@fabricorg/platform 1.7.0 → 1.8.0

package/dist/chunk-HEYMMVDP.js

@@ -0,0 +1,480 @@
+import { createFabricId, FABRIC_ID_PREFIXES } from './chunk-RALMUSOX.js';
+import { AnonymizationEngine } from './chunk-TYNIFC7J.js';
+import { createHash } from 'crypto';
+
+// evidence/canonical-json.ts
+function canonicalJson(value) {
+  return JSON.stringify(sortKeys(value));
+}
+function sortKeys(value) {
+  if (Array.isArray(value)) return value.map(sortKeys);
+  if (value && typeof value === "object") {
+    return Object.fromEntries(Object.entries(value).sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0).map(([key, child]) => [key, sortKeys(child)]));
+  }
+  return value;
+}
+var EVIDENCE_PACKET_CHECKSUM_ALGORITHM = "fabric-canonical-json-sha256-v1";
+var EVIDENCE_PACKET_SCHEMA_VERSION = 1;
+var DEFAULT_EVIDENCE_PACKET_TYPE = "compliance_evidence";
+var DEFAULT_EVIDENCE_REDACTION_REASON = "evidence_packet_generation";
+var EvidencePacketGenerationError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "EvidencePacketGenerationError";
+    this.code = code;
+  }
+};
+function compareStrings(left, right) {
+  return left < right ? -1 : left > right ? 1 : 0;
+}
+function assertNonEmptyString(value, what) {
+  if (typeof value !== "string" || value.length === 0) {
+    throw new EvidencePacketGenerationError("EVIDENCE_INVALID_RECORD", `${what} must be a non-empty string.`);
+  }
+}
+function isPlainObject(value) {
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
+function exhaustiveList() {
+  return (list) => list;
+}
+var REDACTION_METHODS = Object.freeze(
+  exhaustiveList()(["nullify", "mask", "hash", "tokenize", "generalize", "drop"])
+);
+var PLATFORM_DATA_CLASSES = Object.freeze(
+  exhaustiveList()([
+    "asset_event",
+    "read_model",
+    "raw_payload",
+    "evidence_packet",
+    "action_evidence",
+    "access_event"
+  ])
+);
+var SHA256_HEX = /^[0-9a-f]{64}$/;
+function isIsoInstant(value) {
+  if (typeof value !== "string") return false;
+  const date = new Date(value);
+  return !Number.isNaN(date.getTime()) && date.toISOString() === value;
+}
+var METADATA_STRING_KEYS = ["policyVersion", "jobId", "redactedAt", "reason"];
+var METADATA_KEYS = Object.freeze([
+  "redactionState",
+  "dataClass",
+  "redactedFields",
+  "preservedSemantics",
+  ...METADATA_STRING_KEYS
+]);
+var FIELD_METADATA_KEYS = Object.freeze([
+  "fieldPath",
+  "method",
+  "policyVersion",
+  "jobId",
+  "redactedAt",
+  "reason",
+  "dataClass",
+  "beforeChecksum"
+]);
+function hasExactKeys(value, keys) {
+  const present = Object.keys(value);
+  return present.length === keys.length && present.every((key) => keys.includes(key));
+}
+function assertEnginePrivacyMetadata(value, path) {
+  const invalid = (detail) => new EvidencePacketGenerationError(
+    "EVIDENCE_INVALID_RECORD",
+    `${path} is not engine-written AnonymizationMetadata (${detail}); _privacy values bypass the anonymization policy, so other data is rejected.`
+  );
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw invalid("not an object");
+  const metadata = value;
+  if (!hasExactKeys(metadata, METADATA_KEYS)) throw invalid("unexpected or missing keys");
+  if (metadata.redactionState !== "anonymized") throw invalid("redactionState");
+  if (!PLATFORM_DATA_CLASSES.includes(metadata.dataClass)) throw invalid("dataClass");
+  for (const key of METADATA_STRING_KEYS) {
+    if (typeof metadata[key] !== "string") throw invalid(key);
+  }
+  if (!isIsoInstant(metadata.redactedAt)) throw invalid("redactedAt");
+  if (!Array.isArray(metadata.preservedSemantics) || !metadata.preservedSemantics.every((item) => typeof item === "string")) {
+    throw invalid("preservedSemantics");
+  }
+  if (!Array.isArray(metadata.redactedFields)) throw invalid("redactedFields");
+  metadata.redactedFields.forEach((field, index) => {
+    if (!field || typeof field !== "object" || Array.isArray(field)) throw invalid(`redactedFields[${index}]`);
+    const entry = field;
+    if (!hasExactKeys(entry, FIELD_METADATA_KEYS) || !Object.values(entry).every((item) => typeof item === "string")) {
+      throw invalid(`redactedFields[${index}]`);
+    }
+    if (!REDACTION_METHODS.includes(entry.method)) throw invalid(`redactedFields[${index}].method`);
+    if (!PLATFORM_DATA_CLASSES.includes(entry.dataClass)) throw invalid(`redactedFields[${index}].dataClass`);
+    if (!isIsoInstant(entry.redactedAt)) throw invalid(`redactedFields[${index}].redactedAt`);
+    if (!SHA256_HEX.test(entry.beforeChecksum)) throw invalid(`redactedFields[${index}].beforeChecksum`);
+  });
+}
+function toPlainJson(value, path) {
+  if (value === null || typeof value === "string" || typeof value === "boolean") return value;
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) {
+      throw new EvidencePacketGenerationError("EVIDENCE_INVALID_RECORD", `${path} is not a finite number.`);
+    }
+    return value;
+  }
+  if (value instanceof Date) {
+    if (Number.isNaN(value.getTime())) {
+      throw new EvidencePacketGenerationError("EVIDENCE_INVALID_RECORD", `${path} is an invalid Date.`);
+    }
+    return value.toISOString();
+  }
+  if (Array.isArray(value)) {
+    return value.map((item, index) => item === void 0 ? null : toPlainJson(item, `${path}[${index}]`));
+  }
+  if (typeof value === "object") {
+    if (!isPlainObject(value)) {
+      const toJSON = value.toJSON;
+      if (typeof toJSON === "function") return toPlainJson(toJSON.call(value), path);
+      throw new EvidencePacketGenerationError(
+        "EVIDENCE_INVALID_RECORD",
+        `${path} is a non-plain object that cannot be represented as JSON.`
+      );
+    }
+    const result = /* @__PURE__ */ Object.create(null);
+    for (const [key, child] of Object.entries(value)) {
+      if (key === "__proto__") {
+        throw new EvidencePacketGenerationError("EVIDENCE_INVALID_RECORD", `${path} has an own "__proto__" key.`);
+      }
+      if (child === void 0) continue;
+      const normalized = toPlainJson(child, `${path}.${key}`);
+      if (key === "_privacy") assertEnginePrivacyMetadata(normalized, `${path}._privacy`);
+      result[key] = normalized;
+    }
+    return result;
+  }
+  throw new EvidencePacketGenerationError("EVIDENCE_INVALID_RECORD", `${path} has unsupported type ${typeof value}.`);
+}
+var ZONED_TIMESTAMP = /^([+-]\d{4,6}|\d{4})-(\d{2})-(\d{2})[T ](\d{2}):(\d{2})(?::(\d{2})(?:\.(\d+))?)? ?(?:(Z)|([+-])(\d{2})(?::?(\d{2}))?)$/;
+function isLeapYear(year) {
+  return year % 4 === 0 && year % 100 !== 0 || year % 400 === 0;
+}
+function daysInMonth(year, month) {
+  return [31, isLeapYear(year) ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31][month - 1];
+}
+function parseZonedTimestamp(value) {
+  const match = ZONED_TIMESTAMP.exec(value);
+  if (!match) return void 0;
+  const [, yearText, monthText, dayText, hourText, minuteText, secondText, fraction, zulu, sign, offsetHourText, offsetMinuteText] = match;
+  const year = Number(yearText);
+  const month = Number(monthText);
+  const day = Number(dayText);
+  const hour = Number(hourText);
+  const minute = Number(minuteText);
+  const second = secondText === void 0 ? 0 : Number(secondText);
+  const millisecond = fraction === void 0 ? 0 : Number(fraction.padEnd(3, "0").slice(0, 3));
+  if (month < 1 || month > 12 || day < 1 || day > daysInMonth(year, month)) return void 0;
+  if (hour > 23 || minute > 59 || second > 59) return void 0;
+  let offsetMinutes = 0;
+  if (!zulu) {
+    const offsetHours = Number(offsetHourText);
+    const offsetMinutePart = offsetMinuteText === void 0 ? 0 : Number(offsetMinuteText);
+    if (offsetHours > 14 || offsetMinutePart > 59) return void 0;
+    offsetMinutes = (sign === "-" ? -1 : 1) * (offsetHours * 60 + offsetMinutePart);
+  }
+  const date = /* @__PURE__ */ new Date(0);
+  date.setUTCFullYear(year, month - 1, day);
+  date.setUTCHours(hour, minute, second, millisecond);
+  const instant = date.getTime() - offsetMinutes * 6e4;
+  return Number.isNaN(new Date(instant).getTime()) ? void 0 : instant;
+}
+function toIsoTimestamp(value, path) {
+  const instant = value instanceof Date ? value.getTime() : typeof value === "string" ? parseZonedTimestamp(value) : void 0;
+  if (instant === void 0 || Number.isNaN(instant)) {
+    throw new EvidencePacketGenerationError(
+      "EVIDENCE_INVALID_RECORD",
+      `${path} must be a Date or an ISO 8601 / PostgreSQL ISO date-time with a valid date, time and explicit zone (Z, +HH, +HH:MM or +HHMM).`
+    );
+  }
+  return new Date(instant).toISOString();
+}
+function assertScope(record, scope, section) {
+  if (record.tenantId !== scope.tenantId || record.spaceId !== scope.spaceId) {
+    throw new EvidencePacketGenerationError(
+      "EVIDENCE_SCOPE_MISMATCH",
+      `Evidence read port returned a ${section} record (${String(record.id)}) outside tenant/space ${scope.tenantId}/${scope.spaceId}.`
+    );
+  }
+}
+function normalizeSection(records, scope, section, prepare) {
+  if (!Array.isArray(records)) {
+    throw new EvidencePacketGenerationError("EVIDENCE_INVALID_RECORD", `Evidence read port returned a non-array for ${section}.`);
+  }
+  const byId2 = /* @__PURE__ */ new Map();
+  records.forEach((raw, index) => {
+    const path = `${section}[${index}]`;
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+      throw new EvidencePacketGenerationError("EVIDENCE_INVALID_RECORD", `${path} must be an object.`);
+    }
+    assertScope(raw, scope, section);
+    const record = toPlainJson(raw, path);
+    assertScope(record, scope, section);
+    assertNonEmptyString(record.id, `${path}.id`);
+    prepare?.(record, path);
+    const canonical = canonicalJson(record);
+    const existing = byId2.get(record.id);
+    if (existing && existing.canonical !== canonical) {
+      throw new EvidencePacketGenerationError(
+        "EVIDENCE_INVALID_RECORD",
+        `Evidence read port returned conflicting ${section} records with id ${String(record.id)}.`
+      );
+    }
+    byId2.set(record.id, { record, canonical });
+  });
+  return [...byId2.values()].map((entry) => entry.record);
+}
+function byId(left, right) {
+  return compareStrings(left.id, right.id);
+}
+function byEventOrder(left, right) {
+  return Date.parse(left.occurredAt) - Date.parse(right.occurredAt) || Date.parse(left.recordedAt) - Date.parse(right.recordedAt) || left.sequence - right.sequence || byId(left, right);
+}
+function assertSubject(subject, path) {
+  if (!subject || typeof subject !== "object") {
+    throw new EvidencePacketGenerationError("EVIDENCE_INVALID_RECORD", `${path} must be an object.`);
+  }
+  assertNonEmptyString(subject.subjectType, `${path}.subjectType`);
+  assertNonEmptyString(subject.subjectId, `${path}.subjectId`);
+  return { subjectType: subject.subjectType, subjectId: subject.subjectId };
+}
+function compareSubjects(left, right) {
+  return compareStrings(left.subjectType, right.subjectType) || compareStrings(left.subjectId, right.subjectId);
+}
+async function resolveSubjects(primary, includeRelated, port, scope) {
+  if (!includeRelated || !port.resolveRelatedSubjects) return [primary];
+  const related = await port.resolveRelatedSubjects({ ...primary }, { ...scope });
+  if (!Array.isArray(related)) {
+    throw new EvidencePacketGenerationError("EVIDENCE_INVALID_RECORD", "resolveRelatedSubjects must return an array.");
+  }
+  const key = (subject) => `${subject.subjectType}\0${subject.subjectId}`;
+  const seen = /* @__PURE__ */ new Set([key(primary)]);
+  const unique = [];
+  related.forEach((candidate, index) => {
+    const subject = assertSubject(candidate, `relatedSubjects[${index}]`);
+    if (seen.has(key(subject))) return;
+    seen.add(key(subject));
+    unique.push(subject);
+  });
+  return [primary, ...unique.sort(compareSubjects)];
+}
+function assertRequestedInvocation(record, path, requested) {
+  const invocationId = record.actionInvocationId;
+  if (typeof invocationId !== "string" || !requested.has(invocationId)) {
+    throw new EvidencePacketGenerationError(
+      "EVIDENCE_UNREQUESTED_RECORD",
+      `${path}.actionInvocationId (${String(invocationId)}) is not one of the requested action invocations.`
+    );
+  }
+}
+var REFERENCE_METADATA_FIELDS = {
+  actionInvocations: ["actionId", "status"],
+  events: ["eventType", "subjectType", "subjectId", "actionInvocationId"],
+  policyEvaluations: ["actionInvocationId", "policyId", "policyVersion", "result"],
+  adapterInvocations: ["actionInvocationId", "adapterType", "operation", "status"]
+};
+var REFERENCE_TYPES = {
+  actionInvocations: "action_invocation",
+  events: "asset_event",
+  policyEvaluations: "policy_evaluation",
+  adapterInvocations: "adapter_invocation"
+};
+function buildReferences(payload, unredacted) {
+  const sections = ["actionInvocations", "events", "policyEvaluations", "adapterInvocations"];
+  return sections.flatMap(
+    (section) => payload[section].map((record, index) => {
+      const originalId = unredacted[section][index]?.id;
+      if (!record || typeof record !== "object" || record.id !== originalId) {
+        throw new EvidencePacketGenerationError(
+          "EVIDENCE_IDENTIFIER_REDACTED",
+          `The anonymization policy removed or changed ${section}[${index}].id; record ids must pass through redaction unchanged.`
+        );
+      }
+      const metadata = {};
+      for (const field of REFERENCE_METADATA_FIELDS[section]) {
+        const value = record[field];
+        if (typeof value === "string") metadata[field] = value;
+      }
+      return {
+        referenceType: REFERENCE_TYPES[section],
+        referenceId: record.id,
+        metadata
+      };
+    })
+  );
+}
+function redactedSubjects(value) {
+  if (!Array.isArray(value)) {
+    throw new EvidencePacketGenerationError("EVIDENCE_IDENTIFIER_REDACTED", "The anonymization policy removed payload.subjects.");
+  }
+  return value.map((subject, index) => {
+    try {
+      return assertSubject(subject, `subjects[${index}]`);
+    } catch {
+      throw new EvidencePacketGenerationError(
+        "EVIDENCE_IDENTIFIER_REDACTED",
+        `The anonymization policy removed subjects[${index}] or made its subjectType/subjectId a non-string; subject identifiers may be transformed (for example tokenized) but must remain non-empty strings.`
+      );
+    }
+  });
+}
+function computeEvidencePacketChecksum(payload) {
+  return createHash("sha256").update(canonicalJson(payload)).digest("hex");
+}
+async function generateEvidencePacket(input, context, options) {
+  const { port } = options;
+  if (!port || typeof port.listEvents !== "function") {
+    throw new TypeError("generateEvidencePacket requires a read port with listEvents().");
+  }
+  if (!options.anonymizationPolicy || !Array.isArray(options.anonymizationPolicy.fields)) {
+    throw new TypeError("generateEvidencePacket requires an anonymizationPolicy (use { fields: [] } to redact nothing).");
+  }
+  assertNonEmptyString(context.tenantId, "context.tenantId");
+  assertNonEmptyString(context.spaceId, "context.spaceId");
+  assertNonEmptyString(context.actorId, "context.actorId");
+  assertNonEmptyString(context.correlationId, "context.correlationId");
+  const scope = { tenantId: context.tenantId, spaceId: context.spaceId };
+  const primary = assertSubject(input.subject, "input.subject");
+  const includeRelated = input.includeRelated !== false && typeof port.resolveRelatedSubjects === "function";
+  const packetType = input.packetType ?? DEFAULT_EVIDENCE_PACKET_TYPE;
+  assertNonEmptyString(packetType, "input.packetType");
+  const subjects = await resolveSubjects(primary, includeRelated, port, scope);
+  const rawEvents = await port.listEvents({
+    ...scope,
+    primarySubject: { ...primary },
+    subjects: subjects.map((subject) => ({ ...subject }))
+  });
+  const events = normalizeSection(rawEvents, scope, "events", (record, path) => {
+    for (const field of ["eventType", "subjectType", "subjectId", "correlationId"]) {
+      assertNonEmptyString(record[field], `${path}.${field}`);
+    }
+    if (typeof record.sequence !== "number") {
+      throw new EvidencePacketGenerationError("EVIDENCE_INVALID_RECORD", `${path}.sequence must be a number.`);
+    }
+    record.occurredAt = toIsoTimestamp(record.occurredAt, `${path}.occurredAt`);
+    record.recordedAt = toIsoTimestamp(record.recordedAt, `${path}.recordedAt`);
+    const invocationId = record.actionInvocationId;
+    if (invocationId !== void 0 && invocationId !== null) {
+      assertNonEmptyString(invocationId, `${path}.actionInvocationId`);
+    }
+  }).sort(byEventOrder);
+  const invocationIds = [
+    ...new Set(
+      events.map((event) => event.actionInvocationId).filter((id2) => typeof id2 === "string")
+    )
+  ].sort(compareStrings);
+  const requested = new Set(invocationIds);
+  const read = async (method) => {
+    if (!method || invocationIds.length === 0) return [];
+    return method.call(port, { ...scope }, [...invocationIds]);
+  };
+  const [rawActionInvocations, rawPolicyEvaluations, rawAdapterInvocations] = await Promise.all([
+    read(port.listActionInvocations),
+    read(port.listPolicyEvaluations),
+    read(port.listAdapterInvocations)
+  ]);
+  const actionInvocations = normalizeSection(rawActionInvocations, scope, "actionInvocations", (record, path) => {
+    if (!requested.has(record.id)) {
+      throw new EvidencePacketGenerationError(
+        "EVIDENCE_UNREQUESTED_RECORD",
+        `${path}.id (${String(record.id)}) is not one of the requested action invocations.`
+      );
+    }
+  }).sort(byId);
+  const policyEvaluations = normalizeSection(
+    rawPolicyEvaluations,
+    scope,
+    "policyEvaluations",
+    (record, path) => assertRequestedInvocation(record, path, requested)
+  ).sort(byId);
+  const adapterInvocations = normalizeSection(
+    rawAdapterInvocations,
+    scope,
+    "adapterInvocations",
+    (record, path) => assertRequestedInvocation(record, path, requested)
+  ).sort(byId);
+  const generatedAt = context.now ?? /* @__PURE__ */ new Date();
+  const id = options.idFactory ? options.idFactory() : createFabricId(FABRIC_ID_PREFIXES.complianceEvidencePacket);
+  assertNonEmptyString(id, "packet id");
+  const unredacted = {
+    schemaVersion: EVIDENCE_PACKET_SCHEMA_VERSION,
+    packetType,
+    tenantId: scope.tenantId,
+    spaceId: scope.spaceId,
+    primarySubject: { ...primary },
+    subjects: subjects.map((subject) => ({ ...subject })),
+    includeRelated,
+    ...input.policyVersion !== void 0 ? { policyVersion: input.policyVersion } : {},
+    events,
+    actionInvocations,
+    policyEvaluations,
+    adapterInvocations
+  };
+  const anonymizationContext = {
+    tenantId: scope.tenantId,
+    spaceId: scope.spaceId,
+    jobId: options.anonymization?.jobId ?? id,
+    reason: options.anonymization?.reason ?? DEFAULT_EVIDENCE_REDACTION_REASON,
+    redactedAt: generatedAt,
+    ...options.anonymization?.policyVersion !== void 0 ? { policyVersion: options.anonymization.policyVersion } : {}
+  };
+  const keySorted = JSON.parse(canonicalJson(unredacted));
+  const redacted = new AnonymizationEngine(options.anonymizationPolicy).anonymizeJsonValue(
+    keySorted,
+    anonymizationContext,
+    "evidence_packet"
+  );
+  const payload = { ...redacted.value, redaction: redacted.metadata };
+  for (const section of ["events", "actionInvocations", "policyEvaluations", "adapterInvocations"]) {
+    if (!Array.isArray(payload[section])) {
+      throw new EvidencePacketGenerationError(
+        "EVIDENCE_IDENTIFIER_REDACTED",
+        `The anonymization policy removed or replaced payload.${section}.`
+      );
+    }
+  }
+  const envelopeSubjects = redactedSubjects(payload.subjects);
+  const references = buildReferences(payload, keySorted);
+  return {
+    id,
+    tenantId: scope.tenantId,
+    spaceId: scope.spaceId,
+    packetType,
+    status: "sealed",
+    subjects: envelopeSubjects,
+    references,
+    payload,
+    generatedAt: generatedAt.toISOString(),
+    generatedBy: context.actorId,
+    ...input.policyVersion !== void 0 ? { policyVersion: input.policyVersion } : {},
+    checksum: computeEvidencePacketChecksum(payload),
+    checksumAlgorithm: EVIDENCE_PACKET_CHECKSUM_ALGORITHM,
+    correlationId: context.correlationId,
+    ...context.causationId !== void 0 ? { causationId: context.causationId } : {}
+  };
+}
+function verifyEvidencePacketChecksum(envelope) {
+  try {
+    if (!envelope || typeof envelope.checksum !== "string" || envelope.checksum.length === 0) return false;
+    if (envelope.checksumAlgorithm !== EVIDENCE_PACKET_CHECKSUM_ALGORITHM) return false;
+    return computeEvidencePacketChecksum(envelope.payload) === envelope.checksum;
+  } catch {
+    return false;
+  }
+}
+function createEvidencePacketRenderer(options) {
+  const { packetType = DEFAULT_EVIDENCE_PACKET_TYPE, ...generatorOptions } = options;
+  return {
+    packetType,
+    render: (input, context) => generateEvidencePacket({ ...input, packetType }, context, generatorOptions)
+  };
+}
+
+export { DEFAULT_EVIDENCE_PACKET_TYPE, DEFAULT_EVIDENCE_REDACTION_REASON, EVIDENCE_PACKET_CHECKSUM_ALGORITHM, EVIDENCE_PACKET_SCHEMA_VERSION, EvidencePacketGenerationError, canonicalJson, computeEvidencePacketChecksum, createEvidencePacketRenderer, generateEvidencePacket, verifyEvidencePacketChecksum };
+//# sourceMappingURL=chunk-HEYMMVDP.js.map
+//# sourceMappingURL=chunk-HEYMMVDP.js.map

package/dist/chunk-HEYMMVDP.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../evidence/canonical-json.ts","../evidence/generator.ts"],"names":["byId","id"],"mappings":";;;;;AAYO,SAAS,cAAc,KAAA,EAAwB;AACrD,EAAA,OAAO,IAAA,CAAK,SAAA,CAAU,QAAA,CAAS,KAAK,CAAC,CAAA;AACtC;AAEA,SAAS,SAAS,KAAA,EAAyB;AAC1C,EAAA,IAAI,MAAM,OAAA,CAAQ,KAAK,GAAG,OAAO,KAAA,CAAM,IAAI,QAAQ,CAAA;AACnD,EAAA,IAAI,KAAA,IAAS,OAAO,KAAA,KAAU,QAAA,EAAU;AACvC,IAAA,OAAO,MAAA,CAAO,WAAA,CAAY,MAAA,CAAO,OAAA,CAAQ,KAAgC,CAAA,CACvE,IAAA,CAAK,CAAC,CAAC,IAAI,CAAA,EAAG,CAAC,KAAK,CAAA,KAAM,OAAO,KAAA,GAAQ,EAAA,GAAK,IAAA,GAAO,KAAA,GAAQ,CAAA,GAAI,CAAC,CAAA,CAClE,GAAA,CAAI,CAAC,CAAC,GAAA,EAAK,KAAK,CAAA,KAAM,CAAC,GAAA,EAAK,QAAA,CAAS,KAAK,CAAC,CAAC,CAAC,CAAA;AAAA,EAChD;AACA,EAAA,OAAO,KAAA;AACR;ACLO,IAAM,kCAAA,GAAqC;AAG3C,IAAM,8BAAA,GAAiC;AAGvC,IAAM,4BAAA,GAA+B;AAGrC,IAAM,iCAAA,GAAoC;AAoJ1C,IAAM,6BAAA,GAAN,cAA4C,KAAA,CAAM;AAAA,EAC/C,IAAA;AAAA,EAET,WAAA,CAAY,MAAyC,OAAA,EAAiB;AACrE,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,+BAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACb;AACD;AAIA,SAAS,cAAA,CAAe,MAAc,KAAA,EAAuB;AAC5D,EAAA,OAAO,IAAA,GAAO,KAAA,GAAQ,EAAA,GAAK,IAAA,GAAO,QAAQ,CAAA,GAAI,CAAA;AAC/C;AAEA,SAAS,oBAAA,CAAqB,OAAgB,IAAA,EAAuC;AACpF,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,WAAW,CAAA,EAAG;AACpD,IAAA,MAAM,IAAI,6BAAA,CAA8B,yBAAA,EAA2B,CAAA,EAAG,IAAI,CAAA,4BAAA,CAA8B,CAAA;AAAA,EACzG;AACD;AAEA,SAAS,cAAc,KAAA,EAAwB;AAC9C,EAAA,MAAM,SAAA,GAAY,MAAA,CAAO,cAAA,CAAe,KAAK,CAAA;AAC7C,EAAA,OAAO,SAAA,KAAc,MAAA,CAAO,SAAA,IAAa,SAAA,KAAc,IAAA;AACxD;AAQA,SAAS,cAAA,GAAyB;AACjC,EAAA,OAAO,CACN,IAAA,KACW,IAAA;AACb;AAGA,IAAM,oBAAgD,MAAA,CAAO,MAAA;AAAA,EAC5D,cAAA,GAAkC,CAAC,SAAA,EAAW,QAAQ,MAAA,EAAQ,UAAA,EAAY,YAAA,EAAc,MAAM,CAAC;AAChG,CAAA;AACA,IAAM,wBAAsD,MAAA,CAAO,MAAA;AAAA,EAClE,gBAAkC,CAAE;AAAA,IACnC,aAAA;AAAA,IACA,YAAA;AAAA,IACA,aAAA;AAAA,IACA,iBAAA;AAAA,IACA,iBAAA;AAAA,IACA;AAAA,GACA;AACF,CAAA;AACA,IAAM,UAAA,GAAa,gBAAA;AAGnB,SAAS,aAAa,KAAA,EAAyB;AAC9C,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,OAAO,KAAA;AACtC,EAAA,MAAM,IAAA,GAAO,IAAI,IAAA,CAAK,KAAK,CAAA;AAC3B,EAAA,OAAO,CAAC,OAAO,KAAA,CAAM,IAAA,CAAK,SAAS,CAAA,IAAK,IAAA,CAAK,WAAA,EAAY,KAAM,KAAA;AAChE;AACA,IAAM,oBAAA,GAAuB,CAAC,eAAA,EAAiB,OAAA,EAAS,cAAc,QAAQ,CAAA;AAC9E,IAAM,aAAA,GAAmC,OAAO,MAAA,CAAO;AAAA,EACtD,gBAAA;AAAA,EACA,WAAA;AAAA,EACA,gBAAA;AAAA,EACA,oBAAA;AAAA,EACA,GAAG;AACJ,CAAC,CAAA;AACD,IAAM,mBAAA,GAAyC,OAAO,MAAA,CAAO;AAAA,EAC5D,WAAA;AAAA,EACA,QAAA;AAAA,EACA,eAAA;AAAA,EACA,OAAA;AAAA,EACA,YAAA;AAAA,EACA,QAAA;AAAA,EACA,WAAA;AAAA,EACA;AACD,CAAC,CAAA;AAED,SAAS,YAAA,CAAa,OAAgC,IAAA,EAAkC;AACvF,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,IAAA,CAAK,KAAK,CAAA;AACjC,EAAA,OAAO,OAAA,CAAQ,MAAA,KAAW,IAAA,CAAK,MAAA,IAAU,OAAA,CAAQ,KAAA,CAAM,CAAC,GAAA,KAAQ,IAAA,CAAK,QAAA,CAAS,GAAG,CAAC,CAAA;AACnF;AAOA,SAAS,2BAAA,CAA4B,OAAgB,IAAA,EAAoB;AACxE,EAAA,MAAM,OAAA,GAAU,CAAC,MAAA,KAChB,IAAI,6BAAA;AAAA,IACH,yBAAA;AAAA,IACA,CAAA,EAAG,IAAI,CAAA,8CAAA,EAAiD,MAAM,CAAA,8EAAA;AAAA,GAC/D;AACD,EAAA,IAAI,CAAC,KAAA,IAAS,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG,MAAM,OAAA,CAAQ,eAAe,CAAA;AAC9F,EAAA,MAAM,QAAA,GAAW,KAAA;AACjB,EAAA,IAAI,CAAC,YAAA,CAAa,QAAA,EAAU,aAAa,CAAA,EAAG,MAAM,QAAQ,4BAA4B,CAAA;AACtF,EAAA,IAAI,QAAA,CAAS,cAAA,KAAmB,YAAA,EAAc,MAAM,QAAQ,gBAAgB,CAAA;AAC5E,EAAA,IAAI,CAAC,sBAAsB,QAAA,CAAS,QAAA,CAAS,SAA8B,CAAA,EAAG,MAAM,QAAQ,WAAW,CAAA;AACvG,EAAA,KAAA,MAAW,OAAO,oBAAA,EAAsB;AACvC,IAAA,IAAI,OAAO,QAAA,CAAS,GAAG,MAAM,QAAA,EAAU,MAAM,QAAQ,GAAG,CAAA;AAAA,EACzD;AAEA,EAAA,IAAI,CAAC,YAAA,CAAa,QAAA,CAAS,UAAU,CAAA,EAAG,MAAM,QAAQ,YAAY,CAAA;AAClE,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,QAAA,CAAS,kBAAkB,CAAA,IAAK,CAAC,QAAA,CAAS,kBAAA,CAAmB,MAAM,CAAC,IAAA,KAAS,OAAO,IAAA,KAAS,QAAQ,CAAA,EAAG;AAC1H,IAAA,MAAM,QAAQ,oBAAoB,CAAA;AAAA,EACnC;AACA,EAAA,IAAI,CAAC,MAAM,OAAA,CAAQ,QAAA,CAAS,cAAc,CAAA,EAAG,MAAM,QAAQ,gBAAgB,CAAA;AAC3E,EAAA,QAAA,CAAS,cAAA,CAAe,OAAA,CAAQ,CAAC,KAAA,EAAO,KAAA,KAAU;AACjD,IAAA,IAAI,CAAC,KAAA,IAAS,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG,MAAM,OAAA,CAAQ,CAAA,eAAA,EAAkB,KAAK,CAAA,CAAA,CAAG,CAAA;AACzG,IAAA,MAAM,KAAA,GAAQ,KAAA;AACd,IAAA,IAAI,CAAC,YAAA,CAAa,KAAA,EAAO,mBAAmB,CAAA,IAAK,CAAC,MAAA,CAAO,MAAA,CAAO,KAAK,CAAA,CAAE,MAAM,CAAC,IAAA,KAAS,OAAO,IAAA,KAAS,QAAQ,CAAA,EAAG;AACjH,MAAA,MAAM,OAAA,CAAQ,CAAA,eAAA,EAAkB,KAAK,CAAA,CAAA,CAAG,CAAA;AAAA,IACzC;AACA,IAAA,IAAI,CAAC,iBAAA,CAAkB,QAAA,CAAS,KAAA,CAAM,MAAyB,GAAG,MAAM,OAAA,CAAQ,CAAA,eAAA,EAAkB,KAAK,CAAA,QAAA,CAAU,CAAA;AACjH,IAAA,IAAI,CAAC,qBAAA,CAAsB,QAAA,CAAS,KAAA,CAAM,SAA8B,GAAG,MAAM,OAAA,CAAQ,CAAA,eAAA,EAAkB,KAAK,CAAA,WAAA,CAAa,CAAA;AAG7H,IAAA,IAAI,CAAC,aAAa,KAAA,CAAM,UAAU,GAAG,MAAM,OAAA,CAAQ,CAAA,eAAA,EAAkB,KAAK,CAAA,YAAA,CAAc,CAAA;AACxF,IAAA,IAAI,CAAC,UAAA,CAAW,IAAA,CAAK,KAAA,CAAM,cAAwB,GAAG,MAAM,OAAA,CAAQ,CAAA,eAAA,EAAkB,KAAK,CAAA,gBAAA,CAAkB,CAAA;AAAA,EAC9G,CAAC,CAAA;AACF;AASA,SAAS,WAAA,CAAY,OAAgB,IAAA,EAAuB;AAC3D,EAAA,IAAI,KAAA,KAAU,QAAQ,OAAO,KAAA,KAAU,YAAY,OAAO,KAAA,KAAU,WAAW,OAAO,KAAA;AACtF,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC9B,IAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,KAAK,CAAA,EAAG;AAC5B,MAAA,MAAM,IAAI,6BAAA,CAA8B,yBAAA,EAA2B,CAAA,EAAG,IAAI,CAAA,wBAAA,CAA0B,CAAA;AAAA,IACrG;AACA,IAAA,OAAO,KAAA;AAAA,EACR;AACA,EAAA,IAAI,iBAAiB,IAAA,EAAM;AAC1B,IAAA,IAAI,MAAA,CAAO,KAAA,CAAM,KAAA,CAAM,OAAA,EAAS,CAAA,EAAG;AAClC,MAAA,MAAM,IAAI,6BAAA,CAA8B,yBAAA,EAA2B,CAAA,EAAG,IAAI,CAAA,oBAAA,CAAsB,CAAA;AAAA,IACjG;AACA,IAAA,OAAO,MAAM,WAAA,EAAY;AAAA,EAC1B;AACA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACzB,IAAA,OAAO,KAAA,CAAM,GAAA,CAAI,CAAC,IAAA,EAAM,UAAW,IAAA,KAAS,MAAA,GAAY,IAAA,GAAO,WAAA,CAAY,MAAM,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,KAAK,GAAG,CAAE,CAAA;AAAA,EACvG;AACA,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC9B,IAAA,IAAI,CAAC,aAAA,CAAc,KAAK,CAAA,EAAG;AAC1B,MAAA,MAAM,SAAU,KAAA,CAA+B,MAAA;AAC/C,MAAA,IAAI,OAAO,WAAW,UAAA,EAAY,OAAO,YAAY,MAAA,CAAO,IAAA,CAAK,KAAK,CAAA,EAAG,IAAI,CAAA;AAC7E,MAAA,MAAM,IAAI,6BAAA;AAAA,QACT,yBAAA;AAAA,QACA,GAAG,IAAI,CAAA,0DAAA;AAAA,OACR;AAAA,IACD;AACA,IAAA,MAAM,MAAA,mBAAkC,MAAA,CAAO,MAAA,CAAO,IAAI,CAAA;AAC1D,IAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA,EAAG;AACjD,MAAA,IAAI,QAAQ,WAAA,EAAa;AACxB,QAAA,MAAM,IAAI,6BAAA,CAA8B,yBAAA,EAA2B,CAAA,EAAG,IAAI,CAAA,4BAAA,CAA8B,CAAA;AAAA,MACzG;AACA,MAAA,IAAI,UAAU,MAAA,EAAW;AACzB,MAAA,MAAM,aAAa,WAAA,CAAY,KAAA,EAAO,GAAG,IAAI,CAAA,CAAA,EAAI,GAAG,CAAA,CAAE,CAAA;AACtD,MAAA,IAAI,QAAQ,UAAA,EAAY,2BAAA,CAA4B,UAAA,EAAY,CAAA,EAAG,IAAI,CAAA,SAAA,CAAW,CAAA;AAClF,MAAA,MAAA,CAAO,GAAG,CAAA,GAAI,UAAA;AAAA,IACf;AACA,IAAA,OAAO,MAAA;AAAA,EACR;AACA,EAAA,MAAM,IAAI,8BAA8B,yBAAA,EAA2B,CAAA,EAAG,IAAI,CAAA,sBAAA,EAAyB,OAAO,KAAK,CAAA,CAAA,CAAG,CAAA;AACnH;AAQA,IAAM,eAAA,GACL,wHAAA;AAED,SAAS,WAAW,IAAA,EAAuB;AAC1C,EAAA,OAAQ,OAAO,CAAA,KAAM,CAAA,IAAK,OAAO,GAAA,KAAQ,CAAA,IAAM,OAAO,GAAA,KAAQ,CAAA;AAC/D;AAEA,SAAS,WAAA,CAAY,MAAc,KAAA,EAAuB;AACzD,EAAA,OAAO,CAAC,EAAA,EAAI,UAAA,CAAW,IAAI,CAAA,GAAI,EAAA,GAAK,IAAI,EAAA,EAAI,EAAA,EAAI,IAAI,EAAA,EAAI,EAAA,EAAI,IAAI,EAAA,EAAI,EAAA,EAAI,IAAI,EAAE,CAAA,CAAE,QAAQ,CAAC,CAAA;AAC1F;AAQA,SAAS,oBAAoB,KAAA,EAAmC;AAC/D,EAAA,MAAM,KAAA,GAAQ,eAAA,CAAgB,IAAA,CAAK,KAAK,CAAA;AACxC,EAAA,IAAI,CAAC,OAAO,OAAO,MAAA;AACnB,EAAA,MAAM,GAAG,QAAA,EAAU,SAAA,EAAW,OAAA,EAAS,QAAA,EAAU,UAAA,EAAY,UAAA,EAAY,QAAA,EAAU,IAAA,EAAM,IAAA,EAAM,cAAA,EAAgB,gBAAgB,CAAA,GAAI,KAAA;AACnI,EAAA,MAAM,IAAA,GAAO,OAAO,QAAQ,CAAA;AAC5B,EAAA,MAAM,KAAA,GAAQ,OAAO,SAAS,CAAA;AAC9B,EAAA,MAAM,GAAA,GAAM,OAAO,OAAO,CAAA;AAC1B,EAAA,MAAM,IAAA,GAAO,OAAO,QAAQ,CAAA;AAC5B,EAAA,MAAM,MAAA,GAAS,OAAO,UAAU,CAAA;AAChC,EAAA,MAAM,MAAA,GAAS,UAAA,KAAe,MAAA,GAAY,CAAA,GAAI,OAAO,UAAU,CAAA;AAC/D,EAAA,MAAM,WAAA,GAAc,QAAA,KAAa,MAAA,GAAY,CAAA,GAAI,MAAA,CAAO,QAAA,CAAS,MAAA,CAAO,CAAA,EAAG,GAAG,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA;AAC3F,EAAA,IAAI,KAAA,GAAQ,CAAA,IAAK,KAAA,GAAQ,EAAA,IAAM,GAAA,GAAM,CAAA,IAAK,GAAA,GAAM,WAAA,CAAY,IAAA,EAAM,KAAK,CAAA,EAAG,OAAO,MAAA;AACjF,EAAA,IAAI,OAAO,EAAA,IAAM,MAAA,GAAS,EAAA,IAAM,MAAA,GAAS,IAAI,OAAO,MAAA;AACpD,EAAA,IAAI,aAAA,GAAgB,CAAA;AACpB,EAAA,IAAI,CAAC,IAAA,EAAM;AACV,IAAA,MAAM,WAAA,GAAc,OAAO,cAAc,CAAA;AACzC,IAAA,MAAM,gBAAA,GAAmB,gBAAA,KAAqB,MAAA,GAAY,CAAA,GAAI,OAAO,gBAAgB,CAAA;AACrF,IAAA,IAAI,WAAA,GAAc,EAAA,IAAM,gBAAA,GAAmB,EAAA,EAAI,OAAO,MAAA;AACtD,IAAA,aAAA,GAAA,CAAiB,IAAA,KAAS,GAAA,GAAM,EAAA,GAAK,CAAA,KAAM,cAAc,EAAA,GAAK,gBAAA,CAAA;AAAA,EAC/D;AAEA,EAAA,MAAM,IAAA,mBAAO,IAAI,IAAA,CAAK,CAAC,CAAA;AACvB,EAAA,IAAA,CAAK,cAAA,CAAe,IAAA,EAAM,KAAA,GAAQ,CAAA,EAAG,GAAG,CAAA;AACxC,EAAA,IAAA,CAAK,WAAA,CAAY,IAAA,EAAM,MAAA,EAAQ,MAAA,EAAQ,WAAW,CAAA;AAClD,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,OAAA,EAAQ,GAAI,aAAA,GAAgB,GAAA;AACjD,EAAA,OAAO,MAAA,CAAO,MAAM,IAAI,IAAA,CAAK,OAAO,CAAA,CAAE,OAAA,EAAS,CAAA,GAAI,MAAA,GAAY,OAAA;AAChE;AAGA,SAAS,cAAA,CAAe,OAAgB,IAAA,EAAsB;AAC7D,EAAA,MAAM,OAAA,GACL,KAAA,YAAiB,IAAA,GAAO,KAAA,CAAM,OAAA,EAAQ,GAAI,OAAO,KAAA,KAAU,QAAA,GAAW,mBAAA,CAAoB,KAAK,CAAA,GAAI,MAAA;AACpG,EAAA,IAAI,OAAA,KAAY,MAAA,IAAa,MAAA,CAAO,KAAA,CAAM,OAAO,CAAA,EAAG;AACnD,IAAA,MAAM,IAAI,6BAAA;AAAA,MACT,yBAAA;AAAA,MACA,GAAG,IAAI,CAAA,8HAAA;AAAA,KACR;AAAA,EACD;AACA,EAAA,OAAO,IAAI,IAAA,CAAK,OAAO,CAAA,CAAE,WAAA,EAAY;AACtC;AAEA,SAAS,WAAA,CAAY,MAAA,EAAiE,KAAA,EAAsB,OAAA,EAAwB;AACnI,EAAA,IAAI,OAAO,QAAA,KAAa,KAAA,CAAM,YAAY,MAAA,CAAO,OAAA,KAAY,MAAM,OAAA,EAAS;AAC3E,IAAA,MAAM,IAAI,6BAAA;AAAA,MACT,yBAAA;AAAA,MACA,CAAA,8BAAA,EAAiC,OAAO,CAAA,SAAA,EAAY,MAAA,CAAO,MAAA,CAAO,EAAE,CAAC,CAAA,uBAAA,EAA0B,KAAA,CAAM,QAAQ,CAAA,CAAA,EAAI,KAAA,CAAM,OAAO,CAAA,CAAA;AAAA,KAC/H;AAAA,EACD;AACD;AAGA,SAAS,gBAAA,CACR,OAAA,EACA,KAAA,EACA,OAAA,EACA,OAAA,EACuB;AACvB,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,OAAO,CAAA,EAAG;AAC5B,IAAA,MAAM,IAAI,6BAAA,CAA8B,yBAAA,EAA2B,CAAA,4CAAA,EAA+C,OAAO,CAAA,CAAA,CAAG,CAAA;AAAA,EAC7H;AACA,EAAA,MAAMA,KAAAA,uBAAW,GAAA,EAA+D;AAChF,EAAA,OAAA,CAAQ,OAAA,CAAQ,CAAC,GAAA,EAAK,KAAA,KAAU;AAC/B,IAAA,MAAM,IAAA,GAAO,CAAA,EAAG,OAAO,CAAA,CAAA,EAAI,KAAK,CAAA,CAAA,CAAA;AAChC,IAAA,IAAI,CAAC,OAAO,OAAO,GAAA,KAAQ,YAAY,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,EAAG;AAC1D,MAAA,MAAM,IAAI,6BAAA,CAA8B,yBAAA,EAA2B,CAAA,EAAG,IAAI,CAAA,mBAAA,CAAqB,CAAA;AAAA,IAChG;AAIA,IAAA,WAAA,CAAY,GAAA,EAAuB,OAAO,OAAO,CAAA;AACjD,IAAA,MAAM,MAAA,GAAS,WAAA,CAAY,GAAA,EAAK,IAAI,CAAA;AACpC,IAAA,WAAA,CAAY,MAAA,EAAQ,OAAO,OAAO,CAAA;AAClC,IAAA,oBAAA,CAAqB,MAAA,CAAO,EAAA,EAAI,CAAA,EAAG,IAAI,CAAA,GAAA,CAAK,CAAA;AAC5C,IAAA,OAAA,GAAU,QAAQ,IAAI,CAAA;AACtB,IAAA,MAAM,SAAA,GAAY,cAAc,MAAM,CAAA;AACtC,IAAA,MAAM,QAAA,GAAWA,KAAAA,CAAK,GAAA,CAAI,MAAA,CAAO,EAAY,CAAA;AAC7C,IAAA,IAAI,QAAA,IAAY,QAAA,CAAS,SAAA,KAAc,SAAA,EAAW;AACjD,MAAA,MAAM,IAAI,6BAAA;AAAA,QACT,yBAAA;AAAA,QACA,2CAA2C,OAAO,CAAA,iBAAA,EAAoB,MAAA,CAAO,MAAA,CAAO,EAAE,CAAC,CAAA,CAAA;AAAA,OACxF;AAAA,IACD;AACA,IAAAA,MAAK,GAAA,CAAI,MAAA,CAAO,IAAc,EAAE,MAAA,EAAQ,WAAW,CAAA;AAAA,EACpD,CAAC,CAAA;AACD,EAAA,OAAO,CAAC,GAAGA,KAAAA,CAAK,MAAA,EAAQ,EAAE,GAAA,CAAI,CAAC,KAAA,KAAU,KAAA,CAAM,MAAM,CAAA;AACtD;AAEA,SAAS,IAAA,CAAK,MAA0B,KAAA,EAAmC;AAC1E,EAAA,OAAO,cAAA,CAAe,IAAA,CAAK,EAAA,EAAc,KAAA,CAAM,EAAY,CAAA;AAC5D;AAEA,SAAS,YAAA,CAAa,MAA0B,KAAA,EAAmC;AAElF,EAAA,OACC,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,UAAoB,CAAA,GAAI,IAAA,CAAK,KAAA,CAAM,KAAA,CAAM,UAAoB,CAAA,IAC7E,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,UAAoB,CAAA,GAAI,IAAA,CAAK,KAAA,CAAM,KAAA,CAAM,UAAoB,CAAA,IAC5E,IAAA,CAAK,QAAA,GAAuB,KAAA,CAAM,QAAA,IACnC,IAAA,CAAK,IAAA,EAAM,KAAK,CAAA;AAElB;AAEA,SAAS,aAAA,CAAc,SAAgC,IAAA,EAAqC;AAC3F,EAAA,IAAI,CAAC,OAAA,IAAW,OAAO,OAAA,KAAY,QAAA,EAAU;AAC5C,IAAA,MAAM,IAAI,6BAAA,CAA8B,yBAAA,EAA2B,CAAA,EAAG,IAAI,CAAA,mBAAA,CAAqB,CAAA;AAAA,EAChG;AACA,EAAA,oBAAA,CAAqB,OAAA,CAAQ,WAAA,EAAa,CAAA,EAAG,IAAI,CAAA,YAAA,CAAc,CAAA;AAC/D,EAAA,oBAAA,CAAqB,OAAA,CAAQ,SAAA,EAAW,CAAA,EAAG,IAAI,CAAA,UAAA,CAAY,CAAA;AAC3D,EAAA,OAAO,EAAE,WAAA,EAAa,OAAA,CAAQ,WAAA,EAAa,SAAA,EAAW,QAAQ,SAAA,EAAU;AACzE;AAEA,SAAS,eAAA,CAAgB,MAA6B,KAAA,EAAsC;AAC3F,EAAA,OAAO,cAAA,CAAe,IAAA,CAAK,WAAA,EAAa,KAAA,CAAM,WAAW,KAAK,cAAA,CAAe,IAAA,CAAK,SAAA,EAAW,KAAA,CAAM,SAAS,CAAA;AAC7G;AAEA,eAAe,eAAA,CACd,OAAA,EACA,cAAA,EACA,IAAA,EACA,KAAA,EACmC;AACnC,EAAA,IAAI,CAAC,cAAA,IAAkB,CAAC,KAAK,sBAAA,EAAwB,OAAO,CAAC,OAAO,CAAA;AACpE,EAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,sBAAA,CAAuB,EAAE,GAAG,OAAA,EAAQ,EAAG,EAAE,GAAG,KAAA,EAAO,CAAA;AAC9E,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,OAAO,CAAA,EAAG;AAC5B,IAAA,MAAM,IAAI,6BAAA,CAA8B,yBAAA,EAA2B,8CAA8C,CAAA;AAAA,EAClH;AACA,EAAA,MAAM,GAAA,GAAM,CAAC,OAAA,KAAmC,CAAA,EAAG,QAAQ,WAAW,CAAA,EAAA,EAAS,QAAQ,SAAS,CAAA,CAAA;AAChG,EAAA,MAAM,uBAAO,IAAI,GAAA,CAAI,CAAC,GAAA,CAAI,OAAO,CAAC,CAAC,CAAA;AACnC,EAAA,MAAM,SAAkC,EAAC;AACzC,EAAA,OAAA,CAAQ,OAAA,CAAQ,CAAC,SAAA,EAAW,KAAA,KAAU;AACrC,IAAA,MAAM,OAAA,GAAU,aAAA,CAAc,SAAA,EAAW,CAAA,gBAAA,EAAmB,KAAK,CAAA,CAAA,CAAG,CAAA;AACpE,IAAA,IAAI,IAAA,CAAK,GAAA,CAAI,GAAA,CAAI,OAAO,CAAC,CAAA,EAAG;AAC5B,IAAA,IAAA,CAAK,GAAA,CAAI,GAAA,CAAI,OAAO,CAAC,CAAA;AACrB,IAAA,MAAA,CAAO,KAAK,OAAO,CAAA;AAAA,EACpB,CAAC,CAAA;AACD,EAAA,OAAO,CAAC,OAAA,EAAS,GAAG,MAAA,CAAO,IAAA,CAAK,eAAe,CAAC,CAAA;AACjD;AAEA,SAAS,yBAAA,CAA0B,MAAA,EAA4B,IAAA,EAAc,SAAA,EAAsC;AAClH,EAAA,MAAM,eAAe,MAAA,CAAO,kBAAA;AAC5B,EAAA,IAAI,OAAO,YAAA,KAAiB,QAAA,IAAY,CAAC,SAAA,CAAU,GAAA,CAAI,YAAY,CAAA,EAAG;AACrE,IAAA,MAAM,IAAI,6BAAA;AAAA,MACT,6BAAA;AAAA,MACA,CAAA,EAAG,IAAI,CAAA,qBAAA,EAAwB,MAAA,CAAO,YAAY,CAAC,CAAA,iDAAA;AAAA,KACpD;AAAA,EACD;AACD;AAEA,IAAM,yBAAA,GAAgE;AAAA,EACrE,iBAAA,EAAmB,CAAC,UAAA,EAAY,QAAQ,CAAA;AAAA,EACxC,MAAA,EAAQ,CAAC,WAAA,EAAa,aAAA,EAAe,aAAa,oBAAoB,CAAA;AAAA,EACtE,iBAAA,EAAmB,CAAC,oBAAA,EAAsB,UAAA,EAAY,iBAAiB,QAAQ,CAAA;AAAA,EAC/E,kBAAA,EAAoB,CAAC,oBAAA,EAAsB,aAAA,EAAe,aAAa,QAAQ;AAChF,CAAA;AAEA,IAAM,eAAA,GAA6E;AAAA,EAClF,iBAAA,EAAmB,mBAAA;AAAA,EACnB,MAAA,EAAQ,aAAA;AAAA,EACR,iBAAA,EAAmB,mBAAA;AAAA,EACnB,kBAAA,EAAoB;AACrB,CAAA;AAOA,SAAS,eAAA,CACR,SACA,UAAA,EAC4B;AAC5B,EAAA,MAAM,QAAA,GAAsB,CAAC,mBAAA,EAAqB,QAAA,EAAU,qBAAqB,oBAAoB,CAAA;AACrG,EAAA,OAAO,QAAA,CAAS,OAAA;AAAA,IAAQ,CAAC,YACvB,OAAA,CAAQ,OAAO,EAAgB,GAAA,CAAI,CAAC,QAAQ,KAAA,KAAU;AACtD,MAAA,MAAM,UAAA,GAAa,UAAA,CAAW,OAAO,CAAA,CAAE,KAAK,CAAA,EAAG,EAAA;AAC/C,MAAA,IAAI,CAAC,MAAA,IAAU,OAAO,WAAW,QAAA,IAAa,MAAA,CAA8B,OAAO,UAAA,EAAY;AAC9F,QAAA,MAAM,IAAI,6BAAA;AAAA,UACT,8BAAA;AAAA,UACA,CAAA,4CAAA,EAA+C,OAAO,CAAA,CAAA,EAAI,KAAK,CAAA,uDAAA;AAAA,SAChE;AAAA,MACD;AACA,MAAA,MAAM,WAAmC,EAAC;AAC1C,MAAA,KAAA,MAAW,KAAA,IAAS,yBAAA,CAA0B,OAAO,CAAA,EAAG;AACvD,QAAA,MAAM,KAAA,GAAS,OAA8B,KAAK,CAAA;AAClD,QAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,QAAA,CAAS,KAAK,CAAA,GAAI,KAAA;AAAA,MAClD;AACA,MAAA,OAAO;AAAA,QACN,aAAA,EAAe,gBAAgB,OAAO,CAAA;AAAA,QACtC,aAAc,MAAA,CAA8B,EAAA;AAAA,QAC5C;AAAA,OACD;AAAA,IACD,CAAC;AAAA,GACF;AACD;AAEA,SAAS,iBAAiB,KAAA,EAAyC;AAClE,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AAC1B,IAAA,MAAM,IAAI,6BAAA,CAA8B,8BAAA,EAAgC,oDAAoD,CAAA;AAAA,EAC7H;AACA,EAAA,OAAO,KAAA,CAAM,GAAA,CAAI,CAAC,OAAA,EAAS,KAAA,KAAU;AACpC,IAAA,IAAI;AACH,MAAA,OAAO,aAAA,CAAc,OAAA,EAAkC,CAAA,SAAA,EAAY,KAAK,CAAA,CAAA,CAAG,CAAA;AAAA,IAC5E,CAAA,CAAA,MAAQ;AACP,MAAA,MAAM,IAAI,6BAAA;AAAA,QACT,8BAAA;AAAA,QACA,6CAA6C,KAAK,CAAA,mJAAA;AAAA,OACnD;AAAA,IACD;AAAA,EACD,CAAC,CAAA;AACF;AAGO,SAAS,8BAA8B,OAAA,EAA0B;AACvE,EAAA,OAAO,UAAA,CAAW,QAAQ,CAAA,CAAE,MAAA,CAAO,cAAc,OAAO,CAAC,CAAA,CAAE,MAAA,CAAO,KAAK,CAAA;AACxE;AAaA,eAAsB,sBAAA,CACrB,KAAA,EACA,OAAA,EACA,OAAA,EACyD;AACzD,EAAA,MAAM,EAAE,MAAK,GAAI,OAAA;AACjB,EAAA,IAAI,CAAC,IAAA,IAAQ,OAAO,IAAA,CAAK,eAAe,UAAA,EAAY;AACnD,IAAA,MAAM,IAAI,UAAU,gEAAgE,CAAA;AAAA,EACrF;AACA,EAAA,IAAI,CAAC,QAAQ,mBAAA,IAAuB,CAAC,MAAM,OAAA,CAAQ,OAAA,CAAQ,mBAAA,CAAoB,MAAM,CAAA,EAAG;AACvF,IAAA,MAAM,IAAI,UAAU,gGAAgG,CAAA;AAAA,EACrH;AACA,EAAA,oBAAA,CAAqB,OAAA,CAAQ,UAAU,kBAAkB,CAAA;AACzD,EAAA,oBAAA,CAAqB,OAAA,CAAQ,SAAS,iBAAiB,CAAA;AACvD,EAAA,oBAAA,CAAqB,OAAA,CAAQ,SAAS,iBAAiB,CAAA;AACvD,EAAA,oBAAA,CAAqB,OAAA,CAAQ,eAAe,uBAAuB,CAAA;AAEnE,EAAA,MAAM,QAAuB,EAAE,QAAA,EAAU,QAAQ,QAAA,EAAU,OAAA,EAAS,QAAQ,OAAA,EAAQ;AACpF,EAAA,MAAM,OAAA,GAAU,aAAA,CAAc,KAAA,CAAM,OAAA,EAAS,eAAe,CAAA;AAE5D,EAAA,MAAM,iBAAiB,KAAA,CAAM,cAAA,KAAmB,KAAA,IAAS,OAAO,KAAK,sBAAA,KAA2B,UAAA;AAChG,EAAA,MAAM,UAAA,GAAa,MAAM,UAAA,IAAc,4BAAA;AACvC,EAAA,oBAAA,CAAqB,YAAY,kBAAkB,CAAA;AAEnD,EAAA,MAAM,WAAW,MAAM,eAAA,CAAgB,OAAA,EAAS,cAAA,EAAgB,MAAM,KAAK,CAAA;AAE3E,EAAA,MAAM,SAAA,GAAY,MAAM,IAAA,CAAK,UAAA,CAAW;AAAA,IACvC,GAAG,KAAA;AAAA,IACH,cAAA,EAAgB,EAAE,GAAG,OAAA,EAAQ;AAAA,IAC7B,QAAA,EAAU,SAAS,GAAA,CAAI,CAAC,aAAa,EAAE,GAAG,SAAQ,CAAE;AAAA,GACpD,CAAA;AACD,EAAA,MAAM,SAAS,gBAAA,CAAiB,SAAA,EAAW,OAAO,QAAA,EAAU,CAAC,QAAQ,IAAA,KAAS;AAC7E,IAAA,KAAA,MAAW,SAAS,CAAC,WAAA,EAAa,aAAA,EAAe,WAAA,EAAa,eAAe,CAAA,EAAG;AAC/E,MAAA,oBAAA,CAAqB,OAAO,KAAK,CAAA,EAAG,GAAG,IAAI,CAAA,CAAA,EAAI,KAAK,CAAA,CAAE,CAAA;AAAA,IACvD;AACA,IAAA,IAAI,OAAO,MAAA,CAAO,QAAA,KAAa,QAAA,EAAU;AACxC,MAAA,MAAM,IAAI,6BAAA,CAA8B,yBAAA,EAA2B,CAAA,EAAG,IAAI,CAAA,2BAAA,CAA6B,CAAA;AAAA,IACxG;AACA,IAAA,MAAA,CAAO,aAAa,cAAA,CAAe,MAAA,CAAO,UAAA,EAAY,CAAA,EAAG,IAAI,CAAA,WAAA,CAAa,CAAA;AAC1E,IAAA,MAAA,CAAO,aAAa,cAAA,CAAe,MAAA,CAAO,UAAA,EAAY,CAAA,EAAG,IAAI,CAAA,WAAA,CAAa,CAAA;AAC1E,IAAA,MAAM,eAAe,MAAA,CAAO,kBAAA;AAC5B,IAAA,IAAI,YAAA,KAAiB,MAAA,IAAa,YAAA,KAAiB,IAAA,EAAM;AACxD,MAAA,oBAAA,CAAqB,YAAA,EAAc,CAAA,EAAG,IAAI,CAAA,mBAAA,CAAqB,CAAA;AAAA,IAChE;AAAA,EACD,CAAC,CAAA,CAAE,IAAA,CAAK,YAAY,CAAA;AAEpB,EAAA,MAAM,aAAA,GAAgB;AAAA,IACrB,GAAG,IAAI,GAAA;AAAA,MACN,MAAA,CACE,GAAA,CAAI,CAAC,KAAA,KAAU,KAAA,CAAM,kBAAkB,CAAA,CACvC,MAAA,CAAO,CAACC,GAAAA,KAAqB,OAAOA,GAAAA,KAAO,QAAQ;AAAA;AACtD,GACD,CAAE,KAAK,cAAc,CAAA;AACrB,EAAA,MAAM,SAAA,GAAY,IAAI,GAAA,CAAI,aAAa,CAAA;AAEvC,EAAA,MAAM,IAAA,GAAO,OACZ,MAAA,KACgC;AAChC,IAAA,IAAI,CAAC,MAAA,IAAU,aAAA,CAAc,MAAA,KAAW,CAAA,SAAU,EAAC;AACnD,IAAA,OAAO,MAAA,CAAO,IAAA,CAAK,IAAA,EAAM,EAAE,GAAG,OAAM,EAAG,CAAC,GAAG,aAAa,CAAC,CAAA;AAAA,EAC1D,CAAA;AACA,EAAA,MAAM,CAAC,oBAAA,EAAsB,oBAAA,EAAsB,qBAAqB,CAAA,GAAI,MAAM,QAAQ,GAAA,CAAI;AAAA,IAC7F,IAAA,CAAK,KAAK,qBAAqB,CAAA;AAAA,IAC/B,IAAA,CAAK,KAAK,qBAAqB,CAAA;AAAA,IAC/B,IAAA,CAAK,KAAK,sBAAsB;AAAA,GAChC,CAAA;AAED,EAAA,MAAM,oBAAoB,gBAAA,CAAiB,oBAAA,EAAsB,OAAO,mBAAA,EAAqB,CAAC,QAAQ,IAAA,KAAS;AAC9G,IAAA,IAAI,CAAC,SAAA,CAAU,GAAA,CAAI,MAAA,CAAO,EAAY,CAAA,EAAG;AACxC,MAAA,MAAM,IAAI,6BAAA;AAAA,QACT,6BAAA;AAAA,QACA,GAAG,IAAI,CAAA,KAAA,EAAQ,MAAA,CAAO,MAAA,CAAO,EAAE,CAAC,CAAA,iDAAA;AAAA,OACjC;AAAA,IACD;AAAA,EACD,CAAC,CAAA,CAAE,IAAA,CAAK,IAAI,CAAA;AACZ,EAAA,MAAM,iBAAA,GAAoB,gBAAA;AAAA,IAAiB,oBAAA;AAAA,IAAsB,KAAA;AAAA,IAAO,mBAAA;AAAA,IAAqB,CAAC,MAAA,EAAQ,IAAA,KACrG,yBAAA,CAA0B,MAAA,EAAQ,MAAM,SAAS;AAAA,GAClD,CAAE,KAAK,IAAI,CAAA;AACX,EAAA,MAAM,kBAAA,GAAqB,gBAAA;AAAA,IAAiB,qBAAA;AAAA,IAAuB,KAAA;AAAA,IAAO,oBAAA;AAAA,IAAsB,CAAC,MAAA,EAAQ,IAAA,KACxG,yBAAA,CAA0B,MAAA,EAAQ,MAAM,SAAS;AAAA,GAClD,CAAE,KAAK,IAAI,CAAA;AAEX,EAAA,MAAM,WAAA,GAAc,OAAA,CAAQ,GAAA,oBAAO,IAAI,IAAA,EAAK;AAC5C,EAAA,MAAM,EAAA,GAAK,QAAQ,SAAA,GAAY,OAAA,CAAQ,WAAU,GAAI,cAAA,CAAe,mBAAmB,wBAAwB,CAAA;AAC/G,EAAA,oBAAA,CAAqB,IAAI,WAAW,CAAA;AAEpC,EAAA,MAAM,UAAA,GAAuD;AAAA,IAC5D,aAAA,EAAe,8BAAA;AAAA,IACf,UAAA;AAAA,IACA,UAAU,KAAA,CAAM,QAAA;AAAA,IAChB,SAAS,KAAA,CAAM,OAAA;AAAA,IACf,cAAA,EAAgB,EAAE,GAAG,OAAA,EAAQ;AAAA,IAC7B,QAAA,EAAU,SAAS,GAAA,CAAI,CAAC,aAAa,EAAE,GAAG,SAAQ,CAAE,CAAA;AAAA,IACpD,cAAA;AAAA,IACA,GAAI,MAAM,aAAA,KAAkB,MAAA,GAAY,EAAE,aAAA,EAAe,KAAA,CAAM,aAAA,EAAc,GAAI,EAAC;AAAA,IAClF,MAAA;AAAA,IACA,iBAAA;AAAA,IACA,iBAAA;AAAA,IACA;AAAA,GACD;AAEA,EAAA,MAAM,oBAAA,GAA6C;AAAA,IAClD,UAAU,KAAA,CAAM,QAAA;AAAA,IAChB,SAAS,KAAA,CAAM,OAAA;AAAA,IACf,KAAA,EAAO,OAAA,CAAQ,aAAA,EAAe,KAAA,IAAS,EAAA;AAAA,IACvC,MAAA,EAAQ,OAAA,CAAQ,aAAA,EAAe,MAAA,IAAU,iCAAA;AAAA,IACzC,UAAA,EAAY,WAAA;AAAA,IACZ,GAAI,OAAA,CAAQ,aAAA,EAAe,aAAA,KAAkB,MAAA,GAC1C,EAAE,aAAA,EAAe,OAAA,CAAQ,aAAA,CAAc,aAAA,EAAc,GACrD;AAAC,GACL;AAIA,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,KAAA,CAAM,aAAA,CAAc,UAAU,CAAC,CAAA;AACtD,EAAA,MAAM,QAAA,GAAW,IAAI,mBAAA,CAAoB,OAAA,CAAQ,mBAAmB,CAAA,CAAE,kBAAA;AAAA,IACrE,SAAA;AAAA,IACA,oBAAA;AAAA,IACA;AAAA,GACD;AAGA,EAAA,MAAM,UAAU,EAAE,GAAI,SAAS,KAAA,EAAkB,SAAA,EAAW,SAAS,QAAA,EAAS;AAC9E,EAAA,KAAA,MAAW,WAAW,CAAC,QAAA,EAAU,mBAAA,EAAqB,mBAAA,EAAqB,oBAAoB,CAAA,EAAY;AAC1G,IAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,OAAA,CAAQ,OAAO,CAAC,CAAA,EAAG;AACrC,MAAA,MAAM,IAAI,6BAAA;AAAA,QACT,8BAAA;AAAA,QACA,wDAAwD,OAAO,CAAA,CAAA;AAAA,OAChE;AAAA,IACD;AAAA,EACD;AACA,EAAA,MAAM,gBAAA,GAAmB,gBAAA,CAAiB,OAAA,CAAQ,QAAQ,CAAA;AAC1D,EAAA,MAAM,UAAA,GAAa,eAAA,CAAgB,OAAA,EAAS,SAAS,CAAA;AAErD,EAAA,OAAO;AAAA,IACN,EAAA;AAAA,IACA,UAAU,KAAA,CAAM,QAAA;AAAA,IAChB,SAAS,KAAA,CAAM,OAAA;AAAA,IACf,UAAA;AAAA,IACA,MAAA,EAAQ,QAAA;AAAA,IACR,QAAA,EAAU,gBAAA;AAAA,IACV,UAAA;AAAA,IACA,OAAA;AAAA,IACA,WAAA,EAAa,YAAY,WAAA,EAAY;AAAA,IACrC,aAAa,OAAA,CAAQ,OAAA;AAAA,IACrB,GAAI,MAAM,aAAA,KAAkB,MAAA,GAAY,EAAE,aAAA,EAAe,KAAA,CAAM,aAAA,EAAc,GAAI,EAAC;AAAA,IAClF,QAAA,EAAU,8BAA8B,OAAO,CAAA;AAAA,IAC/C,iBAAA,EAAmB,kCAAA;AAAA,IACnB,eAAe,OAAA,CAAQ,aAAA;AAAA,IACvB,GAAI,QAAQ,WAAA,KAAgB,MAAA,GAAY,EAAE,WAAA,EAAa,OAAA,CAAQ,WAAA,EAAY,GAAI;AAAC,GACjF;AACD;AAQO,SAAS,6BAA6B,QAAA,EAAwG;AACpJ,EAAA,IAAI;AACH,IAAA,IAAI,CAAC,QAAA,IAAY,OAAO,QAAA,CAAS,QAAA,KAAa,YAAY,QAAA,CAAS,QAAA,CAAS,MAAA,KAAW,CAAA,EAAG,OAAO,KAAA;AACjG,IAAA,IAAI,QAAA,CAAS,iBAAA,KAAsB,kCAAA,EAAoC,OAAO,KAAA;AAC9E,IAAA,OAAO,6BAAA,CAA8B,QAAA,CAAS,OAAO,CAAA,KAAM,QAAA,CAAS,QAAA;AAAA,EACrE,CAAA,CAAA,MAAQ;AACP,IAAA,OAAO,KAAA;AAAA,EACR;AACD;AASO,SAAS,6BACf,OAAA,EAC4E;AAC5E,EAAA,MAAM,EAAE,UAAA,GAAa,4BAAA,EAA8B,GAAG,kBAAiB,GAAI,OAAA;AAC3E,EAAA,OAAO;AAAA,IACN,UAAA;AAAA,IACA,MAAA,EAAQ,CAAC,KAAA,EAAO,OAAA,KAAY,sBAAA,CAAuB,EAAE,GAAG,KAAA,EAAO,UAAA,EAAW,EAAG,OAAA,EAAS,gBAAgB;AAAA,GACvG;AACD","file":"chunk-HEYMMVDP.js","sourcesContent":["/**\n * Serializes a value as JSON with every object's keys sorted, recursively, by UTF-16 code-unit\n * order (locale-independent). Array order is preserved.\n *\n * This is the serialization behind the `fabric-canonical-json-sha256-v1` digests: Host's\n * parameter digests (`PARAMETER_DIGEST_ALGORITHM` in `@fabricorg/platform-host`) and evidence\n * packet checksums (`EVIDENCE_PACKET_CHECKSUM_ALGORITHM`). Its output is a durable contract, so it\n * must not change for any input. That includes values that are not plain JSON: any non-array\n * object is rebuilt from its own enumerable entries before serialization, so a `Date` (which has\n * none) serializes as `{}`, not as an ISO string. Convert dates to strings before calling this\n * when they must survive into the output.\n */\nexport function canonicalJson(value: unknown): string {\n\treturn JSON.stringify(sortKeys(value));\n}\n\nfunction sortKeys(value: unknown): unknown {\n\tif (Array.isArray(value)) return value.map(sortKeys);\n\tif (value && typeof value === \"object\") {\n\t\treturn Object.fromEntries(Object.entries(value as Record<string, unknown>)\n\t\t\t.sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0)\n\t\t\t.map(([key, child]) => [key, sortKeys(child)]));\n\t}\n\treturn value;\n}\n","import { createHash } from \"node:crypto\";\n\nimport { createFabricId, FABRIC_ID_PREFIXES } from \"../ids\";\nimport type { AnonymizationContext, AnonymizationMetadata, PlatformDataClass, RedactionMethod } from \"../privacy\";\nimport { AnonymizationEngine, type AnonymizationPolicy } from \"../privacy/engine\";\nimport { canonicalJson } from \"./canonical-json\";\nimport type {\n\tEvidenceGenerationContext,\n\tEvidencePacketEnvelope,\n\tEvidencePacketReference,\n\tEvidencePacketSubject,\n\tEvidenceRenderer,\n} from \"./index\";\n\n/**\n * Identifies how `EvidencePacketEnvelope.checksum` is computed: the lowercase hex SHA-256 of\n * `canonicalJson(payload)`. It is the same identifier as Host's `PARAMETER_DIGEST_ALGORITHM`\n * because the algorithm is the same (SHA-256 over `canonicalJson`).\n */\nexport const EVIDENCE_PACKET_CHECKSUM_ALGORITHM = \"fabric-canonical-json-sha256-v1\" as const;\n\n/** Version of the `EvidencePacketPayload` shape produced by `generateEvidencePacket`. */\nexport const EVIDENCE_PACKET_SCHEMA_VERSION = 1 as const;\n\n/** Packet type used when the input does not name one. */\nexport const DEFAULT_EVIDENCE_PACKET_TYPE = \"compliance_evidence\";\n\n/** Anonymization reason recorded when the caller does not supply one. */\nexport const DEFAULT_EVIDENCE_REDACTION_REASON = \"evidence_packet_generation\";\n\n/**\n * A `Date`, or an ISO 8601 / PostgreSQL ISO date-time string with an explicit zone (`Z`, `+HH`,\n * `+HH:MM` or `+HHMM`). Zone-less, non-ISO and out-of-range strings are rejected.\n */\nexport type EvidenceTimestamp = Date | string;\n\n/** Tenant and space every record read through the port must belong to. */\nexport interface EvidenceScope {\n\ttenantId: string;\n\tspaceId: string;\n}\n\n/**\n * An asset event as the read port returns it. `AssetEventEnvelope` (events) and `AssetEventLike`\n * (privacy) both satisfy this shape. Fields beyond these are kept in the packet payload.\n */\nexport interface EvidenceEventRecord {\n\tid: string;\n\ttenantId: string;\n\tspaceId: string;\n\teventType: string;\n\tsubjectType: string;\n\tsubjectId: string;\n\tactionInvocationId?: string | null;\n\tsequence: number;\n\toccurredAt: EvidenceTimestamp;\n\trecordedAt: EvidenceTimestamp;\n\tcorrelationId: string;\n\tcausationId?: string | null;\n\tpayload: unknown;\n}\n\n/** An action invocation, policy evaluation or adapter invocation record. Further fields are kept. */\nexport interface EvidenceRecord {\n\tid: string;\n\ttenantId: string;\n\tspaceId: string;\n\tactionInvocationId?: string | null;\n\t[field: string]: unknown;\n}\n\n/** A record that belongs to one action invocation (policy evaluations, adapter invocations). */\nexport interface EvidenceInvocationRecord extends EvidenceRecord {\n\tactionInvocationId: string;\n}\n\nexport interface EvidenceEventQuery extends EvidenceScope {\n\t/** The subject the packet is about. Always `subjects[0]`. */\n\tprimarySubject: EvidencePacketSubject;\n\t/** Primary subject first, then related subjects, de-duplicated and sorted. */\n\tsubjects: readonly EvidencePacketSubject[];\n}\n\ntype MaybePromise<T> = T | Promise<T>;\n\n/**\n * Read-only access to the application's evidence store. The generator filters nothing the port\n * returns; it rejects, rather than drops, a record that fails one of its checks:\n *\n * - every record must have the generation context's `tenantId` and `spaceId`;\n * - action invocations must have one of the requested ids, and policy evaluations and adapter\n *   invocations one of the requested `actionInvocationId`s;\n * - records must have the documented shape (non-empty `id`, event fields, parseable timestamps) and\n *   be representable as plain JSON, and any `_privacy` value must be engine-written\n *   `AnonymizationMetadata`.\n *\n * Which events belong to the packet is the port's decision: the generator does not check an event's\n * subject against `subjects`, because a port may legitimately return events recorded against the\n * primary subject's own action invocations under another subject.\n */\nexport interface EvidencePacketReadPort {\n\t/** Asset events for the given subjects within the tenant and space. Required. */\n\tlistEvents(query: EvidenceEventQuery): MaybePromise<readonly EvidenceEventRecord[]>;\n\t/** The application's related-subject rules. When absent, only the primary subject is used. */\n\tresolveRelatedSubjects?(\n\t\tsubject: EvidencePacketSubject,\n\t\tscope: EvidenceScope,\n\t): MaybePromise<readonly EvidencePacketSubject[]>;\n\t/** Action invocations by id. When absent, the section is empty. */\n\tlistActionInvocations?(scope: EvidenceScope, ids: readonly string[]): MaybePromise<readonly EvidenceRecord[]>;\n\t/** Policy evaluations for the given action invocations. When absent, the section is empty. */\n\tlistPolicyEvaluations?(\n\t\tscope: EvidenceScope,\n\t\tactionInvocationIds: readonly string[],\n\t): MaybePromise<readonly EvidenceInvocationRecord[]>;\n\t/** Adapter invocations for the given action invocations. When absent, the section is empty. */\n\tlistAdapterInvocations?(\n\t\tscope: EvidenceScope,\n\t\tactionInvocationIds: readonly string[],\n\t): MaybePromise<readonly EvidenceInvocationRecord[]>;\n}\n\n/** A record after normalization: plain JSON, every `Date` replaced by its ISO string. */\nexport type EvidenceJsonRecord = Record<string, unknown>;\n\nexport interface EvidencePacketPayload {\n\tschemaVersion: typeof EVIDENCE_PACKET_SCHEMA_VERSION;\n\tpacketType: string;\n\ttenantId: string;\n\tspaceId: string;\n\tprimarySubject: EvidencePacketSubject;\n\tsubjects: EvidencePacketSubject[];\n\tincludeRelated: boolean;\n\tpolicyVersion?: string;\n\tevents: EvidenceJsonRecord[];\n\tactionInvocations: EvidenceJsonRecord[];\n\tpolicyEvaluations: EvidenceJsonRecord[];\n\tadapterInvocations: EvidenceJsonRecord[];\n\t/** Metadata from the anonymization pass over the rest of the payload (validated engine-written `_privacy` values pass through it unchanged). */\n\tredaction: AnonymizationMetadata;\n}\n\nexport interface GenerateEvidencePacketInput {\n\tsubject: EvidencePacketSubject;\n\t/** Set to `false` to skip `resolveRelatedSubjects`. Defaults to `true`. */\n\tincludeRelated?: boolean;\n\t/** Defaults to `DEFAULT_EVIDENCE_PACKET_TYPE`. */\n\tpacketType?: string;\n\tpolicyVersion?: string;\n}\n\nexport interface GenerateEvidencePacketOptions {\n\tport: EvidencePacketReadPort;\n\t/**\n\t * Redaction applied to the whole payload with data class `\"evidence_packet\"`. Required so that\n\t * redaction cannot be skipped by omission; pass `{ fields: [] }` to redact nothing.\n\t */\n\tanonymizationPolicy: AnonymizationPolicy;\n\tanonymization?: {\n\t\t/** Defaults to the packet id. */\n\t\tjobId?: string;\n\t\t/** Defaults to `DEFAULT_EVIDENCE_REDACTION_REASON`. */\n\t\treason?: string;\n\t\t/** Defaults to the engine's `ANONYMIZATION_POLICY_VERSION`. */\n\t\tpolicyVersion?: string;\n\t};\n\t/** Defaults to `createFabricId(FABRIC_ID_PREFIXES.complianceEvidencePacket)`. */\n\tidFactory?: () => string;\n}\n\nexport type EvidencePacketGenerationErrorCode =\n\t| \"EVIDENCE_SCOPE_MISMATCH\"\n\t| \"EVIDENCE_INVALID_RECORD\"\n\t| \"EVIDENCE_UNREQUESTED_RECORD\"\n\t| \"EVIDENCE_IDENTIFIER_REDACTED\";\n\nexport class EvidencePacketGenerationError extends Error {\n\treadonly code: EvidencePacketGenerationErrorCode;\n\n\tconstructor(code: EvidencePacketGenerationErrorCode, message: string) {\n\t\tsuper(message);\n\t\tthis.name = \"EvidencePacketGenerationError\";\n\t\tthis.code = code;\n\t}\n}\n\ntype Section = \"events\" | \"actionInvocations\" | \"policyEvaluations\" | \"adapterInvocations\";\n\nfunction compareStrings(left: string, right: string): number {\n\treturn left < right ? -1 : left > right ? 1 : 0;\n}\n\nfunction assertNonEmptyString(value: unknown, what: string): asserts value is string {\n\tif (typeof value !== \"string\" || value.length === 0) {\n\t\tthrow new EvidencePacketGenerationError(\"EVIDENCE_INVALID_RECORD\", `${what} must be a non-empty string.`);\n\t}\n}\n\nfunction isPlainObject(value: object): boolean {\n\tconst prototype = Object.getPrototypeOf(value);\n\treturn prototype === Object.prototype || prototype === null;\n}\n\ntype MissingMembers<TUnion, TList extends readonly unknown[]> = Exclude<TUnion, TList[number]>;\n\n/**\n * Returns the list unchanged, but fails type-checking unless it names every member of `TUnion`\n * (and nothing else), so these runtime lists cannot drift from the privacy types.\n */\nfunction exhaustiveList<TUnion>() {\n\treturn <const TList extends readonly TUnion[]>(\n\t\tlist: TList & ([MissingMembers<TUnion, TList>] extends [never] ? unknown : { missingMembers: MissingMembers<TUnion, TList> }),\n\t): TList => list;\n}\n\n// Plain frozen arrays, not Sets: the boundary guard forbids module-scope Map/Set state in core.\nconst REDACTION_METHODS: readonly RedactionMethod[] = Object.freeze(\n\texhaustiveList<RedactionMethod>()([\"nullify\", \"mask\", \"hash\", \"tokenize\", \"generalize\", \"drop\"]),\n);\nconst PLATFORM_DATA_CLASSES: readonly PlatformDataClass[] = Object.freeze(\n\texhaustiveList<PlatformDataClass>()([\n\t\t\"asset_event\",\n\t\t\"read_model\",\n\t\t\"raw_payload\",\n\t\t\"evidence_packet\",\n\t\t\"action_evidence\",\n\t\t\"access_event\",\n\t]),\n);\nconst SHA256_HEX = /^[0-9a-f]{64}$/;\n\n/** True for a string `Date.prototype.toISOString` produced: it parses and serializes back unchanged. */\nfunction isIsoInstant(value: unknown): boolean {\n\tif (typeof value !== \"string\") return false;\n\tconst date = new Date(value);\n\treturn !Number.isNaN(date.getTime()) && date.toISOString() === value;\n}\nconst METADATA_STRING_KEYS = [\"policyVersion\", \"jobId\", \"redactedAt\", \"reason\"] as const;\nconst METADATA_KEYS: readonly string[] = Object.freeze([\n\t\"redactionState\",\n\t\"dataClass\",\n\t\"redactedFields\",\n\t\"preservedSemantics\",\n\t...METADATA_STRING_KEYS,\n]);\nconst FIELD_METADATA_KEYS: readonly string[] = Object.freeze([\n\t\"fieldPath\",\n\t\"method\",\n\t\"policyVersion\",\n\t\"jobId\",\n\t\"redactedAt\",\n\t\"reason\",\n\t\"dataClass\",\n\t\"beforeChecksum\",\n]);\n\nfunction hasExactKeys(value: Record<string, unknown>, keys: readonly string[]): boolean {\n\tconst present = Object.keys(value);\n\treturn present.length === keys.length && present.every((key) => keys.includes(key));\n}\n\n/**\n * `AnonymizationEngine` copies any `_privacy` key through unredacted, because that is where it\n * stores its own metadata. A `_privacy` value from the port is therefore accepted only when it has\n * exactly the shape the engine writes; anything else could carry raw data past the policy.\n */\nfunction assertEnginePrivacyMetadata(value: unknown, path: string): void {\n\tconst invalid = (detail: string) =>\n\t\tnew EvidencePacketGenerationError(\n\t\t\t\"EVIDENCE_INVALID_RECORD\",\n\t\t\t`${path} is not engine-written AnonymizationMetadata (${detail}); _privacy values bypass the anonymization policy, so other data is rejected.`,\n\t\t);\n\tif (!value || typeof value !== \"object\" || Array.isArray(value)) throw invalid(\"not an object\");\n\tconst metadata = value as Record<string, unknown>;\n\tif (!hasExactKeys(metadata, METADATA_KEYS)) throw invalid(\"unexpected or missing keys\");\n\tif (metadata.redactionState !== \"anonymized\") throw invalid(\"redactionState\");\n\tif (!PLATFORM_DATA_CLASSES.includes(metadata.dataClass as PlatformDataClass)) throw invalid(\"dataClass\");\n\tfor (const key of METADATA_STRING_KEYS) {\n\t\tif (typeof metadata[key] !== \"string\") throw invalid(key);\n\t}\n\t// The engine writes redactedAt with toISOString() (privacy/engine.ts buildMetadata).\n\tif (!isIsoInstant(metadata.redactedAt)) throw invalid(\"redactedAt\");\n\tif (!Array.isArray(metadata.preservedSemantics) || !metadata.preservedSemantics.every((item) => typeof item === \"string\")) {\n\t\tthrow invalid(\"preservedSemantics\");\n\t}\n\tif (!Array.isArray(metadata.redactedFields)) throw invalid(\"redactedFields\");\n\tmetadata.redactedFields.forEach((field, index) => {\n\t\tif (!field || typeof field !== \"object\" || Array.isArray(field)) throw invalid(`redactedFields[${index}]`);\n\t\tconst entry = field as Record<string, unknown>;\n\t\tif (!hasExactKeys(entry, FIELD_METADATA_KEYS) || !Object.values(entry).every((item) => typeof item === \"string\")) {\n\t\t\tthrow invalid(`redactedFields[${index}]`);\n\t\t}\n\t\tif (!REDACTION_METHODS.includes(entry.method as RedactionMethod)) throw invalid(`redactedFields[${index}].method`);\n\t\tif (!PLATFORM_DATA_CLASSES.includes(entry.dataClass as PlatformDataClass)) throw invalid(`redactedFields[${index}].dataClass`);\n\t\t// The engine writes these with toISOString() and a SHA-256 hex digest (privacy/engine.ts\n\t\t// anonymizeRecursive and stableChecksum), so free text in them is not engine output.\n\t\tif (!isIsoInstant(entry.redactedAt)) throw invalid(`redactedFields[${index}].redactedAt`);\n\t\tif (!SHA256_HEX.test(entry.beforeChecksum as string)) throw invalid(`redactedFields[${index}].beforeChecksum`);\n\t});\n}\n\n/**\n * Converts a value to plain JSON. Dates become ISO strings; objects with a `toJSON` method (for\n * example decimal types) are replaced by its result. Values JSON cannot represent faithfully\n * (bigint, functions, symbols, non-finite numbers, invalid dates, other non-plain objects, an own\n * `__proto__` key) throw rather than being silently changed or dropped. Objects are rebuilt with a\n * null prototype, so later reads cannot pick up inherited fields.\n */\nfunction toPlainJson(value: unknown, path: string): unknown {\n\tif (value === null || typeof value === \"string\" || typeof value === \"boolean\") return value;\n\tif (typeof value === \"number\") {\n\t\tif (!Number.isFinite(value)) {\n\t\t\tthrow new EvidencePacketGenerationError(\"EVIDENCE_INVALID_RECORD\", `${path} is not a finite number.`);\n\t\t}\n\t\treturn value;\n\t}\n\tif (value instanceof Date) {\n\t\tif (Number.isNaN(value.getTime())) {\n\t\t\tthrow new EvidencePacketGenerationError(\"EVIDENCE_INVALID_RECORD\", `${path} is an invalid Date.`);\n\t\t}\n\t\treturn value.toISOString();\n\t}\n\tif (Array.isArray(value)) {\n\t\treturn value.map((item, index) => (item === undefined ? null : toPlainJson(item, `${path}[${index}]`)));\n\t}\n\tif (typeof value === \"object\") {\n\t\tif (!isPlainObject(value)) {\n\t\t\tconst toJSON = (value as { toJSON?: unknown }).toJSON;\n\t\t\tif (typeof toJSON === \"function\") return toPlainJson(toJSON.call(value), path);\n\t\t\tthrow new EvidencePacketGenerationError(\n\t\t\t\t\"EVIDENCE_INVALID_RECORD\",\n\t\t\t\t`${path} is a non-plain object that cannot be represented as JSON.`,\n\t\t\t);\n\t\t}\n\t\tconst result: Record<string, unknown> = Object.create(null);\n\t\tfor (const [key, child] of Object.entries(value)) {\n\t\t\tif (key === \"__proto__\") {\n\t\t\t\tthrow new EvidencePacketGenerationError(\"EVIDENCE_INVALID_RECORD\", `${path} has an own \"__proto__\" key.`);\n\t\t\t}\n\t\t\tif (child === undefined) continue;\n\t\t\tconst normalized = toPlainJson(child, `${path}.${key}`);\n\t\t\tif (key === \"_privacy\") assertEnginePrivacyMetadata(normalized, `${path}._privacy`);\n\t\t\tresult[key] = normalized;\n\t\t}\n\t\treturn result;\n\t}\n\tthrow new EvidencePacketGenerationError(\"EVIDENCE_INVALID_RECORD\", `${path} has unsupported type ${typeof value}.`);\n}\n\n/**\n * The timestamp strings accepted for event `occurredAt`/`recordedAt`: an ISO 8601 date-time, or\n * PostgreSQL's ISO output, with an explicit zone. Groups: year (4 digits, or a sign and 4 to 6\n * digits), month, day, `T` or one space, hour, minute, optional second and fraction, an optional\n * single space, then `Z` or an offset written `+HH`, `+HH:MM` or `+HHMM`.\n */\nconst ZONED_TIMESTAMP =\n\t/^([+-]\\d{4,6}|\\d{4})-(\\d{2})-(\\d{2})[T ](\\d{2}):(\\d{2})(?::(\\d{2})(?:\\.(\\d+))?)? ?(?:(Z)|([+-])(\\d{2})(?::?(\\d{2}))?)$/;\n\nfunction isLeapYear(year: number): boolean {\n\treturn (year % 4 === 0 && year % 100 !== 0) || year % 400 === 0;\n}\n\nfunction daysInMonth(year: number, month: number): number {\n\treturn [31, isLeapYear(year) ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31][month - 1]!;\n}\n\n/**\n * Parses a zoned timestamp string without `new Date(string)`, whose fallback parser accepts\n * non-ISO text and rolls invalid dates over. Every field is range-checked, so the result is exactly\n * the instant written, truncated to milliseconds. Returns `undefined` when the string is not\n * accepted. A zone-less string is rejected because reading it would depend on the host's time zone.\n */\nfunction parseZonedTimestamp(value: string): number | undefined {\n\tconst match = ZONED_TIMESTAMP.exec(value);\n\tif (!match) return undefined;\n\tconst [, yearText, monthText, dayText, hourText, minuteText, secondText, fraction, zulu, sign, offsetHourText, offsetMinuteText] = match;\n\tconst year = Number(yearText);\n\tconst month = Number(monthText);\n\tconst day = Number(dayText);\n\tconst hour = Number(hourText);\n\tconst minute = Number(minuteText);\n\tconst second = secondText === undefined ? 0 : Number(secondText);\n\tconst millisecond = fraction === undefined ? 0 : Number(fraction.padEnd(3, \"0\").slice(0, 3));\n\tif (month < 1 || month > 12 || day < 1 || day > daysInMonth(year, month)) return undefined;\n\tif (hour > 23 || minute > 59 || second > 59) return undefined;\n\tlet offsetMinutes = 0;\n\tif (!zulu) {\n\t\tconst offsetHours = Number(offsetHourText);\n\t\tconst offsetMinutePart = offsetMinuteText === undefined ? 0 : Number(offsetMinuteText);\n\t\tif (offsetHours > 14 || offsetMinutePart > 59) return undefined;\n\t\toffsetMinutes = (sign === \"-\" ? -1 : 1) * (offsetHours * 60 + offsetMinutePart);\n\t}\n\t// setUTCFullYear, not Date.UTC: Date.UTC maps years 0-99 to 1900-1999.\n\tconst date = new Date(0);\n\tdate.setUTCFullYear(year, month - 1, day);\n\tdate.setUTCHours(hour, minute, second, millisecond);\n\tconst instant = date.getTime() - offsetMinutes * 60_000;\n\treturn Number.isNaN(new Date(instant).getTime()) ? undefined : instant;\n}\n\n/** Normalizes a Date or zoned timestamp string to an ISO string, at millisecond precision. */\nfunction toIsoTimestamp(value: unknown, path: string): string {\n\tconst instant =\n\t\tvalue instanceof Date ? value.getTime() : typeof value === \"string\" ? parseZonedTimestamp(value) : undefined;\n\tif (instant === undefined || Number.isNaN(instant)) {\n\t\tthrow new EvidencePacketGenerationError(\n\t\t\t\"EVIDENCE_INVALID_RECORD\",\n\t\t\t`${path} must be a Date or an ISO 8601 / PostgreSQL ISO date-time with a valid date, time and explicit zone (Z, +HH, +HH:MM or +HHMM).`,\n\t\t);\n\t}\n\treturn new Date(instant).toISOString();\n}\n\nfunction assertScope(record: { id?: unknown; tenantId?: unknown; spaceId?: unknown }, scope: EvidenceScope, section: Section): void {\n\tif (record.tenantId !== scope.tenantId || record.spaceId !== scope.spaceId) {\n\t\tthrow new EvidencePacketGenerationError(\n\t\t\t\"EVIDENCE_SCOPE_MISMATCH\",\n\t\t\t`Evidence read port returned a ${section} record (${String(record.id)}) outside tenant/space ${scope.tenantId}/${scope.spaceId}.`,\n\t\t);\n\t}\n}\n\n/** Normalizes, scope-checks and de-duplicates a section. Conflicting records with one id throw. */\nfunction normalizeSection(\n\trecords: readonly object[],\n\tscope: EvidenceScope,\n\tsection: Section,\n\tprepare?: (record: EvidenceJsonRecord, path: string) => void,\n): EvidenceJsonRecord[] {\n\tif (!Array.isArray(records)) {\n\t\tthrow new EvidencePacketGenerationError(\"EVIDENCE_INVALID_RECORD\", `Evidence read port returned a non-array for ${section}.`);\n\t}\n\tconst byId = new Map<string, { record: EvidenceJsonRecord; canonical: string }>();\n\trecords.forEach((raw, index) => {\n\t\tconst path = `${section}[${index}]`;\n\t\tif (!raw || typeof raw !== \"object\" || Array.isArray(raw)) {\n\t\t\tthrow new EvidencePacketGenerationError(\"EVIDENCE_INVALID_RECORD\", `${path} must be an object.`);\n\t\t}\n\t\t// Scope is checked on the record as returned, before anything else is done with it, and again\n\t\t// on the normalized record, which is authoritative: it has a null prototype (so inherited\n\t\t// fields cannot satisfy the check) and reflects any toJSON conversion.\n\t\tassertScope(raw as EvidenceRecord, scope, section);\n\t\tconst record = toPlainJson(raw, path) as EvidenceJsonRecord;\n\t\tassertScope(record, scope, section);\n\t\tassertNonEmptyString(record.id, `${path}.id`);\n\t\tprepare?.(record, path);\n\t\tconst canonical = canonicalJson(record);\n\t\tconst existing = byId.get(record.id as string);\n\t\tif (existing && existing.canonical !== canonical) {\n\t\t\tthrow new EvidencePacketGenerationError(\n\t\t\t\t\"EVIDENCE_INVALID_RECORD\",\n\t\t\t\t`Evidence read port returned conflicting ${section} records with id ${String(record.id)}.`,\n\t\t\t);\n\t\t}\n\t\tbyId.set(record.id as string, { record, canonical });\n\t});\n\treturn [...byId.values()].map((entry) => entry.record);\n}\n\nfunction byId(left: EvidenceJsonRecord, right: EvidenceJsonRecord): number {\n\treturn compareStrings(left.id as string, right.id as string);\n}\n\nfunction byEventOrder(left: EvidenceJsonRecord, right: EvidenceJsonRecord): number {\n\t// Compare instants, not ISO strings: extended years (+010000-...) do not sort as strings.\n\treturn (\n\t\tDate.parse(left.occurredAt as string) - Date.parse(right.occurredAt as string) ||\n\t\tDate.parse(left.recordedAt as string) - Date.parse(right.recordedAt as string) ||\n\t\t(left.sequence as number) - (right.sequence as number) ||\n\t\tbyId(left, right)\n\t);\n}\n\nfunction assertSubject(subject: EvidencePacketSubject, path: string): EvidencePacketSubject {\n\tif (!subject || typeof subject !== \"object\") {\n\t\tthrow new EvidencePacketGenerationError(\"EVIDENCE_INVALID_RECORD\", `${path} must be an object.`);\n\t}\n\tassertNonEmptyString(subject.subjectType, `${path}.subjectType`);\n\tassertNonEmptyString(subject.subjectId, `${path}.subjectId`);\n\treturn { subjectType: subject.subjectType, subjectId: subject.subjectId };\n}\n\nfunction compareSubjects(left: EvidencePacketSubject, right: EvidencePacketSubject): number {\n\treturn compareStrings(left.subjectType, right.subjectType) || compareStrings(left.subjectId, right.subjectId);\n}\n\nasync function resolveSubjects(\n\tprimary: EvidencePacketSubject,\n\tincludeRelated: boolean,\n\tport: EvidencePacketReadPort,\n\tscope: EvidenceScope,\n): Promise<EvidencePacketSubject[]> {\n\tif (!includeRelated || !port.resolveRelatedSubjects) return [primary];\n\tconst related = await port.resolveRelatedSubjects({ ...primary }, { ...scope });\n\tif (!Array.isArray(related)) {\n\t\tthrow new EvidencePacketGenerationError(\"EVIDENCE_INVALID_RECORD\", \"resolveRelatedSubjects must return an array.\");\n\t}\n\tconst key = (subject: EvidencePacketSubject) => `${subject.subjectType}\\u0000${subject.subjectId}`;\n\tconst seen = new Set([key(primary)]);\n\tconst unique: EvidencePacketSubject[] = [];\n\trelated.forEach((candidate, index) => {\n\t\tconst subject = assertSubject(candidate, `relatedSubjects[${index}]`);\n\t\tif (seen.has(key(subject))) return;\n\t\tseen.add(key(subject));\n\t\tunique.push(subject);\n\t});\n\treturn [primary, ...unique.sort(compareSubjects)];\n}\n\nfunction assertRequestedInvocation(record: EvidenceJsonRecord, path: string, requested: ReadonlySet<string>): void {\n\tconst invocationId = record.actionInvocationId;\n\tif (typeof invocationId !== \"string\" || !requested.has(invocationId)) {\n\t\tthrow new EvidencePacketGenerationError(\n\t\t\t\"EVIDENCE_UNREQUESTED_RECORD\",\n\t\t\t`${path}.actionInvocationId (${String(invocationId)}) is not one of the requested action invocations.`,\n\t\t);\n\t}\n}\n\nconst REFERENCE_METADATA_FIELDS: Record<Section, readonly string[]> = {\n\tactionInvocations: [\"actionId\", \"status\"],\n\tevents: [\"eventType\", \"subjectType\", \"subjectId\", \"actionInvocationId\"],\n\tpolicyEvaluations: [\"actionInvocationId\", \"policyId\", \"policyVersion\", \"result\"],\n\tadapterInvocations: [\"actionInvocationId\", \"adapterType\", \"operation\", \"status\"],\n};\n\nconst REFERENCE_TYPES: Record<Section, EvidencePacketReference[\"referenceType\"]> = {\n\tactionInvocations: \"action_invocation\",\n\tevents: \"asset_event\",\n\tpolicyEvaluations: \"policy_evaluation\",\n\tadapterInvocations: \"adapter_invocation\",\n};\n\n/**\n * References are built from the redacted payload so nothing outside it can carry a raw value.\n * Each record's `id` must come through redaction unchanged, because references and verifiers\n * identify records by it.\n */\nfunction buildReferences(\n\tpayload: EvidencePacketPayload,\n\tunredacted: Pick<EvidencePacketPayload, Section>,\n): EvidencePacketReference[] {\n\tconst sections: Section[] = [\"actionInvocations\", \"events\", \"policyEvaluations\", \"adapterInvocations\"];\n\treturn sections.flatMap((section) =>\n\t\t(payload[section] as unknown[]).map((record, index) => {\n\t\t\tconst originalId = unredacted[section][index]?.id;\n\t\t\tif (!record || typeof record !== \"object\" || (record as EvidenceJsonRecord).id !== originalId) {\n\t\t\t\tthrow new EvidencePacketGenerationError(\n\t\t\t\t\t\"EVIDENCE_IDENTIFIER_REDACTED\",\n\t\t\t\t\t`The anonymization policy removed or changed ${section}[${index}].id; record ids must pass through redaction unchanged.`,\n\t\t\t\t);\n\t\t\t}\n\t\t\tconst metadata: Record<string, string> = {};\n\t\t\tfor (const field of REFERENCE_METADATA_FIELDS[section]) {\n\t\t\t\tconst value = (record as EvidenceJsonRecord)[field];\n\t\t\t\tif (typeof value === \"string\") metadata[field] = value;\n\t\t\t}\n\t\t\treturn {\n\t\t\t\treferenceType: REFERENCE_TYPES[section],\n\t\t\t\treferenceId: (record as EvidenceJsonRecord).id as string,\n\t\t\t\tmetadata,\n\t\t\t};\n\t\t}),\n\t);\n}\n\nfunction redactedSubjects(value: unknown): EvidencePacketSubject[] {\n\tif (!Array.isArray(value)) {\n\t\tthrow new EvidencePacketGenerationError(\"EVIDENCE_IDENTIFIER_REDACTED\", \"The anonymization policy removed payload.subjects.\");\n\t}\n\treturn value.map((subject, index) => {\n\t\ttry {\n\t\t\treturn assertSubject(subject as EvidencePacketSubject, `subjects[${index}]`);\n\t\t} catch {\n\t\t\tthrow new EvidencePacketGenerationError(\n\t\t\t\t\"EVIDENCE_IDENTIFIER_REDACTED\",\n\t\t\t\t`The anonymization policy removed subjects[${index}] or made its subjectType/subjectId a non-string; subject identifiers may be transformed (for example tokenized) but must remain non-empty strings.`,\n\t\t\t);\n\t\t}\n\t});\n}\n\n/** Lowercase hex SHA-256 of `canonicalJson(payload)`. */\nexport function computeEvidencePacketChecksum(payload: unknown): string {\n\treturn createHash(\"sha256\").update(canonicalJson(payload)).digest(\"hex\");\n}\n\n/**\n * Builds a sealed evidence packet for one subject from the application's read port.\n *\n * Steps: resolve subjects (primary first, then related, de-duplicated and sorted); read events,\n * then the action invocations, policy evaluations and adapter invocations those events reference;\n * reject any record outside `context.tenantId`/`context.spaceId`; normalize to plain JSON and sort\n * deterministically; redact the payload with `AnonymizationEngine` (data class\n * `\"evidence_packet\"`); checksum the redacted payload; and build references from it.\n *\n * Nothing is persisted. Storing the returned envelope is the application's job.\n */\nexport async function generateEvidencePacket<TDb = unknown>(\n\tinput: GenerateEvidencePacketInput,\n\tcontext: EvidenceGenerationContext<TDb>,\n\toptions: GenerateEvidencePacketOptions,\n): Promise<EvidencePacketEnvelope<EvidencePacketPayload>> {\n\tconst { port } = options;\n\tif (!port || typeof port.listEvents !== \"function\") {\n\t\tthrow new TypeError(\"generateEvidencePacket requires a read port with listEvents().\");\n\t}\n\tif (!options.anonymizationPolicy || !Array.isArray(options.anonymizationPolicy.fields)) {\n\t\tthrow new TypeError(\"generateEvidencePacket requires an anonymizationPolicy (use { fields: [] } to redact nothing).\");\n\t}\n\tassertNonEmptyString(context.tenantId, \"context.tenantId\");\n\tassertNonEmptyString(context.spaceId, \"context.spaceId\");\n\tassertNonEmptyString(context.actorId, \"context.actorId\");\n\tassertNonEmptyString(context.correlationId, \"context.correlationId\");\n\n\tconst scope: EvidenceScope = { tenantId: context.tenantId, spaceId: context.spaceId };\n\tconst primary = assertSubject(input.subject, \"input.subject\");\n\t// Records whether a related-subject lookup actually ran, not only whether it was requested.\n\tconst includeRelated = input.includeRelated !== false && typeof port.resolveRelatedSubjects === \"function\";\n\tconst packetType = input.packetType ?? DEFAULT_EVIDENCE_PACKET_TYPE;\n\tassertNonEmptyString(packetType, \"input.packetType\");\n\n\tconst subjects = await resolveSubjects(primary, includeRelated, port, scope);\n\n\tconst rawEvents = await port.listEvents({\n\t\t...scope,\n\t\tprimarySubject: { ...primary },\n\t\tsubjects: subjects.map((subject) => ({ ...subject })),\n\t});\n\tconst events = normalizeSection(rawEvents, scope, \"events\", (record, path) => {\n\t\tfor (const field of [\"eventType\", \"subjectType\", \"subjectId\", \"correlationId\"]) {\n\t\t\tassertNonEmptyString(record[field], `${path}.${field}`);\n\t\t}\n\t\tif (typeof record.sequence !== \"number\") {\n\t\t\tthrow new EvidencePacketGenerationError(\"EVIDENCE_INVALID_RECORD\", `${path}.sequence must be a number.`);\n\t\t}\n\t\trecord.occurredAt = toIsoTimestamp(record.occurredAt, `${path}.occurredAt`);\n\t\trecord.recordedAt = toIsoTimestamp(record.recordedAt, `${path}.recordedAt`);\n\t\tconst invocationId = record.actionInvocationId;\n\t\tif (invocationId !== undefined && invocationId !== null) {\n\t\t\tassertNonEmptyString(invocationId, `${path}.actionInvocationId`);\n\t\t}\n\t}).sort(byEventOrder);\n\n\tconst invocationIds = [\n\t\t...new Set(\n\t\t\tevents\n\t\t\t\t.map((event) => event.actionInvocationId)\n\t\t\t\t.filter((id): id is string => typeof id === \"string\"),\n\t\t),\n\t].sort(compareStrings);\n\tconst requested = new Set(invocationIds);\n\n\tconst read = async (\n\t\tmethod: ((scope: EvidenceScope, ids: readonly string[]) => MaybePromise<readonly object[]>) | undefined,\n\t): Promise<readonly object[]> => {\n\t\tif (!method || invocationIds.length === 0) return [];\n\t\treturn method.call(port, { ...scope }, [...invocationIds]);\n\t};\n\tconst [rawActionInvocations, rawPolicyEvaluations, rawAdapterInvocations] = await Promise.all([\n\t\tread(port.listActionInvocations),\n\t\tread(port.listPolicyEvaluations),\n\t\tread(port.listAdapterInvocations),\n\t]);\n\n\tconst actionInvocations = normalizeSection(rawActionInvocations, scope, \"actionInvocations\", (record, path) => {\n\t\tif (!requested.has(record.id as string)) {\n\t\t\tthrow new EvidencePacketGenerationError(\n\t\t\t\t\"EVIDENCE_UNREQUESTED_RECORD\",\n\t\t\t\t`${path}.id (${String(record.id)}) is not one of the requested action invocations.`,\n\t\t\t);\n\t\t}\n\t}).sort(byId);\n\tconst policyEvaluations = normalizeSection(rawPolicyEvaluations, scope, \"policyEvaluations\", (record, path) =>\n\t\tassertRequestedInvocation(record, path, requested),\n\t).sort(byId);\n\tconst adapterInvocations = normalizeSection(rawAdapterInvocations, scope, \"adapterInvocations\", (record, path) =>\n\t\tassertRequestedInvocation(record, path, requested),\n\t).sort(byId);\n\n\tconst generatedAt = context.now ?? new Date();\n\tconst id = options.idFactory ? options.idFactory() : createFabricId(FABRIC_ID_PREFIXES.complianceEvidencePacket);\n\tassertNonEmptyString(id, \"packet id\");\n\n\tconst unredacted: Omit<EvidencePacketPayload, \"redaction\"> = {\n\t\tschemaVersion: EVIDENCE_PACKET_SCHEMA_VERSION,\n\t\tpacketType,\n\t\ttenantId: scope.tenantId,\n\t\tspaceId: scope.spaceId,\n\t\tprimarySubject: { ...primary },\n\t\tsubjects: subjects.map((subject) => ({ ...subject })),\n\t\tincludeRelated,\n\t\t...(input.policyVersion !== undefined ? { policyVersion: input.policyVersion } : {}),\n\t\tevents,\n\t\tactionInvocations,\n\t\tpolicyEvaluations,\n\t\tadapterInvocations,\n\t};\n\n\tconst anonymizationContext: AnonymizationContext = {\n\t\ttenantId: scope.tenantId,\n\t\tspaceId: scope.spaceId,\n\t\tjobId: options.anonymization?.jobId ?? id,\n\t\treason: options.anonymization?.reason ?? DEFAULT_EVIDENCE_REDACTION_REASON,\n\t\tredactedAt: generatedAt,\n\t\t...(options.anonymization?.policyVersion !== undefined\n\t\t\t? { policyVersion: options.anonymization.policyVersion }\n\t\t\t: {}),\n\t};\n\t// Rebuild the payload with sorted keys first: the engine walks keys in insertion order and lists\n\t// redacted fields in that order, so without this the record key order chosen by the store\n\t// would change the redaction metadata and therefore the checksum.\n\tconst keySorted = JSON.parse(canonicalJson(unredacted)) as typeof unredacted;\n\tconst redacted = new AnonymizationEngine(options.anonymizationPolicy).anonymizeJsonValue(\n\t\tkeySorted,\n\t\tanonymizationContext,\n\t\t\"evidence_packet\",\n\t);\n\t// The engine can replace any field, including the payload's own structure, so the result is\n\t// re-read defensively below rather than trusted to keep the declared shape.\n\tconst payload = { ...(redacted.value as object), redaction: redacted.metadata } as EvidencePacketPayload;\n\tfor (const section of [\"events\", \"actionInvocations\", \"policyEvaluations\", \"adapterInvocations\"] as const) {\n\t\tif (!Array.isArray(payload[section])) {\n\t\t\tthrow new EvidencePacketGenerationError(\n\t\t\t\t\"EVIDENCE_IDENTIFIER_REDACTED\",\n\t\t\t\t`The anonymization policy removed or replaced payload.${section}.`,\n\t\t\t);\n\t\t}\n\t}\n\tconst envelopeSubjects = redactedSubjects(payload.subjects);\n\tconst references = buildReferences(payload, keySorted);\n\n\treturn {\n\t\tid,\n\t\ttenantId: scope.tenantId,\n\t\tspaceId: scope.spaceId,\n\t\tpacketType,\n\t\tstatus: \"sealed\",\n\t\tsubjects: envelopeSubjects,\n\t\treferences,\n\t\tpayload,\n\t\tgeneratedAt: generatedAt.toISOString(),\n\t\tgeneratedBy: context.actorId,\n\t\t...(input.policyVersion !== undefined ? { policyVersion: input.policyVersion } : {}),\n\t\tchecksum: computeEvidencePacketChecksum(payload),\n\t\tchecksumAlgorithm: EVIDENCE_PACKET_CHECKSUM_ALGORITHM,\n\t\tcorrelationId: context.correlationId,\n\t\t...(context.causationId !== undefined ? { causationId: context.causationId } : {}),\n\t};\n}\n\n/**\n * Recomputes an envelope's checksum. Returns `false`, never throws, when the checksum is missing,\n * the algorithm is missing or unknown, the payload cannot be serialized, or the values differ.\n * It covers `payload` only, which includes the subjects and the redaction metadata; the other\n * envelope fields are not covered.\n */\nexport function verifyEvidencePacketChecksum(envelope: Pick<EvidencePacketEnvelope<unknown>, \"payload\" | \"checksum\" | \"checksumAlgorithm\">): boolean {\n\ttry {\n\t\tif (!envelope || typeof envelope.checksum !== \"string\" || envelope.checksum.length === 0) return false;\n\t\tif (envelope.checksumAlgorithm !== EVIDENCE_PACKET_CHECKSUM_ALGORITHM) return false;\n\t\treturn computeEvidencePacketChecksum(envelope.payload) === envelope.checksum;\n\t} catch {\n\t\treturn false;\n\t}\n}\n\nexport type EvidencePacketRendererInput = Omit<GenerateEvidencePacketInput, \"packetType\">;\n\nexport interface EvidencePacketRendererOptions extends GenerateEvidencePacketOptions {\n\tpacketType?: string;\n}\n\n/** Wraps `generateEvidencePacket` as an `EvidenceRenderer` for one packet type. */\nexport function createEvidencePacketRenderer<TDb = unknown>(\n\toptions: EvidencePacketRendererOptions,\n): EvidenceRenderer<EvidencePacketRendererInput, EvidencePacketPayload, TDb> {\n\tconst { packetType = DEFAULT_EVIDENCE_PACKET_TYPE, ...generatorOptions } = options;\n\treturn {\n\t\tpacketType,\n\t\trender: (input, context) => generateEvidencePacket({ ...input, packetType }, context, generatorOptions),\n\t};\n}\n"]}