@grantex/sdk 0.6.0 → 0.7.0

package/dist/evidence/build.js

@@ -0,0 +1,201 @@
+/** Building evidence packages from case records (mirrors `grantex.evidence._build`). */
+import { CanonicalizationError, canonicalize } from './canonical.js';
+import { IDENTIFIER_CLASSES, PLATFORM_MARKER, actionReference, auditEntryHash, caseKey, chainRoot, entryHash, headerHash, keyedContentDigest, pseudonym, } from './hashing.js';
+import { EvidenceBuildError, VerificationFailure } from './result.js';
+import { FORMAT, checkDocument } from './verify.js';
+const ENTRY_INPUT_MEMBERS = new Set(['type', 'at', 'data', 'source', 'ext']);
+/** The canonical bytes of a package document. */
+export function serializePackage(document) {
+    return new TextEncoder().encode(canonicalize(document));
+}
+function privacyMember(privacy) {
+    const disclosed = [...new Set(privacy.disclosed ?? [])].sort();
+    const unknown = disclosed.filter((c) => !IDENTIFIER_CLASSES.includes(c));
+    if (unknown.length)
+        throw new EvidenceBuildError('privacy_violation', `unknown classes ${unknown.join(', ')}`);
+    if (disclosed.join('\n') === IDENTIFIER_CLASSES.join('\n'))
+        return { disclosed, scheme: 'none' };
+    if (!privacy.key || privacy.key.length < 32 || !privacy.keyId) {
+        throw new EvidenceBuildError('privacy_violation', 'keying undisclosed classes requires a key of at least 32 bytes and a keyId');
+    }
+    return { disclosed, key_id: privacy.keyId, scheme: 'hmac-sha256-v1' };
+}
+const isObject = (value) => value !== null && typeof value === 'object' && !Array.isArray(value);
+const list = (value) => (Array.isArray(value) ? value : []);
+class Protector {
+    disclosed;
+    key = null;
+    constructor(privacy, disclosed, kase) {
+        this.disclosed = new Set(disclosed);
+        if (privacy.key && this.disclosed.size !== IDENTIFIER_CLASSES.length) {
+            if (typeof kase['tenant_id'] !== 'string' || typeof kase['case_id'] !== 'string') {
+                throw new EvidenceBuildError('schema_violation', 'case_id and tenant_id must be strings', 'case');
+            }
+            this.key = caseKey(privacy.key, kase['tenant_id'], kase['case_id']);
+        }
+    }
+    identifier(cls, holder, name) {
+        if (this.disclosed.has(cls) || !isObject(holder) || typeof holder[name] !== 'string')
+            return;
+        holder[name] = pseudonym(this.key, cls, holder[name]);
+    }
+    content(holder, name) {
+        if (this.disclosed.has('content') || typeof holder[name] !== 'string')
+            return;
+        holder[name] = keyedContentDigest(this.key, holder[name]);
+    }
+    action(data) {
+        if (this.disclosed.has('subject') || typeof data['action_hash'] !== 'string')
+            return;
+        const actionHash = data['action_hash'];
+        delete data['action_hash'];
+        data['action_ref'] = actionReference(this.key, actionHash);
+    }
+    refs(refs) {
+        for (const ref of list(refs)) {
+            this.identifier('record', ref, 'record_id');
+            this.identifier('record', ref, 'excerpt_ref');
+        }
+    }
+    entry(entry) {
+        const data = entry['data'];
+        if (!isObject(data))
+            return;
+        switch (entry['type']) {
+            case 'grant':
+                this.identifier('principal', data, 'principal');
+                break;
+            case 'tool_call':
+                this.content(data, 'input_hash');
+                this.content(data, 'output_hash');
+                for (const record of list(data['upstream_records']))
+                    this.identifier('record', record, 'record_id');
+                break;
+            case 'policy_evaluation':
+                for (const item of list(data['inputs']))
+                    if (isObject(item))
+                        this.refs(item['evidence']);
+                break;
+            case 'recommendation':
+                for (const section of list(data['sections']))
+                    if (isObject(section))
+                        this.refs(section['evidence']);
+                break;
+            case 'disposition':
+                for (const comparison of list(data['comparisons']))
+                    if (isObject(comparison))
+                        this.refs(comparison['evidence']);
+                this.refs([data['hit']]);
+                break;
+            case 'decision':
+                this.identifier('subject', data['action'], 'subject');
+                this.identifier('approver', data, 'approver');
+                this.action(data);
+                break;
+            case 'decision_consumption':
+                this.action(data);
+                break;
+            default:
+                break;
+        }
+    }
+}
+/**
+ * Build a package from a case header and entry records. Values are given in the
+ * clear (decisions carry the token's `action_hash`) and keyed here according to
+ * `privacy`. The result is checked with the verification rules, so an invalid
+ * package is refused with `EvidenceBuildError`.
+ */
+export function buildPackage(input) {
+    const privacy = privacyMember(input.privacy);
+    const kase = structuredClone(input.case);
+    const protect = new Protector(input.privacy, privacy['disclosed'], kase);
+    protect.identifier('subject', kase, 'subject');
+    const document = { case: kase, format: FORMAT, privacy, version: '1.0' };
+    let previous;
+    try {
+        previous = headerHash(document);
+    }
+    catch (err) {
+        if (err instanceof CanonicalizationError)
+            throw new EvidenceBuildError('schema_violation', err.message, 'case');
+        throw err;
+    }
+    const genesis = previous;
+    const entries = input.entries.map((record, index) => {
+        const unknown = Object.keys(record).filter((name) => !ENTRY_INPUT_MEMBERS.has(name)).sort();
+        if (unknown.length)
+            throw new EvidenceBuildError('schema_violation', `unknown record members ${unknown.join(', ')}`, `entries[${index}]`);
+        const entry = structuredClone(record);
+        protect.entry(entry);
+        entry['seq'] = index;
+        entry['prev'] = previous;
+        try {
+            entry['hash'] = entryHash(entry);
+        }
+        catch (err) {
+            if (err instanceof CanonicalizationError)
+                throw new EvidenceBuildError('schema_violation', err.message, `entries[${index}]`);
+            throw err;
+        }
+        previous = entry['hash'];
+        return entry;
+    });
+    const chain = { alg: 'sha256', canonicalization: 'RFC8785', genesis, head: previous, length: entries.length };
+    chain['root'] = chainRoot(chain);
+    document['entries'] = entries;
+    document['chain'] = chain;
+    try {
+        checkDocument(document);
+    }
+    catch (err) {
+        if (err instanceof VerificationFailure)
+            throw new EvidenceBuildError(err.code, err.message, err.fieldPath);
+        throw err;
+    }
+    return { document, data: serializePackage(document), root: chain['root'] };
+}
+/**
+ * The platform audit entry that records a package's root. Its agent, DID and
+ * grant are empty, its principal is `platform` and its metadata carries the
+ * platform marker, none of which a tenant can write through `/v1/audit/log`.
+ */
+export function anchorAuditEntry(document, options) {
+    const chain = document['chain'];
+    const kase = document['case'];
+    const audit = {
+        action: 'evidence.package_exported',
+        agentDid: '',
+        agentId: '',
+        developerId: kase['tenant_id'],
+        grantId: '',
+        id: options.auditEntryId,
+        metadata: {
+            case_id: kase['case_id'],
+            entry_count: chain['length'],
+            format: document['format'],
+            [PLATFORM_MARKER]: true,
+            package_root: chain['root'],
+            version: document['version'],
+        },
+        prevHash: options.prevHash,
+        principalId: 'platform',
+        status: 'success',
+        timestamp: options.timestamp,
+    };
+    audit['hash'] = auditEntryHash(audit);
+    return audit;
+}
+/** A copy of `document` with `anchor` set; the root is unchanged. */
+export function attachAnchor(document, auditEntry) {
+    const out = structuredClone(document);
+    out['anchor'] = { audit_entry: structuredClone(auditEntry), type: 'grantex-audit-entry' };
+    return out;
+}
+/** A copy of `document` with `signature` set; the root is unchanged. */
+export function attachSignature(document, signature) {
+    const out = structuredClone(document);
+    out['signature'] = { ...signature };
+    return out;
+}
+//# sourceMappingURL=build.js.map

package/dist/evidence/build.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"build.js","sourceRoot":"","sources":["../../src/evidence/build.ts"],"names":[],"mappings":"AAAA,wFAAwF;AACxF,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,EACL,kBAAkB,EAAE,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAC/G,kBAAkB,EAAE,SAAS,GAC9B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACtE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAIpD,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;AA4B7E,iDAAiD;AACjD,MAAM,UAAU,gBAAgB,CAAC,QAAc;IAC7C,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,aAAa,CAAC,OAAwB;IAC7C,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/D,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAE,kBAAwC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAChG,IAAI,OAAO,CAAC,MAAM;QAAE,MAAM,IAAI,kBAAkB,CAAC,mBAAmB,EAAE,mBAAmB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC/G,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACjG,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QAC9D,MAAM,IAAI,kBAAkB,CAAC,mBAAmB,EAAE,4EAA4E,CAAC,CAAC;IAClI,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;AACxE,CAAC;AAED,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAiB,EAAE,CAAC,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AACzH,MAAM,IAAI,GAAG,CAAC,KAAc,EAAa,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAEhF,MAAM,SAAS;IACI,SAAS,CAAc;IACvB,GAAG,GAAkB,IAAI,CAAC;IAE3C,YAAY,OAAwB,EAAE,SAAmB,EAAE,IAAU;QACnE,IAAI,CAAC,SAAS,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;QACpC,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,KAAK,kBAAkB,CAAC,MAAM,EAAE,CAAC;YACrE,IAAI,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,QAAQ,EAAE,CAAC;gBACjF,MAAM,IAAI,kBAAkB,CAAC,kBAAkB,EAAE,uCAAuC,EAAE,MAAM,CAAC,CAAC;YACpG,CAAC;YACD,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAED,UAAU,CAAC,GAAmB,EAAE,MAAe,EAAE,IAAY;QAC3D,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,QAAQ;YAAE,OAAO;QAC7F,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,GAAI,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACzD,CAAC;IAED,OAAO,CAAC,MAAY,EAAE,IAAY;QAChC,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,QAAQ;YAAE,OAAO;QAC9E,MAAM,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,IAAI,CAAC,GAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,CAAC,IAAU;QACf,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,QAAQ;YAAE,OAAO;QACrF,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAW,CAAC;QACjD,OAAO,IAAI,CAAC,aAAa,CAAC,CAAC;QAC3B,IAAI,CAAC,YAAY,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,GAAI,EAAE,UAAU,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,CAAC,IAAa;QAChB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;YAC5C,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAW;QACf,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO;QAC5B,QAAQ,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YACtB,KAAK,OAAO;gBACV,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;gBAChD,MAAM;YACR,KAAK,WAAW;gBACd,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;gBACjC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;gBAClC,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;oBAAE,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;gBACpG,MAAM;YACR,KAAK,mBAAmB;gBACtB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;oBAAE,IAAI,QAAQ,CAAC,IAAI,CAAC;wBAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;gBACzF,MAAM;YACR,KAAK,gBAAgB;gBACnB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;oBAAE,IAAI,QAAQ,CAAC,OAAO,CAAC;wBAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;gBACpG,MAAM;YACR,KAAK,aAAa;gBAChB,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;oBAAE,IAAI,QAAQ,CAAC,UAAU,CAAC;wBAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;gBAChH,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACzB,MAAM;YACR,KAAK,UAAU;gBACb,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,SAAS,CAAC,CAAC;gBACtD,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;gBAC9C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBAClB,MAAM;YACR,KAAK,sBAAsB;gBACzB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBAClB,MAAM;YACR;gBACE,MAAM;QACV,CAAC;IACH,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,KAAqG;IAChI,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,IAAI,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,WAAW,CAAa,EAAE,IAAI,CAAC,CAAC;IACrF,OAAO,CAAC,UAAU,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAS,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC/E,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,qBAAqB;YAAE,MAAM,IAAI,kBAAkB,CAAC,kBAAkB,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAChH,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC;IAEzB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;QAClD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5F,IAAI,OAAO,CAAC,MAAM;YAAE,MAAM,IAAI,kBAAkB,CAAC,kBAAkB,EAAE,0BAA0B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,KAAK,GAAG,CAAC,CAAC;QAC1I,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,CAAS,CAAC;QAC9C,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACrB,KAAK,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC;QACrB,KAAK,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC;YACH,KAAK,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,qBAAqB;gBAAE,MAAM,IAAI,kBAAkB,CAAC,kBAAkB,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW,KAAK,GAAG,CAAC,CAAC;YAC7H,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAW,CAAC;QACnC,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,MAAM,KAAK,GAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,gBAAgB,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IACpH,KAAK,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IACjC,QAAQ,CAAC,SAAS,CAAC,GAAG,OAAO,CAAC;IAC9B,QAAQ,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,mBAAmB;YAAE,MAAM,IAAI,kBAAkB,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QAC3G,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,gBAAgB,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAW,EAAE,CAAC;AACvF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAc,EAAE,OAA6E;IAC5H,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAS,CAAC;IACxC,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAS,CAAC;IACtC,MAAM,KAAK,GAAS;QAClB,MAAM,EAAE,2BAA2B;QACnC,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,EAAE;QACX,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC;QAC9B,OAAO,EAAE,EAAE;QACX,EAAE,EAAE,OAAO,CAAC,YAAY;QACxB,QAAQ,EAAE;YACR,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC;YACxB,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC;YAC5B,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC;YAC1B,CAAC,eAAe,CAAC,EAAE,IAAI;YACvB,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC;YAC3B,OAAO,EAAE,QAAQ,CAAC,SAAS,CAAC;SAC7B;QACD,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,WAAW,EAAE,UAAU;QACvB,MAAM,EAAE,SAAS;QACjB,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC;IACF,KAAK,CAAC,MAAM,CAAC,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACtC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,YAAY,CAAC,QAAc,EAAE,UAAgB;IAC3D,MAAM,GAAG,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACtC,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,WAAW,EAAE,eAAe,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC;IAC1F,OAAO,GAAG,CAAC;AACb,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,eAAe,CAAC,QAAc,EAAE,SAA2D;IACzG,MAAM,GAAG,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACtC,GAAG,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC;IACpC,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/evidence/canonical.d.ts

@@ -0,0 +1,3 @@
+/** RFC 8785 canonicalisation for evidence packages: the shared `canonical.ts`. */
+export { CanonicalizationError, canonicalize } from '../canonical.js';
+//# sourceMappingURL=canonical.d.ts.map

package/dist/evidence/canonical.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical.d.ts","sourceRoot":"","sources":["../../src/evidence/canonical.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/evidence/canonical.js

@@ -0,0 +1,3 @@
+/** RFC 8785 canonicalisation for evidence packages: the shared `canonical.ts`. */
+export { CanonicalizationError, canonicalize } from '../canonical.js';
+//# sourceMappingURL=canonical.js.map

package/dist/evidence/canonical.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical.js","sourceRoot":"","sources":["../../src/evidence/canonical.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/evidence/checks.d.ts

@@ -0,0 +1,13 @@
+type Json = Record<string, any>;
+/** Tolerated difference between producer clocks and the recording service (5 minutes). */
+export declare const MAX_CLOCK_SKEW_MS = 300000;
+export declare function checkPrivacy(pkg: Json): void;
+export declare function checkChain(pkg: Json): void;
+export interface SemanticSummary {
+    unsourcedInputs: number;
+    lateEntries: number;
+    tenantAssertedEntries: number;
+}
+export declare function checkSemantics(pkg: Json): SemanticSummary;
+export {};
+//# sourceMappingURL=checks.d.ts.map

package/dist/evidence/checks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"checks.d.ts","sourceRoot":"","sources":["../../src/evidence/checks.ts"],"names":[],"mappings":"AASA,KAAK,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAEhC,0FAA0F;AAC1F,eAAO,MAAM,iBAAiB,SAAU,CAAC;AAgCzC,wBAAgB,YAAY,CAAC,GAAG,EAAE,IAAI,GAAG,IAAI,CA2D5C;AAID,wBAAgB,UAAU,CAAC,GAAG,EAAE,IAAI,GAAG,IAAI,CAiB1C;AAID,MAAM,WAAW,eAAe;IAC9B,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,qBAAqB,EAAE,MAAM,CAAC;CAC/B;AAiBD,wBAAgB,cAAc,CAAC,GAAG,EAAE,IAAI,GAAG,eAAe,CAyFzD"}