@fabricorg/platform 1.7.0 → 1.8.0

package/dist/evidence/index.d.cts

@@ -1,3 +1,183 @@
+import { AnonymizationMetadata, AnonymizationPolicy } from '../privacy/index.cjs';
+
+/**
+ * Serializes a value as JSON with every object's keys sorted, recursively, by UTF-16 code-unit
+ * order (locale-independent). Array order is preserved.
+ *
+ * This is the serialization behind the `fabric-canonical-json-sha256-v1` digests: Host's
+ * parameter digests (`PARAMETER_DIGEST_ALGORITHM` in `@fabricorg/platform-host`) and evidence
+ * packet checksums (`EVIDENCE_PACKET_CHECKSUM_ALGORITHM`). Its output is a durable contract, so it
+ * must not change for any input. That includes values that are not plain JSON: any non-array
+ * object is rebuilt from its own enumerable entries before serialization, so a `Date` (which has
+ * none) serializes as `{}`, not as an ISO string. Convert dates to strings before calling this
+ * when they must survive into the output.
+ */
+declare function canonicalJson(value: unknown): string;
+
+/**
+ * Identifies how `EvidencePacketEnvelope.checksum` is computed: the lowercase hex SHA-256 of
+ * `canonicalJson(payload)`. It is the same identifier as Host's `PARAMETER_DIGEST_ALGORITHM`
+ * because the algorithm is the same (SHA-256 over `canonicalJson`).
+ */
+declare const EVIDENCE_PACKET_CHECKSUM_ALGORITHM: "fabric-canonical-json-sha256-v1";
+/** Version of the `EvidencePacketPayload` shape produced by `generateEvidencePacket`. */
+declare const EVIDENCE_PACKET_SCHEMA_VERSION: 1;
+/** Packet type used when the input does not name one. */
+declare const DEFAULT_EVIDENCE_PACKET_TYPE = "compliance_evidence";
+/** Anonymization reason recorded when the caller does not supply one. */
+declare const DEFAULT_EVIDENCE_REDACTION_REASON = "evidence_packet_generation";
+/**
+ * A `Date`, or an ISO 8601 / PostgreSQL ISO date-time string with an explicit zone (`Z`, `+HH`,
+ * `+HH:MM` or `+HHMM`). Zone-less, non-ISO and out-of-range strings are rejected.
+ */
+type EvidenceTimestamp = Date | string;
+/** Tenant and space every record read through the port must belong to. */
+interface EvidenceScope {
+    tenantId: string;
+    spaceId: string;
+}
+/**
+ * An asset event as the read port returns it. `AssetEventEnvelope` (events) and `AssetEventLike`
+ * (privacy) both satisfy this shape. Fields beyond these are kept in the packet payload.
+ */
+interface EvidenceEventRecord {
+    id: string;
+    tenantId: string;
+    spaceId: string;
+    eventType: string;
+    subjectType: string;
+    subjectId: string;
+    actionInvocationId?: string | null;
+    sequence: number;
+    occurredAt: EvidenceTimestamp;
+    recordedAt: EvidenceTimestamp;
+    correlationId: string;
+    causationId?: string | null;
+    payload: unknown;
+}
+/** An action invocation, policy evaluation or adapter invocation record. Further fields are kept. */
+interface EvidenceRecord {
+    id: string;
+    tenantId: string;
+    spaceId: string;
+    actionInvocationId?: string | null;
+    [field: string]: unknown;
+}
+/** A record that belongs to one action invocation (policy evaluations, adapter invocations). */
+interface EvidenceInvocationRecord extends EvidenceRecord {
+    actionInvocationId: string;
+}
+interface EvidenceEventQuery extends EvidenceScope {
+    /** The subject the packet is about. Always `subjects[0]`. */
+    primarySubject: EvidencePacketSubject;
+    /** Primary subject first, then related subjects, de-duplicated and sorted. */
+    subjects: readonly EvidencePacketSubject[];
+}
+type MaybePromise<T> = T | Promise<T>;
+/**
+ * Read-only access to the application's evidence store. The generator filters nothing the port
+ * returns; it rejects, rather than drops, a record that fails one of its checks:
+ *
+ * - every record must have the generation context's `tenantId` and `spaceId`;
+ * - action invocations must have one of the requested ids, and policy evaluations and adapter
+ *   invocations one of the requested `actionInvocationId`s;
+ * - records must have the documented shape (non-empty `id`, event fields, parseable timestamps) and
+ *   be representable as plain JSON, and any `_privacy` value must be engine-written
+ *   `AnonymizationMetadata`.
+ *
+ * Which events belong to the packet is the port's decision: the generator does not check an event's
+ * subject against `subjects`, because a port may legitimately return events recorded against the
+ * primary subject's own action invocations under another subject.
+ */
+interface EvidencePacketReadPort {
+    /** Asset events for the given subjects within the tenant and space. Required. */
+    listEvents(query: EvidenceEventQuery): MaybePromise<readonly EvidenceEventRecord[]>;
+    /** The application's related-subject rules. When absent, only the primary subject is used. */
+    resolveRelatedSubjects?(subject: EvidencePacketSubject, scope: EvidenceScope): MaybePromise<readonly EvidencePacketSubject[]>;
+    /** Action invocations by id. When absent, the section is empty. */
+    listActionInvocations?(scope: EvidenceScope, ids: readonly string[]): MaybePromise<readonly EvidenceRecord[]>;
+    /** Policy evaluations for the given action invocations. When absent, the section is empty. */
+    listPolicyEvaluations?(scope: EvidenceScope, actionInvocationIds: readonly string[]): MaybePromise<readonly EvidenceInvocationRecord[]>;
+    /** Adapter invocations for the given action invocations. When absent, the section is empty. */
+    listAdapterInvocations?(scope: EvidenceScope, actionInvocationIds: readonly string[]): MaybePromise<readonly EvidenceInvocationRecord[]>;
+}
+/** A record after normalization: plain JSON, every `Date` replaced by its ISO string. */
+type EvidenceJsonRecord = Record<string, unknown>;
+interface EvidencePacketPayload {
+    schemaVersion: typeof EVIDENCE_PACKET_SCHEMA_VERSION;
+    packetType: string;
+    tenantId: string;
+    spaceId: string;
+    primarySubject: EvidencePacketSubject;
+    subjects: EvidencePacketSubject[];
+    includeRelated: boolean;
+    policyVersion?: string;
+    events: EvidenceJsonRecord[];
+    actionInvocations: EvidenceJsonRecord[];
+    policyEvaluations: EvidenceJsonRecord[];
+    adapterInvocations: EvidenceJsonRecord[];
+    /** Metadata from the anonymization pass over the rest of the payload (validated engine-written `_privacy` values pass through it unchanged). */
+    redaction: AnonymizationMetadata;
+}
+interface GenerateEvidencePacketInput {
+    subject: EvidencePacketSubject;
+    /** Set to `false` to skip `resolveRelatedSubjects`. Defaults to `true`. */
+    includeRelated?: boolean;
+    /** Defaults to `DEFAULT_EVIDENCE_PACKET_TYPE`. */
+    packetType?: string;
+    policyVersion?: string;
+}
+interface GenerateEvidencePacketOptions {
+    port: EvidencePacketReadPort;
+    /**
+     * Redaction applied to the whole payload with data class `"evidence_packet"`. Required so that
+     * redaction cannot be skipped by omission; pass `{ fields: [] }` to redact nothing.
+     */
+    anonymizationPolicy: AnonymizationPolicy;
+    anonymization?: {
+        /** Defaults to the packet id. */
+        jobId?: string;
+        /** Defaults to `DEFAULT_EVIDENCE_REDACTION_REASON`. */
+        reason?: string;
+        /** Defaults to the engine's `ANONYMIZATION_POLICY_VERSION`. */
+        policyVersion?: string;
+    };
+    /** Defaults to `createFabricId(FABRIC_ID_PREFIXES.complianceEvidencePacket)`. */
+    idFactory?: () => string;
+}
+type EvidencePacketGenerationErrorCode = "EVIDENCE_SCOPE_MISMATCH" | "EVIDENCE_INVALID_RECORD" | "EVIDENCE_UNREQUESTED_RECORD" | "EVIDENCE_IDENTIFIER_REDACTED";
+declare class EvidencePacketGenerationError extends Error {
+    readonly code: EvidencePacketGenerationErrorCode;
+    constructor(code: EvidencePacketGenerationErrorCode, message: string);
+}
+/** Lowercase hex SHA-256 of `canonicalJson(payload)`. */
+declare function computeEvidencePacketChecksum(payload: unknown): string;
+/**
+ * Builds a sealed evidence packet for one subject from the application's read port.
+ *
+ * Steps: resolve subjects (primary first, then related, de-duplicated and sorted); read events,
+ * then the action invocations, policy evaluations and adapter invocations those events reference;
+ * reject any record outside `context.tenantId`/`context.spaceId`; normalize to plain JSON and sort
+ * deterministically; redact the payload with `AnonymizationEngine` (data class
+ * `"evidence_packet"`); checksum the redacted payload; and build references from it.
+ *
+ * Nothing is persisted. Storing the returned envelope is the application's job.
+ */
+declare function generateEvidencePacket<TDb = unknown>(input: GenerateEvidencePacketInput, context: EvidenceGenerationContext<TDb>, options: GenerateEvidencePacketOptions): Promise<EvidencePacketEnvelope<EvidencePacketPayload>>;
+/**
+ * Recomputes an envelope's checksum. Returns `false`, never throws, when the checksum is missing,
+ * the algorithm is missing or unknown, the payload cannot be serialized, or the values differ.
+ * It covers `payload` only, which includes the subjects and the redaction metadata; the other
+ * envelope fields are not covered.
+ */
+declare function verifyEvidencePacketChecksum(envelope: Pick<EvidencePacketEnvelope<unknown>, "payload" | "checksum" | "checksumAlgorithm">): boolean;
+type EvidencePacketRendererInput = Omit<GenerateEvidencePacketInput, "packetType">;
+interface EvidencePacketRendererOptions extends GenerateEvidencePacketOptions {
+    packetType?: string;
+}
+/** Wraps `generateEvidencePacket` as an `EvidenceRenderer` for one packet type. */
+declare function createEvidencePacketRenderer<TDb = unknown>(options: EvidencePacketRendererOptions): EvidenceRenderer<EvidencePacketRendererInput, EvidencePacketPayload, TDb>;
+
 type EvidencePacketStatus = "draft" | "sealed" | "superseded";
 interface EvidencePacketSubject {
     subjectType: string;
@@ -23,6 +203,12 @@ interface EvidencePacketEnvelope<TPayload = Record<string, unknown>> {
     generatedBy: string;
     policyVersion?: string;
     checksum?: string;
+    /**
+     * How `checksum` was computed. Packets built by `generateEvidencePacket` use
+     * `EVIDENCE_PACKET_CHECKSUM_ALGORITHM`. Optional and additive: envelopes built before this field
+     * existed omit it.
+     */
+    checksumAlgorithm?: string;
     correlationId: string;
     causationId?: string;
 }
@@ -40,4 +226,4 @@ interface EvidenceRenderer<TInput = unknown, TPayload = Record<string, unknown>,
     render: (input: TInput, context: EvidenceGenerationContext<TDb>) => Promise<EvidencePacketEnvelope<TPayload>> | EvidencePacketEnvelope<TPayload>;
 }
 
-export type { EvidenceGenerationContext, EvidencePacketEnvelope, EvidencePacketReference, EvidencePacketStatus, EvidencePacketSubject, EvidenceRenderer };
+export { DEFAULT_EVIDENCE_PACKET_TYPE, DEFAULT_EVIDENCE_REDACTION_REASON, EVIDENCE_PACKET_CHECKSUM_ALGORITHM, EVIDENCE_PACKET_SCHEMA_VERSION, type EvidenceEventQuery, type EvidenceEventRecord, type EvidenceGenerationContext, type EvidenceInvocationRecord, type EvidenceJsonRecord, type EvidencePacketEnvelope, EvidencePacketGenerationError, type EvidencePacketGenerationErrorCode, type EvidencePacketPayload, type EvidencePacketReadPort, type EvidencePacketReference, type EvidencePacketRendererInput, type EvidencePacketRendererOptions, type EvidencePacketStatus, type EvidencePacketSubject, type EvidenceRecord, type EvidenceRenderer, type EvidenceScope, type EvidenceTimestamp, type GenerateEvidencePacketInput, type GenerateEvidencePacketOptions, canonicalJson, computeEvidencePacketChecksum, createEvidencePacketRenderer, generateEvidencePacket, verifyEvidencePacketChecksum };

package/dist/evidence/index.d.ts

@@ -1,3 +1,183 @@
+import { AnonymizationMetadata, AnonymizationPolicy } from '../privacy/index.js';
+
+/**
+ * Serializes a value as JSON with every object's keys sorted, recursively, by UTF-16 code-unit
+ * order (locale-independent). Array order is preserved.
+ *
+ * This is the serialization behind the `fabric-canonical-json-sha256-v1` digests: Host's
+ * parameter digests (`PARAMETER_DIGEST_ALGORITHM` in `@fabricorg/platform-host`) and evidence
+ * packet checksums (`EVIDENCE_PACKET_CHECKSUM_ALGORITHM`). Its output is a durable contract, so it
+ * must not change for any input. That includes values that are not plain JSON: any non-array
+ * object is rebuilt from its own enumerable entries before serialization, so a `Date` (which has
+ * none) serializes as `{}`, not as an ISO string. Convert dates to strings before calling this
+ * when they must survive into the output.
+ */
+declare function canonicalJson(value: unknown): string;
+
+/**
+ * Identifies how `EvidencePacketEnvelope.checksum` is computed: the lowercase hex SHA-256 of
+ * `canonicalJson(payload)`. It is the same identifier as Host's `PARAMETER_DIGEST_ALGORITHM`
+ * because the algorithm is the same (SHA-256 over `canonicalJson`).
+ */
+declare const EVIDENCE_PACKET_CHECKSUM_ALGORITHM: "fabric-canonical-json-sha256-v1";
+/** Version of the `EvidencePacketPayload` shape produced by `generateEvidencePacket`. */
+declare const EVIDENCE_PACKET_SCHEMA_VERSION: 1;
+/** Packet type used when the input does not name one. */
+declare const DEFAULT_EVIDENCE_PACKET_TYPE = "compliance_evidence";
+/** Anonymization reason recorded when the caller does not supply one. */
+declare const DEFAULT_EVIDENCE_REDACTION_REASON = "evidence_packet_generation";
+/**
+ * A `Date`, or an ISO 8601 / PostgreSQL ISO date-time string with an explicit zone (`Z`, `+HH`,
+ * `+HH:MM` or `+HHMM`). Zone-less, non-ISO and out-of-range strings are rejected.
+ */
+type EvidenceTimestamp = Date | string;
+/** Tenant and space every record read through the port must belong to. */
+interface EvidenceScope {
+    tenantId: string;
+    spaceId: string;
+}
+/**
+ * An asset event as the read port returns it. `AssetEventEnvelope` (events) and `AssetEventLike`
+ * (privacy) both satisfy this shape. Fields beyond these are kept in the packet payload.
+ */
+interface EvidenceEventRecord {
+    id: string;
+    tenantId: string;
+    spaceId: string;
+    eventType: string;
+    subjectType: string;
+    subjectId: string;
+    actionInvocationId?: string | null;
+    sequence: number;
+    occurredAt: EvidenceTimestamp;
+    recordedAt: EvidenceTimestamp;
+    correlationId: string;
+    causationId?: string | null;
+    payload: unknown;
+}
+/** An action invocation, policy evaluation or adapter invocation record. Further fields are kept. */
+interface EvidenceRecord {
+    id: string;
+    tenantId: string;
+    spaceId: string;
+    actionInvocationId?: string | null;
+    [field: string]: unknown;
+}
+/** A record that belongs to one action invocation (policy evaluations, adapter invocations). */
+interface EvidenceInvocationRecord extends EvidenceRecord {
+    actionInvocationId: string;
+}
+interface EvidenceEventQuery extends EvidenceScope {
+    /** The subject the packet is about. Always `subjects[0]`. */
+    primarySubject: EvidencePacketSubject;
+    /** Primary subject first, then related subjects, de-duplicated and sorted. */
+    subjects: readonly EvidencePacketSubject[];
+}
+type MaybePromise<T> = T | Promise<T>;
+/**
+ * Read-only access to the application's evidence store. The generator filters nothing the port
+ * returns; it rejects, rather than drops, a record that fails one of its checks:
+ *
+ * - every record must have the generation context's `tenantId` and `spaceId`;
+ * - action invocations must have one of the requested ids, and policy evaluations and adapter
+ *   invocations one of the requested `actionInvocationId`s;
+ * - records must have the documented shape (non-empty `id`, event fields, parseable timestamps) and
+ *   be representable as plain JSON, and any `_privacy` value must be engine-written
+ *   `AnonymizationMetadata`.
+ *
+ * Which events belong to the packet is the port's decision: the generator does not check an event's
+ * subject against `subjects`, because a port may legitimately return events recorded against the
+ * primary subject's own action invocations under another subject.
+ */
+interface EvidencePacketReadPort {
+    /** Asset events for the given subjects within the tenant and space. Required. */
+    listEvents(query: EvidenceEventQuery): MaybePromise<readonly EvidenceEventRecord[]>;
+    /** The application's related-subject rules. When absent, only the primary subject is used. */
+    resolveRelatedSubjects?(subject: EvidencePacketSubject, scope: EvidenceScope): MaybePromise<readonly EvidencePacketSubject[]>;
+    /** Action invocations by id. When absent, the section is empty. */
+    listActionInvocations?(scope: EvidenceScope, ids: readonly string[]): MaybePromise<readonly EvidenceRecord[]>;
+    /** Policy evaluations for the given action invocations. When absent, the section is empty. */
+    listPolicyEvaluations?(scope: EvidenceScope, actionInvocationIds: readonly string[]): MaybePromise<readonly EvidenceInvocationRecord[]>;
+    /** Adapter invocations for the given action invocations. When absent, the section is empty. */
+    listAdapterInvocations?(scope: EvidenceScope, actionInvocationIds: readonly string[]): MaybePromise<readonly EvidenceInvocationRecord[]>;
+}
+/** A record after normalization: plain JSON, every `Date` replaced by its ISO string. */
+type EvidenceJsonRecord = Record<string, unknown>;
+interface EvidencePacketPayload {
+    schemaVersion: typeof EVIDENCE_PACKET_SCHEMA_VERSION;
+    packetType: string;
+    tenantId: string;
+    spaceId: string;
+    primarySubject: EvidencePacketSubject;
+    subjects: EvidencePacketSubject[];
+    includeRelated: boolean;
+    policyVersion?: string;
+    events: EvidenceJsonRecord[];
+    actionInvocations: EvidenceJsonRecord[];
+    policyEvaluations: EvidenceJsonRecord[];
+    adapterInvocations: EvidenceJsonRecord[];
+    /** Metadata from the anonymization pass over the rest of the payload (validated engine-written `_privacy` values pass through it unchanged). */
+    redaction: AnonymizationMetadata;
+}
+interface GenerateEvidencePacketInput {
+    subject: EvidencePacketSubject;
+    /** Set to `false` to skip `resolveRelatedSubjects`. Defaults to `true`. */
+    includeRelated?: boolean;
+    /** Defaults to `DEFAULT_EVIDENCE_PACKET_TYPE`. */
+    packetType?: string;
+    policyVersion?: string;
+}
+interface GenerateEvidencePacketOptions {
+    port: EvidencePacketReadPort;
+    /**
+     * Redaction applied to the whole payload with data class `"evidence_packet"`. Required so that
+     * redaction cannot be skipped by omission; pass `{ fields: [] }` to redact nothing.
+     */
+    anonymizationPolicy: AnonymizationPolicy;
+    anonymization?: {
+        /** Defaults to the packet id. */
+        jobId?: string;
+        /** Defaults to `DEFAULT_EVIDENCE_REDACTION_REASON`. */
+        reason?: string;
+        /** Defaults to the engine's `ANONYMIZATION_POLICY_VERSION`. */
+        policyVersion?: string;
+    };
+    /** Defaults to `createFabricId(FABRIC_ID_PREFIXES.complianceEvidencePacket)`. */
+    idFactory?: () => string;
+}
+type EvidencePacketGenerationErrorCode = "EVIDENCE_SCOPE_MISMATCH" | "EVIDENCE_INVALID_RECORD" | "EVIDENCE_UNREQUESTED_RECORD" | "EVIDENCE_IDENTIFIER_REDACTED";
+declare class EvidencePacketGenerationError extends Error {
+    readonly code: EvidencePacketGenerationErrorCode;
+    constructor(code: EvidencePacketGenerationErrorCode, message: string);
+}
+/** Lowercase hex SHA-256 of `canonicalJson(payload)`. */
+declare function computeEvidencePacketChecksum(payload: unknown): string;
+/**
+ * Builds a sealed evidence packet for one subject from the application's read port.
+ *
+ * Steps: resolve subjects (primary first, then related, de-duplicated and sorted); read events,
+ * then the action invocations, policy evaluations and adapter invocations those events reference;
+ * reject any record outside `context.tenantId`/`context.spaceId`; normalize to plain JSON and sort
+ * deterministically; redact the payload with `AnonymizationEngine` (data class
+ * `"evidence_packet"`); checksum the redacted payload; and build references from it.
+ *
+ * Nothing is persisted. Storing the returned envelope is the application's job.
+ */
+declare function generateEvidencePacket<TDb = unknown>(input: GenerateEvidencePacketInput, context: EvidenceGenerationContext<TDb>, options: GenerateEvidencePacketOptions): Promise<EvidencePacketEnvelope<EvidencePacketPayload>>;
+/**
+ * Recomputes an envelope's checksum. Returns `false`, never throws, when the checksum is missing,
+ * the algorithm is missing or unknown, the payload cannot be serialized, or the values differ.
+ * It covers `payload` only, which includes the subjects and the redaction metadata; the other
+ * envelope fields are not covered.
+ */
+declare function verifyEvidencePacketChecksum(envelope: Pick<EvidencePacketEnvelope<unknown>, "payload" | "checksum" | "checksumAlgorithm">): boolean;
+type EvidencePacketRendererInput = Omit<GenerateEvidencePacketInput, "packetType">;
+interface EvidencePacketRendererOptions extends GenerateEvidencePacketOptions {
+    packetType?: string;
+}
+/** Wraps `generateEvidencePacket` as an `EvidenceRenderer` for one packet type. */
+declare function createEvidencePacketRenderer<TDb = unknown>(options: EvidencePacketRendererOptions): EvidenceRenderer<EvidencePacketRendererInput, EvidencePacketPayload, TDb>;
+
 type EvidencePacketStatus = "draft" | "sealed" | "superseded";
 interface EvidencePacketSubject {
     subjectType: string;
@@ -23,6 +203,12 @@ interface EvidencePacketEnvelope<TPayload = Record<string, unknown>> {
     generatedBy: string;
     policyVersion?: string;
     checksum?: string;
+    /**
+     * How `checksum` was computed. Packets built by `generateEvidencePacket` use
+     * `EVIDENCE_PACKET_CHECKSUM_ALGORITHM`. Optional and additive: envelopes built before this field
+     * existed omit it.
+     */
+    checksumAlgorithm?: string;
     correlationId: string;
     causationId?: string;
 }
@@ -40,4 +226,4 @@ interface EvidenceRenderer<TInput = unknown, TPayload = Record<string, unknown>,
     render: (input: TInput, context: EvidenceGenerationContext<TDb>) => Promise<EvidencePacketEnvelope<TPayload>> | EvidencePacketEnvelope<TPayload>;
 }
 
-export type { EvidenceGenerationContext, EvidencePacketEnvelope, EvidencePacketReference, EvidencePacketStatus, EvidencePacketSubject, EvidenceRenderer };
+export { DEFAULT_EVIDENCE_PACKET_TYPE, DEFAULT_EVIDENCE_REDACTION_REASON, EVIDENCE_PACKET_CHECKSUM_ALGORITHM, EVIDENCE_PACKET_SCHEMA_VERSION, type EvidenceEventQuery, type EvidenceEventRecord, type EvidenceGenerationContext, type EvidenceInvocationRecord, type EvidenceJsonRecord, type EvidencePacketEnvelope, EvidencePacketGenerationError, type EvidencePacketGenerationErrorCode, type EvidencePacketPayload, type EvidencePacketReadPort, type EvidencePacketReference, type EvidencePacketRendererInput, type EvidencePacketRendererOptions, type EvidencePacketStatus, type EvidencePacketSubject, type EvidenceRecord, type EvidenceRenderer, type EvidenceScope, type EvidenceTimestamp, type GenerateEvidencePacketInput, type GenerateEvidencePacketOptions, canonicalJson, computeEvidencePacketChecksum, createEvidencePacketRenderer, generateEvidencePacket, verifyEvidencePacketChecksum };

package/dist/evidence/index.js

@@ -1,3 +1,5 @@
-import '../chunk-OZLZHISS.js';
+export { DEFAULT_EVIDENCE_PACKET_TYPE, DEFAULT_EVIDENCE_REDACTION_REASON, EVIDENCE_PACKET_CHECKSUM_ALGORITHM, EVIDENCE_PACKET_SCHEMA_VERSION, EvidencePacketGenerationError, canonicalJson, computeEvidencePacketChecksum, createEvidencePacketRenderer, generateEvidencePacket, verifyEvidencePacketChecksum } from '../chunk-HEYMMVDP.js';
+import '../chunk-RALMUSOX.js';
+import '../chunk-TYNIFC7J.js';
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/governance/index.d.cts

@@ -1,6 +1,7 @@
 import { ActorType } from '../actions/index.cjs';
 import { EvidencePacketReference } from '../evidence/index.cjs';
 import '../discovery/index.cjs';
+import '../privacy/index.cjs';
 
 /** Language-neutral governance contract version shared by TypeScript and .NET. */
 declare const FABRIC_GOVERNANCE_CONTRACT_VERSION: 1;

package/dist/governance/index.d.ts

@@ -1,6 +1,7 @@
 import { ActorType } from '../actions/index.js';
 import { EvidencePacketReference } from '../evidence/index.js';
 import '../discovery/index.js';
+import '../privacy/index.js';
 
 /** Language-neutral governance contract version shared by TypeScript and .NET. */
 declare const FABRIC_GOVERNANCE_CONTRACT_VERSION: 1;