@probemesh/sdk 0.1.0

package/dist/chunk-5Q3PDYIA.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/callAuditArtifact.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\n\nimport { ProbeMeshError, isProbeMeshError } from \"./errors\";\nimport { redactX402Secrets } from \"./protocols/x402Redaction\";\nimport type {\n  CallStatus,\n  Cost,\n  ProbeMeshAttemptMetadata,\n  ProbeMeshCallRequest,\n  ProbeMeshCallResponse,\n  ProbeMeshCallSafety,\n  ProbeMeshCallTimeline,\n  ProbeMeshErrorCode,\n  ProbeMeshRetrySafety,\n  ProbeMeshRouteMetadata,\n  ProbeMeshTimelineEventType,\n  ReceiptRef,\n} from \"./types\";\n\nexport const PROBEMESH_CALL_AUDIT_ARTIFACT_SCHEMA_VERSION =\n  \"probemesh.call-audit.v1\" as const;\n\nexport type ProbeMeshCallAuditArtifactStatus = \"completed\" | \"failed\";\n\nexport type ProbeMeshCallAuditArtifactFormat = \"json\" | \"markdown\";\n\nexport interface ProbeMeshCallAuditArtifactOptions {\n  request: ProbeMeshCallRequest;\n  response?: ProbeMeshCallResponse;\n  error?: ProbeMeshError;\n  generatedAt?: string;\n  artifactId?: string;\n  forbiddenOutputValues?: string[];\n  timeline?: ProbeMeshCallTimeline;\n  retrySafety?: ProbeMeshRetrySafety;\n  attempt?: ProbeMeshAttemptMetadata;\n  route?: ProbeMeshRouteMetadata;\n}\n\nexport interface ProbeMeshCallAuditArtifactHashes {\n  request: string;\n  route: string;\n  timeline: string;\n  receipts: string;\n  safety: string;\n  retrySafety: string;\n  artifact: string;\n}\n\nexport interface ProbeMeshCallAuditArtifactReceiptSummary {\n  total: number;\n  types: string[];\n  providers: string[];\n  byType: Record<string, number>;\n  hasPaymentProof: boolean;\n  hasSettlementConfirmation: boolean;\n  hasProviderDelivery: boolean;\n}\n\nexport interface ProbeMeshCallAuditArtifactTimelineEvent {\n  type: ProbeMeshTimelineEventType;\n  timestamp: string;\n  provider?: string;\n  status?: CallStatus;\n  errorCode?: ProbeMeshErrorCode;\n  receiptType?: string;\n  attestationBundleId?: string;\n}\n\nexport interface ProbeMeshCallAuditArtifactTimelineSummary {\n  routeId?: string;\n  eventTypes: ProbeMeshTimelineEventType[];\n  events: ProbeMeshCallAuditArtifactTimelineEvent[];\n}\n\nexport interface ProbeMeshCallAuditArtifactCallSummary {\n  callId?: string;\n  capability: string;\n  status: ProbeMeshCallAuditArtifactStatus;\n  providerId?: string;\n  errorCode?: ProbeMeshErrorCode;\n  cost?: Cost;\n  latencyMs?: number;\n  attempt?: ProbeMeshAttemptMetadata;\n}\n\nexport interface ProbeMeshCallAuditArtifactRequestProof {\n  requestHash: string;\n  idempotencyKey?: string;\n}\n\nexport interface ProbeMeshCallAuditArtifactEvidence {\n  receiptSummary: ProbeMeshCallAuditArtifactReceiptSummary;\n  receiptRefs: ReceiptRef[];\n  safety?: ProbeMeshCallSafety;\n  retrySafety?: ProbeMeshRetrySafety;\n  route?: ProbeMeshRouteMetadata;\n  timeline: ProbeMeshCallAuditArtifactTimelineSummary;\n}\n\nexport interface ProbeMeshCallAuditArtifact {\n  schemaVersion: typeof PROBEMESH_CALL_AUDIT_ARTIFACT_SCHEMA_VERSION;\n  artifactId: string;\n  generatedAt: string;\n  status: ProbeMeshCallAuditArtifactStatus;\n  hashAlgorithm: \"sha256\";\n  hashes: ProbeMeshCallAuditArtifactHashes;\n  call: ProbeMeshCallAuditArtifactCallSummary;\n  request: ProbeMeshCallAuditArtifactRequestProof;\n  evidence: ProbeMeshCallAuditArtifactEvidence;\n}\n\nexport interface ProbeMeshCallAuditArtifactValidationError {\n  path: string;\n  message: string;\n}\n\nexport interface ProbeMeshCallAuditArtifactValidationResult {\n  valid: boolean;\n  errors: ProbeMeshCallAuditArtifactValidationError[];\n}\n\nexport function createProbeMeshCallAuditArtifact(\n  options: ProbeMeshCallAuditArtifactOptions,\n): ProbeMeshCallAuditArtifact {\n  assertAuditArtifactOptions(options);\n\n  const requestHash = hashStableJson(options.request);\n  const status: ProbeMeshCallAuditArtifactStatus = options.response\n    ? \"completed\"\n    : \"failed\";\n  const callId = options.response?.callId ?? options.error?.callId;\n  const capability =\n    options.response?.capability ?? options.error?.capability ?? options.request.capability;\n  const receiptRefs = cloneSerializable(\n    options.response?.receiptRefs ?? options.error?.receiptRefs ?? [],\n  );\n  const safety = cloneSerializable(\n    options.response?.safety ?? options.error?.safety,\n  );\n  const retrySafety = cloneSerializable(\n    options.retrySafety ??\n      options.response?.retrySafety ??\n      options.error?.retrySafety,\n  );\n  const attempt = cloneSerializable(\n    options.attempt ?? options.response?.attempt ?? options.error?.attempt,\n  );\n  const route = cloneSerializable(\n    options.route ?? options.response?.route ?? options.error?.route,\n  );\n  const timeline = cloneSerializable(\n    options.timeline ?? options.response?.timeline ?? options.error?.timeline,\n  );\n  const timelineSummary = summarizeTimeline(timeline);\n  const baseContent = sanitizeAuditOutput(\n    {\n      schemaVersion: PROBEMESH_CALL_AUDIT_ARTIFACT_SCHEMA_VERSION,\n      artifactId:\n        options.artifactId ??\n        `call_audit_${callId ?? requestHash.slice(0, 16)}`,\n      generatedAt: options.generatedAt ?? new Date().toISOString(),\n      status,\n      hashAlgorithm: \"sha256\" as const,\n      call: {\n        callId,\n        capability,\n        status,\n        providerId: options.response?.provider.id ?? options.error?.provider,\n        errorCode: options.error?.code,\n        cost: cloneSerializable(options.response?.cost),\n        latencyMs: options.response?.latencyMs,\n        attempt,\n      },\n      request: {\n        requestHash,\n        idempotencyKey: options.request.idempotencyKey,\n      },\n      evidence: {\n        receiptSummary: summarizeAuditReceipts(receiptRefs),\n        receiptRefs,\n        safety,\n        retrySafety,\n        route,\n        timeline: timelineSummary,\n      },\n    },\n    options.forbiddenOutputValues ?? [],\n  );\n  const hashesWithoutArtifact: ProbeMeshCallAuditArtifactHashes = {\n    request: requestHash,\n    route: hashStableJson(baseContent.evidence.route ?? null),\n    timeline: hashStableJson(baseContent.evidence.timeline),\n    receipts: hashStableJson(baseContent.evidence.receiptRefs),\n    safety: hashStableJson(baseContent.evidence.safety ?? null),\n    retrySafety: hashStableJson(baseContent.evidence.retrySafety ?? null),\n    artifact: \"\",\n  };\n  const artifact: ProbeMeshCallAuditArtifact = {\n    ...baseContent,\n    hashes: {\n      ...hashesWithoutArtifact,\n      artifact: hashArtifactContent({\n        ...baseContent,\n        hashes: hashesWithoutArtifact,\n      }),\n    },\n  };\n\n  assertProbeMeshCallAuditArtifact(artifact);\n\n  return artifact;\n}\n\nexport function validateProbeMeshCallAuditArtifact(\n  artifact: unknown,\n): ProbeMeshCallAuditArtifactValidationResult {\n  const errors: ProbeMeshCallAuditArtifactValidationError[] = [];\n\n  if (!isRecord(artifact)) {\n    return {\n      valid: false,\n      errors: [\n        {\n          path: \"$\",\n          message: \"ProbeMesh call audit artifact must be an object.\",\n        },\n      ],\n    };\n  }\n\n  if (artifact.schemaVersion !== PROBEMESH_CALL_AUDIT_ARTIFACT_SCHEMA_VERSION) {\n    errors.push({\n      path: \"schemaVersion\",\n      message: `schemaVersion must be \"${PROBEMESH_CALL_AUDIT_ARTIFACT_SCHEMA_VERSION}\".`,\n    });\n  }\n\n  validateNonEmptyString(artifact.artifactId, \"artifactId\", errors);\n  validateIsoTimestamp(artifact.generatedAt, \"generatedAt\", errors);\n\n  if (artifact.status !== \"completed\" && artifact.status !== \"failed\") {\n    errors.push({\n      path: \"status\",\n      message: 'status must be \"completed\" or \"failed\".',\n    });\n  }\n\n  if (artifact.hashAlgorithm !== \"sha256\") {\n    errors.push({\n      path: \"hashAlgorithm\",\n      message: 'hashAlgorithm must be \"sha256\".',\n    });\n  }\n\n  validateHashes(artifact.hashes, errors);\n  validateCallSummary(artifact.call, artifact.status, errors);\n  validateRequestProof(artifact.request, artifact.hashes, errors);\n  validateEvidence(artifact.evidence, errors);\n\n  if (errors.length === 0) {\n    const typedArtifact = artifact as unknown as ProbeMeshCallAuditArtifact;\n\n    pushHashMismatch(\n      errors,\n      \"hashes.route\",\n      typedArtifact.hashes.route,\n      hashStableJson(typedArtifact.evidence.route ?? null),\n    );\n    pushHashMismatch(\n      errors,\n      \"hashes.timeline\",\n      typedArtifact.hashes.timeline,\n      hashStableJson(typedArtifact.evidence.timeline),\n    );\n    pushHashMismatch(\n      errors,\n      \"hashes.receipts\",\n      typedArtifact.hashes.receipts,\n      hashStableJson(typedArtifact.evidence.receiptRefs),\n    );\n    pushHashMismatch(\n      errors,\n      \"hashes.safety\",\n      typedArtifact.hashes.safety,\n      hashStableJson(typedArtifact.evidence.safety ?? null),\n    );\n    pushHashMismatch(\n      errors,\n      \"hashes.retrySafety\",\n      typedArtifact.hashes.retrySafety,\n      hashStableJson(typedArtifact.evidence.retrySafety ?? null),\n    );\n    pushHashMismatch(\n      errors,\n      \"hashes.artifact\",\n      typedArtifact.hashes.artifact,\n      hashArtifactContent(typedArtifact),\n    );\n  }\n\n  return {\n    valid: errors.length === 0,\n    errors,\n  };\n}\n\nexport function assertProbeMeshCallAuditArtifact(\n  artifact: unknown,\n): asserts artifact is ProbeMeshCallAuditArtifact {\n  const result = validateProbeMeshCallAuditArtifact(artifact);\n\n  if (result.valid) {\n    return;\n  }\n\n  throw new ProbeMeshError({\n    code: \"invalid_request\",\n    message: `Invalid ProbeMesh call audit artifact: ${formatValidationErrors(\n      result.errors,\n    )}`,\n  });\n}\n\nexport function formatProbeMeshCallAuditArtifact(\n  artifact: ProbeMeshCallAuditArtifact,\n  options: {\n    format?: ProbeMeshCallAuditArtifactFormat;\n  } = {},\n) {\n  assertProbeMeshCallAuditArtifact(artifact);\n\n  if ((options.format ?? \"json\") === \"markdown\") {\n    return formatAuditArtifactMarkdown(artifact);\n  }\n\n  return JSON.stringify(artifact, null, 2);\n}\n\nfunction assertAuditArtifactOptions(\n  options: ProbeMeshCallAuditArtifactOptions,\n): asserts options is ProbeMeshCallAuditArtifactOptions {\n  if (!isRecord(options)) {\n    throw new ProbeMeshError({\n      code: \"invalid_request\",\n      message: \"ProbeMesh call audit artifact options must be an object.\",\n    });\n  }\n\n  if (!isRecord(options.request)) {\n    throw new ProbeMeshError({\n      code: \"invalid_request\",\n      message: \"ProbeMesh call audit artifact request must be an object.\",\n    });\n  }\n\n  if (\n    typeof options.request.capability !== \"string\" ||\n    options.request.capability.length === 0\n  ) {\n    throw new ProbeMeshError({\n      code: \"invalid_request\",\n      message: \"ProbeMesh call audit artifact request capability is required.\",\n    });\n  }\n\n  if (!(\"input\" in options.request)) {\n    throw new ProbeMeshError({\n      code: \"invalid_request\",\n      message: \"ProbeMesh call audit artifact request input is required for hashing.\",\n    });\n  }\n\n  if (\n    (options.response === undefined && options.error === undefined) ||\n    (options.response !== undefined && options.error !== undefined)\n  ) {\n    throw new ProbeMeshError({\n      code: \"invalid_request\",\n      message:\n        \"ProbeMesh call audit artifact requires exactly one response or error.\",\n    });\n  }\n\n  if (options.error !== undefined && !isProbeMeshError(options.error)) {\n    throw new ProbeMeshError({\n      code: \"invalid_request\",\n      message: \"ProbeMesh call audit artifact error must be a ProbeMeshError.\",\n    });\n  }\n\n  if (\n    options.generatedAt !== undefined &&\n    (typeof options.generatedAt !== \"string\" ||\n      Number.isNaN(Date.parse(options.generatedAt)))\n  ) {\n    throw new ProbeMeshError({\n      code: \"invalid_request\",\n      message: \"ProbeMesh call audit artifact generatedAt must be an ISO timestamp.\",\n    });\n  }\n\n  if (\n    options.artifactId !== undefined &&\n    (typeof options.artifactId !== \"string\" || options.artifactId.length === 0)\n  ) {\n    throw new ProbeMeshError({\n      code: \"invalid_request\",\n      message: \"ProbeMesh call audit artifact artifactId must be a non-empty string.\",\n    });\n  }\n\n  if (\n    options.forbiddenOutputValues !== undefined &&\n    (!Array.isArray(options.forbiddenOutputValues) ||\n      options.forbiddenOutputValues.some((value) => typeof value !== \"string\"))\n  ) {\n    throw new ProbeMeshError({\n      code: \"invalid_request\",\n      message:\n        \"ProbeMesh call audit artifact forbiddenOutputValues must be an array of strings.\",\n    });\n  }\n}\n\nfunction summarizeAuditReceipts(\n  receiptRefs: ReceiptRef[],\n): ProbeMeshCallAuditArtifactReceiptSummary {\n  const types: string[] = [];\n  const providers: string[] = [];\n  const byType: Record<string, number> = {};\n\n  for (const receiptRef of receiptRefs) {\n    if (!types.includes(receiptRef.type)) {\n      types.push(receiptRef.type);\n    }\n\n    if (!providers.includes(receiptRef.provider)) {\n      providers.push(receiptRef.provider);\n    }\n\n    byType[receiptRef.type] = (byType[receiptRef.type] ?? 0) + 1;\n  }\n\n  return {\n    total: receiptRefs.length,\n    types,\n    providers,\n    byType,\n    hasPaymentProof: receiptRefs.some(\n      (receiptRef) => receiptRef.type === \"payment_proof\",\n    ),\n    hasSettlementConfirmation: receiptRefs.some(\n      (receiptRef) => receiptRef.type === \"settlement_confirmation\",\n    ),\n    hasProviderDelivery: receiptRefs.some(\n      (receiptRef) => receiptRef.type === \"provider_delivery\",\n    ),\n  };\n}\n\nfunction summarizeTimeline(\n  timeline: ProbeMeshCallTimeline | undefined,\n): ProbeMeshCallAuditArtifactTimelineSummary {\n  if (!timeline) {\n    return {\n      eventTypes: [],\n      events: [],\n    };\n  }\n\n  return {\n    routeId: timeline.routeId,\n    eventTypes: timeline.events.map((event) => event.type),\n    events: timeline.events.map((event) => ({\n      type: event.type,\n      timestamp: event.timestamp,\n      provider: event.provider,\n      status: event.status,\n      errorCode: event.errorCode,\n      receiptType: event.receiptRef?.type,\n      attestationBundleId: event.attestation?.bundleId,\n    })),\n  };\n}\n\nfunction validateHashes(\n  hashes: unknown,\n  errors: ProbeMeshCallAuditArtifactValidationError[],\n) {\n  if (!isRecord(hashes)) {\n    errors.push({\n      path: \"hashes\",\n      message: \"hashes must be an object.\",\n    });\n    return;\n  }\n\n  for (const key of [\n    \"request\",\n    \"route\",\n    \"timeline\",\n    \"receipts\",\n    \"safety\",\n    \"retrySafety\",\n    \"artifact\",\n  ]) {\n    validateSha256String(hashes[key], `hashes.${key}`, errors);\n  }\n}\n\nfunction validateCallSummary(\n  call: unknown,\n  status: unknown,\n  errors: ProbeMeshCallAuditArtifactValidationError[],\n) {\n  if (!isRecord(call)) {\n    errors.push({\n      path: \"call\",\n      message: \"call must be an object.\",\n    });\n    return;\n  }\n\n  validateNonEmptyString(call.capability, \"call.capability\", errors);\n\n  if (call.status !== status) {\n    errors.push({\n      path: \"call.status\",\n      message: \"call.status must match artifact status.\",\n    });\n  }\n\n  if (call.callId !== undefined) {\n    validateNonEmptyString(call.callId, \"call.callId\", errors);\n  }\n\n  if (call.providerId !== undefined) {\n    validateNonEmptyString(call.providerId, \"call.providerId\", errors);\n  }\n\n  if (\n    call.errorCode !== undefined &&\n    (typeof call.errorCode !== \"string\" || call.errorCode.length === 0)\n  ) {\n    errors.push({\n      path: \"call.errorCode\",\n      message: \"call.errorCode must be a non-empty string when provided.\",\n    });\n  }\n\n  if (\n    call.latencyMs !== undefined &&\n    (typeof call.latencyMs !== \"number\" ||\n      !Number.isFinite(call.latencyMs) ||\n      call.latencyMs < 0)\n  ) {\n    errors.push({\n      path: \"call.latencyMs\",\n      message: \"call.latencyMs must be a non-negative finite number.\",\n    });\n  }\n}\n\nfunction validateRequestProof(\n  request: unknown,\n  hashes: unknown,\n  errors: ProbeMeshCallAuditArtifactValidationError[],\n) {\n  if (!isRecord(request)) {\n    errors.push({\n      path: \"request\",\n      message: \"request must be an object.\",\n    });\n    return;\n  }\n\n  validateSha256String(request.requestHash, \"request.requestHash\", errors);\n\n  if (isRecord(hashes) && hashes.request !== request.requestHash) {\n    errors.push({\n      path: \"hashes.request\",\n      message: \"hashes.request must equal request.requestHash.\",\n    });\n  }\n\n  if (request.idempotencyKey !== undefined) {\n    validateNonEmptyString(\n      request.idempotencyKey,\n      \"request.idempotencyKey\",\n      errors,\n    );\n  }\n}\n\nfunction validateEvidence(\n  evidence: unknown,\n  errors: ProbeMeshCallAuditArtifactValidationError[],\n) {\n  if (!isRecord(evidence)) {\n    errors.push({\n      path: \"evidence\",\n      message: \"evidence must be an object.\",\n    });\n    return;\n  }\n\n  validateReceiptSummary(evidence.receiptSummary, errors);\n  validateReceiptRefs(evidence.receiptRefs, errors);\n  validateTimelineSummary(evidence.timeline, errors);\n}\n\nfunction validateReceiptSummary(\n  summary: unknown,\n  errors: ProbeMeshCallAuditArtifactValidationError[],\n) {\n  if (!isRecord(summary)) {\n    errors.push({\n      path: \"evidence.receiptSummary\",\n      message: \"evidence.receiptSummary must be an object.\",\n    });\n    return;\n  }\n\n  if (typeof summary.total !== \"number\" || !Number.isFinite(summary.total)) {\n    errors.push({\n      path: \"evidence.receiptSummary.total\",\n      message: \"evidence.receiptSummary.total must be a number.\",\n    });\n  }\n\n  validateStringArray(summary.types, \"evidence.receiptSummary.types\", errors);\n  validateStringArray(\n    summary.providers,\n    \"evidence.receiptSummary.providers\",\n    errors,\n  );\n\n  if (!isRecord(summary.byType)) {\n    errors.push({\n      path: \"evidence.receiptSummary.byType\",\n      message: \"evidence.receiptSummary.byType must be an object.\",\n    });\n  }\n\n  for (const key of [\n    \"hasPaymentProof\",\n    \"hasSettlementConfirmation\",\n    \"hasProviderDelivery\",\n  ]) {\n    if (typeof summary[key] !== \"boolean\") {\n      errors.push({\n        path: `evidence.receiptSummary.${key}`,\n        message: `evidence.receiptSummary.${key} must be a boolean.`,\n      });\n    }\n  }\n}\n\nfunction validateReceiptRefs(\n  receiptRefs: unknown,\n  errors: ProbeMeshCallAuditArtifactValidationError[],\n) {\n  if (!Array.isArray(receiptRefs)) {\n    errors.push({\n      path: \"evidence.receiptRefs\",\n      message: \"evidence.receiptRefs must be an array.\",\n    });\n    return;\n  }\n\n  receiptRefs.forEach((receiptRef, index) => {\n    if (!isRecord(receiptRef)) {\n      errors.push({\n        path: `evidence.receiptRefs.${index}`,\n        message: \"receipt ref must be an object.\",\n      });\n      return;\n    }\n\n    for (const key of [\"type\", \"provider\", \"status\", \"ref\", \"timestamp\"]) {\n      validateNonEmptyString(\n        receiptRef[key],\n        `evidence.receiptRefs.${index}.${key}`,\n        errors,\n      );\n    }\n  });\n}\n\nfunction validateTimelineSummary(\n  timeline: unknown,\n  errors: ProbeMeshCallAuditArtifactValidationError[],\n) {\n  if (!isRecord(timeline)) {\n    errors.push({\n      path: \"evidence.timeline\",\n      message: \"evidence.timeline must be an object.\",\n    });\n    return;\n  }\n\n  if (timeline.routeId !== undefined) {\n    validateNonEmptyString(timeline.routeId, \"evidence.timeline.routeId\", errors);\n  }\n\n  validateStringArray(\n    timeline.eventTypes,\n    \"evidence.timeline.eventTypes\",\n    errors,\n  );\n\n  if (!Array.isArray(timeline.events)) {\n    errors.push({\n      path: \"evidence.timeline.events\",\n      message: \"evidence.timeline.events must be an array.\",\n    });\n    return;\n  }\n\n  timeline.events.forEach((event, index) => {\n    if (!isRecord(event)) {\n      errors.push({\n        path: `evidence.timeline.events.${index}`,\n        message: \"timeline event must be an object.\",\n      });\n      return;\n    }\n\n    validateNonEmptyString(\n      event.type,\n      `evidence.timeline.events.${index}.type`,\n      errors,\n    );\n    validateIsoTimestamp(\n      event.timestamp,\n      `evidence.timeline.events.${index}.timestamp`,\n      errors,\n    );\n  });\n}\n\nfunction hashArtifactContent(artifact: ProbeMeshCallAuditArtifact) {\n  return hashStableJson({\n    ...artifact,\n    hashes: {\n      ...artifact.hashes,\n      artifact: \"\",\n    },\n  });\n}\n\nfunction pushHashMismatch(\n  errors: ProbeMeshCallAuditArtifactValidationError[],\n  path: string,\n  expected: string,\n  actual: string,\n) {\n  if (expected === actual) {\n    return;\n  }\n\n  errors.push({\n    path,\n    message: `${path} does not match artifact content.`,\n  });\n}\n\nfunction hashStableJson(value: unknown) {\n  return createHash(\"sha256\").update(stableStringify(value)).digest(\"hex\");\n}\n\nfunction stableStringify(value: unknown): string {\n  return JSON.stringify(sortSerializable(value));\n}\n\nfunction sortSerializable(value: unknown): unknown {\n  if (Array.isArray(value)) {\n    return value.map(sortSerializable);\n  }\n\n  if (!isRecord(value)) {\n    return value;\n  }\n\n  return Object.fromEntries(\n    Object.keys(value)\n      .sort()\n      .filter((key) => value[key] !== undefined)\n      .map((key) => [key, sortSerializable(value[key])]),\n  );\n}\n\nfunction sanitizeAuditOutput<T>(value: T, forbiddenOutputValues: string[]) {\n  const forbiddenValues = forbiddenOutputValues.filter((entry) => entry.length > 0);\n\n  return redactX402Secrets(\n    replaceForbiddenValues(cloneSerializable(value), forbiddenValues),\n  ) as T;\n}\n\nfunction replaceForbiddenValues(\n  value: unknown,\n  forbiddenValues: string[],\n): unknown {\n  if (typeof value === \"string\") {\n    return forbiddenValues.reduce(\n      (current, forbidden) => current.split(forbidden).join(\"[REDACTED]\"),\n      value,\n    );\n  }\n\n  if (value === null || typeof value !== \"object\" || value instanceof Date) {\n    return value;\n  }\n\n  if (Array.isArray(value)) {\n    return value.map((entry) => replaceForbiddenValues(entry, forbiddenValues));\n  }\n\n  return Object.fromEntries(\n    Object.entries(value).map(([key, entry]) => [\n      key,\n      replaceForbiddenValues(entry, forbiddenValues),\n    ]),\n  );\n}\n\nfunction cloneSerializable<T>(value: T): T {\n  if (value === undefined) {\n    return value;\n  }\n\n  return JSON.parse(JSON.stringify(value)) as T;\n}\n\nfunction formatAuditArtifactMarkdown(artifact: ProbeMeshCallAuditArtifact) {\n  const attestation = artifact.evidence.route?.attestation;\n\n  return [\n    `# ProbeMesh Call Audit Artifact`,\n    ``,\n    `Status: ${artifact.status}`,\n    `Schema: ${artifact.schemaVersion}`,\n    `Artifact ID: ${artifact.artifactId}`,\n    `Generated: ${artifact.generatedAt}`,\n    ``,\n    `## Call`,\n    `- Call ID: ${artifact.call.callId ?? \"none\"}`,\n    `- Capability: ${artifact.call.capability}`,\n    `- Provider: ${artifact.call.providerId ?? \"none\"}`,\n    `- Error code: ${artifact.call.errorCode ?? \"none\"}`,\n    `- Cost USD: ${artifact.call.cost?.amountUsd ?? \"none\"}`,\n    `- Request hash: ${artifact.request.requestHash}`,\n    ``,\n    `## Evidence`,\n    `- Receipts: ${artifact.evidence.receiptSummary.total}`,\n    `- Receipt types: ${formatInlineList(artifact.evidence.receiptSummary.types)}`,\n    `- Payment proof: ${String(artifact.evidence.receiptSummary.hasPaymentProof)}`,\n    `- Settlement confirmation: ${String(\n      artifact.evidence.receiptSummary.hasSettlementConfirmation,\n    )}`,\n    `- Provider delivery: ${String(\n      artifact.evidence.receiptSummary.hasProviderDelivery,\n    )}`,\n    `- Money may have moved: ${String(\n      artifact.evidence.safety?.moneyMayHaveMoved ?? false,\n    )}`,\n    `- Retry safe: ${String(\n      artifact.evidence.retrySafety?.safeToAutoRetry ?? false,\n    )}`,\n    `- Route stop: ${\n      artifact.evidence.route?.explanation?.stopReason ?? \"none\"\n    }`,\n    `- Bundle: ${attestation?.bundleId ?? \"none\"}`,\n    `- Bundle verified: ${String(attestation?.runtimeVerified ?? false)}`,\n    `- Timeline events: ${formatInlineList(\n      artifact.evidence.timeline.eventTypes,\n    )}`,\n    ``,\n    `## Hashes`,\n    `- Artifact: ${artifact.hashes.artifact}`,\n    `- Route: ${artifact.hashes.route}`,\n    `- Timeline: ${artifact.hashes.timeline}`,\n    `- Receipts: ${artifact.hashes.receipts}`,\n  ].join(\"\\n\");\n}\n\nfunction formatInlineList(values: string[]) {\n  return values.length === 0 ? \"none\" : values.join(\", \");\n}\n\nfunction validateSha256String(\n  value: unknown,\n  path: string,\n  errors: ProbeMeshCallAuditArtifactValidationError[],\n) {\n  if (typeof value !== \"string\" || !/^[a-f0-9]{64}$/.test(value)) {\n    errors.push({\n      path,\n      message: `${path} must be a sha256 hex string.`,\n    });\n  }\n}\n\nfunction validateNonEmptyString(\n  value: unknown,\n  path: string,\n  errors: ProbeMeshCallAuditArtifactValidationError[],\n) {\n  if (typeof value !== \"string\" || value.length === 0) {\n    errors.push({\n      path,\n      message: `${path} must be a non-empty string.`,\n    });\n  }\n}\n\nfunction validateIsoTimestamp(\n  value: unknown,\n  path: string,\n  errors: ProbeMeshCallAuditArtifactValidationError[],\n) {\n  if (typeof value !== \"string\" || Number.isNaN(Date.parse(value))) {\n    errors.push({\n      path,\n      message: `${path} must be an ISO timestamp.`,\n    });\n  }\n}\n\nfunction validateStringArray(\n  value: unknown,\n  path: string,\n  errors: ProbeMeshCallAuditArtifactValidationError[],\n) {\n  if (\n    !Array.isArray(value) ||\n    value.some((entry) => typeof entry !== \"string\" || entry.length === 0)\n  ) {\n    errors.push({\n      path,\n      message: `${path} must be an array of non-empty strings.`,\n    });\n  }\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return !!value && typeof value === \"object\" && !Array.isArray(value);\n}\n\nfunction formatValidationErrors(errors: ProbeMeshCallAuditArtifactValidationError[]) {\n  return errors.map((error) => `${error.path}: ${error.message}`).join(\"; \");\n}\n"],"mappings":";;;;;;;;;AAAA,SAAS,kBAAkB;AAmBpB,IAAM,+CACX;AAsGK,SAAS,iCACd,SAC4B;AAC5B,6BAA2B,OAAO;AAElC,QAAM,cAAc,eAAe,QAAQ,OAAO;AAClD,QAAM,SAA2C,QAAQ,WACrD,cACA;AACJ,QAAM,SAAS,QAAQ,UAAU,UAAU,QAAQ,OAAO;AAC1D,QAAM,aACJ,QAAQ,UAAU,cAAc,QAAQ,OAAO,cAAc,QAAQ,QAAQ;AAC/E,QAAM,cAAc;AAAA,IAClB,QAAQ,UAAU,eAAe,QAAQ,OAAO,eAAe,CAAC;AAAA,EAClE;AACA,QAAM,SAAS;AAAA,IACb,QAAQ,UAAU,UAAU,QAAQ,OAAO;AAAA,EAC7C;AACA,QAAM,cAAc;AAAA,IAClB,QAAQ,eACN,QAAQ,UAAU,eAClB,QAAQ,OAAO;AAAA,EACnB;AACA,QAAM,UAAU;AAAA,IACd,QAAQ,WAAW,QAAQ,UAAU,WAAW,QAAQ,OAAO;AAAA,EACjE;AACA,QAAM,QAAQ;AAAA,IACZ,QAAQ,SAAS,QAAQ,UAAU,SAAS,QAAQ,OAAO;AAAA,EAC7D;AACA,QAAM,WAAW;AAAA,IACf,QAAQ,YAAY,QAAQ,UAAU,YAAY,QAAQ,OAAO;AAAA,EACnE;AACA,QAAM,kBAAkB,kBAAkB,QAAQ;AAClD,QAAM,cAAc;AAAA,IAClB;AAAA,MACE,eAAe;AAAA,MACf,YACE,QAAQ,cACR,cAAc,UAAU,YAAY,MAAM,GAAG,EAAE,CAAC;AAAA,MAClD,aAAa,QAAQ,gBAAe,oBAAI,KAAK,GAAE,YAAY;AAAA,MAC3D;AAAA,MACA,eAAe;AAAA,MACf,MAAM;AAAA,QACJ;AAAA,QACA;AAAA,QACA;AAAA,QACA,YAAY,QAAQ,UAAU,SAAS,MAAM,QAAQ,OAAO;AAAA,QAC5D,WAAW,QAAQ,OAAO;AAAA,QAC1B,MAAM,kBAAkB,QAAQ,UAAU,IAAI;AAAA,QAC9C,WAAW,QAAQ,UAAU;AAAA,QAC7B;AAAA,MACF;AAAA,MACA,SAAS;AAAA,QACP;AAAA,QACA,gBAAgB,QAAQ,QAAQ;AAAA,MAClC;AAAA,MACA,UAAU;AAAA,QACR,gBAAgB,uBAAuB,WAAW;AAAA,QAClD;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,UAAU;AAAA,MACZ;AAAA,IACF;AAAA,IACA,QAAQ,yBAAyB,CAAC;AAAA,EACpC;AACA,QAAM,wBAA0D;AAAA,IAC9D,SAAS;AAAA,IACT,OAAO,eAAe,YAAY,SAAS,SAAS,IAAI;AAAA,IACxD,UAAU,eAAe,YAAY,SAAS,QAAQ;AAAA,IACtD,UAAU,eAAe,YAAY,SAAS,WAAW;AAAA,IACzD,QAAQ,eAAe,YAAY,SAAS,UAAU,IAAI;AAAA,IAC1D,aAAa,eAAe,YAAY,SAAS,eAAe,IAAI;AAAA,IACpE,UAAU;AAAA,EACZ;AACA,QAAM,WAAuC;AAAA,IAC3C,GAAG;AAAA,IACH,QAAQ;AAAA,MACN,GAAG;AAAA,MACH,UAAU,oBAAoB;AAAA,QAC5B,GAAG;AAAA,QACH,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AAAA,EACF;AAEA,mCAAiC,QAAQ;AAEzC,SAAO;AACT;AAEO,SAAS,mCACd,UAC4C;AAC5C,QAAM,SAAsD,CAAC;AAE7D,MAAI,CAAC,SAAS,QAAQ,GAAG;AACvB,WAAO;AAAA,MACL,OAAO;AAAA,MACP,QAAQ;AAAA,QACN;AAAA,UACE,MAAM;AAAA,UACN,SAAS;AAAA,QACX;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,MAAI,SAAS,kBAAkB,8CAA8C;AAC3E,WAAO,KAAK;AAAA,MACV,MAAM;AAAA,MACN,SAAS,0BAA0B,4CAA4C;AAAA,IACjF,CAAC;AAAA,EACH;AAEA,yBAAuB,SAAS,YAAY,cAAc,MAAM;AAChE,uBAAqB,SAAS,aAAa,eAAe,MAAM;AAEhE,MAAI,SAAS,WAAW,eAAe,SAAS,WAAW,UAAU;AACnE,WAAO,KAAK;AAAA,MACV,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AAEA,MAAI,SAAS,kBAAkB,UAAU;AACvC,WAAO,KAAK;AAAA,MACV,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AAEA,iBAAe,SAAS,QAAQ,MAAM;AACtC,sBAAoB,SAAS,MAAM,SAAS,QAAQ,MAAM;AAC1D,uBAAqB,SAAS,SAAS,SAAS,QAAQ,MAAM;AAC9D,mBAAiB,SAAS,UAAU,MAAM;AAE1C,MAAI,OAAO,WAAW,GAAG;AACvB,UAAM,gBAAgB;AAEtB;AAAA,MACE;AAAA,MACA;AAAA,MACA,cAAc,OAAO;AAAA,MACrB,eAAe,cAAc,SAAS,SAAS,IAAI;AAAA,IACrD;AACA;AAAA,MACE;AAAA,MACA;AAAA,MACA,cAAc,OAAO;AAAA,MACrB,eAAe,cAAc,SAAS,QAAQ;AAAA,IAChD;AACA;AAAA,MACE;AAAA,MACA;AAAA,MACA,cAAc,OAAO;AAAA,MACrB,eAAe,cAAc,SAAS,WAAW;AAAA,IACnD;AACA;AAAA,MACE;AAAA,MACA;AAAA,MACA,cAAc,OAAO;AAAA,MACrB,eAAe,cAAc,SAAS,UAAU,IAAI;AAAA,IACtD;AACA;AAAA,MACE;AAAA,MACA;AAAA,MACA,cAAc,OAAO;AAAA,MACrB,eAAe,cAAc,SAAS,eAAe,IAAI;AAAA,IAC3D;AACA;AAAA,MACE;AAAA,MACA;AAAA,MACA,cAAc,OAAO;AAAA,MACrB,oBAAoB,aAAa;AAAA,IACnC;AAAA,EACF;AAEA,SAAO;AAAA,IACL,OAAO,OAAO,WAAW;AAAA,IACzB;AAAA,EACF;AACF;AAEO,SAAS,iCACd,UACgD;AAChD,QAAM,SAAS,mCAAmC,QAAQ;AAE1D,MAAI,OAAO,OAAO;AAChB;AAAA,EACF;AAEA,QAAM,IAAI,eAAe;AAAA,IACvB,MAAM;AAAA,IACN,SAAS,0CAA0C;AAAA,MACjD,OAAO;AAAA,IACT,CAAC;AAAA,EACH,CAAC;AACH;AAEO,SAAS,iCACd,UACA,UAEI,CAAC,GACL;AACA,mCAAiC,QAAQ;AAEzC,OAAK,QAAQ,UAAU,YAAY,YAAY;AAC7C,WAAO,4BAA4B,QAAQ;AAAA,EAC7C;AAEA,SAAO,KAAK,UAAU,UAAU,MAAM,CAAC;AACzC;AAEA,SAAS,2BACP,SACsD;AACtD,MAAI,CAAC,SAAS,OAAO,GAAG;AACtB,UAAM,IAAI,eAAe;AAAA,MACvB,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AAEA,MAAI,CAAC,SAAS,QAAQ,OAAO,GAAG;AAC9B,UAAM,IAAI,eAAe;AAAA,MACvB,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AAEA,MACE,OAAO,QAAQ,QAAQ,eAAe,YACtC,QAAQ,QAAQ,WAAW,WAAW,GACtC;AACA,UAAM,IAAI,eAAe;AAAA,MACvB,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AAEA,MAAI,EAAE,WAAW,QAAQ,UAAU;AACjC,UAAM,IAAI,eAAe;AAAA,MACvB,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AAEA,MACG,QAAQ,aAAa,UAAa,QAAQ,UAAU,UACpD,QAAQ,aAAa,UAAa,QAAQ,UAAU,QACrD;AACA,UAAM,IAAI,eAAe;AAAA,MACvB,MAAM;AAAA,MACN,SACE;AAAA,IACJ,CAAC;AAAA,EACH;AAEA,MAAI,QAAQ,UAAU,UAAa,CAAC,iBAAiB,QAAQ,KAAK,GAAG;AACnE,UAAM,IAAI,eAAe;AAAA,MACvB,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AAEA,MACE,QAAQ,gBAAgB,WACvB,OAAO,QAAQ,gBAAgB,YAC9B,OAAO,MAAM,KAAK,MAAM,QAAQ,WAAW,CAAC,IAC9C;AACA,UAAM,IAAI,eAAe;AAAA,MACvB,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AAEA,MACE,QAAQ,eAAe,WACtB,OAAO,QAAQ,eAAe,YAAY,QAAQ,WAAW,WAAW,IACzE;AACA,UAAM,IAAI,eAAe;AAAA,MACvB,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AAEA,MACE,QAAQ,0BAA0B,WACjC,CAAC,MAAM,QAAQ,QAAQ,qBAAqB,KAC3C,QAAQ,sBAAsB,KAAK,CAAC,UAAU,OAAO,UAAU,QAAQ,IACzE;AACA,UAAM,IAAI,eAAe;AAAA,MACvB,MAAM;AAAA,MACN,SACE;AAAA,IACJ,CAAC;AAAA,EACH;AACF;AAEA,SAAS,uBACP,aAC0C;AAC1C,QAAM,QAAkB,CAAC;AACzB,QAAM,YAAsB,CAAC;AAC7B,QAAM,SAAiC,CAAC;AAExC,aAAW,cAAc,aAAa;AACpC,QAAI,CAAC,MAAM,SAAS,WAAW,IAAI,GAAG;AACpC,YAAM,KAAK,WAAW,IAAI;AAAA,IAC5B;AAEA,QAAI,CAAC,UAAU,SAAS,WAAW,QAAQ,GAAG;AAC5C,gBAAU,KAAK,WAAW,QAAQ;AAAA,IACpC;AAEA,WAAO,WAAW,IAAI,KAAK,OAAO,WAAW,IAAI,KAAK,KAAK;AAAA,EAC7D;AAEA,SAAO;AAAA,IACL,OAAO,YAAY;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,IACA,iBAAiB,YAAY;AAAA,MAC3B,CAAC,eAAe,WAAW,SAAS;AAAA,IACtC;AAAA,IACA,2BAA2B,YAAY;AAAA,MACrC,CAAC,eAAe,WAAW,SAAS;AAAA,IACtC;AAAA,IACA,qBAAqB,YAAY;AAAA,MAC/B,CAAC,eAAe,WAAW,SAAS;AAAA,IACtC;AAAA,EACF;AACF;AAEA,SAAS,kBACP,UAC2C;AAC3C,MAAI,CAAC,UAAU;AACb,WAAO;AAAA,MACL,YAAY,CAAC;AAAA,MACb,QAAQ,CAAC;AAAA,IACX;AAAA,EACF;AAEA,SAAO;AAAA,IACL,SAAS,SAAS;AAAA,IAClB,YAAY,SAAS,OAAO,IAAI,CAAC,UAAU,MAAM,IAAI;AAAA,IACrD,QAAQ,SAAS,OAAO,IAAI,CAAC,WAAW;AAAA,MACtC,MAAM,MAAM;AAAA,MACZ,WAAW,MAAM;AAAA,MACjB,UAAU,MAAM;AAAA,MAChB,QAAQ,MAAM;AAAA,MACd,WAAW,MAAM;AAAA,MACjB,aAAa,MAAM,YAAY;AAAA,MAC/B,qBAAqB,MAAM,aAAa;AAAA,IAC1C,EAAE;AAAA,EACJ;AACF;AAEA,SAAS,eACP,QACA,QACA;AACA,MAAI,CAAC,SAAS,MAAM,GAAG;AACrB,WAAO,KAAK;AAAA,MACV,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AACD;AAAA,EACF;AAEA,aAAW,OAAO;AAAA,IAChB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,GAAG;AACD,yBAAqB,OAAO,GAAG,GAAG,UAAU,GAAG,IAAI,MAAM;AAAA,EAC3D;AACF;AAEA,SAAS,oBACP,MACA,QACA,QACA;AACA,MAAI,CAAC,SAAS,IAAI,GAAG;AACnB,WAAO,KAAK;AAAA,MACV,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AACD;AAAA,EACF;AAEA,yBAAuB,KAAK,YAAY,mBAAmB,MAAM;AAEjE,MAAI,KAAK,WAAW,QAAQ;AAC1B,WAAO,KAAK;AAAA,MACV,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AAEA,MAAI,KAAK,WAAW,QAAW;AAC7B,2BAAuB,KAAK,QAAQ,eAAe,MAAM;AAAA,EAC3D;AAEA,MAAI,KAAK,eAAe,QAAW;AACjC,2BAAuB,KAAK,YAAY,mBAAmB,MAAM;AAAA,EACnE;AAEA,MACE,KAAK,cAAc,WAClB,OAAO,KAAK,cAAc,YAAY,KAAK,UAAU,WAAW,IACjE;AACA,WAAO,KAAK;AAAA,MACV,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AAEA,MACE,KAAK,cAAc,WAClB,OAAO,KAAK,cAAc,YACzB,CAAC,OAAO,SAAS,KAAK,SAAS,KAC/B,KAAK,YAAY,IACnB;AACA,WAAO,KAAK;AAAA,MACV,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF;AAEA,SAAS,qBACP,SACA,QACA,QACA;AACA,MAAI,CAAC,SAAS,OAAO,GAAG;AACtB,WAAO,KAAK;AAAA,MACV,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AACD;AAAA,EACF;AAEA,uBAAqB,QAAQ,aAAa,uBAAuB,MAAM;AAEvE,MAAI,SAAS,MAAM,KAAK,OAAO,YAAY,QAAQ,aAAa;AAC9D,WAAO,KAAK;AAAA,MACV,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AAEA,MAAI,QAAQ,mBAAmB,QAAW;AACxC;AAAA,MACE,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,iBACP,UACA,QACA;AACA,MAAI,CAAC,SAAS,QAAQ,GAAG;AACvB,WAAO,KAAK;AAAA,MACV,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AACD;AAAA,EACF;AAEA,yBAAuB,SAAS,gBAAgB,MAAM;AACtD,sBAAoB,SAAS,aAAa,MAAM;AAChD,0BAAwB,SAAS,UAAU,MAAM;AACnD;AAEA,SAAS,uBACP,SACA,QACA;AACA,MAAI,CAAC,SAAS,OAAO,GAAG;AACtB,WAAO,KAAK;AAAA,MACV,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AACD;AAAA,EACF;AAEA,MAAI,OAAO,QAAQ,UAAU,YAAY,CAAC,OAAO,SAAS,QAAQ,KAAK,GAAG;AACxE,WAAO,KAAK;AAAA,MACV,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AAEA,sBAAoB,QAAQ,OAAO,iCAAiC,MAAM;AAC1E;AAAA,IACE,QAAQ;AAAA,IACR;AAAA,IACA;AAAA,EACF;AAEA,MAAI,CAAC,SAAS,QAAQ,MAAM,GAAG;AAC7B,WAAO,KAAK;AAAA,MACV,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AAEA,aAAW,OAAO;AAAA,IAChB;AAAA,IACA;AAAA,IACA;AAAA,EACF,GAAG;AACD,QAAI,OAAO,QAAQ,GAAG,MAAM,WAAW;AACrC,aAAO,KAAK;AAAA,QACV,MAAM,2BAA2B,GAAG;AAAA,QACpC,SAAS,2BAA2B,GAAG;AAAA,MACzC,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAEA,SAAS,oBACP,aACA,QACA;AACA,MAAI,CAAC,MAAM,QAAQ,WAAW,GAAG;AAC/B,WAAO,KAAK;AAAA,MACV,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AACD;AAAA,EACF;AAEA,cAAY,QAAQ,CAAC,YAAY,UAAU;AACzC,QAAI,CAAC,SAAS,UAAU,GAAG;AACzB,aAAO,KAAK;AAAA,QACV,MAAM,wBAAwB,KAAK;AAAA,QACnC,SAAS;AAAA,MACX,CAAC;AACD;AAAA,IACF;AAEA,eAAW,OAAO,CAAC,QAAQ,YAAY,UAAU,OAAO,WAAW,GAAG;AACpE;AAAA,QACE,WAAW,GAAG;AAAA,QACd,wBAAwB,KAAK,IAAI,GAAG;AAAA,QACpC;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAEA,SAAS,wBACP,UACA,QACA;AACA,MAAI,CAAC,SAAS,QAAQ,GAAG;AACvB,WAAO,KAAK;AAAA,MACV,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AACD;AAAA,EACF;AAEA,MAAI,SAAS,YAAY,QAAW;AAClC,2BAAuB,SAAS,SAAS,6BAA6B,MAAM;AAAA,EAC9E;AAEA;AAAA,IACE,SAAS;AAAA,IACT;AAAA,IACA;AAAA,EACF;AAEA,MAAI,CAAC,MAAM,QAAQ,SAAS,MAAM,GAAG;AACnC,WAAO,KAAK;AAAA,MACV,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AACD;AAAA,EACF;AAEA,WAAS,OAAO,QAAQ,CAAC,OAAO,UAAU;AACxC,QAAI,CAAC,SAAS,KAAK,GAAG;AACpB,aAAO,KAAK;AAAA,QACV,MAAM,4BAA4B,KAAK;AAAA,QACvC,SAAS;AAAA,MACX,CAAC;AACD;AAAA,IACF;AAEA;AAAA,MACE,MAAM;AAAA,MACN,4BAA4B,KAAK;AAAA,MACjC;AAAA,IACF;AACA;AAAA,MACE,MAAM;AAAA,MACN,4BAA4B,KAAK;AAAA,MACjC;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAEA,SAAS,oBAAoB,UAAsC;AACjE,SAAO,eAAe;AAAA,IACpB,GAAG;AAAA,IACH,QAAQ;AAAA,MACN,GAAG,SAAS;AAAA,MACZ,UAAU;AAAA,IACZ;AAAA,EACF,CAAC;AACH;AAEA,SAAS,iBACP,QACA,MACA,UACA,QACA;AACA,MAAI,aAAa,QAAQ;AACvB;AAAA,EACF;AAEA,SAAO,KAAK;AAAA,IACV;AAAA,IACA,SAAS,GAAG,IAAI;AAAA,EAClB,CAAC;AACH;AAEA,SAAS,eAAe,OAAgB;AACtC,SAAO,WAAW,QAAQ,EAAE,OAAO,gBAAgB,KAAK,CAAC,EAAE,OAAO,KAAK;AACzE;AAEA,SAAS,gBAAgB,OAAwB;AAC/C,SAAO,KAAK,UAAU,iBAAiB,KAAK,CAAC;AAC/C;AAEA,SAAS,iBAAiB,OAAyB;AACjD,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,WAAO,MAAM,IAAI,gBAAgB;AAAA,EACnC;AAEA,MAAI,CAAC,SAAS,KAAK,GAAG;AACpB,WAAO;AAAA,EACT;AAEA,SAAO,OAAO;AAAA,IACZ,OAAO,KAAK,KAAK,EACd,KAAK,EACL,OAAO,CAAC,QAAQ,MAAM,GAAG,MAAM,MAAS,EACxC,IAAI,CAAC,QAAQ,CAAC,KAAK,iBAAiB,MAAM,GAAG,CAAC,CAAC,CAAC;AAAA,EACrD;AACF;AAEA,SAAS,oBAAuB,OAAU,uBAAiC;AACzE,QAAM,kBAAkB,sBAAsB,OAAO,CAAC,UAAU,MAAM,SAAS,CAAC;AAEhF,SAAO;AAAA,IACL,uBAAuB,kBAAkB,KAAK,GAAG,eAAe;AAAA,EAClE;AACF;AAEA,SAAS,uBACP,OACA,iBACS;AACT,MAAI,OAAO,UAAU,UAAU;AAC7B,WAAO,gBAAgB;AAAA,MACrB,CAAC,SAAS,cAAc,QAAQ,MAAM,SAAS,EAAE,KAAK,YAAY;AAAA,MAClE;AAAA,IACF;AAAA,EACF;AAEA,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,iBAAiB,MAAM;AACxE,WAAO;AAAA,EACT;AAEA,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,WAAO,MAAM,IAAI,CAAC,UAAU,uBAAuB,OAAO,eAAe,CAAC;AAAA,EAC5E;AAEA,SAAO,OAAO;AAAA,IACZ,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM;AAAA,MAC1C;AAAA,MACA,uBAAuB,OAAO,eAAe;AAAA,IAC/C,CAAC;AAAA,EACH;AACF;AAEA,SAAS,kBAAqB,OAAa;AACzC,MAAI,UAAU,QAAW;AACvB,WAAO;AAAA,EACT;AAEA,SAAO,KAAK,MAAM,KAAK,UAAU,KAAK,CAAC;AACzC;AAEA,SAAS,4BAA4B,UAAsC;AACzE,QAAM,cAAc,SAAS,SAAS,OAAO;AAE7C,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,WAAW,SAAS,MAAM;AAAA,IAC1B,WAAW,SAAS,aAAa;AAAA,IACjC,gBAAgB,SAAS,UAAU;AAAA,IACnC,cAAc,SAAS,WAAW;AAAA,IAClC;AAAA,IACA;AAAA,IACA,cAAc,SAAS,KAAK,UAAU,MAAM;AAAA,IAC5C,iBAAiB,SAAS,KAAK,UAAU;AAAA,IACzC,eAAe,SAAS,KAAK,cAAc,MAAM;AAAA,IACjD,iBAAiB,SAAS,KAAK,aAAa,MAAM;AAAA,IAClD,eAAe,SAAS,KAAK,MAAM,aAAa,MAAM;AAAA,IACtD,mBAAmB,SAAS,QAAQ,WAAW;AAAA,IAC/C;AAAA,IACA;AAAA,IACA,eAAe,SAAS,SAAS,eAAe,KAAK;AAAA,IACrD,oBAAoB,iBAAiB,SAAS,SAAS,eAAe,KAAK,CAAC;AAAA,IAC5E,oBAAoB,OAAO,SAAS,SAAS,eAAe,eAAe,CAAC;AAAA,IAC5E,8BAA8B;AAAA,MAC5B,SAAS,SAAS,eAAe;AAAA,IACnC,CAAC;AAAA,IACD,wBAAwB;AAAA,MACtB,SAAS,SAAS,eAAe;AAAA,IACnC,CAAC;AAAA,IACD,2BAA2B;AAAA,MACzB,SAAS,SAAS,QAAQ,qBAAqB;AAAA,IACjD,CAAC;AAAA,IACD,iBAAiB;AAAA,MACf,SAAS,SAAS,aAAa,mBAAmB;AAAA,IACpD,CAAC;AAAA,IACD,iBACE,SAAS,SAAS,OAAO,aAAa,cAAc,MACtD;AAAA,IACA,aAAa,aAAa,YAAY,MAAM;AAAA,IAC5C,sBAAsB,OAAO,aAAa,mBAAmB,KAAK,CAAC;AAAA,IACnE,sBAAsB;AAAA,MACpB,SAAS,SAAS,SAAS;AAAA,IAC7B,CAAC;AAAA,IACD;AAAA,IACA;AAAA,IACA,eAAe,SAAS,OAAO,QAAQ;AAAA,IACvC,YAAY,SAAS,OAAO,KAAK;AAAA,IACjC,eAAe,SAAS,OAAO,QAAQ;AAAA,IACvC,eAAe,SAAS,OAAO,QAAQ;AAAA,EACzC,EAAE,KAAK,IAAI;AACb;AAEA,SAAS,iBAAiB,QAAkB;AAC1C,SAAO,OAAO,WAAW,IAAI,SAAS,OAAO,KAAK,IAAI;AACxD;AAEA,SAAS,qBACP,OACA,MACA,QACA;AACA,MAAI,OAAO,UAAU,YAAY,CAAC,iBAAiB,KAAK,KAAK,GAAG;AAC9D,WAAO,KAAK;AAAA,MACV;AAAA,MACA,SAAS,GAAG,IAAI;AAAA,IAClB,CAAC;AAAA,EACH;AACF;AAEA,SAAS,uBACP,OACA,MACA,QACA;AACA,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG;AACnD,WAAO,KAAK;AAAA,MACV;AAAA,MACA,SAAS,GAAG,IAAI;AAAA,IAClB,CAAC;AAAA,EACH;AACF;AAEA,SAAS,qBACP,OACA,MACA,QACA;AACA,MAAI,OAAO,UAAU,YAAY,OAAO,MAAM,KAAK,MAAM,KAAK,CAAC,GAAG;AAChE,WAAO,KAAK;AAAA,MACV;AAAA,MACA,SAAS,GAAG,IAAI;AAAA,IAClB,CAAC;AAAA,EACH;AACF;AAEA,SAAS,oBACP,OACA,MACA,QACA;AACA,MACE,CAAC,MAAM,QAAQ,KAAK,KACpB,MAAM,KAAK,CAAC,UAAU,OAAO,UAAU,YAAY,MAAM,WAAW,CAAC,GACrE;AACA,WAAO,KAAK;AAAA,MACV;AAAA,MACA,SAAS,GAAG,IAAI;AAAA,IAClB,CAAC;AAAA,EACH;AACF;AAEA,SAAS,SAAS,OAAkD;AAClE,SAAO,CAAC,CAAC,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK;AACrE;AAEA,SAAS,uBAAuB,QAAqD;AACnF,SAAO,OAAO,IAAI,CAAC,UAAU,GAAG,MAAM,IAAI,KAAK,MAAM,OAAO,EAAE,EAAE,KAAK,IAAI;AAC3E;","names":[]}

package/dist/chunk-CXZOO3U4.js

@@ -0,0 +1,550 @@
+import {
+  assertProviderCatalog,
+  evaluateProviderCatalogPolicy,
+  summarizeProviderCatalog
+} from "./chunk-ZJOLPBJJ.js";
+import {
+  ProbeMeshError
+} from "./chunk-2ASMVLG4.js";
+
+// src/providerCatalogPolicyBundle.ts
+import { createHash } from "crypto";
+var PROVIDER_CATALOG_POLICY_BUNDLE_SCHEMA_VERSION = "probemesh.catalog-policy-bundle.v1";
+function createProviderCatalogPolicyBundle(options) {
+  assertBundleOptions(options);
+  const evaluation = options.evaluation ?? evaluateProviderCatalogPolicy({
+    catalog: options.catalog,
+    catalogPolicy: options.catalogPolicy,
+    adapterInventory: options.adapterInventory,
+    queries: options.queries
+  });
+  const hashesWithoutBundle = {
+    catalog: hashStableJson(options.catalog),
+    catalogPolicy: hashStableJson(options.catalogPolicy ?? null),
+    adapterInventory: hashStableJson(options.adapterInventory),
+    queries: hashStableJson(options.queries),
+    evaluation: hashStableJson(evaluation),
+    bundle: ""
+  };
+  const bundleBase = {
+    schemaVersion: PROVIDER_CATALOG_POLICY_BUNDLE_SCHEMA_VERSION,
+    bundleId: options.bundleId ?? `catalog_policy_bundle_${hashStableJson({
+      catalog: hashesWithoutBundle.catalog,
+      catalogPolicy: hashesWithoutBundle.catalogPolicy,
+      adapterInventory: hashesWithoutBundle.adapterInventory,
+      queries: hashesWithoutBundle.queries
+    }).slice(0, 16)}`,
+    generatedAt: options.generatedAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+    status: evaluation.status,
+    hashAlgorithm: "sha256",
+    hashes: hashesWithoutBundle,
+    catalogSummary: summarizeProviderCatalog(options.catalog),
+    evaluationSummary: cloneSerializable(evaluation.summary),
+    queryCoverage: evaluation.queryResults.map(createQueryCoverage),
+    checks: cloneSerializable(evaluation.checks),
+    failedChecks: evaluation.checks.filter((check) => check.status === "failed").map((check) => check.name),
+    queries: cloneSerializable(options.queries)
+  };
+  const bundle = {
+    ...bundleBase,
+    hashes: {
+      ...hashesWithoutBundle,
+      bundle: hashBundleContent(bundleBase)
+    }
+  };
+  const sanitizedBundle = sanitizeBundleOutput(
+    bundle,
+    options.forbiddenOutputValues ?? []
+  );
+  assertProviderCatalogPolicyBundle(sanitizedBundle);
+  return sanitizedBundle;
+}
+function validateProviderCatalogPolicyBundle(bundle) {
+  const errors = [];
+  if (!isRecord(bundle)) {
+    return {
+      valid: false,
+      errors: [
+        {
+          path: "$",
+          message: "Provider catalog policy bundle must be an object."
+        }
+      ]
+    };
+  }
+  if (bundle.schemaVersion !== PROVIDER_CATALOG_POLICY_BUNDLE_SCHEMA_VERSION) {
+    errors.push({
+      path: "schemaVersion",
+      message: `schemaVersion must be "${PROVIDER_CATALOG_POLICY_BUNDLE_SCHEMA_VERSION}".`
+    });
+  }
+  validateNonEmptyString(bundle.bundleId, "bundleId", errors);
+  validateIsoTimestamp(bundle.generatedAt, "generatedAt", errors);
+  if (bundle.status !== "passed" && bundle.status !== "failed") {
+    errors.push({
+      path: "status",
+      message: 'status must be "passed" or "failed".'
+    });
+  }
+  if (bundle.hashAlgorithm !== "sha256") {
+    errors.push({
+      path: "hashAlgorithm",
+      message: 'hashAlgorithm must be "sha256".'
+    });
+  }
+  validateHashes(bundle.hashes, errors);
+  validateObject(bundle.catalogSummary, "catalogSummary", errors);
+  validateObject(bundle.evaluationSummary, "evaluationSummary", errors);
+  validateQueryCoverage(bundle.queryCoverage, errors);
+  validateCheckArray(bundle.checks, "checks", errors);
+  validateStringArray(bundle.failedChecks, "failedChecks", errors);
+  if (!Array.isArray(bundle.queries) || bundle.queries.length === 0) {
+    errors.push({
+      path: "queries",
+      message: "queries must be a non-empty array."
+    });
+  }
+  if (errors.length === 0) {
+    const expectedBundleHash = hashBundleContent(
+      bundle
+    );
+    if (bundle.hashes.bundle !== expectedBundleHash) {
+      errors.push({
+        path: "hashes.bundle",
+        message: "bundle hash does not match bundle content."
+      });
+    }
+  }
+  return {
+    valid: errors.length === 0,
+    errors
+  };
+}
+function assertProviderCatalogPolicyBundle(bundle) {
+  const result = validateProviderCatalogPolicyBundle(bundle);
+  if (result.valid) {
+    return;
+  }
+  throw new ProbeMeshError({
+    code: "invalid_request",
+    message: `Invalid provider catalog policy bundle: ${formatValidationErrors(
+      result.errors
+    )}`
+  });
+}
+function formatProviderCatalogPolicyBundle(bundle, options = {}) {
+  assertProviderCatalogPolicyBundle(bundle);
+  if ((options.format ?? "json") === "markdown") {
+    return formatBundleMarkdown(bundle);
+  }
+  return JSON.stringify(bundle, null, 2);
+}
+function verifyProviderCatalogPolicyBundleRuntime(options) {
+  assertRuntimeVerificationOptions(options);
+  const errors = [];
+  const bundleValidation = validateProviderCatalogPolicyBundle(options.bundle);
+  errors.push(...bundleValidation.errors);
+  if (options.bundle.status !== "passed") {
+    errors.push({
+      path: "status",
+      message: "Provider catalog policy bundle must have passed evaluation."
+    });
+  }
+  const queries = options.queries ?? options.bundle.queries;
+  const evaluation = evaluateProviderCatalogPolicy({
+    catalog: options.catalog,
+    catalogPolicy: options.catalogPolicy,
+    adapterInventory: options.adapterInventory,
+    queries
+  });
+  const runtimeHashes = {
+    catalog: hashStableJson(options.catalog),
+    catalogPolicy: hashStableJson(options.catalogPolicy ?? null),
+    adapterInventory: hashStableJson(options.adapterInventory),
+    queries: hashStableJson(queries),
+    evaluation: hashStableJson(evaluation)
+  };
+  pushHashMismatch(
+    errors,
+    "catalog",
+    options.bundle.hashes.catalog,
+    runtimeHashes.catalog
+  );
+  pushHashMismatch(
+    errors,
+    "catalogPolicy",
+    options.bundle.hashes.catalogPolicy,
+    runtimeHashes.catalogPolicy
+  );
+  pushHashMismatch(
+    errors,
+    "adapterInventory",
+    options.bundle.hashes.adapterInventory,
+    runtimeHashes.adapterInventory
+  );
+  pushHashMismatch(
+    errors,
+    "queries",
+    options.bundle.hashes.queries,
+    runtimeHashes.queries
+  );
+  pushHashMismatch(
+    errors,
+    "evaluation",
+    options.bundle.hashes.evaluation,
+    runtimeHashes.evaluation
+  );
+  const queryIndex = options.capability === void 0 ? void 0 : options.bundle.queries.findIndex(
+    (query) => query.capability === options.capability
+  );
+  const covered = options.capability === void 0 ? true : queryIndex !== void 0 && queryIndex >= 0;
+  if (!covered) {
+    errors.push({
+      path: "queries",
+      message: `Capability "${options.capability}" is not covered by the policy bundle queries.`
+    });
+  }
+  const valid = errors.length === 0;
+  const attestation = {
+    schemaVersion: PROVIDER_CATALOG_POLICY_BUNDLE_SCHEMA_VERSION,
+    bundleId: options.bundle.bundleId,
+    status: options.bundle.status,
+    hashAlgorithm: options.bundle.hashAlgorithm,
+    bundleHash: options.bundle.hashes.bundle,
+    catalogHash: options.bundle.hashes.catalog,
+    catalogPolicyHash: options.bundle.hashes.catalogPolicy,
+    adapterInventoryHash: options.bundle.hashes.adapterInventory,
+    queriesHash: options.bundle.hashes.queries,
+    evaluationHash: options.bundle.hashes.evaluation,
+    runtimeVerified: valid,
+    covered,
+    capability: options.capability,
+    queryIndex: queryIndex !== void 0 && queryIndex >= 0 ? queryIndex : void 0,
+    reason: valid ? "runtime_verified" : errors[0]?.message
+  };
+  return {
+    valid,
+    attestation,
+    errors,
+    coveredQuery: queryIndex !== void 0 && queryIndex >= 0 ? options.bundle.queries[queryIndex] : void 0
+  };
+}
+function assertBundleOptions(options) {
+  if (!isRecord(options)) {
+    throw new ProbeMeshError({
+      code: "invalid_request",
+      message: "Provider catalog policy bundle options must be an object."
+    });
+  }
+  assertProviderCatalog(options.catalog);
+  if (!Array.isArray(options.adapterInventory)) {
+    throw new ProbeMeshError({
+      code: "invalid_request",
+      message: "Provider catalog policy bundle adapterInventory must be an array."
+    });
+  }
+  if (!Array.isArray(options.queries) || options.queries.length === 0) {
+    throw new ProbeMeshError({
+      code: "invalid_request",
+      message: "Provider catalog policy bundle requires at least one query."
+    });
+  }
+  if (options.bundleId !== void 0 && (typeof options.bundleId !== "string" || options.bundleId.length === 0)) {
+    throw new ProbeMeshError({
+      code: "invalid_request",
+      message: "Provider catalog policy bundleId must be a non-empty string."
+    });
+  }
+  if (options.generatedAt !== void 0 && (typeof options.generatedAt !== "string" || Number.isNaN(Date.parse(options.generatedAt)))) {
+    throw new ProbeMeshError({
+      code: "invalid_request",
+      message: "Provider catalog policy bundle generatedAt must be an ISO timestamp."
+    });
+  }
+}
+function assertRuntimeVerificationOptions(options) {
+  if (!isRecord(options)) {
+    throw new ProbeMeshError({
+      code: "invalid_request",
+      message: "Provider catalog policy bundle runtime options must be an object."
+    });
+  }
+  assertProviderCatalogPolicyBundle(options.bundle);
+  assertProviderCatalog(options.catalog);
+  if (!Array.isArray(options.adapterInventory)) {
+    throw new ProbeMeshError({
+      code: "invalid_request",
+      message: "Provider catalog policy bundle runtime adapterInventory must be an array."
+    });
+  }
+  if (options.queries !== void 0 && !Array.isArray(options.queries)) {
+    throw new ProbeMeshError({
+      code: "invalid_request",
+      message: "Provider catalog policy bundle runtime queries must be an array."
+    });
+  }
+  if (options.capability !== void 0 && (typeof options.capability !== "string" || options.capability.length === 0)) {
+    throw new ProbeMeshError({
+      code: "invalid_request",
+      message: "Provider catalog policy bundle runtime capability must be a string."
+    });
+  }
+}
+function createQueryCoverage(result) {
+  return {
+    capability: result.query.capability,
+    minMatches: result.query.minMatches ?? 1,
+    matches: result.matches.length,
+    routeableMatches: result.routeableMatches.length,
+    missingAdapterMatches: result.missingAdapterMatches.length,
+    providerIds: result.routeableMatches.map((match) => match.providerId)
+  };
+}
+function hashStableJson(value) {
+  return createHash("sha256").update(stableStringify(value)).digest("hex");
+}
+function hashBundleContent(bundle) {
+  return hashStableJson({
+    ...bundle,
+    hashes: {
+      ...bundle.hashes,
+      bundle: ""
+    }
+  });
+}
+function stableStringify(value) {
+  return JSON.stringify(sortSerializable(value));
+}
+function sortSerializable(value) {
+  if (Array.isArray(value)) {
+    return value.map(sortSerializable);
+  }
+  if (!isRecord(value)) {
+    return value;
+  }
+  return Object.fromEntries(
+    Object.keys(value).sort().filter((key) => value[key] !== void 0).map((key) => [key, sortSerializable(value[key])])
+  );
+}
+function pushHashMismatch(errors, name, expected, actual) {
+  if (expected !== actual) {
+    errors.push({
+      path: `hashes.${name}`,
+      message: `${name} hash does not match runtime input.`
+    });
+  }
+}
+function formatBundleMarkdown(bundle) {
+  const lines = [
+    `# Provider Catalog Policy Bundle ${bundle.bundleId}`,
+    "",
+    `Status: ${bundle.status}`,
+    `Generated: ${bundle.generatedAt}`,
+    `Bundle hash: ${bundle.hashes.bundle}`,
+    "",
+    "## Summary",
+    `- Catalog entries: ${bundle.catalogSummary.totalEntries}`,
+    `- Ready entries: ${bundle.catalogSummary.readyEntries}`,
+    `- Queries: ${bundle.queryCoverage.length}`,
+    `- Routeable matches: ${bundle.evaluationSummary.routeableMatches}`,
+    `- Failed checks: ${bundle.evaluationSummary.failedChecks}`,
+    "",
+    "## Query Coverage",
+    ...bundle.queryCoverage.map(
+      (coverage) => `- ${coverage.capability}: ${coverage.routeableMatches}/${coverage.minMatches} routeable (${formatInlineList(
+        coverage.providerIds
+      )})`
+    ),
+    "",
+    "## Checks",
+    ...bundle.checks.map(
+      (check) => `- ${check.status === "passed" ? "[x]" : "[ ]"} ${check.name}: ${check.message}`
+    )
+  ];
+  return `${lines.join("\n")}
+`;
+}
+function validateHashes(value, errors) {
+  if (!isRecord(value)) {
+    errors.push({
+      path: "hashes",
+      message: "hashes must be an object."
+    });
+    return;
+  }
+  for (const key of [
+    "catalog",
+    "catalogPolicy",
+    "adapterInventory",
+    "queries",
+    "evaluation",
+    "bundle"
+  ]) {
+    validateSha256(value[key], `hashes.${key}`, errors);
+  }
+}
+function validateQueryCoverage(value, errors) {
+  if (!Array.isArray(value)) {
+    errors.push({
+      path: "queryCoverage",
+      message: "queryCoverage must be an array."
+    });
+    return;
+  }
+  value.forEach((coverage, index) => {
+    if (!isRecord(coverage)) {
+      errors.push({
+        path: `queryCoverage.${index}`,
+        message: "query coverage entry must be an object."
+      });
+      return;
+    }
+    validateNonEmptyString(coverage.capability, `queryCoverage.${index}.capability`, errors);
+    validateNonNegativeInteger(
+      coverage.minMatches,
+      `queryCoverage.${index}.minMatches`,
+      errors
+    );
+    validateNonNegativeInteger(
+      coverage.matches,
+      `queryCoverage.${index}.matches`,
+      errors
+    );
+    validateNonNegativeInteger(
+      coverage.routeableMatches,
+      `queryCoverage.${index}.routeableMatches`,
+      errors
+    );
+    validateNonNegativeInteger(
+      coverage.missingAdapterMatches,
+      `queryCoverage.${index}.missingAdapterMatches`,
+      errors
+    );
+    validateStringArray(coverage.providerIds, `queryCoverage.${index}.providerIds`, errors);
+  });
+}
+function validateCheckArray(value, path, errors) {
+  if (!Array.isArray(value)) {
+    errors.push({
+      path,
+      message: `${path} must be an array.`
+    });
+    return;
+  }
+  value.forEach((check, index) => {
+    if (!isRecord(check)) {
+      errors.push({
+        path: `${path}.${index}`,
+        message: "check must be an object."
+      });
+      return;
+    }
+    validateNonEmptyString(check.name, `${path}.${index}.name`, errors);
+    if (check.status !== "passed" && check.status !== "failed") {
+      errors.push({
+        path: `${path}.${index}.status`,
+        message: 'check status must be "passed" or "failed".'
+      });
+    }
+    validateNonEmptyString(check.message, `${path}.${index}.message`, errors);
+  });
+}
+function validateObject(value, path, errors) {
+  if (!isRecord(value)) {
+    errors.push({
+      path,
+      message: `${path} must be an object.`
+    });
+  }
+}
+function validateSha256(value, path, errors) {
+  if (typeof value !== "string" || !/^[a-f0-9]{64}$/.test(value)) {
+    errors.push({
+      path,
+      message: `${path} must be a sha256 hex string.`
+    });
+  }
+}
+function validateNonEmptyString(value, path, errors) {
+  if (typeof value !== "string" || value.length === 0) {
+    errors.push({
+      path,
+      message: `${path} must be a non-empty string.`
+    });
+  }
+}
+function validateStringArray(value, path, errors) {
+  if (!Array.isArray(value) || value.some((entry) => typeof entry !== "string" || entry.length === 0)) {
+    errors.push({
+      path,
+      message: `${path} must be an array of non-empty strings.`
+    });
+  }
+}
+function validateNonNegativeInteger(value, path, errors) {
+  if (typeof value !== "number" || !Number.isInteger(value) || value < 0) {
+    errors.push({
+      path,
+      message: `${path} must be a non-negative integer.`
+    });
+  }
+}
+function validateIsoTimestamp(value, path, errors) {
+  if (typeof value !== "string" || Number.isNaN(Date.parse(value))) {
+    errors.push({
+      path,
+      message: `${path} must be an ISO timestamp.`
+    });
+  }
+}
+function sanitizeBundleOutput(value, forbiddenOutputValues) {
+  return replaceForbiddenValues(
+    cloneSerializable(value),
+    forbiddenOutputValues.filter((entry) => entry.length > 0)
+  );
+}
+function replaceForbiddenValues(value, forbiddenValues) {
+  if (typeof value === "string") {
+    return forbiddenValues.reduce(
+      (current, forbidden) => current.split(forbidden).join("[REDACTED]"),
+      value
+    );
+  }
+  if (value === null || typeof value !== "object" || value instanceof Date) {
+    return value;
+  }
+  if (Array.isArray(value)) {
+    return value.map((entry) => replaceForbiddenValues(entry, forbiddenValues));
+  }
+  return Object.fromEntries(
+    Object.entries(value).map(([key, entry]) => [
+      key,
+      replaceForbiddenValues(entry, forbiddenValues)
+    ])
+  );
+}
+function cloneSerializable(value) {
+  if (value === void 0) {
+    return value;
+  }
+  return JSON.parse(JSON.stringify(value));
+}
+function formatValidationErrors(errors) {
+  return errors.map((error) => `${error.path}: ${error.message}`).join("; ");
+}
+function formatInlineList(values) {
+  return values.length > 0 ? values.join(", ") : "none";
+}
+function isRecord(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+
+export {
+  PROVIDER_CATALOG_POLICY_BUNDLE_SCHEMA_VERSION,
+  createProviderCatalogPolicyBundle,
+  validateProviderCatalogPolicyBundle,
+  assertProviderCatalogPolicyBundle,
+  formatProviderCatalogPolicyBundle,
+  verifyProviderCatalogPolicyBundleRuntime
+};
+//# sourceMappingURL=chunk-CXZOO3U4.js.map