@payoutjp/core 0.1.0-alpha.1

package/dist/finding.js

@@ -0,0 +1,63 @@
+import { z } from "zod";
+import { ProfileIdSchema, RuleIdSchema } from "./identifier-schema.js";
+import { severityValues } from "./status.js";
+function isNormalizedRelativePath(value) {
+    if (value.length === 0 || value.startsWith("/") || value.includes("\\")) {
+        return false;
+    }
+    if (/^[A-Za-z]:\//u.test(value)) {
+        return false;
+    }
+    return value.split("/").every((segment) => segment !== "" && segment !== "." && segment !== "..");
+}
+const NormalizedRelativePathSchema = z
+    .string()
+    .refine(isNormalizedRelativePath, "Expected a normalized relative path");
+const JsonPointerSchema = z
+    .string()
+    .refine((value) => value === "" || value.startsWith("/"), "Expected a JSON Pointer");
+/** Runtime schema for a safe source or item location attached to a finding. */
+export const FindingLocationV1Schema = z.strictObject({
+    file: NormalizedRelativePathSchema.optional(),
+    line: z.number().int().positive().optional(),
+    column: z.number().int().positive().optional(),
+    itemIndex: z.number().int().nonnegative().optional(),
+    jsonPointer: JsonPointerSchema.optional(),
+});
+/** Allowed disclosure classifications for already-safe observed values. */
+export const safeObservedValueClassificationValues = Object.freeze([
+    "public",
+    "masked-bank-account",
+    "redacted-account-holder",
+    "short-wallet-address",
+    "metadata-only",
+]);
+/**
+ * Runtime schema for an observed value that has already passed the applicable redaction policy.
+ * Shape validation does not itself redact or prove that `display` is safe.
+ */
+export const SafeObservedValueV1Schema = z.strictObject({
+    classification: z.enum(safeObservedValueClassificationValues),
+    display: z.string(),
+});
+/** Runtime schema for deterministic remediation guidance. */
+export const RemediationV1Schema = z.strictObject({
+    code: z.string(),
+    message: z.string(),
+});
+/** Runtime schema for the version 1 validation finding contract. */
+export const FindingV1Schema = z.strictObject({
+    schemaVersion: z.literal("1"),
+    ruleId: RuleIdSchema,
+    severity: z.enum(severityValues),
+    messageKey: z.string(),
+    message: z.string(),
+    path: z.string(),
+    location: FindingLocationV1Schema.optional(),
+    actual: SafeObservedValueV1Schema.optional(),
+    expected: z.string().optional(),
+    remediation: RemediationV1Schema.optional(),
+    profileId: ProfileIdSchema,
+    profileVersion: z.string(),
+});
+//# sourceMappingURL=finding.js.map

package/dist/finding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"finding.js","sourceRoot":"","sources":["../src/finding.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C,SAAS,wBAAwB,CAAC,KAAa;IAC7C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACxE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,CAAC,CAAC;AACpG,CAAC;AAED,MAAM,4BAA4B,GAAG,CAAC;KACnC,MAAM,EAAE;KACR,MAAM,CAAC,wBAAwB,EAAE,qCAAqC,CAAC,CAAC;AAC3E,MAAM,iBAAiB,GAAG,CAAC;KACxB,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,yBAAyB,CAAC,CAAC;AAEvF,+EAA+E;AAC/E,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,YAAY,CAAC;IACpD,IAAI,EAAE,4BAA4B,CAAC,QAAQ,EAAE;IAC7C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC5C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC9C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IACpD,WAAW,EAAE,iBAAiB,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC;AAKH,2EAA2E;AAC3E,MAAM,CAAC,MAAM,qCAAqC,GAAG,MAAM,CAAC,MAAM,CAAC;IACjE,QAAQ;IACR,qBAAqB;IACrB,yBAAyB;IACzB,sBAAsB;IACtB,eAAe;CACP,CAAC,CAAC;AAEZ;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,YAAY,CAAC;IACtD,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC;IAC7D,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;CACpB,CAAC,CAAC;AAKH,6DAA6D;AAC7D,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,YAAY,CAAC;IAChD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;CACpB,CAAC,CAAC;AAKH,oEAAoE;AACpE,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5C,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IAC7B,MAAM,EAAE,YAAY;IACpB,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;IAChC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,QAAQ,EAAE,uBAAuB,CAAC,QAAQ,EAAE;IAC5C,MAAM,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAC5C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,WAAW,EAAE,mBAAmB,CAAC,QAAQ,EAAE;IAC3C,SAAS,EAAE,eAAe;IAC1B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;CAC3B,CAAC,CAAC"}

package/dist/identifier-schema.d.ts

@@ -0,0 +1,7 @@
+import { z } from "zod";
+import { type ItemId, type ProfileId, type RegistryId, type RuleId } from "./identifiers.js";
+export declare const RuleIdSchema: z.ZodPipe<z.ZodString, z.ZodTransform<RuleId, string>>;
+export declare const ProfileIdSchema: z.ZodPipe<z.ZodString, z.ZodTransform<ProfileId, string>>;
+export declare const RegistryIdSchema: z.ZodPipe<z.ZodString, z.ZodTransform<RegistryId, string>>;
+export declare const ItemIdSchema: z.ZodPipe<z.ZodString, z.ZodTransform<ItemId, string>>;
+//# sourceMappingURL=identifier-schema.d.ts.map

package/dist/identifier-schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identifier-schema.d.ts","sourceRoot":"","sources":["../src/identifier-schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAKL,KAAK,MAAM,EACX,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,MAAM,EACZ,MAAM,kBAAkB,CAAC;AAgB1B,eAAO,MAAM,YAAY,wDAEwE,CAAC;AAElG,eAAO,MAAM,eAAe,2DAIzB,CAAC;AAEJ,eAAO,MAAM,gBAAgB,4DAI1B,CAAC;AAEJ,eAAO,MAAM,YAAY,wDAEwE,CAAC"}

package/dist/identifier-schema.js

@@ -0,0 +1,24 @@
+import { z } from "zod";
+import { createItemId, createProfileId, createRegistryId, createRuleId, } from "./identifiers.js";
+function parseIdentifier(value, context, create, kind) {
+    try {
+        return create(value);
+    }
+    catch {
+        context.addIssue({ code: "custom", message: `Invalid ${kind}` });
+        return z.NEVER;
+    }
+}
+export const RuleIdSchema = z
+    .string()
+    .transform((value, context) => parseIdentifier(value, context, createRuleId, "RuleId"));
+export const ProfileIdSchema = z
+    .string()
+    .transform((value, context) => parseIdentifier(value, context, createProfileId, "ProfileId"));
+export const RegistryIdSchema = z
+    .string()
+    .transform((value, context) => parseIdentifier(value, context, createRegistryId, "RegistryId"));
+export const ItemIdSchema = z
+    .string()
+    .transform((value, context) => parseIdentifier(value, context, createItemId, "ItemId"));
+//# sourceMappingURL=identifier-schema.js.map

package/dist/identifier-schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identifier-schema.js","sourceRoot":"","sources":["../src/identifier-schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,YAAY,GAKb,MAAM,kBAAkB,CAAC;AAE1B,SAAS,eAAe,CACtB,KAAa,EACb,OAAwB,EACxB,MAAqC,EACrC,IAAY;IAEZ,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,IAAI,EAAE,EAAE,CAAC,CAAC;QACjE,OAAO,CAAC,CAAC,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,EAAE;KACR,SAAS,CAAC,CAAC,KAAK,EAAE,OAAO,EAAU,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC;AAElG,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC;KAC7B,MAAM,EAAE;KACR,SAAS,CACR,CAAC,KAAK,EAAE,OAAO,EAAa,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,eAAe,EAAE,WAAW,CAAC,CAC7F,CAAC;AAEJ,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,EAAE;KACR,SAAS,CACR,CAAC,KAAK,EAAE,OAAO,EAAc,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,gBAAgB,EAAE,YAAY,CAAC,CAChG,CAAC;AAEJ,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,EAAE;KACR,SAAS,CAAC,CAAC,KAAK,EAAE,OAAO,EAAU,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC"}

package/dist/identifiers.d.ts

@@ -0,0 +1,38 @@
+declare const identifierBrand: unique symbol;
+type BrandedIdentifier<Name extends string> = string & {
+    readonly [identifierBrand]: Name;
+};
+/** Stable identifier for a validation rule. */
+export type RuleId = BrandedIdentifier<"RuleId">;
+/** Identifier for a compatibility profile, excluding its version. */
+export type ProfileId = BrandedIdentifier<"ProfileId">;
+/** Identifier for a versioned registry, excluding its version. */
+export type RegistryId = BrandedIdentifier<"RegistryId">;
+/** Caller-supplied or deterministically generated validation item identifier. */
+export type ItemId = BrandedIdentifier<"ItemId">;
+/**
+ * Creates a stable uppercase, hyphen-separated rule identifier.
+ *
+ * @throws {TypeError} When the value is empty, malformed, or contains unsafe whitespace/control characters.
+ */
+export declare function createRuleId(value: string): RuleId;
+/**
+ * Creates a compatibility profile identifier without imposing provider-specific naming rules.
+ *
+ * @throws {TypeError} When the value is empty or contains surrounding whitespace/control characters.
+ */
+export declare function createProfileId(value: string): ProfileId;
+/**
+ * Creates a registry identifier without imposing source-specific naming rules.
+ *
+ * @throws {TypeError} When the value is empty or contains surrounding whitespace/control characters.
+ */
+export declare function createRegistryId(value: string): RegistryId;
+/**
+ * Creates an item identifier while preserving the caller's non-sensitive stable value.
+ *
+ * @throws {TypeError} When the value is empty or contains surrounding whitespace/control characters.
+ */
+export declare function createItemId(value: string): ItemId;
+export {};
+//# sourceMappingURL=identifiers.d.ts.map

package/dist/identifiers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identifiers.d.ts","sourceRoot":"","sources":["../src/identifiers.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,eAAe,EAAE,OAAO,MAAM,CAAC;AAE7C,KAAK,iBAAiB,CAAC,IAAI,SAAS,MAAM,IAAI,MAAM,GAAG;IACrD,QAAQ,CAAC,CAAC,eAAe,CAAC,EAAE,IAAI,CAAC;CAClC,CAAC;AAEF,+CAA+C;AAC/C,MAAM,MAAM,MAAM,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;AAEjD,qEAAqE;AACrE,MAAM,MAAM,SAAS,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;AAEvD,kEAAkE;AAClE,MAAM,MAAM,UAAU,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;AAEzD,iFAAiF;AACjF,MAAM,MAAM,MAAM,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;AA8BjD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAQlD;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAExD;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAE1D;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAElD"}

package/dist/identifiers.js

@@ -0,0 +1,53 @@
+const ruleIdPattern = /^[A-Z][A-Z0-9]*(?:-[A-Z0-9]+)+$/u;
+function containsControlCharacter(value) {
+    for (const character of value) {
+        const codePoint = character.codePointAt(0);
+        if (codePoint !== undefined && (codePoint <= 0x1f || codePoint === 0x7f)) {
+            return true;
+        }
+    }
+    return false;
+}
+function createIdentifier(value, kind) {
+    if (value.length === 0 || value !== value.trim() || containsControlCharacter(value)) {
+        throw new TypeError(`${kind} must be a non-empty string without surrounding whitespace or control characters`);
+    }
+    return value;
+}
+/**
+ * Creates a stable uppercase, hyphen-separated rule identifier.
+ *
+ * @throws {TypeError} When the value is empty, malformed, or contains unsafe whitespace/control characters.
+ */
+export function createRuleId(value) {
+    const id = createIdentifier(value, "RuleId");
+    if (!ruleIdPattern.test(id)) {
+        throw new TypeError("RuleId must be an uppercase hyphen-separated identifier");
+    }
+    return id;
+}
+/**
+ * Creates a compatibility profile identifier without imposing provider-specific naming rules.
+ *
+ * @throws {TypeError} When the value is empty or contains surrounding whitespace/control characters.
+ */
+export function createProfileId(value) {
+    return createIdentifier(value, "ProfileId");
+}
+/**
+ * Creates a registry identifier without imposing source-specific naming rules.
+ *
+ * @throws {TypeError} When the value is empty or contains surrounding whitespace/control characters.
+ */
+export function createRegistryId(value) {
+    return createIdentifier(value, "RegistryId");
+}
+/**
+ * Creates an item identifier while preserving the caller's non-sensitive stable value.
+ *
+ * @throws {TypeError} When the value is empty or contains surrounding whitespace/control characters.
+ */
+export function createItemId(value) {
+    return createIdentifier(value, "ItemId");
+}
+//# sourceMappingURL=identifiers.js.map

package/dist/identifiers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identifiers.js","sourceRoot":"","sources":["../src/identifiers.ts"],"names":[],"mappings":"AAoBA,MAAM,aAAa,GAAG,kCAAkC,CAAC;AAEzD,SAAS,wBAAwB,CAAC,KAAa;IAC7C,KAAK,MAAM,SAAS,IAAI,KAAK,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QAC3C,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,SAAS,IAAI,IAAI,IAAI,SAAS,KAAK,IAAI,CAAC,EAAE,CAAC;YACzE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,gBAAgB,CACvB,KAAa,EACb,IAAU;IAEV,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,KAAK,KAAK,CAAC,IAAI,EAAE,IAAI,wBAAwB,CAAC,KAAK,CAAC,EAAE,CAAC;QACpF,MAAM,IAAI,SAAS,CACjB,GAAG,IAAI,kFAAkF,CAC1F,CAAC;IACJ,CAAC;IAED,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,MAAM,EAAE,GAAG,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAE7C,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,SAAS,CAAC,yDAAyD,CAAC,CAAC;IACjF,CAAC;IAED,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,OAAO,gBAAgB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;AAC9C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,OAAO,gBAAgB,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;AAC/C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,OAAO,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;AAC3C,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,14 @@
+/** Placeholder package version for the repository bootstrap. */
+export declare const version = "0.0.0";
+export { aggregateItemStatus, aggregateReportStatus, summarizeValidationItems, } from "./aggregation.js";
+export { compareFindings, executeRules, sortFindings } from "./engine.js";
+export { isPayoutJpError, PayoutJpConfigurationError, type PayoutJpConfigurationErrorCode, PayoutJpError, type PayoutJpErrorCode, payoutJpErrorCodeValues, type PayoutJpErrorExitCode, PayoutJpInputError, PayoutJpIntegrityError, type PayoutJpIntegrityErrorCode, PayoutJpInternalError, } from "./errors.js";
+export { type FindingLocationV1, FindingLocationV1Schema, type FindingV1, FindingV1Schema, type RemediationV1, RemediationV1Schema, type SafeObservedValueV1, SafeObservedValueV1Schema, safeObservedValueClassificationValues, } from "./finding.js";
+export { createItemId, createProfileId, createRegistryId, createRuleId, type ItemId, type ProfileId, type RegistryId, type RuleId, } from "./identifiers.js";
+export { type CompatibilityProfileV1, CompatibilityProfileV1Schema, type LoadCompatibilityProfileV1Options, loadCompatibilityProfileV1, type ProfileRuleParameterParser, type RuleConfigurationV1, RuleConfigurationV1Schema, } from "./profile.js";
+export { type CreateValidationReportV1Input, createValidationReportV1, type ProfileReferenceV1, ProfileReferenceV1Schema, type Rail, railValues, type RegistryReferenceV1, RegistryReferenceV1Schema, type ToolReferenceV1, ToolReferenceV1Schema, type ValidationItemInputV1, type ValidationItemReportV1, ValidationItemReportV1Schema, type ValidationReportV1, ValidationReportV1Schema, type ValidationSummaryV1, ValidationSummaryV1Schema, sortProfileReferences, sortRegistryReferences, } from "./report.js";
+export { createMetadataObservedValue, createPublicObservedValue, maskBankAccountNumber, redactAccountHolder, shortenTokenContract, shortenWalletAddress, } from "./redaction.js";
+export { calculateRegistryEnvelopeSha256, canonicalizeJson, createRegistryEnvelopeV1Schema, type RegistryEnvelopeV1, RegistryEnvelopeV1Schema, type SourceMetadataV1, SourceMetadataV1Schema, loadRegistryEnvelopeV1, } from "./registry.js";
+export type { Rule, RuleContextV1 } from "./rule.js";
+export { isItemStatus, isProfileStatus, isSeverity, type ItemStatus, itemStatusValues, type ProfileStatus, profileStatusValues, type Severity, severityValues, } from "./status.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,eAAO,MAAM,OAAO,UAAU,CAAC;AAE/B,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE1E,OAAO,EACL,eAAe,EACf,0BAA0B,EAC1B,KAAK,8BAA8B,EACnC,aAAa,EACb,KAAK,iBAAiB,EACtB,uBAAuB,EACvB,KAAK,qBAAqB,EAC1B,kBAAkB,EAClB,sBAAsB,EACtB,KAAK,0BAA0B,EAC/B,qBAAqB,GACtB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,KAAK,iBAAiB,EACtB,uBAAuB,EACvB,KAAK,SAAS,EACd,eAAe,EACf,KAAK,aAAa,EAClB,mBAAmB,EACnB,KAAK,mBAAmB,EACxB,yBAAyB,EACzB,qCAAqC,GACtC,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,KAAK,MAAM,EACX,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,MAAM,GACZ,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,KAAK,sBAAsB,EAC3B,4BAA4B,EAC5B,KAAK,iCAAiC,EACtC,0BAA0B,EAC1B,KAAK,0BAA0B,EAC/B,KAAK,mBAAmB,EACxB,yBAAyB,GAC1B,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,KAAK,6BAA6B,EAClC,wBAAwB,EACxB,KAAK,kBAAkB,EACvB,wBAAwB,EACxB,KAAK,IAAI,EACT,UAAU,EACV,KAAK,mBAAmB,EACxB,yBAAyB,EACzB,KAAK,eAAe,EACpB,qBAAqB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,4BAA4B,EAC5B,KAAK,kBAAkB,EACvB,wBAAwB,EACxB,KAAK,mBAAmB,EACxB,yBAAyB,EACzB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,+BAA+B,EAC/B,gBAAgB,EAChB,8BAA8B,EAC9B,KAAK,kBAAkB,EACvB,wBAAwB,EACxB,KAAK,gBAAgB,EACrB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,eAAe,CAAC;AAEvB,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAErD,OAAO,EACL,YAAY,EACZ,eAAe,EACf,UAAU,EACV,KAAK,UAAU,EACf,gBAAgB,EAChB,KAAK,aAAa,EAClB,mBAAmB,EACnB,KAAK,QAAQ,EACb,cAAc,GACf,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -0,0 +1,13 @@
+/** Placeholder package version for the repository bootstrap. */
+export const version = "0.0.0";
+export { aggregateItemStatus, aggregateReportStatus, summarizeValidationItems, } from "./aggregation.js";
+export { compareFindings, executeRules, sortFindings } from "./engine.js";
+export { isPayoutJpError, PayoutJpConfigurationError, PayoutJpError, payoutJpErrorCodeValues, PayoutJpInputError, PayoutJpIntegrityError, PayoutJpInternalError, } from "./errors.js";
+export { FindingLocationV1Schema, FindingV1Schema, RemediationV1Schema, SafeObservedValueV1Schema, safeObservedValueClassificationValues, } from "./finding.js";
+export { createItemId, createProfileId, createRegistryId, createRuleId, } from "./identifiers.js";
+export { CompatibilityProfileV1Schema, loadCompatibilityProfileV1, RuleConfigurationV1Schema, } from "./profile.js";
+export { createValidationReportV1, ProfileReferenceV1Schema, railValues, RegistryReferenceV1Schema, ToolReferenceV1Schema, ValidationItemReportV1Schema, ValidationReportV1Schema, ValidationSummaryV1Schema, sortProfileReferences, sortRegistryReferences, } from "./report.js";
+export { createMetadataObservedValue, createPublicObservedValue, maskBankAccountNumber, redactAccountHolder, shortenTokenContract, shortenWalletAddress, } from "./redaction.js";
+export { calculateRegistryEnvelopeSha256, canonicalizeJson, createRegistryEnvelopeV1Schema, RegistryEnvelopeV1Schema, SourceMetadataV1Schema, loadRegistryEnvelopeV1, } from "./registry.js";
+export { isItemStatus, isProfileStatus, isSeverity, itemStatusValues, profileStatusValues, severityValues, } from "./status.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC;AAE/B,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE1E,OAAO,EACL,eAAe,EACf,0BAA0B,EAE1B,aAAa,EAEb,uBAAuB,EAEvB,kBAAkB,EAClB,sBAAsB,EAEtB,qBAAqB,GACtB,MAAM,aAAa,CAAC;AAErB,OAAO,EAEL,uBAAuB,EAEvB,eAAe,EAEf,mBAAmB,EAEnB,yBAAyB,EACzB,qCAAqC,GACtC,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,YAAY,GAKb,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAEL,4BAA4B,EAE5B,0BAA0B,EAG1B,yBAAyB,GAC1B,MAAM,cAAc,CAAC;AAEtB,OAAO,EAEL,wBAAwB,EAExB,wBAAwB,EAExB,UAAU,EAEV,yBAAyB,EAEzB,qBAAqB,EAGrB,4BAA4B,EAE5B,wBAAwB,EAExB,yBAAyB,EACzB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,+BAA+B,EAC/B,gBAAgB,EAChB,8BAA8B,EAE9B,wBAAwB,EAExB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,eAAe,CAAC;AAIvB,OAAO,EACL,YAAY,EACZ,eAAe,EACf,UAAU,EAEV,gBAAgB,EAEhB,mBAAmB,EAEnB,cAAc,GACf,MAAM,aAAa,CAAC"}

package/dist/profile.d.ts

@@ -0,0 +1,69 @@
+import { z } from "zod";
+/** Runtime schema for one rule entry in a compatibility profile. */
+export declare const RuleConfigurationV1Schema: z.ZodObject<{
+    id: z.ZodPipe<z.ZodString, z.ZodTransform<import("./identifiers.js").RuleId, string>>;
+    enabled: z.ZodBoolean;
+    severity: z.ZodOptional<z.ZodEnum<{
+        error: "error";
+        info: "info";
+        warning: "warning";
+    }>>;
+    params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, z.core.$strict>;
+/** One rule entry in a compatibility profile. */
+export type RuleConfigurationV1 = z.infer<typeof RuleConfigurationV1Schema>;
+/** Runtime schema for an immutable version 1 compatibility profile artifact. */
+export declare const CompatibilityProfileV1Schema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<"1">;
+    id: z.ZodPipe<z.ZodString, z.ZodTransform<import("./identifiers.js").ProfileId, string>>;
+    version: z.ZodString;
+    status: z.ZodEnum<{
+        deprecated: "deprecated";
+        experimental: "experimental";
+        retired: "retired";
+        verified: "verified";
+    }>;
+    rail: z.ZodEnum<{
+        bank_transfer: "bank_transfer";
+        jpyc: "jpyc";
+    }>;
+    title: z.ZodString;
+    description: z.ZodString;
+    rules: z.ZodArray<z.ZodObject<{
+        id: z.ZodPipe<z.ZodString, z.ZodTransform<import("./identifiers.js").RuleId, string>>;
+        enabled: z.ZodBoolean;
+        severity: z.ZodOptional<z.ZodEnum<{
+            error: "error";
+            info: "info";
+            warning: "warning";
+        }>>;
+        params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, z.core.$strict>>;
+    registries: z.ZodArray<z.ZodObject<{
+        id: z.ZodPipe<z.ZodString, z.ZodTransform<import("./identifiers.js").RegistryId, string>>;
+        version: z.ZodString;
+        sha256: z.ZodString;
+    }, z.core.$strict>>;
+    sourceNotes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strict>;
+/** Version 1 compatibility profile inferred from {@link CompatibilityProfileV1Schema}. */
+export type CompatibilityProfileV1 = z.infer<typeof CompatibilityProfileV1Schema>;
+/** Minimal rule capability required while loading a Profile. */
+export interface ProfileRuleParameterParser {
+    readonly id: RuleConfigurationV1["id"];
+    parseParams(input: unknown): unknown;
+}
+/** Explicit policy and rule catalog used to load one Profile artifact. */
+export interface LoadCompatibilityProfileV1Options {
+    readonly rules: Iterable<ProfileRuleParameterParser>;
+    readonly allowExperimental?: boolean;
+    readonly allowRetired?: boolean;
+}
+/**
+ * Loads and validates a decoded Profile without file or network access.
+ *
+ * Rule-specific parameter errors are deliberately replaced with a fixed safe
+ * message so a parser cannot leak raw Profile values through this boundary.
+ */
+export declare function loadCompatibilityProfileV1(input: unknown, options: LoadCompatibilityProfileV1Options): CompatibilityProfileV1;
+//# sourceMappingURL=profile.d.ts.map

package/dist/profile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile.d.ts","sourceRoot":"","sources":["../src/profile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB,oEAAoE;AACpE,eAAO,MAAM,yBAAyB;;;;;;;;;kBAKpC,CAAC;AAEH,iDAAiD;AACjD,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AA6B5E,gFAAgF;AAChF,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAWvC,CAAC;AAEH,0FAA0F;AAC1F,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,gEAAgE;AAChE,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,EAAE,EAAE,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACvC,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC;CACtC;AAED,0EAA0E;AAC1E,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,0BAA0B,CAAC,CAAC;IACrD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IACrC,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;CACjC;AAiBD;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,iCAAiC,GACzC,sBAAsB,CA8BxB"}

package/dist/profile.js

@@ -0,0 +1,89 @@
+import { z } from "zod";
+import { PayoutJpConfigurationError } from "./errors.js";
+import { ProfileIdSchema, RuleIdSchema } from "./identifier-schema.js";
+import { railValues, RegistryReferenceV1Schema } from "./report.js";
+import { profileStatusValues, severityValues } from "./status.js";
+const NonEmptyStringSchema = z.string().min(1);
+/** Runtime schema for one rule entry in a compatibility profile. */
+export const RuleConfigurationV1Schema = z.strictObject({
+    id: RuleIdSchema,
+    enabled: z.boolean(),
+    severity: z.enum(severityValues).optional(),
+    params: z.record(z.string(), z.unknown()).optional(),
+});
+function rejectDuplicateIds(entries, context, kind) {
+    const seen = new Set();
+    entries.forEach((entry, index) => {
+        if (seen.has(entry.id)) {
+            context.addIssue({
+                code: "custom",
+                message: `Duplicate ${kind} ID`,
+                path: [index, "id"],
+            });
+        }
+        seen.add(entry.id);
+    });
+}
+const ProfileRulesSchema = z
+    .array(RuleConfigurationV1Schema)
+    .superRefine((rules, context) => rejectDuplicateIds(rules, context, "rule"));
+const ProfileRegistriesSchema = z
+    .array(RegistryReferenceV1Schema)
+    .superRefine((registries, context) => rejectDuplicateIds(registries, context, "registry"));
+/** Runtime schema for an immutable version 1 compatibility profile artifact. */
+export const CompatibilityProfileV1Schema = z.strictObject({
+    schemaVersion: z.literal("1"),
+    id: ProfileIdSchema,
+    version: NonEmptyStringSchema,
+    status: z.enum(profileStatusValues),
+    rail: z.enum(railValues),
+    title: NonEmptyStringSchema,
+    description: NonEmptyStringSchema,
+    rules: ProfileRulesSchema,
+    registries: ProfileRegistriesSchema,
+    sourceNotes: z.array(NonEmptyStringSchema).optional(),
+});
+function indexRuleParsers(rules) {
+    const parsers = new Map();
+    for (const rule of rules) {
+        if (parsers.has(rule.id)) {
+            throw new PayoutJpConfigurationError("PJP_RULE_DUPLICATE");
+        }
+        parsers.set(rule.id, rule);
+    }
+    return parsers;
+}
+/**
+ * Loads and validates a decoded Profile without file or network access.
+ *
+ * Rule-specific parameter errors are deliberately replaced with a fixed safe
+ * message so a parser cannot leak raw Profile values through this boundary.
+ */
+export function loadCompatibilityProfileV1(input, options) {
+    const parsed = CompatibilityProfileV1Schema.safeParse(input);
+    if (!parsed.success) {
+        throw new PayoutJpConfigurationError("PJP_PROFILE_INVALID");
+    }
+    const profile = parsed.data;
+    if (profile.status === "experimental" && options.allowExperimental !== true) {
+        throw new PayoutJpConfigurationError("PJP_PROFILE_STATUS_NOT_ALLOWED");
+    }
+    if (profile.status === "retired" && options.allowRetired !== true) {
+        throw new PayoutJpConfigurationError("PJP_PROFILE_STATUS_NOT_ALLOWED");
+    }
+    const parsers = indexRuleParsers(options.rules);
+    for (const configuration of profile.rules) {
+        const rule = parsers.get(configuration.id);
+        if (rule === undefined) {
+            throw new PayoutJpConfigurationError("PJP_RULE_UNKNOWN");
+        }
+        try {
+            rule.parseParams(configuration.params);
+        }
+        catch {
+            throw new PayoutJpConfigurationError("PJP_RULE_PARAMS_INVALID");
+        }
+    }
+    return profile;
+}
+//# sourceMappingURL=profile.js.map

package/dist/profile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile.js","sourceRoot":"","sources":["../src/profile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,EAAE,UAAU,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElE,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAE/C,oEAAoE;AACpE,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,YAAY,CAAC;IACtD,EAAE,EAAE,YAAY;IAChB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,QAAQ,EAAE;IAC3C,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAC;AAKH,SAAS,kBAAkB,CACzB,OAAkC,EAClC,OAAwB,EACxB,IAAyB;IAEzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAC/B,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;YACvB,OAAO,CAAC,QAAQ,CAAC;gBACf,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,aAAa,IAAI,KAAK;gBAC/B,IAAI,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC;aACpB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,kBAAkB,GAAG,CAAC;KACzB,KAAK,CAAC,yBAAyB,CAAC;KAChC,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AAE/E,MAAM,uBAAuB,GAAG,CAAC;KAC9B,KAAK,CAAC,yBAAyB,CAAC;KAChC,WAAW,CAAC,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,CAAC,kBAAkB,CAAC,UAAU,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;AAE7F,gFAAgF;AAChF,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,YAAY,CAAC;IACzD,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IAC7B,EAAE,EAAE,eAAe;IACnB,OAAO,EAAE,oBAAoB;IAC7B,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC;IACnC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;IACxB,KAAK,EAAE,oBAAoB;IAC3B,WAAW,EAAE,oBAAoB;IACjC,KAAK,EAAE,kBAAkB;IACzB,UAAU,EAAE,uBAAuB;IACnC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;CACtD,CAAC,CAAC;AAkBH,SAAS,gBAAgB,CACvB,KAA2C;IAE3C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAsC,CAAC;IAE9D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,0BAA0B,CAAC,oBAAoB,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CACxC,KAAc,EACd,OAA0C;IAE1C,MAAM,MAAM,GAAG,4BAA4B,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC7D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,0BAA0B,CAAC,qBAAqB,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC;IAE5B,IAAI,OAAO,CAAC,MAAM,KAAK,cAAc,IAAI,OAAO,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;QAC5E,MAAM,IAAI,0BAA0B,CAAC,gCAAgC,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;QAClE,MAAM,IAAI,0BAA0B,CAAC,gCAAgC,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAEhD,KAAK,MAAM,aAAa,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QAC3C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,0BAA0B,CAAC,kBAAkB,CAAC,CAAC;QAC3D,CAAC;QAED,IAAI,CAAC;YACH,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,0BAA0B,CAAC,yBAAyB,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/redaction.d.ts

@@ -0,0 +1,14 @@
+import type { SafeObservedValueV1 } from "./finding.js";
+/** Marks an explicitly public value as safe for finding output. */
+export declare function createPublicObservedValue(display: string): SafeObservedValueV1;
+/** Emits caller-provided non-sensitive metadata without attaching a source value. */
+export declare function createMetadataObservedValue(display: string): SafeObservedValueV1;
+/** Fully redacts an account holder value regardless of its content or length. */
+export declare function redactAccountHolder(_value: unknown): SafeObservedValueV1;
+/** Masks a bank account number while preserving at most its final two characters. */
+export declare function maskBankAccountNumber(value: string): SafeObservedValueV1;
+/** Shortens a public wallet address for normal finding output. */
+export declare function shortenWalletAddress(value: string): SafeObservedValueV1;
+/** Shortens a public token contract address using the wallet-address disclosure policy. */
+export declare function shortenTokenContract(value: string): SafeObservedValueV1;
+//# sourceMappingURL=redaction.d.ts.map

package/dist/redaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction.d.ts","sourceRoot":"","sources":["../src/redaction.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAMxD,mEAAmE;AACnE,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,mBAAmB,CAE9E;AAED,qFAAqF;AACrF,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,MAAM,GAAG,mBAAmB,CAEhF;AAED,iFAAiF;AACjF,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,GAAG,mBAAmB,CAExE;AAED,qFAAqF;AACrF,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,mBAAmB,CAQxE;AAaD,kEAAkE;AAClE,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,mBAAmB,CAEvE;AAED,2FAA2F;AAC3F,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,mBAAmB,CAEvE"}

package/dist/redaction.js

@@ -0,0 +1,41 @@
+const redactedDisplay = "<redacted>";
+const maskCharacter = "*";
+const shortenedSeparator = "…";
+/** Marks an explicitly public value as safe for finding output. */
+export function createPublicObservedValue(display) {
+    return { classification: "public", display };
+}
+/** Emits caller-provided non-sensitive metadata without attaching a source value. */
+export function createMetadataObservedValue(display) {
+    return { classification: "metadata-only", display };
+}
+/** Fully redacts an account holder value regardless of its content or length. */
+export function redactAccountHolder(_value) {
+    return { classification: "redacted-account-holder", display: redactedDisplay };
+}
+/** Masks a bank account number while preserving at most its final two characters. */
+export function maskBankAccountNumber(value) {
+    const characters = [...value];
+    const visibleCharacters = characters.length > 2 ? characters.slice(-2) : [];
+    const maskedLength = characters.length - visibleCharacters.length;
+    const display = `${maskCharacter.repeat(maskedLength)}${visibleCharacters.join("")}` || redactedDisplay;
+    return { classification: "masked-bank-account", display };
+}
+function shortenAddress(value) {
+    const prefixLength = 6;
+    const suffixLength = 4;
+    const minimumAddressLikeLength = 20;
+    if (value.length < minimumAddressLikeLength) {
+        return redactedDisplay;
+    }
+    return `${value.slice(0, prefixLength)}${shortenedSeparator}${value.slice(-suffixLength)}`;
+}
+/** Shortens a public wallet address for normal finding output. */
+export function shortenWalletAddress(value) {
+    return { classification: "short-wallet-address", display: shortenAddress(value) };
+}
+/** Shortens a public token contract address using the wallet-address disclosure policy. */
+export function shortenTokenContract(value) {
+    return { classification: "short-wallet-address", display: shortenAddress(value) };
+}
+//# sourceMappingURL=redaction.js.map

package/dist/redaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction.js","sourceRoot":"","sources":["../src/redaction.ts"],"names":[],"mappings":"AAEA,MAAM,eAAe,GAAG,YAAY,CAAC;AACrC,MAAM,aAAa,GAAG,GAAG,CAAC;AAC1B,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAE/B,mEAAmE;AACnE,MAAM,UAAU,yBAAyB,CAAC,OAAe;IACvD,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAC/C,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,2BAA2B,CAAC,OAAe;IACzD,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;AACtD,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,mBAAmB,CAAC,MAAe;IACjD,OAAO,EAAE,cAAc,EAAE,yBAAyB,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;AACjF,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,qBAAqB,CAAC,KAAa;IACjD,MAAM,UAAU,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;IAC9B,MAAM,iBAAiB,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5E,MAAM,YAAY,GAAG,UAAU,CAAC,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC;IAClE,MAAM,OAAO,GACX,GAAG,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,eAAe,CAAC;IAE1F,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,OAAO,EAAE,CAAC;AAC5D,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,MAAM,YAAY,GAAG,CAAC,CAAC;IACvB,MAAM,YAAY,GAAG,CAAC,CAAC;IACvB,MAAM,wBAAwB,GAAG,EAAE,CAAC;IACpC,IAAI,KAAK,CAAC,MAAM,GAAG,wBAAwB,EAAE,CAAC;QAC5C,OAAO,eAAe,CAAC;IACzB,CAAC;IAED,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,GAAG,kBAAkB,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC;AAC7F,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,OAAO,EAAE,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;AACpF,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,OAAO,EAAE,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;AACpF,CAAC"}

package/dist/registry.d.ts

@@ -0,0 +1,64 @@
+import { z } from "zod";
+import type { RegistryId } from "./identifiers.js";
+/** Runtime schema for provenance attached to a Registry snapshot. */
+export declare const SourceMetadataV1Schema: z.ZodObject<{
+    publisher: z.ZodString;
+    uri: z.ZodString;
+    retrievedAt: z.ZodUnion<readonly [z.ZodISODate, z.ZodISODateTime]>;
+    effectiveAsOf: z.ZodOptional<z.ZodUnion<readonly [z.ZodISODate, z.ZodISODateTime]>>;
+    license: z.ZodOptional<z.ZodString>;
+    notes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strict>;
+/** Provenance attached to a Registry snapshot. */
+export type SourceMetadataV1 = z.infer<typeof SourceMetadataV1Schema>;
+/** Immutable version 1 Registry envelope with a payload-specific type. */
+export interface RegistryEnvelopeV1<TPayload = unknown> {
+    readonly schemaVersion: "1";
+    readonly id: RegistryId;
+    readonly version: string;
+    readonly kind: string;
+    readonly sha256: string;
+    readonly source: SourceMetadataV1;
+    readonly payload: TPayload;
+}
+/** Creates a strict Registry envelope schema for one payload contract. */
+export declare function createRegistryEnvelopeV1Schema<TPayload>(payloadSchema: z.ZodType<TPayload>): z.ZodObject<{
+    schemaVersion: z.ZodLiteral<"1">;
+    id: z.ZodPipe<z.ZodString, z.ZodTransform<RegistryId, string>>;
+    version: z.ZodString;
+    kind: z.ZodString;
+    sha256: z.ZodString;
+    source: z.ZodObject<{
+        publisher: z.ZodString;
+        uri: z.ZodString;
+        retrievedAt: z.ZodUnion<readonly [z.ZodISODate, z.ZodISODateTime]>;
+        effectiveAsOf: z.ZodOptional<z.ZodUnion<readonly [z.ZodISODate, z.ZodISODateTime]>>;
+        license: z.ZodOptional<z.ZodString>;
+        notes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>;
+    payload: z.ZodType<TPayload, unknown, z.core.$ZodTypeInternals<TPayload, unknown>>;
+}, z.core.$strict>;
+/** Runtime schema for a Registry envelope whose payload contract is not yet selected. */
+export declare const RegistryEnvelopeV1Schema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<"1">;
+    id: z.ZodPipe<z.ZodString, z.ZodTransform<RegistryId, string>>;
+    version: z.ZodString;
+    kind: z.ZodString;
+    sha256: z.ZodString;
+    source: z.ZodObject<{
+        publisher: z.ZodString;
+        uri: z.ZodString;
+        retrievedAt: z.ZodUnion<readonly [z.ZodISODate, z.ZodISODateTime]>;
+        effectiveAsOf: z.ZodOptional<z.ZodUnion<readonly [z.ZodISODate, z.ZodISODateTime]>>;
+        license: z.ZodOptional<z.ZodString>;
+        notes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>;
+    payload: z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>;
+}, z.core.$strict>;
+/** Serializes finite JSON data with recursively sorted object keys and preserved array order. */
+export declare function canonicalizeJson(value: unknown): string;
+/** Calculates the lowercase SHA-256 for a Registry envelope with its digest field omitted. */
+export declare function calculateRegistryEnvelopeSha256(input: unknown): string;
+/** Loads a decoded local Registry and verifies its payload contract and content digest. */
+export declare function loadRegistryEnvelopeV1<TPayload = unknown>(input: unknown, payloadSchema?: z.ZodType<TPayload>): RegistryEnvelopeV1<TPayload>;
+//# sourceMappingURL=registry.d.ts.map

package/dist/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAMnD,qEAAqE;AACrE,eAAO,MAAM,sBAAsB;;;;;;;kBAOjC,CAAC;AAEH,kDAAkD;AAClD,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,0EAA0E;AAC1E,MAAM,WAAW,kBAAkB,CAAC,QAAQ,GAAG,OAAO;IACpD,QAAQ,CAAC,aAAa,EAAE,GAAG,CAAC;IAC5B,QAAQ,CAAC,EAAE,EAAE,UAAU,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC;CAC5B;AAED,0EAA0E;AAC1E,wBAAgB,8BAA8B,CAAC,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;;;;;;;;;;;;;;;mBAU1F;AAED,yFAAyF;AACzF,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;kBAA8C,CAAC;AA6EpF,iGAAiG;AACjG,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEvD;AAED,8FAA8F;AAC9F,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAYtE;AAED,2FAA2F;AAC3F,wBAAgB,sBAAsB,CAAC,QAAQ,GAAG,OAAO,EACvD,KAAK,EAAE,OAAO,EACd,aAAa,GAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAsC,GACtE,kBAAkB,CAAC,QAAQ,CAAC,CAmB9B"}