@fabricorg/platform 1.6.0 → 1.8.0

package/dist/{chunk-USDLP4E7.cjs → chunk-5IVFPWK6.cjs}

@@ -1,6 +1,6 @@
 'use strict';
 
-var chunkXZQZQ5SW_cjs = require('./chunk-XZQZQ5SW.cjs');
+var chunkIF6NJORI_cjs = require('./chunk-IF6NJORI.cjs');
 
 // testing/index.ts
 function createFakeActionContext(options = {}) {
@@ -17,7 +17,7 @@ function createFakeActionContext(options = {}) {
   };
 }
 function createInMemoryAdapterRegistry() {
-  return new chunkXZQZQ5SW_cjs.AdapterRegistry();
+  return new chunkIF6NJORI_cjs.AdapterRegistry();
 }
 function createDeterministicIdFactory(prefix = "test") {
   let sequence = 0;
@@ -27,5 +27,5 @@ function createDeterministicIdFactory(prefix = "test") {
 exports.createDeterministicIdFactory = createDeterministicIdFactory;
 exports.createFakeActionContext = createFakeActionContext;
 exports.createInMemoryAdapterRegistry = createInMemoryAdapterRegistry;
-//# sourceMappingURL=chunk-USDLP4E7.cjs.map
-//# sourceMappingURL=chunk-USDLP4E7.cjs.map
+//# sourceMappingURL=chunk-5IVFPWK6.cjs.map
+//# sourceMappingURL=chunk-5IVFPWK6.cjs.map

package/dist/{chunk-USDLP4E7.cjs.map → chunk-5IVFPWK6.cjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["../testing/index.ts"],"names":["AdapterRegistry"],"mappings":";;;;;AAeO,SAAS,uBAAA,CACf,OAAA,GAAyC,EAAC,EACrB;AACrB,EAAA,OAAO;AAAA,IACN,kBAAA,EAAoB,QAAQ,kBAAA,IAAsB,UAAA;AAAA,IAClD,QAAA,EAAU,QAAQ,QAAA,IAAY,aAAA;AAAA,IAC9B,OAAA,EAAS,QAAQ,OAAA,IAAW,YAAA;AAAA,IAC5B,OAAA,EAAS,QAAQ,OAAA,IAAW,YAAA;AAAA,IAC5B,SAAA,EAAW,QAAQ,SAAA,IAAa,QAAA;AAAA,IAChC,aAAA,EAAe,QAAQ,aAAA,IAAiB,WAAA;AAAA,IACxC,aAAa,OAAA,CAAQ,WAAA;AAAA,IACrB,EAAA,EAAI,OAAA,CAAQ,EAAA,IAAO,EAAC;AAAA,IACpB,QAAA,EAAU,OAAA,CAAQ,QAAA,IAAY;AAAC,GAChC;AACD;AAEO,SAAS,6BAAA,GAAiD;AAChE,EAAA,OAAO,IAAIA,iCAAA,EAAgB;AAC5B;AAEO,SAAS,4BAAA,CAA6B,SAAS,MAAA,EAAsB;AAC3E,EAAA,IAAI,QAAA,GAAW,CAAA;AACf,EAAA,OAAO,MAAM,CAAA,EAAG,MAAM,CAAA,CAAA,EAAI,MAAA,CAAO,EAAE,QAAQ,CAAA,CAAE,QAAA,CAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CAAA;AAC9D","file":"chunk-USDLP4E7.cjs","sourcesContent":["import { AdapterRegistry } from \"../adapters\";\nimport type { ActionContext, ActorType } from \"../actions\";\n\nexport interface FakeActionContextOptions<TDb = Record<string, never>> {\n\tactionInvocationId?: string;\n\ttenantId?: string;\n\tspaceId?: string;\n\tactorId?: string;\n\tactorType?: ActorType;\n\tcorrelationId?: string;\n\tcausationId?: string;\n\tdb?: TDb;\n\tservices?: Record<string, unknown>;\n}\n\nexport function createFakeActionContext<TDb = Record<string, never>>(\n\toptions: FakeActionContextOptions<TDb> = {},\n): ActionContext<TDb> {\n\treturn {\n\t\tactionInvocationId: options.actionInvocationId ?? \"act_test\",\n\t\ttenantId: options.tenantId ?? \"tenant-test\",\n\t\tspaceId: options.spaceId ?? \"space-test\",\n\t\tactorId: options.actorId ?? \"actor-test\",\n\t\tactorType: options.actorType ?? \"system\",\n\t\tcorrelationId: options.correlationId ?? \"corr-test\",\n\t\tcausationId: options.causationId,\n\t\tdb: options.db ?? ({} as TDb),\n\t\tservices: options.services ?? {},\n\t};\n}\n\nexport function createInMemoryAdapterRegistry(): AdapterRegistry {\n\treturn new AdapterRegistry();\n}\n\nexport function createDeterministicIdFactory(prefix = \"test\"): () => string {\n\tlet sequence = 0;\n\treturn () => `${prefix}_${String(++sequence).padStart(6, \"0\")}`;\n}\n"]}
+{"version":3,"sources":["../testing/index.ts"],"names":["AdapterRegistry"],"mappings":";;;;;AAeO,SAAS,uBAAA,CACf,OAAA,GAAyC,EAAC,EACrB;AACrB,EAAA,OAAO;AAAA,IACN,kBAAA,EAAoB,QAAQ,kBAAA,IAAsB,UAAA;AAAA,IAClD,QAAA,EAAU,QAAQ,QAAA,IAAY,aAAA;AAAA,IAC9B,OAAA,EAAS,QAAQ,OAAA,IAAW,YAAA;AAAA,IAC5B,OAAA,EAAS,QAAQ,OAAA,IAAW,YAAA;AAAA,IAC5B,SAAA,EAAW,QAAQ,SAAA,IAAa,QAAA;AAAA,IAChC,aAAA,EAAe,QAAQ,aAAA,IAAiB,WAAA;AAAA,IACxC,aAAa,OAAA,CAAQ,WAAA;AAAA,IACrB,EAAA,EAAI,OAAA,CAAQ,EAAA,IAAO,EAAC;AAAA,IACpB,QAAA,EAAU,OAAA,CAAQ,QAAA,IAAY;AAAC,GAChC;AACD;AAEO,SAAS,6BAAA,GAAiD;AAChE,EAAA,OAAO,IAAIA,iCAAA,EAAgB;AAC5B;AAEO,SAAS,4BAAA,CAA6B,SAAS,MAAA,EAAsB;AAC3E,EAAA,IAAI,QAAA,GAAW,CAAA;AACf,EAAA,OAAO,MAAM,CAAA,EAAG,MAAM,CAAA,CAAA,EAAI,MAAA,CAAO,EAAE,QAAQ,CAAA,CAAE,QAAA,CAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CAAA;AAC9D","file":"chunk-5IVFPWK6.cjs","sourcesContent":["import { AdapterRegistry } from \"../adapters\";\nimport type { ActionContext, ActorType } from \"../actions\";\n\nexport interface FakeActionContextOptions<TDb = Record<string, never>> {\n\tactionInvocationId?: string;\n\ttenantId?: string;\n\tspaceId?: string;\n\tactorId?: string;\n\tactorType?: ActorType;\n\tcorrelationId?: string;\n\tcausationId?: string;\n\tdb?: TDb;\n\tservices?: Record<string, unknown>;\n}\n\nexport function createFakeActionContext<TDb = Record<string, never>>(\n\toptions: FakeActionContextOptions<TDb> = {},\n): ActionContext<TDb> {\n\treturn {\n\t\tactionInvocationId: options.actionInvocationId ?? \"act_test\",\n\t\ttenantId: options.tenantId ?? \"tenant-test\",\n\t\tspaceId: options.spaceId ?? \"space-test\",\n\t\tactorId: options.actorId ?? \"actor-test\",\n\t\tactorType: options.actorType ?? \"system\",\n\t\tcorrelationId: options.correlationId ?? \"corr-test\",\n\t\tcausationId: options.causationId,\n\t\tdb: options.db ?? ({} as TDb),\n\t\tservices: options.services ?? {},\n\t};\n}\n\nexport function createInMemoryAdapterRegistry(): AdapterRegistry {\n\treturn new AdapterRegistry();\n}\n\nexport function createDeterministicIdFactory(prefix = \"test\"): () => string {\n\tlet sequence = 0;\n\treturn () => `${prefix}_${String(++sequence).padStart(6, \"0\")}`;\n}\n"]}

package/dist/chunk-6HY35TKB.cjs

@@ -0,0 +1,491 @@
+'use strict';
+
+var chunkLZSE6QGQ_cjs = require('./chunk-LZSE6QGQ.cjs');
+var chunkCRZXTZ36_cjs = require('./chunk-CRZXTZ36.cjs');
+var crypto = require('crypto');
+
+// evidence/canonical-json.ts
+function canonicalJson(value) {
+  return JSON.stringify(sortKeys(value));
+}
+function sortKeys(value) {
+  if (Array.isArray(value)) return value.map(sortKeys);
+  if (value && typeof value === "object") {
+    return Object.fromEntries(Object.entries(value).sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0).map(([key, child]) => [key, sortKeys(child)]));
+  }
+  return value;
+}
+var EVIDENCE_PACKET_CHECKSUM_ALGORITHM = "fabric-canonical-json-sha256-v1";
+var EVIDENCE_PACKET_SCHEMA_VERSION = 1;
+var DEFAULT_EVIDENCE_PACKET_TYPE = "compliance_evidence";
+var DEFAULT_EVIDENCE_REDACTION_REASON = "evidence_packet_generation";
+var EvidencePacketGenerationError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "EvidencePacketGenerationError";
+    this.code = code;
+  }
+};
+function compareStrings(left, right) {
+  return left < right ? -1 : left > right ? 1 : 0;
+}
+function assertNonEmptyString(value, what) {
+  if (typeof value !== "string" || value.length === 0) {
+    throw new EvidencePacketGenerationError("EVIDENCE_INVALID_RECORD", `${what} must be a non-empty string.`);
+  }
+}
+function isPlainObject(value) {
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
+function exhaustiveList() {
+  return (list) => list;
+}
+var REDACTION_METHODS = Object.freeze(
+  exhaustiveList()(["nullify", "mask", "hash", "tokenize", "generalize", "drop"])
+);
+var PLATFORM_DATA_CLASSES = Object.freeze(
+  exhaustiveList()([
+    "asset_event",
+    "read_model",
+    "raw_payload",
+    "evidence_packet",
+    "action_evidence",
+    "access_event"
+  ])
+);
+var SHA256_HEX = /^[0-9a-f]{64}$/;
+function isIsoInstant(value) {
+  if (typeof value !== "string") return false;
+  const date = new Date(value);
+  return !Number.isNaN(date.getTime()) && date.toISOString() === value;
+}
+var METADATA_STRING_KEYS = ["policyVersion", "jobId", "redactedAt", "reason"];
+var METADATA_KEYS = Object.freeze([
+  "redactionState",
+  "dataClass",
+  "redactedFields",
+  "preservedSemantics",
+  ...METADATA_STRING_KEYS
+]);
+var FIELD_METADATA_KEYS = Object.freeze([
+  "fieldPath",
+  "method",
+  "policyVersion",
+  "jobId",
+  "redactedAt",
+  "reason",
+  "dataClass",
+  "beforeChecksum"
+]);
+function hasExactKeys(value, keys) {
+  const present = Object.keys(value);
+  return present.length === keys.length && present.every((key) => keys.includes(key));
+}
+function assertEnginePrivacyMetadata(value, path) {
+  const invalid = (detail) => new EvidencePacketGenerationError(
+    "EVIDENCE_INVALID_RECORD",
+    `${path} is not engine-written AnonymizationMetadata (${detail}); _privacy values bypass the anonymization policy, so other data is rejected.`
+  );
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw invalid("not an object");
+  const metadata = value;
+  if (!hasExactKeys(metadata, METADATA_KEYS)) throw invalid("unexpected or missing keys");
+  if (metadata.redactionState !== "anonymized") throw invalid("redactionState");
+  if (!PLATFORM_DATA_CLASSES.includes(metadata.dataClass)) throw invalid("dataClass");
+  for (const key of METADATA_STRING_KEYS) {
+    if (typeof metadata[key] !== "string") throw invalid(key);
+  }
+  if (!isIsoInstant(metadata.redactedAt)) throw invalid("redactedAt");
+  if (!Array.isArray(metadata.preservedSemantics) || !metadata.preservedSemantics.every((item) => typeof item === "string")) {
+    throw invalid("preservedSemantics");
+  }
+  if (!Array.isArray(metadata.redactedFields)) throw invalid("redactedFields");
+  metadata.redactedFields.forEach((field, index) => {
+    if (!field || typeof field !== "object" || Array.isArray(field)) throw invalid(`redactedFields[${index}]`);
+    const entry = field;
+    if (!hasExactKeys(entry, FIELD_METADATA_KEYS) || !Object.values(entry).every((item) => typeof item === "string")) {
+      throw invalid(`redactedFields[${index}]`);
+    }
+    if (!REDACTION_METHODS.includes(entry.method)) throw invalid(`redactedFields[${index}].method`);
+    if (!PLATFORM_DATA_CLASSES.includes(entry.dataClass)) throw invalid(`redactedFields[${index}].dataClass`);
+    if (!isIsoInstant(entry.redactedAt)) throw invalid(`redactedFields[${index}].redactedAt`);
+    if (!SHA256_HEX.test(entry.beforeChecksum)) throw invalid(`redactedFields[${index}].beforeChecksum`);
+  });
+}
+function toPlainJson(value, path) {
+  if (value === null || typeof value === "string" || typeof value === "boolean") return value;
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) {
+      throw new EvidencePacketGenerationError("EVIDENCE_INVALID_RECORD", `${path} is not a finite number.`);
+    }
+    return value;
+  }
+  if (value instanceof Date) {
+    if (Number.isNaN(value.getTime())) {
+      throw new EvidencePacketGenerationError("EVIDENCE_INVALID_RECORD", `${path} is an invalid Date.`);
+    }
+    return value.toISOString();
+  }
+  if (Array.isArray(value)) {
+    return value.map((item, index) => item === void 0 ? null : toPlainJson(item, `${path}[${index}]`));
+  }
+  if (typeof value === "object") {
+    if (!isPlainObject(value)) {
+      const toJSON = value.toJSON;
+      if (typeof toJSON === "function") return toPlainJson(toJSON.call(value), path);
+      throw new EvidencePacketGenerationError(
+        "EVIDENCE_INVALID_RECORD",
+        `${path} is a non-plain object that cannot be represented as JSON.`
+      );
+    }
+    const result = /* @__PURE__ */ Object.create(null);
+    for (const [key, child] of Object.entries(value)) {
+      if (key === "__proto__") {
+        throw new EvidencePacketGenerationError("EVIDENCE_INVALID_RECORD", `${path} has an own "__proto__" key.`);
+      }
+      if (child === void 0) continue;
+      const normalized = toPlainJson(child, `${path}.${key}`);
+      if (key === "_privacy") assertEnginePrivacyMetadata(normalized, `${path}._privacy`);
+      result[key] = normalized;
+    }
+    return result;
+  }
+  throw new EvidencePacketGenerationError("EVIDENCE_INVALID_RECORD", `${path} has unsupported type ${typeof value}.`);
+}
+var ZONED_TIMESTAMP = /^([+-]\d{4,6}|\d{4})-(\d{2})-(\d{2})[T ](\d{2}):(\d{2})(?::(\d{2})(?:\.(\d+))?)? ?(?:(Z)|([+-])(\d{2})(?::?(\d{2}))?)$/;
+function isLeapYear(year) {
+  return year % 4 === 0 && year % 100 !== 0 || year % 400 === 0;
+}
+function daysInMonth(year, month) {
+  return [31, isLeapYear(year) ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31][month - 1];
+}
+function parseZonedTimestamp(value) {
+  const match = ZONED_TIMESTAMP.exec(value);
+  if (!match) return void 0;
+  const [, yearText, monthText, dayText, hourText, minuteText, secondText, fraction, zulu, sign, offsetHourText, offsetMinuteText] = match;
+  const year = Number(yearText);
+  const month = Number(monthText);
+  const day = Number(dayText);
+  const hour = Number(hourText);
+  const minute = Number(minuteText);
+  const second = secondText === void 0 ? 0 : Number(secondText);
+  const millisecond = fraction === void 0 ? 0 : Number(fraction.padEnd(3, "0").slice(0, 3));
+  if (month < 1 || month > 12 || day < 1 || day > daysInMonth(year, month)) return void 0;
+  if (hour > 23 || minute > 59 || second > 59) return void 0;
+  let offsetMinutes = 0;
+  if (!zulu) {
+    const offsetHours = Number(offsetHourText);
+    const offsetMinutePart = offsetMinuteText === void 0 ? 0 : Number(offsetMinuteText);
+    if (offsetHours > 14 || offsetMinutePart > 59) return void 0;
+    offsetMinutes = (sign === "-" ? -1 : 1) * (offsetHours * 60 + offsetMinutePart);
+  }
+  const date = /* @__PURE__ */ new Date(0);
+  date.setUTCFullYear(year, month - 1, day);
+  date.setUTCHours(hour, minute, second, millisecond);
+  const instant = date.getTime() - offsetMinutes * 6e4;
+  return Number.isNaN(new Date(instant).getTime()) ? void 0 : instant;
+}
+function toIsoTimestamp(value, path) {
+  const instant = value instanceof Date ? value.getTime() : typeof value === "string" ? parseZonedTimestamp(value) : void 0;
+  if (instant === void 0 || Number.isNaN(instant)) {
+    throw new EvidencePacketGenerationError(
+      "EVIDENCE_INVALID_RECORD",
+      `${path} must be a Date or an ISO 8601 / PostgreSQL ISO date-time with a valid date, time and explicit zone (Z, +HH, +HH:MM or +HHMM).`
+    );
+  }
+  return new Date(instant).toISOString();
+}
+function assertScope(record, scope, section) {
+  if (record.tenantId !== scope.tenantId || record.spaceId !== scope.spaceId) {
+    throw new EvidencePacketGenerationError(
+      "EVIDENCE_SCOPE_MISMATCH",
+      `Evidence read port returned a ${section} record (${String(record.id)}) outside tenant/space ${scope.tenantId}/${scope.spaceId}.`
+    );
+  }
+}
+function normalizeSection(records, scope, section, prepare) {
+  if (!Array.isArray(records)) {
+    throw new EvidencePacketGenerationError("EVIDENCE_INVALID_RECORD", `Evidence read port returned a non-array for ${section}.`);
+  }
+  const byId2 = /* @__PURE__ */ new Map();
+  records.forEach((raw, index) => {
+    const path = `${section}[${index}]`;
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+      throw new EvidencePacketGenerationError("EVIDENCE_INVALID_RECORD", `${path} must be an object.`);
+    }
+    assertScope(raw, scope, section);
+    const record = toPlainJson(raw, path);
+    assertScope(record, scope, section);
+    assertNonEmptyString(record.id, `${path}.id`);
+    prepare?.(record, path);
+    const canonical = canonicalJson(record);
+    const existing = byId2.get(record.id);
+    if (existing && existing.canonical !== canonical) {
+      throw new EvidencePacketGenerationError(
+        "EVIDENCE_INVALID_RECORD",
+        `Evidence read port returned conflicting ${section} records with id ${String(record.id)}.`
+      );
+    }
+    byId2.set(record.id, { record, canonical });
+  });
+  return [...byId2.values()].map((entry) => entry.record);
+}
+function byId(left, right) {
+  return compareStrings(left.id, right.id);
+}
+function byEventOrder(left, right) {
+  return Date.parse(left.occurredAt) - Date.parse(right.occurredAt) || Date.parse(left.recordedAt) - Date.parse(right.recordedAt) || left.sequence - right.sequence || byId(left, right);
+}
+function assertSubject(subject, path) {
+  if (!subject || typeof subject !== "object") {
+    throw new EvidencePacketGenerationError("EVIDENCE_INVALID_RECORD", `${path} must be an object.`);
+  }
+  assertNonEmptyString(subject.subjectType, `${path}.subjectType`);
+  assertNonEmptyString(subject.subjectId, `${path}.subjectId`);
+  return { subjectType: subject.subjectType, subjectId: subject.subjectId };
+}
+function compareSubjects(left, right) {
+  return compareStrings(left.subjectType, right.subjectType) || compareStrings(left.subjectId, right.subjectId);
+}
+async function resolveSubjects(primary, includeRelated, port, scope) {
+  if (!includeRelated || !port.resolveRelatedSubjects) return [primary];
+  const related = await port.resolveRelatedSubjects({ ...primary }, { ...scope });
+  if (!Array.isArray(related)) {
+    throw new EvidencePacketGenerationError("EVIDENCE_INVALID_RECORD", "resolveRelatedSubjects must return an array.");
+  }
+  const key = (subject) => `${subject.subjectType}\0${subject.subjectId}`;
+  const seen = /* @__PURE__ */ new Set([key(primary)]);
+  const unique = [];
+  related.forEach((candidate, index) => {
+    const subject = assertSubject(candidate, `relatedSubjects[${index}]`);
+    if (seen.has(key(subject))) return;
+    seen.add(key(subject));
+    unique.push(subject);
+  });
+  return [primary, ...unique.sort(compareSubjects)];
+}
+function assertRequestedInvocation(record, path, requested) {
+  const invocationId = record.actionInvocationId;
+  if (typeof invocationId !== "string" || !requested.has(invocationId)) {
+    throw new EvidencePacketGenerationError(
+      "EVIDENCE_UNREQUESTED_RECORD",
+      `${path}.actionInvocationId (${String(invocationId)}) is not one of the requested action invocations.`
+    );
+  }
+}
+var REFERENCE_METADATA_FIELDS = {
+  actionInvocations: ["actionId", "status"],
+  events: ["eventType", "subjectType", "subjectId", "actionInvocationId"],
+  policyEvaluations: ["actionInvocationId", "policyId", "policyVersion", "result"],
+  adapterInvocations: ["actionInvocationId", "adapterType", "operation", "status"]
+};
+var REFERENCE_TYPES = {
+  actionInvocations: "action_invocation",
+  events: "asset_event",
+  policyEvaluations: "policy_evaluation",
+  adapterInvocations: "adapter_invocation"
+};
+function buildReferences(payload, unredacted) {
+  const sections = ["actionInvocations", "events", "policyEvaluations", "adapterInvocations"];
+  return sections.flatMap(
+    (section) => payload[section].map((record, index) => {
+      const originalId = unredacted[section][index]?.id;
+      if (!record || typeof record !== "object" || record.id !== originalId) {
+        throw new EvidencePacketGenerationError(
+          "EVIDENCE_IDENTIFIER_REDACTED",
+          `The anonymization policy removed or changed ${section}[${index}].id; record ids must pass through redaction unchanged.`
+        );
+      }
+      const metadata = {};
+      for (const field of REFERENCE_METADATA_FIELDS[section]) {
+        const value = record[field];
+        if (typeof value === "string") metadata[field] = value;
+      }
+      return {
+        referenceType: REFERENCE_TYPES[section],
+        referenceId: record.id,
+        metadata
+      };
+    })
+  );
+}
+function redactedSubjects(value) {
+  if (!Array.isArray(value)) {
+    throw new EvidencePacketGenerationError("EVIDENCE_IDENTIFIER_REDACTED", "The anonymization policy removed payload.subjects.");
+  }
+  return value.map((subject, index) => {
+    try {
+      return assertSubject(subject, `subjects[${index}]`);
+    } catch {
+      throw new EvidencePacketGenerationError(
+        "EVIDENCE_IDENTIFIER_REDACTED",
+        `The anonymization policy removed subjects[${index}] or made its subjectType/subjectId a non-string; subject identifiers may be transformed (for example tokenized) but must remain non-empty strings.`
+      );
+    }
+  });
+}
+function computeEvidencePacketChecksum(payload) {
+  return crypto.createHash("sha256").update(canonicalJson(payload)).digest("hex");
+}
+async function generateEvidencePacket(input, context, options) {
+  const { port } = options;
+  if (!port || typeof port.listEvents !== "function") {
+    throw new TypeError("generateEvidencePacket requires a read port with listEvents().");
+  }
+  if (!options.anonymizationPolicy || !Array.isArray(options.anonymizationPolicy.fields)) {
+    throw new TypeError("generateEvidencePacket requires an anonymizationPolicy (use { fields: [] } to redact nothing).");
+  }
+  assertNonEmptyString(context.tenantId, "context.tenantId");
+  assertNonEmptyString(context.spaceId, "context.spaceId");
+  assertNonEmptyString(context.actorId, "context.actorId");
+  assertNonEmptyString(context.correlationId, "context.correlationId");
+  const scope = { tenantId: context.tenantId, spaceId: context.spaceId };
+  const primary = assertSubject(input.subject, "input.subject");
+  const includeRelated = input.includeRelated !== false && typeof port.resolveRelatedSubjects === "function";
+  const packetType = input.packetType ?? DEFAULT_EVIDENCE_PACKET_TYPE;
+  assertNonEmptyString(packetType, "input.packetType");
+  const subjects = await resolveSubjects(primary, includeRelated, port, scope);
+  const rawEvents = await port.listEvents({
+    ...scope,
+    primarySubject: { ...primary },
+    subjects: subjects.map((subject) => ({ ...subject }))
+  });
+  const events = normalizeSection(rawEvents, scope, "events", (record, path) => {
+    for (const field of ["eventType", "subjectType", "subjectId", "correlationId"]) {
+      assertNonEmptyString(record[field], `${path}.${field}`);
+    }
+    if (typeof record.sequence !== "number") {
+      throw new EvidencePacketGenerationError("EVIDENCE_INVALID_RECORD", `${path}.sequence must be a number.`);
+    }
+    record.occurredAt = toIsoTimestamp(record.occurredAt, `${path}.occurredAt`);
+    record.recordedAt = toIsoTimestamp(record.recordedAt, `${path}.recordedAt`);
+    const invocationId = record.actionInvocationId;
+    if (invocationId !== void 0 && invocationId !== null) {
+      assertNonEmptyString(invocationId, `${path}.actionInvocationId`);
+    }
+  }).sort(byEventOrder);
+  const invocationIds = [
+    ...new Set(
+      events.map((event) => event.actionInvocationId).filter((id2) => typeof id2 === "string")
+    )
+  ].sort(compareStrings);
+  const requested = new Set(invocationIds);
+  const read = async (method) => {
+    if (!method || invocationIds.length === 0) return [];
+    return method.call(port, { ...scope }, [...invocationIds]);
+  };
+  const [rawActionInvocations, rawPolicyEvaluations, rawAdapterInvocations] = await Promise.all([
+    read(port.listActionInvocations),
+    read(port.listPolicyEvaluations),
+    read(port.listAdapterInvocations)
+  ]);
+  const actionInvocations = normalizeSection(rawActionInvocations, scope, "actionInvocations", (record, path) => {
+    if (!requested.has(record.id)) {
+      throw new EvidencePacketGenerationError(
+        "EVIDENCE_UNREQUESTED_RECORD",
+        `${path}.id (${String(record.id)}) is not one of the requested action invocations.`
+      );
+    }
+  }).sort(byId);
+  const policyEvaluations = normalizeSection(
+    rawPolicyEvaluations,
+    scope,
+    "policyEvaluations",
+    (record, path) => assertRequestedInvocation(record, path, requested)
+  ).sort(byId);
+  const adapterInvocations = normalizeSection(
+    rawAdapterInvocations,
+    scope,
+    "adapterInvocations",
+    (record, path) => assertRequestedInvocation(record, path, requested)
+  ).sort(byId);
+  const generatedAt = context.now ?? /* @__PURE__ */ new Date();
+  const id = options.idFactory ? options.idFactory() : chunkLZSE6QGQ_cjs.createFabricId(chunkLZSE6QGQ_cjs.FABRIC_ID_PREFIXES.complianceEvidencePacket);
+  assertNonEmptyString(id, "packet id");
+  const unredacted = {
+    schemaVersion: EVIDENCE_PACKET_SCHEMA_VERSION,
+    packetType,
+    tenantId: scope.tenantId,
+    spaceId: scope.spaceId,
+    primarySubject: { ...primary },
+    subjects: subjects.map((subject) => ({ ...subject })),
+    includeRelated,
+    ...input.policyVersion !== void 0 ? { policyVersion: input.policyVersion } : {},
+    events,
+    actionInvocations,
+    policyEvaluations,
+    adapterInvocations
+  };
+  const anonymizationContext = {
+    tenantId: scope.tenantId,
+    spaceId: scope.spaceId,
+    jobId: options.anonymization?.jobId ?? id,
+    reason: options.anonymization?.reason ?? DEFAULT_EVIDENCE_REDACTION_REASON,
+    redactedAt: generatedAt,
+    ...options.anonymization?.policyVersion !== void 0 ? { policyVersion: options.anonymization.policyVersion } : {}
+  };
+  const keySorted = JSON.parse(canonicalJson(unredacted));
+  const redacted = new chunkCRZXTZ36_cjs.AnonymizationEngine(options.anonymizationPolicy).anonymizeJsonValue(
+    keySorted,
+    anonymizationContext,
+    "evidence_packet"
+  );
+  const payload = { ...redacted.value, redaction: redacted.metadata };
+  for (const section of ["events", "actionInvocations", "policyEvaluations", "adapterInvocations"]) {
+    if (!Array.isArray(payload[section])) {
+      throw new EvidencePacketGenerationError(
+        "EVIDENCE_IDENTIFIER_REDACTED",
+        `The anonymization policy removed or replaced payload.${section}.`
+      );
+    }
+  }
+  const envelopeSubjects = redactedSubjects(payload.subjects);
+  const references = buildReferences(payload, keySorted);
+  return {
+    id,
+    tenantId: scope.tenantId,
+    spaceId: scope.spaceId,
+    packetType,
+    status: "sealed",
+    subjects: envelopeSubjects,
+    references,
+    payload,
+    generatedAt: generatedAt.toISOString(),
+    generatedBy: context.actorId,
+    ...input.policyVersion !== void 0 ? { policyVersion: input.policyVersion } : {},
+    checksum: computeEvidencePacketChecksum(payload),
+    checksumAlgorithm: EVIDENCE_PACKET_CHECKSUM_ALGORITHM,
+    correlationId: context.correlationId,
+    ...context.causationId !== void 0 ? { causationId: context.causationId } : {}
+  };
+}
+function verifyEvidencePacketChecksum(envelope) {
+  try {
+    if (!envelope || typeof envelope.checksum !== "string" || envelope.checksum.length === 0) return false;
+    if (envelope.checksumAlgorithm !== EVIDENCE_PACKET_CHECKSUM_ALGORITHM) return false;
+    return computeEvidencePacketChecksum(envelope.payload) === envelope.checksum;
+  } catch {
+    return false;
+  }
+}
+function createEvidencePacketRenderer(options) {
+  const { packetType = DEFAULT_EVIDENCE_PACKET_TYPE, ...generatorOptions } = options;
+  return {
+    packetType,
+    render: (input, context) => generateEvidencePacket({ ...input, packetType }, context, generatorOptions)
+  };
+}
+
+exports.DEFAULT_EVIDENCE_PACKET_TYPE = DEFAULT_EVIDENCE_PACKET_TYPE;
+exports.DEFAULT_EVIDENCE_REDACTION_REASON = DEFAULT_EVIDENCE_REDACTION_REASON;
+exports.EVIDENCE_PACKET_CHECKSUM_ALGORITHM = EVIDENCE_PACKET_CHECKSUM_ALGORITHM;
+exports.EVIDENCE_PACKET_SCHEMA_VERSION = EVIDENCE_PACKET_SCHEMA_VERSION;
+exports.EvidencePacketGenerationError = EvidencePacketGenerationError;
+exports.canonicalJson = canonicalJson;
+exports.computeEvidencePacketChecksum = computeEvidencePacketChecksum;
+exports.createEvidencePacketRenderer = createEvidencePacketRenderer;
+exports.generateEvidencePacket = generateEvidencePacket;
+exports.verifyEvidencePacketChecksum = verifyEvidencePacketChecksum;
+//# sourceMappingURL=chunk-6HY35TKB.cjs.map
+//# sourceMappingURL=chunk-6HY35TKB.cjs.map