.map((item) => ({\n\t\t\t\t\trecordClass: \"evidence_packet\" as PlatformDataClass,\n\t\t\t\t\trecordId: item.packet.id,\n\t\t\t\t\tfieldManifest: item.metadata.redactedFields.map(\n\t\t\t\t\t\t({ fieldPath, method, beforeChecksum }) => ({\n\t\t\t\t\t\t\tfieldPath,\n\t\t\t\t\t\t\tmethod,\n\t\t\t\t\t\t\tbeforeChecksum,\n\t\t\t\t\t\t}),\n\t\t\t\t\t),\n\t\t\t\t})),\n\t\t\t],\n\t\t\tpreservedSemantics: [...(this.#policy.preservedSemantics ?? [])],\n\t\t};\n\t}\n}\n"],"mappings":";;AAWA,MAAa,+BAA+B;AAgE5C,SAAS,aAAa,KAAqB;CAC1C,OAAO,IAAI,QAAQ,iBAAiB,EAAE,CAAC,CAAC,YAAY;AACrD;AAEA,SAAgB,eAAe,OAAwB;CACtD,QAAA,GAAOA,OAAAA,WAAAA,CAAW,QAAQ,CAAC,CAAC,OAAO,KAAK,UAAU,KAAK,CAAC,CAAC,CAAC,OAAO,KAAK;AACvE;AAEA,SAAS,kBACR,OACA,SACA,WACS;CACT,MAAM,QAAQ,GAAG,QAAQ,SAAS,GAAG,QAAQ,WAAW,SAAS,GAAG;CACpE,OAAO,QAAA,GAAOA,OAAAA,WAAAA,CAAW,QAAQ,CAAC,CAChC,OAAO,GAAG,QAAQ,iBAAA,oCAA8C,GAAG,MAAM,GAAG,OAAO,KAAK,GAAG,CAAC,CAC5F,OAAO,KAAK,CAAC,CACb,MAAM,GAAG,EAAE;AACd;AAEA,SAAS,UAAU,OAA+B;CACjD,IAAI,UAAU,QAAQ,UAAU,KAAA,GAC/B,OAAO;CAGR,MAAM,cAAc,OAAO,KAAK;CAChC,IAAI,YAAY,UAAU,GACzB,OAAO;CAGR,OAAO,GAAG,IAAI,OAAO,KAAK,IAAI,YAAY,SAAS,GAAG,CAAC,CAAC,IAAI,YAAY,MAAM,EAAE;AACjF;AAEA,SAAS,gBAAgB,OAAyB;CACjD,IAAI,OAAO,UAAU,UACpB,OAAO,KAAK,MAAM,QAAQ,GAAI,IAAI;CAGnC,IAAI,OAAO,UAAU,YAAY,qBAAqB,KAAK,KAAK,GAC/D,OAAO,GAAG,MAAM,MAAM,GAAG,CAAC,EAAE;CAG7B,OAAO;AACR;AAEA,SAAS,YACR,OACA,QACA,SACA,MACU;CACV,QAAQ,QAAR;EACC,KAAK,QACJ;EACD,KAAK,WACJ,OAAO;EACR,KAAK,QACJ,OAAO,UAAU,KAAK;EACvB,KAAK,QACJ,OAAO,UAAU,eAAe,KAAK;EACtC,KAAK,YACJ,OAAO,kBAAkB,OAAO,SAAS,IAAI;EAC9C,KAAK,cACJ,OAAO,gBAAgB,KAAK;CAC9B;AACD;AAEA,SAAS,cAAc,UAA+C,MAAc,KAAoD;CACvI,MAAM,iBAAiB,aAAa,IAAI;CACxC,MAAM,gBAAgB,MAAM,aAAa,GAAG,IAAI,KAAA;CAEhD,OAAO,SAAS,MAAM,WAAW;EAChC,MAAM,kBAAkB,aAAa,OAAO,KAAK;EACjD,IAAI,OAAO,UAAU,OACpB,OAAO,oBAAoB;EAG5B,OAAO,oBAAoB;CAC5B,CAAC;AACF;AAEA,SAAS,cAAc,OAAqC;CAC3D,OACC,QAAQ,KAAK,KAAK,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,KAAK,EAAE,iBAAiB;AAE7F;AAEA,SAAS,mBACR,OACA,SACA,WACA,MACA,gBACA,UACA,KACU;CACV,MAAM,cAAc,cAAc,UAAU,MAAM,GAAG;CACrD,IAAI,eAAe,UAAU,QAAQ,UAAU,KAAA,GAAW;EACzD,eAAe,KAAK;GACnB,WAAW;GACX,QAAQ,YAAY;GACpB,eAAe,QAAQ,iBAAA;GACvB,OAAO,QAAQ;GACf,aAAa,QAAQ,8BAAc,IAAI,KAAK,EAAA,CAAG,YAAY;GAC3D,QAAQ,QAAQ;GAChB;GACA,gBAAgB,eAAe,KAAK;EACrC,CAAC;EAED,OAAO,YAAY,OAAO,YAAY,QAAQ,SAAS,IAAI;CAC5D;CAEA,IAAI,MAAM,QAAQ,KAAK,GACtB,OAAO,MAAM,KAAK,MAAM,UACvB,mBAAmB,MAAM,SAAS,WAAW,GAAG,KAAK,GAAG,MAAM,IAAI,gBAAgB,QAAQ,CAC3F;CAGD,IAAI,CAAC,cAAc,KAAK,GACvB,OAAO;CAGR,MAAM,SAAqB,CAAC;CAC5B,KAAK,MAAM,CAAC,UAAU,eAAe,OAAO,QAAQ,KAAK,GAAG;EAC3D,IAAI,aAAa,YAAY;GAC5B,OAAO,YAAY;GACnB;EACD;EAEA,MAAM,aAAa,mBAClB,YACA,SACA,WACA,GAAG,KAAK,GAAG,YACX,gBACA,UACA,QACD;EAEA,IAAI,eAAe,KAAA,GAClB,OAAO,YAAY;CAErB;CAEA,OAAO;AACR;AAEA,SAAS,cACR,SACA,WACA,gBACA,oBACwB;CACxB,OAAO;EACN,gBAAgB;EAChB,eAAe,QAAQ,iBAAA;EACvB,OAAO,QAAQ;EACf,aAAa,QAAQ,8BAAc,IAAI,KAAK,EAAA,CAAG,YAAY;EAC3D,QAAQ,QAAQ;EAChB;EACA;EACA,oBAAoB,CAAC,GAAG,kBAAkB;CAC3C;AACD;AAEA,IAAa,gBAAb,MAA2B;CAC1B,YAAY,OAAgB,QAAyB,SAA+B,MAAuB;EAC1G,OAAO,YAAY,OAAO,QAAQ,SAAS,IAAI;CAChD;CAEA,KAAK,OAA+B;EACnC,OAAO,UAAU,KAAK;CACvB;CAEA,KAAK,OAAwB;EAC5B,OAAO,UAAU,eAAe,KAAK;CACtC;CAEA,SAAS,OAAgB,SAA+B,MAAsB;EAC7E,OAAO,kBAAkB,OAAO,SAAS,IAAI;CAC9C;CAEA,WAAW,OAAyB;EACnC,OAAO,gBAAgB,KAAK;CAC7B;AACD;AAEA,IAAa,sBAAb,MAAiC;CAChC;CAEA,YAAY,QAA6B;EACxC,KAAK,UAAU;GACd,QAAQ,OAAO,OAAO,KAAK,WAAW,EAAE,GAAG,MAAM,EAAE;GACnD,oBAAoB,CAAC,GAAI,OAAO,sBAAsB,CAAC,CAAE;EAC1D;CACD;CAEA,mBACC,OACA,SACA,WAC8B;EAC9B,OAAO,KAAK,yBAAyB,OAAO,SAAS,WAAW,GAAG;CACpE;CAEA,yBACC,OACA,SACA,WACA,UAC8B;EAC9B,MAAM,iBAA+C,CAAC;EAUtD,OAAO;GACN,OAVuB,mBACvB,OACA,SACA,WACA,UACA,gBACA,KAAK,QAAQ,MAIQ;GACrB,UAAU,cAAc,SAAS,WAAW,gBAAgB,KAAK,QAAQ,sBAAsB,CAAC,CAAC;EAClG;CACD;CAEA,2BACC,OACA,SAC+B;EAC/B,MAAM,SAAS,KAAK,mBAAmB,MAAM,SAAS,SAAS,aAAa;EAK5E,OAAO;GAAE,OAJO,cAAc,OAAO,KAAK,IACvC;IAAE,GAAG,OAAO;IAAO,UAAU,OAAO;GAAS,IAC7C;IAAE,OAAO,OAAO;IAAO,UAAU,OAAO;GAAS;GAE3B,UAAU,OAAO;EAAS;CACpD;CAEA,wBACC,QACA,SAC6F;EAC7F,MAAM,SAAS,KAAK,mBAAmB,OAAO,QAAQ,SAAS,iBAAiB;EAChF,MAAM,oBAAoB;GACzB,GAAI,cAAc,OAAO,iBAAiB,IAAI,OAAO,oBAAoB,CAAC;GAC1E,wBAAwB,OAAO;EAChC;EACA,MAAM,mBAAmB,cAAc,OAAO,KAAK,IAChD;GAAE,GAAG,OAAO;GAAO,UAAU,OAAO;EAAS,IAC7C;GAAE,OAAO,OAAO;GAAO,UAAU,OAAO;EAAS;EAEpD,OAAO;GACN,OAAO;IACN,QAAQ;IACR;IACA,UAAU,eAAe;KAAE,QAAQ;KAAkB;IAAkB,CAAC;GACzE;GACA,UAAU,OAAO;EAClB;CACD;CAEA,oCAAoC,OASD;EAClC,MAAM,cAAc,MAAM,eAAe,CAAC;EAC1C,MAAM,aAAa,MAAM,cAAc,CAAC;EACxC,MAAM,kBAAkB,MAAM,mBAAmB,CAAC;EAClD,MAAM,iBAAiB;GACtB,GAAG,YAAY,SAAS,SAAS,KAAK,SAAS,cAAc;GAC7D,GAAG,WAAW,SAAS,SAAS,KAAK,SAAS,cAAc;GAC5D,GAAG,gBAAgB,SAAS,SAAS,KAAK,SAAS,cAAc;EAClE;EAEA,OAAO;GACN,WAAW;GACX,eAAe,MAAM,QAAQ,iBAAA;GAC7B,OAAO,MAAM,QAAQ;GACrB,QAAQ,MAAM,QAAQ;GACtB,YAAY,MAAM,QAAQ,8BAAc,IAAI,KAAK,EAAA,CAAG,YAAY;GAChE,UAAU,MAAM,QAAQ;GACxB,SAAS,MAAM,QAAQ,WAAW;GAClC,QAAQ;IACP,aAAa,YAAY;IACzB,YAAY,WAAW;IACvB,iBAAiB,gBAAgB;IACjC,gBAAgB,eAAe;GAChC;GACA,SAAS;IACR,GAAG,YAAY,KAAK,UAAU;KAC7B,aAAa;KACb,UAAU,KAAK,MAAM;KACrB,aAAa,KAAK,MAAM;KACxB,WAAW,KAAK,MAAM;KACtB,eAAe,KAAK,SAAS,eAAe,KAC1C,EAAE,WAAW,QAAQ,sBAAsB;MAC3C;MACA;MACA;KACD,EACD;IACD,EAAE;IACF,GAAG,WAAW,KAAK,UAAU;KAC5B,aAAa;KACb,UAAU,KAAK,OAAO;KACtB,aAAa,KAAK;KAClB,WAAW,KAAK,OAAO;KACvB,eAAe,KAAK,SAAS,eAAe,KAC1C,EAAE,WAAW,QAAQ,sBAAsB;MAC3C;MACA;MACA;KACD,EACD;IACD,EAAE;IACF,GAAG,gBAAgB,KAAK,UAAU;KACjC,aAAa;KACb,UAAU,KAAK,OAAO;KACtB,eAAe,KAAK,SAAS,eAAe,KAC1C,EAAE,WAAW,QAAQ,sBAAsB;MAC3C;MACA;MACA;KACD,EACD;IACD,EAAE;GACH;GACA,oBAAoB,CAAC,GAAI,KAAK,QAAQ,sBAAsB,CAAC,CAAE;EAChE;CACD;AACD"}

package/dist/events/index.cjs

@@ -1,12 +1,41 @@
-'use strict';
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+//#region events/index.ts
+const BUILT_IN_SUBJECT_TYPES = Object.freeze([
+	"ActionInvocation",
+	"PolicyEvaluation",
+	"AdapterInvocation"
+]);
+const BUILT_IN_EVENT_TYPES = Object.freeze([
+	"ComplianceBlocked",
+	"StateTransitioned",
+	"AdapterInvocationStarted",
+	"AdapterInvocationSucceeded",
+	"AdapterInvocationFailed",
+	"ExternalOperationAccepted",
+	"ExternalOperationCompleted",
+	"ExternalOperationFailed",
+	"ExternalOperationContradicted",
+	"WebhookReceived"
+]);
+function createEventContractRegistry(input = {}) {
+	const eventTypes = /* @__PURE__ */ new Set([...BUILT_IN_EVENT_TYPES, ...input.eventTypes ?? []]);
+	const subjectTypes = /* @__PURE__ */ new Set([...BUILT_IN_SUBJECT_TYPES, ...input.subjectTypes ?? []]);
+	return {
+		registerEventType(eventType) {
+			if (!eventType) throw new Error("Event type cannot be empty");
+			eventTypes.add(eventType);
+		},
+		registerSubjectType(subjectType) {
+			if (!subjectType) throw new Error("Subject type cannot be empty");
+			subjectTypes.add(subjectType);
+		},
+		hasEventType: (eventType) => eventTypes.has(eventType),
+		hasSubjectType: (subjectType) => subjectTypes.has(subjectType),
+		eventTypes: () => Array.from(eventTypes).sort(),
+		subjectTypes: () => Array.from(subjectTypes).sort()
+	};
+}
+//#endregion
+exports.createEventContractRegistry = createEventContractRegistry;
 
-var chunk2AE6TMAX_cjs = require('../chunk-2AE6TMAX.cjs');
-
-
-
-Object.defineProperty(exports, "createEventContractRegistry", {
-  enumerable: true,
-  get: function () { return chunk2AE6TMAX_cjs.createEventContractRegistry; }
-});
-//# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map

package/dist/events/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"index.cjs"}
+{"version":3,"file":"index.cjs","names":[],"sources":["../../events/index.ts"],"sourcesContent":["export interface AssetEventEnvelope<TPayload = unknown> {\n\tid: string;\n\ttenantId: string;\n\tspaceId: string;\n\teventType: string;\n\teventSchemaVersion: number;\n\tsubjectType: string;\n\tsubjectId: string;\n\tactorId: string;\n\tactorType: string;\n\tactionInvocationId?: string;\n\tpayload: TPayload;\n\tsequence: number;\n\toccurredAt: Date;\n\trecordedAt: Date;\n\tcorrelationId: string;\n\tcausationId?: string;\n\tprovenance?: EventProvenance;\n\t/**\n\t * Mirrors the emitting action's declared consistency. Present only when the\n\t * action declares `provisional-until-reconciled`, so a consumer can tell a\n\t * settled fact from one still awaiting reconciliation without a lookup.\n\t * Additive and optional: tolerant consumers that ignore it stay correct.\n\t */\n\tconsistency?: \"authoritative-now\" | \"provisional-until-reconciled\";\n}\n\nexport interface EventProvenance {\n\tsource: \"ui\" | \"api\" | \"agent\" | \"worker\" | \"system\" | (string & {});\n\tauditAttributes?: Record<string, string>;\n}\n\nconst BUILT_IN_SUBJECT_TYPES = Object.freeze([\n\t\"ActionInvocation\",\n\t\"PolicyEvaluation\",\n\t\"AdapterInvocation\",\n]);\n\nconst BUILT_IN_EVENT_TYPES = Object.freeze([\n\t\"ComplianceBlocked\",\n\t\"StateTransitioned\",\n\t\"AdapterInvocationStarted\",\n\t\"AdapterInvocationSucceeded\",\n\t\"AdapterInvocationFailed\",\n\t\"ExternalOperationAccepted\",\n\t\"ExternalOperationCompleted\",\n\t\"ExternalOperationFailed\",\n\t\"ExternalOperationContradicted\",\n\t\"WebhookReceived\",\n]);\n\nexport type AssetEventSubjectType = string;\nexport type AssetEventType = string;\nexport type AssetEventActorType = \"natural_person\" | \"agent\" | \"adapter\" | \"system\" | \"service_account\" | \"external_system\" | \"integration\";\n\nexport interface EventContractRegistry {\n\tregisterEventType(eventType: string): void;\n\tregisterSubjectType(subjectType: string): void;\n\thasEventType(eventType: string): boolean;\n\thasSubjectType(subjectType: string): boolean;\n\teventTypes(): string[];\n\tsubjectTypes(): string[];\n}\n\nexport function createEventContractRegistry(input: { eventTypes?: readonly string[]; subjectTypes?: readonly string[] } = {}): EventContractRegistry {\n\tconst eventTypes = new Set([...BUILT_IN_EVENT_TYPES, ...(input.eventTypes ?? [])]);\n\tconst subjectTypes = new Set([...BUILT_IN_SUBJECT_TYPES, ...(input.subjectTypes ?? [])]);\n\treturn {\n\t\tregisterEventType(eventType) {\n\t\t\tif (!eventType) {\n\t\t\t\tthrow new Error(\"Event type cannot be empty\");\n\t\t\t}\n\t\t\teventTypes.add(eventType);\n\t\t},\n\t\tregisterSubjectType(subjectType) {\n\t\t\tif (!subjectType) throw new Error(\"Subject type cannot be empty\");\n\t\t\tsubjectTypes.add(subjectType);\n\t\t},\n\t\thasEventType: (eventType) => eventTypes.has(eventType),\n\t\thasSubjectType: (subjectType) => subjectTypes.has(subjectType),\n\t\teventTypes: () => Array.from(eventTypes).sort(),\n\t\tsubjectTypes: () => Array.from(subjectTypes).sort(),\n\t};\n}\n"],"mappings":";;AAgCA,MAAM,yBAAyB,OAAO,OAAO;CAC5C;CACA;CACA;AACD,CAAC;AAED,MAAM,uBAAuB,OAAO,OAAO;CAC1C;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACD,CAAC;AAeD,SAAgB,4BAA4B,QAA8E,CAAC,GAA0B;CACpJ,MAAM,6BAAa,IAAI,IAAI,CAAC,GAAG,sBAAsB,GAAI,MAAM,cAAc,CAAC,CAAE,CAAC;CACjF,MAAM,+BAAe,IAAI,IAAI,CAAC,GAAG,wBAAwB,GAAI,MAAM,gBAAgB,CAAC,CAAE,CAAC;CACvF,OAAO;EACN,kBAAkB,WAAW;GAC5B,IAAI,CAAC,WACJ,MAAM,IAAI,MAAM,4BAA4B;GAE7C,WAAW,IAAI,SAAS;EACzB;EACA,oBAAoB,aAAa;GAChC,IAAI,CAAC,aAAa,MAAM,IAAI,MAAM,8BAA8B;GAChE,aAAa,IAAI,WAAW;EAC7B;EACA,eAAe,cAAc,WAAW,IAAI,SAAS;EACrD,iBAAiB,gBAAgB,aAAa,IAAI,WAAW;EAC7D,kBAAkB,MAAM,KAAK,UAAU,CAAC,CAAC,KAAK;EAC9C,oBAAoB,MAAM,KAAK,YAAY,CAAC,CAAC,KAAK;CACnD;AACD"}

package/dist/events/index.d.cts

@@ -1,47 +1,47 @@
-interface AssetEventEnvelope<TPayload = unknown> {
-    id: string;
-    tenantId: string;
-    spaceId: string;
-    eventType: string;
-    eventSchemaVersion: number;
-    subjectType: string;
-    subjectId: string;
-    actorId: string;
-    actorType: string;
-    actionInvocationId?: string;
-    payload: TPayload;
-    sequence: number;
-    occurredAt: Date;
-    recordedAt: Date;
-    correlationId: string;
-    causationId?: string;
-    provenance?: EventProvenance;
-    /**
-     * Mirrors the emitting action's declared consistency. Present only when the
-     * action declares `provisional-until-reconciled`, so a consumer can tell a
-     * settled fact from one still awaiting reconciliation without a lookup.
-     * Additive and optional: tolerant consumers that ignore it stay correct.
-     */
-    consistency?: "authoritative-now" | "provisional-until-reconciled";
+//#region events/index.d.ts
+export interface AssetEventEnvelope<TPayload = unknown> {
+  id: string;
+  tenantId: string;
+  spaceId: string;
+  eventType: string;
+  eventSchemaVersion: number;
+  subjectType: string;
+  subjectId: string;
+  actorId: string;
+  actorType: string;
+  actionInvocationId?: string;
+  payload: TPayload;
+  sequence: number;
+  occurredAt: Date;
+  recordedAt: Date;
+  correlationId: string;
+  causationId?: string;
+  provenance?: EventProvenance;
+  /**
+   * Mirrors the emitting action's declared consistency. Present only when the
+   * action declares `provisional-until-reconciled`, so a consumer can tell a
+   * settled fact from one still awaiting reconciliation without a lookup.
+   * Additive and optional: tolerant consumers that ignore it stay correct.
+   */
+  consistency?: "authoritative-now" | "provisional-until-reconciled";
 }
-interface EventProvenance {
-    source: "ui" | "api" | "agent" | "worker" | "system" | (string & {});
-    auditAttributes?: Record<string, string>;
+export interface EventProvenance {
+  source: "ui" | "api" | "agent" | "worker" | "system" | (string & {});
+  auditAttributes?: Record<string, string>;
 }
-type AssetEventSubjectType = string;
-type AssetEventType = string;
-type AssetEventActorType = "natural_person" | "agent" | "adapter" | "system" | "service_account" | "external_system" | "integration";
-interface EventContractRegistry {
-    registerEventType(eventType: string): void;
-    registerSubjectType(subjectType: string): void;
-    hasEventType(eventType: string): boolean;
-    hasSubjectType(subjectType: string): boolean;
-    eventTypes(): string[];
-    subjectTypes(): string[];
+export type AssetEventSubjectType = string;
+export type AssetEventType = string;
+export type AssetEventActorType = "natural_person" | "agent" | "adapter" | "system" | "service_account" | "external_system" | "integration";
+export interface EventContractRegistry {
+  registerEventType(eventType: string): void;
+  registerSubjectType(subjectType: string): void;
+  hasEventType(eventType: string): boolean;
+  hasSubjectType(subjectType: string): boolean;
+  eventTypes(): string[];
+  subjectTypes(): string[];
 }
-declare function createEventContractRegistry(input?: {
-    eventTypes?: readonly string[];
-    subjectTypes?: readonly string[];
+export declare function createEventContractRegistry(input?: {
+  eventTypes?: readonly string[];
+  subjectTypes?: readonly string[];
 }): EventContractRegistry;
-
-export { type AssetEventActorType, type AssetEventEnvelope, type AssetEventSubjectType, type AssetEventType, type EventContractRegistry, type EventProvenance, createEventContractRegistry };
+//#endregion

package/dist/events/index.d.ts

@@ -1,47 +1,47 @@
-interface AssetEventEnvelope<TPayload = unknown> {
-    id: string;
-    tenantId: string;
-    spaceId: string;
-    eventType: string;
-    eventSchemaVersion: number;
-    subjectType: string;
-    subjectId: string;
-    actorId: string;
-    actorType: string;
-    actionInvocationId?: string;
-    payload: TPayload;
-    sequence: number;
-    occurredAt: Date;
-    recordedAt: Date;
-    correlationId: string;
-    causationId?: string;
-    provenance?: EventProvenance;
-    /**
-     * Mirrors the emitting action's declared consistency. Present only when the
-     * action declares `provisional-until-reconciled`, so a consumer can tell a
-     * settled fact from one still awaiting reconciliation without a lookup.
-     * Additive and optional: tolerant consumers that ignore it stay correct.
-     */
-    consistency?: "authoritative-now" | "provisional-until-reconciled";
+//#region events/index.d.ts
+export interface AssetEventEnvelope<TPayload = unknown> {
+  id: string;
+  tenantId: string;
+  spaceId: string;
+  eventType: string;
+  eventSchemaVersion: number;
+  subjectType: string;
+  subjectId: string;
+  actorId: string;
+  actorType: string;
+  actionInvocationId?: string;
+  payload: TPayload;
+  sequence: number;
+  occurredAt: Date;
+  recordedAt: Date;
+  correlationId: string;
+  causationId?: string;
+  provenance?: EventProvenance;
+  /**
+   * Mirrors the emitting action's declared consistency. Present only when the
+   * action declares `provisional-until-reconciled`, so a consumer can tell a
+   * settled fact from one still awaiting reconciliation without a lookup.
+   * Additive and optional: tolerant consumers that ignore it stay correct.
+   */
+  consistency?: "authoritative-now" | "provisional-until-reconciled";
 }
-interface EventProvenance {
-    source: "ui" | "api" | "agent" | "worker" | "system" | (string & {});
-    auditAttributes?: Record<string, string>;
+export interface EventProvenance {
+  source: "ui" | "api" | "agent" | "worker" | "system" | (string & {});
+  auditAttributes?: Record<string, string>;
 }
-type AssetEventSubjectType = string;
-type AssetEventType = string;
-type AssetEventActorType = "natural_person" | "agent" | "adapter" | "system" | "service_account" | "external_system" | "integration";
-interface EventContractRegistry {
-    registerEventType(eventType: string): void;
-    registerSubjectType(subjectType: string): void;
-    hasEventType(eventType: string): boolean;
-    hasSubjectType(subjectType: string): boolean;
-    eventTypes(): string[];
-    subjectTypes(): string[];
+export type AssetEventSubjectType = string;
+export type AssetEventType = string;
+export type AssetEventActorType = "natural_person" | "agent" | "adapter" | "system" | "service_account" | "external_system" | "integration";
+export interface EventContractRegistry {
+  registerEventType(eventType: string): void;
+  registerSubjectType(subjectType: string): void;
+  hasEventType(eventType: string): boolean;
+  hasSubjectType(subjectType: string): boolean;
+  eventTypes(): string[];
+  subjectTypes(): string[];
 }
-declare function createEventContractRegistry(input?: {
-    eventTypes?: readonly string[];
-    subjectTypes?: readonly string[];
+export declare function createEventContractRegistry(input?: {
+  eventTypes?: readonly string[];
+  subjectTypes?: readonly string[];
 }): EventContractRegistry;
-
-export { type AssetEventActorType, type AssetEventEnvelope, type AssetEventSubjectType, type AssetEventType, type EventContractRegistry, type EventProvenance, createEventContractRegistry };
+//#endregion

package/dist/events/index.js

@@ -1,3 +1,40 @@
-export { createEventContractRegistry } from '../chunk-B5DOGDPG.js';
-//# sourceMappingURL=index.js.map
+//#region events/index.ts
+const BUILT_IN_SUBJECT_TYPES = Object.freeze([
+	"ActionInvocation",
+	"PolicyEvaluation",
+	"AdapterInvocation"
+]);
+const BUILT_IN_EVENT_TYPES = Object.freeze([
+	"ComplianceBlocked",
+	"StateTransitioned",
+	"AdapterInvocationStarted",
+	"AdapterInvocationSucceeded",
+	"AdapterInvocationFailed",
+	"ExternalOperationAccepted",
+	"ExternalOperationCompleted",
+	"ExternalOperationFailed",
+	"ExternalOperationContradicted",
+	"WebhookReceived"
+]);
+function createEventContractRegistry(input = {}) {
+	const eventTypes = /* @__PURE__ */ new Set([...BUILT_IN_EVENT_TYPES, ...input.eventTypes ?? []]);
+	const subjectTypes = /* @__PURE__ */ new Set([...BUILT_IN_SUBJECT_TYPES, ...input.subjectTypes ?? []]);
+	return {
+		registerEventType(eventType) {
+			if (!eventType) throw new Error("Event type cannot be empty");
+			eventTypes.add(eventType);
+		},
+		registerSubjectType(subjectType) {
+			if (!subjectType) throw new Error("Subject type cannot be empty");
+			subjectTypes.add(subjectType);
+		},
+		hasEventType: (eventType) => eventTypes.has(eventType),
+		hasSubjectType: (subjectType) => subjectTypes.has(subjectType),
+		eventTypes: () => Array.from(eventTypes).sort(),
+		subjectTypes: () => Array.from(subjectTypes).sort()
+	};
+}
+//#endregion
+export { createEventContractRegistry };
+
 //# sourceMappingURL=index.js.map

package/dist/events/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"index.js"}
+{"version":3,"file":"index.js","names":[],"sources":["../../events/index.ts"],"sourcesContent":["export interface AssetEventEnvelope<TPayload = unknown> {\n\tid: string;\n\ttenantId: string;\n\tspaceId: string;\n\teventType: string;\n\teventSchemaVersion: number;\n\tsubjectType: string;\n\tsubjectId: string;\n\tactorId: string;\n\tactorType: string;\n\tactionInvocationId?: string;\n\tpayload: TPayload;\n\tsequence: number;\n\toccurredAt: Date;\n\trecordedAt: Date;\n\tcorrelationId: string;\n\tcausationId?: string;\n\tprovenance?: EventProvenance;\n\t/**\n\t * Mirrors the emitting action's declared consistency. Present only when the\n\t * action declares `provisional-until-reconciled`, so a consumer can tell a\n\t * settled fact from one still awaiting reconciliation without a lookup.\n\t * Additive and optional: tolerant consumers that ignore it stay correct.\n\t */\n\tconsistency?: \"authoritative-now\" | \"provisional-until-reconciled\";\n}\n\nexport interface EventProvenance {\n\tsource: \"ui\" | \"api\" | \"agent\" | \"worker\" | \"system\" | (string & {});\n\tauditAttributes?: Record<string, string>;\n}\n\nconst BUILT_IN_SUBJECT_TYPES = Object.freeze([\n\t\"ActionInvocation\",\n\t\"PolicyEvaluation\",\n\t\"AdapterInvocation\",\n]);\n\nconst BUILT_IN_EVENT_TYPES = Object.freeze([\n\t\"ComplianceBlocked\",\n\t\"StateTransitioned\",\n\t\"AdapterInvocationStarted\",\n\t\"AdapterInvocationSucceeded\",\n\t\"AdapterInvocationFailed\",\n\t\"ExternalOperationAccepted\",\n\t\"ExternalOperationCompleted\",\n\t\"ExternalOperationFailed\",\n\t\"ExternalOperationContradicted\",\n\t\"WebhookReceived\",\n]);\n\nexport type AssetEventSubjectType = string;\nexport type AssetEventType = string;\nexport type AssetEventActorType = \"natural_person\" | \"agent\" | \"adapter\" | \"system\" | \"service_account\" | \"external_system\" | \"integration\";\n\nexport interface EventContractRegistry {\n\tregisterEventType(eventType: string): void;\n\tregisterSubjectType(subjectType: string): void;\n\thasEventType(eventType: string): boolean;\n\thasSubjectType(subjectType: string): boolean;\n\teventTypes(): string[];\n\tsubjectTypes(): string[];\n}\n\nexport function createEventContractRegistry(input: { eventTypes?: readonly string[]; subjectTypes?: readonly string[] } = {}): EventContractRegistry {\n\tconst eventTypes = new Set([...BUILT_IN_EVENT_TYPES, ...(input.eventTypes ?? [])]);\n\tconst subjectTypes = new Set([...BUILT_IN_SUBJECT_TYPES, ...(input.subjectTypes ?? [])]);\n\treturn {\n\t\tregisterEventType(eventType) {\n\t\t\tif (!eventType) {\n\t\t\t\tthrow new Error(\"Event type cannot be empty\");\n\t\t\t}\n\t\t\teventTypes.add(eventType);\n\t\t},\n\t\tregisterSubjectType(subjectType) {\n\t\t\tif (!subjectType) throw new Error(\"Subject type cannot be empty\");\n\t\t\tsubjectTypes.add(subjectType);\n\t\t},\n\t\thasEventType: (eventType) => eventTypes.has(eventType),\n\t\thasSubjectType: (subjectType) => subjectTypes.has(subjectType),\n\t\teventTypes: () => Array.from(eventTypes).sort(),\n\t\tsubjectTypes: () => Array.from(subjectTypes).sort(),\n\t};\n}\n"],"mappings":";AAgCA,MAAM,yBAAyB,OAAO,OAAO;CAC5C;CACA;CACA;AACD,CAAC;AAED,MAAM,uBAAuB,OAAO,OAAO;CAC1C;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACD,CAAC;AAeD,SAAgB,4BAA4B,QAA8E,CAAC,GAA0B;CACpJ,MAAM,6BAAa,IAAI,IAAI,CAAC,GAAG,sBAAsB,GAAI,MAAM,cAAc,CAAC,CAAE,CAAC;CACjF,MAAM,+BAAe,IAAI,IAAI,CAAC,GAAG,wBAAwB,GAAI,MAAM,gBAAgB,CAAC,CAAE,CAAC;CACvF,OAAO;EACN,kBAAkB,WAAW;GAC5B,IAAI,CAAC,WACJ,MAAM,IAAI,MAAM,4BAA4B;GAE7C,WAAW,IAAI,SAAS;EACzB;EACA,oBAAoB,aAAa;GAChC,IAAI,CAAC,aAAa,MAAM,IAAI,MAAM,8BAA8B;GAChE,aAAa,IAAI,WAAW;EAC7B;EACA,eAAe,cAAc,WAAW,IAAI,SAAS;EACrD,iBAAiB,gBAAgB,aAAa,IAAI,WAAW;EAC7D,kBAAkB,MAAM,KAAK,UAAU,CAAC,CAAC,KAAK;EAC9C,oBAAoB,MAAM,KAAK,YAAY,CAAC,CAAC,KAAK;CACnD;AACD"}

package/dist/evidence/index.cjs

@@ -1,50 +1,12 @@
-'use strict';
-
-var chunk6HY35TKB_cjs = require('../chunk-6HY35TKB.cjs');
-require('../chunk-LZSE6QGQ.cjs');
-require('../chunk-CRZXTZ36.cjs');
-
-
-
-Object.defineProperty(exports, "DEFAULT_EVIDENCE_PACKET_TYPE", {
-  enumerable: true,
-  get: function () { return chunk6HY35TKB_cjs.DEFAULT_EVIDENCE_PACKET_TYPE; }
-});
-Object.defineProperty(exports, "DEFAULT_EVIDENCE_REDACTION_REASON", {
-  enumerable: true,
-  get: function () { return chunk6HY35TKB_cjs.DEFAULT_EVIDENCE_REDACTION_REASON; }
-});
-Object.defineProperty(exports, "EVIDENCE_PACKET_CHECKSUM_ALGORITHM", {
-  enumerable: true,
-  get: function () { return chunk6HY35TKB_cjs.EVIDENCE_PACKET_CHECKSUM_ALGORITHM; }
-});
-Object.defineProperty(exports, "EVIDENCE_PACKET_SCHEMA_VERSION", {
-  enumerable: true,
-  get: function () { return chunk6HY35TKB_cjs.EVIDENCE_PACKET_SCHEMA_VERSION; }
-});
-Object.defineProperty(exports, "EvidencePacketGenerationError", {
-  enumerable: true,
-  get: function () { return chunk6HY35TKB_cjs.EvidencePacketGenerationError; }
-});
-Object.defineProperty(exports, "canonicalJson", {
-  enumerable: true,
-  get: function () { return chunk6HY35TKB_cjs.canonicalJson; }
-});
-Object.defineProperty(exports, "computeEvidencePacketChecksum", {
-  enumerable: true,
-  get: function () { return chunk6HY35TKB_cjs.computeEvidencePacketChecksum; }
-});
-Object.defineProperty(exports, "createEvidencePacketRenderer", {
-  enumerable: true,
-  get: function () { return chunk6HY35TKB_cjs.createEvidencePacketRenderer; }
-});
-Object.defineProperty(exports, "generateEvidencePacket", {
-  enumerable: true,
-  get: function () { return chunk6HY35TKB_cjs.generateEvidencePacket; }
-});
-Object.defineProperty(exports, "verifyEvidencePacketChecksum", {
-  enumerable: true,
-  get: function () { return chunk6HY35TKB_cjs.verifyEvidencePacketChecksum; }
-});
-//# sourceMappingURL=index.cjs.map
-//# sourceMappingURL=index.cjs.map
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_evidence = require("../evidence-Cq48eDvA.cjs");
+exports.DEFAULT_EVIDENCE_PACKET_TYPE = require_evidence.DEFAULT_EVIDENCE_PACKET_TYPE;
+exports.DEFAULT_EVIDENCE_REDACTION_REASON = require_evidence.DEFAULT_EVIDENCE_REDACTION_REASON;
+exports.EVIDENCE_PACKET_CHECKSUM_ALGORITHM = require_evidence.EVIDENCE_PACKET_CHECKSUM_ALGORITHM;
+exports.EVIDENCE_PACKET_SCHEMA_VERSION = require_evidence.EVIDENCE_PACKET_SCHEMA_VERSION;
+exports.EvidencePacketGenerationError = require_evidence.EvidencePacketGenerationError;
+exports.canonicalJson = require_evidence.canonicalJson;
+exports.computeEvidencePacketChecksum = require_evidence.computeEvidencePacketChecksum;
+exports.createEvidencePacketRenderer = require_evidence.createEvidencePacketRenderer;
+exports.generateEvidencePacket = require_evidence.generateEvidencePacket;
+exports.verifyEvidencePacketChecksum = require_evidence.verifyEvidencePacketChecksum;