@fabricorg/platform 1.9.0 → 1.10.1

package/dist/evidence-Cq48eDvA.cjs

@@ -0,0 +1,575 @@
+const require_ids_index = require("./ids/index.cjs");
+const require_engine = require("./engine-BqScuhrT.cjs");
+let crypto = require("crypto");
+//#region evidence/canonical-json.ts
+/**
+* Serializes a value as JSON with every object's keys sorted, recursively, by UTF-16 code-unit
+* order (locale-independent). Array order is preserved.
+*
+* This is the serialization behind the `fabric-canonical-json-sha256-v1` digests: Host's
+* parameter digests (`PARAMETER_DIGEST_ALGORITHM` in `@fabricorg/platform-host`) and evidence
+* packet checksums (`EVIDENCE_PACKET_CHECKSUM_ALGORITHM`). Its output is a durable contract, so it
+* must not change for any input. That includes values that are not plain JSON: any non-array
+* object is rebuilt from its own enumerable entries before serialization, so a `Date` (which has
+* none) serializes as `{}`, not as an ISO string. Convert dates to strings before calling this
+* when they must survive into the output.
+*/
+function canonicalJson(value) {
+	return JSON.stringify(sortKeys(value));
+}
+function sortKeys(value) {
+	if (Array.isArray(value)) return value.map(sortKeys);
+	if (value && typeof value === "object") return Object.fromEntries(Object.entries(value).sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0).map(([key, child]) => [key, sortKeys(child)]));
+	return value;
+}
+//#endregion
+//#region evidence/generator.ts
+/**
+* Identifies how `EvidencePacketEnvelope.checksum` is computed: the lowercase hex SHA-256 of
+* `canonicalJson(payload)`. It is the same identifier as Host's `PARAMETER_DIGEST_ALGORITHM`
+* because the algorithm is the same (SHA-256 over `canonicalJson`).
+*/
+const EVIDENCE_PACKET_CHECKSUM_ALGORITHM = "fabric-canonical-json-sha256-v1";
+/** Version of the `EvidencePacketPayload` shape produced by `generateEvidencePacket`. */
+const EVIDENCE_PACKET_SCHEMA_VERSION = 1;
+/** Packet type used when the input does not name one. */
+const DEFAULT_EVIDENCE_PACKET_TYPE = "compliance_evidence";
+/** Anonymization reason recorded when the caller does not supply one. */
+const DEFAULT_EVIDENCE_REDACTION_REASON = "evidence_packet_generation";
+var EvidencePacketGenerationError = class extends Error {
+	code;
+	constructor(code, message) {
+		super(message);
+		this.name = "EvidencePacketGenerationError";
+		this.code = code;
+	}
+};
+function compareStrings(left, right) {
+	return left < right ? -1 : left > right ? 1 : 0;
+}
+function assertNonEmptyString(value, what) {
+	if (typeof value !== "string" || value.length === 0) throw new EvidencePacketGenerationError("EVIDENCE_INVALID_RECORD", `${what} must be a non-empty string.`);
+}
+function isPlainObject(value) {
+	const prototype = Object.getPrototypeOf(value);
+	return prototype === Object.prototype || prototype === null;
+}
+/**
+* Returns the list unchanged, but fails type-checking unless it names every member of `TUnion`
+* (and nothing else), so these runtime lists cannot drift from the privacy types.
+*/
+function exhaustiveList() {
+	return (list) => list;
+}
+const REDACTION_METHODS = Object.freeze(exhaustiveList()([
+	"nullify",
+	"mask",
+	"hash",
+	"tokenize",
+	"generalize",
+	"drop"
+]));
+const PLATFORM_DATA_CLASSES = Object.freeze(exhaustiveList()([
+	"asset_event",
+	"read_model",
+	"raw_payload",
+	"evidence_packet",
+	"action_evidence",
+	"access_event"
+]));
+const SHA256_HEX = /^[0-9a-f]{64}$/;
+/** True for a string `Date.prototype.toISOString` produced: it parses and serializes back unchanged. */
+function isIsoInstant(value) {
+	if (typeof value !== "string") return false;
+	const date = new Date(value);
+	return !Number.isNaN(date.getTime()) && date.toISOString() === value;
+}
+const METADATA_STRING_KEYS = [
+	"policyVersion",
+	"jobId",
+	"redactedAt",
+	"reason"
+];
+const METADATA_KEYS = Object.freeze([
+	"redactionState",
+	"dataClass",
+	"redactedFields",
+	"preservedSemantics",
+	...METADATA_STRING_KEYS
+]);
+const FIELD_METADATA_KEYS = Object.freeze([
+	"fieldPath",
+	"method",
+	"policyVersion",
+	"jobId",
+	"redactedAt",
+	"reason",
+	"dataClass",
+	"beforeChecksum"
+]);
+function hasExactKeys(value, keys) {
+	const present = Object.keys(value);
+	return present.length === keys.length && present.every((key) => keys.includes(key));
+}
+/**
+* `AnonymizationEngine` copies any `_privacy` key through unredacted, because that is where it
+* stores its own metadata. A `_privacy` value from the port is therefore accepted only when it has
+* exactly the shape the engine writes; anything else could carry raw data past the policy.
+*/
+function assertEnginePrivacyMetadata(value, path) {
+	const invalid = (detail) => new EvidencePacketGenerationError("EVIDENCE_INVALID_RECORD", `${path} is not engine-written AnonymizationMetadata (${detail}); _privacy values bypass the anonymization policy, so other data is rejected.`);
+	if (!value || typeof value !== "object" || Array.isArray(value)) throw invalid("not an object");
+	const metadata = value;
+	if (!hasExactKeys(metadata, METADATA_KEYS)) throw invalid("unexpected or missing keys");
+	if (metadata.redactionState !== "anonymized") throw invalid("redactionState");
+	if (!PLATFORM_DATA_CLASSES.includes(metadata.dataClass)) throw invalid("dataClass");
+	for (const key of METADATA_STRING_KEYS) if (typeof metadata[key] !== "string") throw invalid(key);
+	if (!isIsoInstant(metadata.redactedAt)) throw invalid("redactedAt");
+	if (!Array.isArray(metadata.preservedSemantics) || !metadata.preservedSemantics.every((item) => typeof item === "string")) throw invalid("preservedSemantics");
+	if (!Array.isArray(metadata.redactedFields)) throw invalid("redactedFields");
+	metadata.redactedFields.forEach((field, index) => {
+		if (!field || typeof field !== "object" || Array.isArray(field)) throw invalid(`redactedFields[${index}]`);
+		const entry = field;
+		if (!hasExactKeys(entry, FIELD_METADATA_KEYS) || !Object.values(entry).every((item) => typeof item === "string")) throw invalid(`redactedFields[${index}]`);
+		if (!REDACTION_METHODS.includes(entry.method)) throw invalid(`redactedFields[${index}].method`);
+		if (!PLATFORM_DATA_CLASSES.includes(entry.dataClass)) throw invalid(`redactedFields[${index}].dataClass`);
+		if (!isIsoInstant(entry.redactedAt)) throw invalid(`redactedFields[${index}].redactedAt`);
+		if (!SHA256_HEX.test(entry.beforeChecksum)) throw invalid(`redactedFields[${index}].beforeChecksum`);
+	});
+}
+/**
+* Converts a value to plain JSON. Dates become ISO strings; objects with a `toJSON` method (for
+* example decimal types) are replaced by its result. Values JSON cannot represent faithfully
+* (bigint, functions, symbols, non-finite numbers, invalid dates, other non-plain objects, an own
+* `__proto__` key) throw rather than being silently changed or dropped. Objects are rebuilt with a
+* null prototype, so later reads cannot pick up inherited fields.
+*/
+function toPlainJson(value, path) {
+	if (value === null || typeof value === "string" || typeof value === "boolean") return value;
+	if (typeof value === "number") {
+		if (!Number.isFinite(value)) throw new EvidencePacketGenerationError("EVIDENCE_INVALID_RECORD", `${path} is not a finite number.`);
+		return value;
+	}
+	if (value instanceof Date) {
+		if (Number.isNaN(value.getTime())) throw new EvidencePacketGenerationError("EVIDENCE_INVALID_RECORD", `${path} is an invalid Date.`);
+		return value.toISOString();
+	}
+	if (Array.isArray(value)) return value.map((item, index) => item === void 0 ? null : toPlainJson(item, `${path}[${index}]`));
+	if (typeof value === "object") {
+		if (!isPlainObject(value)) {
+			const toJSON = value.toJSON;
+			if (typeof toJSON === "function") return toPlainJson(toJSON.call(value), path);
+			throw new EvidencePacketGenerationError("EVIDENCE_INVALID_RECORD", `${path} is a non-plain object that cannot be represented as JSON.`);
+		}
+		const result = Object.create(null);
+		for (const [key, child] of Object.entries(value)) {
+			if (key === "__proto__") throw new EvidencePacketGenerationError("EVIDENCE_INVALID_RECORD", `${path} has an own "__proto__" key.`);
+			if (child === void 0) continue;
+			const normalized = toPlainJson(child, `${path}.${key}`);
+			if (key === "_privacy") assertEnginePrivacyMetadata(normalized, `${path}._privacy`);
+			result[key] = normalized;
+		}
+		return result;
+	}
+	throw new EvidencePacketGenerationError("EVIDENCE_INVALID_RECORD", `${path} has unsupported type ${typeof value}.`);
+}
+/**
+* The timestamp strings accepted for event `occurredAt`/`recordedAt`: an ISO 8601 date-time, or
+* PostgreSQL's ISO output, with an explicit zone. Groups: year (4 digits, or a sign and 4 to 6
+* digits), month, day, `T` or one space, hour, minute, optional second and fraction, an optional
+* single space, then `Z` or an offset written `+HH`, `+HH:MM` or `+HHMM`.
+*/
+const ZONED_TIMESTAMP = /^([+-]\d{4,6}|\d{4})-(\d{2})-(\d{2})[T ](\d{2}):(\d{2})(?::(\d{2})(?:\.(\d+))?)? ?(?:(Z)|([+-])(\d{2})(?::?(\d{2}))?)$/;
+function isLeapYear(year) {
+	return year % 4 === 0 && year % 100 !== 0 || year % 400 === 0;
+}
+function daysInMonth(year, month) {
+	return [
+		31,
+		isLeapYear(year) ? 29 : 28,
+		31,
+		30,
+		31,
+		30,
+		31,
+		31,
+		30,
+		31,
+		30,
+		31
+	][month - 1];
+}
+/**
+* Parses a zoned timestamp string without `new Date(string)`, whose fallback parser accepts
+* non-ISO text and rolls invalid dates over. Every field is range-checked, so the result is exactly
+* the instant written, truncated to milliseconds. Returns `undefined` when the string is not
+* accepted. A zone-less string is rejected because reading it would depend on the host's time zone.
+*/
+function parseZonedTimestamp(value) {
+	const match = ZONED_TIMESTAMP.exec(value);
+	if (!match) return void 0;
+	const [, yearText, monthText, dayText, hourText, minuteText, secondText, fraction, zulu, sign, offsetHourText, offsetMinuteText] = match;
+	const year = Number(yearText);
+	const month = Number(monthText);
+	const day = Number(dayText);
+	const hour = Number(hourText);
+	const minute = Number(minuteText);
+	const second = secondText === void 0 ? 0 : Number(secondText);
+	const millisecond = fraction === void 0 ? 0 : Number(fraction.padEnd(3, "0").slice(0, 3));
+	if (month < 1 || month > 12 || day < 1 || day > daysInMonth(year, month)) return void 0;
+	if (hour > 23 || minute > 59 || second > 59) return void 0;
+	let offsetMinutes = 0;
+	if (!zulu) {
+		const offsetHours = Number(offsetHourText);
+		const offsetMinutePart = offsetMinuteText === void 0 ? 0 : Number(offsetMinuteText);
+		if (offsetHours > 14 || offsetMinutePart > 59) return void 0;
+		offsetMinutes = (sign === "-" ? -1 : 1) * (offsetHours * 60 + offsetMinutePart);
+	}
+	const date = /* @__PURE__ */ new Date(0);
+	date.setUTCFullYear(year, month - 1, day);
+	date.setUTCHours(hour, minute, second, millisecond);
+	const instant = date.getTime() - offsetMinutes * 6e4;
+	return Number.isNaN(new Date(instant).getTime()) ? void 0 : instant;
+}
+/** Normalizes a Date or zoned timestamp string to an ISO string, at millisecond precision. */
+function toIsoTimestamp(value, path) {
+	const instant = value instanceof Date ? value.getTime() : typeof value === "string" ? parseZonedTimestamp(value) : void 0;
+	if (instant === void 0 || Number.isNaN(instant)) throw new EvidencePacketGenerationError("EVIDENCE_INVALID_RECORD", `${path} must be a Date or an ISO 8601 / PostgreSQL ISO date-time with a valid date, time and explicit zone (Z, +HH, +HH:MM or +HHMM).`);
+	return new Date(instant).toISOString();
+}
+function assertScope(record, scope, section) {
+	if (record.tenantId !== scope.tenantId || record.spaceId !== scope.spaceId) throw new EvidencePacketGenerationError("EVIDENCE_SCOPE_MISMATCH", `Evidence read port returned a ${section} record (${String(record.id)}) outside tenant/space ${scope.tenantId}/${scope.spaceId}.`);
+}
+/** Normalizes, scope-checks and de-duplicates a section. Conflicting records with one id throw. */
+function normalizeSection(records, scope, section, prepare) {
+	if (!Array.isArray(records)) throw new EvidencePacketGenerationError("EVIDENCE_INVALID_RECORD", `Evidence read port returned a non-array for ${section}.`);
+	const byId = /* @__PURE__ */ new Map();
+	records.forEach((raw, index) => {
+		const path = `${section}[${index}]`;
+		if (!raw || typeof raw !== "object" || Array.isArray(raw)) throw new EvidencePacketGenerationError("EVIDENCE_INVALID_RECORD", `${path} must be an object.`);
+		assertScope(raw, scope, section);
+		const record = toPlainJson(raw, path);
+		assertScope(record, scope, section);
+		assertNonEmptyString(record.id, `${path}.id`);
+		prepare?.(record, path);
+		const canonical = canonicalJson(record);
+		const existing = byId.get(record.id);
+		if (existing && existing.canonical !== canonical) throw new EvidencePacketGenerationError("EVIDENCE_INVALID_RECORD", `Evidence read port returned conflicting ${section} records with id ${String(record.id)}.`);
+		byId.set(record.id, {
+			record,
+			canonical
+		});
+	});
+	return [...byId.values()].map((entry) => entry.record);
+}
+function byId(left, right) {
+	return compareStrings(left.id, right.id);
+}
+function byEventOrder(left, right) {
+	return Date.parse(left.occurredAt) - Date.parse(right.occurredAt) || Date.parse(left.recordedAt) - Date.parse(right.recordedAt) || left.sequence - right.sequence || byId(left, right);
+}
+function assertSubject(subject, path) {
+	if (!subject || typeof subject !== "object") throw new EvidencePacketGenerationError("EVIDENCE_INVALID_RECORD", `${path} must be an object.`);
+	assertNonEmptyString(subject.subjectType, `${path}.subjectType`);
+	assertNonEmptyString(subject.subjectId, `${path}.subjectId`);
+	return {
+		subjectType: subject.subjectType,
+		subjectId: subject.subjectId
+	};
+}
+function compareSubjects(left, right) {
+	return compareStrings(left.subjectType, right.subjectType) || compareStrings(left.subjectId, right.subjectId);
+}
+async function resolveSubjects(primary, includeRelated, port, scope) {
+	if (!includeRelated || !port.resolveRelatedSubjects) return [primary];
+	const related = await port.resolveRelatedSubjects({ ...primary }, { ...scope });
+	if (!Array.isArray(related)) throw new EvidencePacketGenerationError("EVIDENCE_INVALID_RECORD", "resolveRelatedSubjects must return an array.");
+	const key = (subject) => `${subject.subjectType}\u0000${subject.subjectId}`;
+	const seen = /* @__PURE__ */ new Set([key(primary)]);
+	const unique = [];
+	related.forEach((candidate, index) => {
+		const subject = assertSubject(candidate, `relatedSubjects[${index}]`);
+		if (seen.has(key(subject))) return;
+		seen.add(key(subject));
+		unique.push(subject);
+	});
+	return [primary, ...unique.sort(compareSubjects)];
+}
+function assertRequestedInvocation(record, path, requested) {
+	const invocationId = record.actionInvocationId;
+	if (typeof invocationId !== "string" || !requested.has(invocationId)) throw new EvidencePacketGenerationError("EVIDENCE_UNREQUESTED_RECORD", `${path}.actionInvocationId (${String(invocationId)}) is not one of the requested action invocations.`);
+}
+const REFERENCE_METADATA_FIELDS = {
+	actionInvocations: ["actionId", "status"],
+	events: [
+		"eventType",
+		"subjectType",
+		"subjectId",
+		"actionInvocationId"
+	],
+	policyEvaluations: [
+		"actionInvocationId",
+		"policyId",
+		"policyVersion",
+		"result"
+	],
+	adapterInvocations: [
+		"actionInvocationId",
+		"adapterType",
+		"operation",
+		"status"
+	]
+};
+const REFERENCE_TYPES = {
+	actionInvocations: "action_invocation",
+	events: "asset_event",
+	policyEvaluations: "policy_evaluation",
+	adapterInvocations: "adapter_invocation"
+};
+/**
+* References are built from the redacted payload so nothing outside it can carry a raw value.
+* Each record's `id` must come through redaction unchanged, because references and verifiers
+* identify records by it.
+*/
+function buildReferences(payload, unredacted) {
+	return [
+		"actionInvocations",
+		"events",
+		"policyEvaluations",
+		"adapterInvocations"
+	].flatMap((section) => payload[section].map((record, index) => {
+		const originalId = unredacted[section][index]?.id;
+		if (!record || typeof record !== "object" || record.id !== originalId) throw new EvidencePacketGenerationError("EVIDENCE_IDENTIFIER_REDACTED", `The anonymization policy removed or changed ${section}[${index}].id; record ids must pass through redaction unchanged.`);
+		const metadata = {};
+		for (const field of REFERENCE_METADATA_FIELDS[section]) {
+			const value = record[field];
+			if (typeof value === "string") metadata[field] = value;
+		}
+		return {
+			referenceType: REFERENCE_TYPES[section],
+			referenceId: record.id,
+			metadata
+		};
+	}));
+}
+function redactedSubjects(value) {
+	if (!Array.isArray(value)) throw new EvidencePacketGenerationError("EVIDENCE_IDENTIFIER_REDACTED", "The anonymization policy removed payload.subjects.");
+	return value.map((subject, index) => {
+		try {
+			return assertSubject(subject, `subjects[${index}]`);
+		} catch {
+			throw new EvidencePacketGenerationError("EVIDENCE_IDENTIFIER_REDACTED", `The anonymization policy removed subjects[${index}] or made its subjectType/subjectId a non-string; subject identifiers may be transformed (for example tokenized) but must remain non-empty strings.`);
+		}
+	});
+}
+/** Lowercase hex SHA-256 of `canonicalJson(payload)`. */
+function computeEvidencePacketChecksum(payload) {
+	return (0, crypto.createHash)("sha256").update(canonicalJson(payload)).digest("hex");
+}
+/**
+* Builds a sealed evidence packet for one subject from the application's read port.
+*
+* Steps: resolve subjects (primary first, then related, de-duplicated and sorted); read events,
+* then the action invocations, policy evaluations and adapter invocations those events reference;
+* reject any record outside `context.tenantId`/`context.spaceId`; normalize to plain JSON and sort
+* deterministically; redact the payload with `AnonymizationEngine` (data class
+* `"evidence_packet"`); checksum the redacted payload; and build references from it.
+*
+* Nothing is persisted. Storing the returned envelope is the application's job.
+*/
+async function generateEvidencePacket(input, context, options) {
+	const { port } = options;
+	if (!port || typeof port.listEvents !== "function") throw new TypeError("generateEvidencePacket requires a read port with listEvents().");
+	if (!options.anonymizationPolicy || !Array.isArray(options.anonymizationPolicy.fields)) throw new TypeError("generateEvidencePacket requires an anonymizationPolicy (use { fields: [] } to redact nothing).");
+	assertNonEmptyString(context.tenantId, "context.tenantId");
+	assertNonEmptyString(context.spaceId, "context.spaceId");
+	assertNonEmptyString(context.actorId, "context.actorId");
+	assertNonEmptyString(context.correlationId, "context.correlationId");
+	const scope = {
+		tenantId: context.tenantId,
+		spaceId: context.spaceId
+	};
+	const primary = assertSubject(input.subject, "input.subject");
+	const includeRelated = input.includeRelated !== false && typeof port.resolveRelatedSubjects === "function";
+	const packetType = input.packetType ?? "compliance_evidence";
+	assertNonEmptyString(packetType, "input.packetType");
+	const subjects = await resolveSubjects(primary, includeRelated, port, scope);
+	const events = normalizeSection(await port.listEvents({
+		...scope,
+		primarySubject: { ...primary },
+		subjects: subjects.map((subject) => ({ ...subject }))
+	}), scope, "events", (record, path) => {
+		for (const field of [
+			"eventType",
+			"subjectType",
+			"subjectId",
+			"correlationId"
+		]) assertNonEmptyString(record[field], `${path}.${field}`);
+		if (typeof record.sequence !== "number") throw new EvidencePacketGenerationError("EVIDENCE_INVALID_RECORD", `${path}.sequence must be a number.`);
+		record.occurredAt = toIsoTimestamp(record.occurredAt, `${path}.occurredAt`);
+		record.recordedAt = toIsoTimestamp(record.recordedAt, `${path}.recordedAt`);
+		const invocationId = record.actionInvocationId;
+		if (invocationId !== void 0 && invocationId !== null) assertNonEmptyString(invocationId, `${path}.actionInvocationId`);
+	}).sort(byEventOrder);
+	const invocationIds = [...new Set(events.map((event) => event.actionInvocationId).filter((id) => typeof id === "string"))].sort(compareStrings);
+	const requested = new Set(invocationIds);
+	const read = async (method) => {
+		if (!method || invocationIds.length === 0) return [];
+		return method.call(port, { ...scope }, [...invocationIds]);
+	};
+	const [rawActionInvocations, rawPolicyEvaluations, rawAdapterInvocations] = await Promise.all([
+		read(port.listActionInvocations),
+		read(port.listPolicyEvaluations),
+		read(port.listAdapterInvocations)
+	]);
+	const actionInvocations = normalizeSection(rawActionInvocations, scope, "actionInvocations", (record, path) => {
+		if (!requested.has(record.id)) throw new EvidencePacketGenerationError("EVIDENCE_UNREQUESTED_RECORD", `${path}.id (${String(record.id)}) is not one of the requested action invocations.`);
+	}).sort(byId);
+	const policyEvaluations = normalizeSection(rawPolicyEvaluations, scope, "policyEvaluations", (record, path) => assertRequestedInvocation(record, path, requested)).sort(byId);
+	const adapterInvocations = normalizeSection(rawAdapterInvocations, scope, "adapterInvocations", (record, path) => assertRequestedInvocation(record, path, requested)).sort(byId);
+	const generatedAt = context.now ?? /* @__PURE__ */ new Date();
+	const id = options.idFactory ? options.idFactory() : require_ids_index.createFabricId(require_ids_index.FABRIC_ID_PREFIXES.complianceEvidencePacket);
+	assertNonEmptyString(id, "packet id");
+	const unredacted = {
+		schemaVersion: 1,
+		packetType,
+		tenantId: scope.tenantId,
+		spaceId: scope.spaceId,
+		primarySubject: { ...primary },
+		subjects: subjects.map((subject) => ({ ...subject })),
+		includeRelated,
+		...input.policyVersion !== void 0 ? { policyVersion: input.policyVersion } : {},
+		events,
+		actionInvocations,
+		policyEvaluations,
+		adapterInvocations
+	};
+	const anonymizationContext = {
+		tenantId: scope.tenantId,
+		spaceId: scope.spaceId,
+		jobId: options.anonymization?.jobId ?? id,
+		reason: options.anonymization?.reason ?? "evidence_packet_generation",
+		redactedAt: generatedAt,
+		...options.anonymization?.policyVersion !== void 0 ? { policyVersion: options.anonymization.policyVersion } : {}
+	};
+	const keySorted = JSON.parse(canonicalJson(unredacted));
+	const redacted = new require_engine.AnonymizationEngine(options.anonymizationPolicy).anonymizeJsonValue(keySorted, anonymizationContext, "evidence_packet");
+	const payload = {
+		...redacted.value,
+		redaction: redacted.metadata
+	};
+	for (const section of [
+		"events",
+		"actionInvocations",
+		"policyEvaluations",
+		"adapterInvocations"
+	]) if (!Array.isArray(payload[section])) throw new EvidencePacketGenerationError("EVIDENCE_IDENTIFIER_REDACTED", `The anonymization policy removed or replaced payload.${section}.`);
+	const envelopeSubjects = redactedSubjects(payload.subjects);
+	const references = buildReferences(payload, keySorted);
+	return {
+		id,
+		tenantId: scope.tenantId,
+		spaceId: scope.spaceId,
+		packetType,
+		status: "sealed",
+		subjects: envelopeSubjects,
+		references,
+		payload,
+		generatedAt: generatedAt.toISOString(),
+		generatedBy: context.actorId,
+		...input.policyVersion !== void 0 ? { policyVersion: input.policyVersion } : {},
+		checksum: computeEvidencePacketChecksum(payload),
+		checksumAlgorithm: EVIDENCE_PACKET_CHECKSUM_ALGORITHM,
+		correlationId: context.correlationId,
+		...context.causationId !== void 0 ? { causationId: context.causationId } : {}
+	};
+}
+/**
+* Recomputes an envelope's checksum. Returns `false`, never throws, when the checksum is missing,
+* the algorithm is missing or unknown, the payload cannot be serialized, or the values differ.
+* It covers `payload` only, which includes the subjects and the redaction metadata; the other
+* envelope fields are not covered.
+*/
+function verifyEvidencePacketChecksum(envelope) {
+	try {
+		if (!envelope || typeof envelope.checksum !== "string" || envelope.checksum.length === 0) return false;
+		if (envelope.checksumAlgorithm !== "fabric-canonical-json-sha256-v1") return false;
+		return computeEvidencePacketChecksum(envelope.payload) === envelope.checksum;
+	} catch {
+		return false;
+	}
+}
+/** Wraps `generateEvidencePacket` as an `EvidenceRenderer` for one packet type. */
+function createEvidencePacketRenderer(options) {
+	const { packetType = DEFAULT_EVIDENCE_PACKET_TYPE, ...generatorOptions } = options;
+	return {
+		packetType,
+		render: (input, context) => generateEvidencePacket({
+			...input,
+			packetType
+		}, context, generatorOptions)
+	};
+}
+//#endregion
+Object.defineProperty(exports, "DEFAULT_EVIDENCE_PACKET_TYPE", {
+	enumerable: true,
+	get: function() {
+		return DEFAULT_EVIDENCE_PACKET_TYPE;
+	}
+});
+Object.defineProperty(exports, "DEFAULT_EVIDENCE_REDACTION_REASON", {
+	enumerable: true,
+	get: function() {
+		return DEFAULT_EVIDENCE_REDACTION_REASON;
+	}
+});
+Object.defineProperty(exports, "EVIDENCE_PACKET_CHECKSUM_ALGORITHM", {
+	enumerable: true,
+	get: function() {
+		return EVIDENCE_PACKET_CHECKSUM_ALGORITHM;
+	}
+});
+Object.defineProperty(exports, "EVIDENCE_PACKET_SCHEMA_VERSION", {
+	enumerable: true,
+	get: function() {
+		return EVIDENCE_PACKET_SCHEMA_VERSION;
+	}
+});
+Object.defineProperty(exports, "EvidencePacketGenerationError", {
+	enumerable: true,
+	get: function() {
+		return EvidencePacketGenerationError;
+	}
+});
+Object.defineProperty(exports, "canonicalJson", {
+	enumerable: true,
+	get: function() {
+		return canonicalJson;
+	}
+});
+Object.defineProperty(exports, "computeEvidencePacketChecksum", {
+	enumerable: true,
+	get: function() {
+		return computeEvidencePacketChecksum;
+	}
+});
+Object.defineProperty(exports, "createEvidencePacketRenderer", {
+	enumerable: true,
+	get: function() {
+		return createEvidencePacketRenderer;
+	}
+});
+Object.defineProperty(exports, "generateEvidencePacket", {
+	enumerable: true,
+	get: function() {
+		return generateEvidencePacket;
+	}
+});
+Object.defineProperty(exports, "verifyEvidencePacketChecksum", {
+	enumerable: true,
+	get: function() {
+		return verifyEvidencePacketChecksum;
+	}
+});
+
+//# sourceMappingURL=evidence-Cq48eDvA.cjs.map