stylegallery 0.1.0

package/scripts/agent-native/fixture.mjs

@@ -0,0 +1,159 @@
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { parseStrictJson } from "../strict-json.mjs";
+import { deepFreeze, hashCanonical } from "./canonical-json.mjs";
+import { defineOperation } from "./execution.mjs";
+import { createManifest, createStableRef, createVersionId } from "./identity.mjs";
+import {
+  createClaim,
+  createEvidenceLink,
+  createGovernanceDecision,
+  createPolicyDisposition,
+  createValidationReport,
+} from "./knowledge.mjs";
+
+export const EDITORIAL_PROFILE_REF = "sg:profile/editorial-reference-profile";
+export const FIXTURE_MANIFEST_REF = "sg:manifest/agent-native-fixture";
+export const REGISTRY_SOURCE_URL = new URL("../../consumer-reference/agent-native/registry.json", import.meta.url);
+
+export class FixtureError extends TypeError {
+  constructor(code, message, recordPath = "") {
+    super(message);
+    this.name = "FixtureError";
+    this.code = code;
+    if (recordPath) this.path = recordPath;
+  }
+}
+
+function fail(code, message, recordPath = "") {
+  throw new FixtureError(code, message, recordPath);
+}
+
+function plainObject(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+function repositoryRoot() {
+  return path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../..");
+}
+
+function safeRepositoryFile(relative) {
+  if (typeof relative !== "string" || relative.length === 0 || path.isAbsolute(relative)) {
+    fail("fixture_source_path_invalid", "repository_path must be a non-empty relative path", "repository_path");
+  }
+  const root = repositoryRoot();
+  const target = path.resolve(root, relative);
+  const local = path.relative(root, target);
+  if (local !== relative || local.startsWith(`..${path.sep}`)) {
+    fail("fixture_source_path_invalid", "repository_path must remain normalized inside the repository", relative);
+  }
+  let current = root;
+  for (const segment of relative.split("/")) {
+    current = path.join(current, segment);
+    if (!fs.existsSync(current)) fail("fixture_source_missing", "fixture source does not exist", relative);
+    if (fs.lstatSync(current).isSymbolicLink()) fail("fixture_source_symlink", "fixture source must not traverse a symlink", relative);
+  }
+  if (!fs.lstatSync(target).isFile()) fail("fixture_source_type_invalid", "fixture source must be a regular file", relative);
+  return target;
+}
+
+function verifyProjectedSource(seed) {
+  if (!Object.hasOwn(seed, "repository_path")) return;
+  const expected = seed.canonical_sha256;
+  if (typeof expected !== "string" || !/^[a-f0-9]{64}$/.test(expected)) {
+    fail("fixture_source_digest_invalid", "canonical_sha256 must be 64 lowercase hex characters", seed.stable_ref);
+  }
+  const file = safeRepositoryFile(seed.repository_path);
+  let value;
+  try {
+    value = parseStrictJson(fs.readFileSync(file, "utf8"));
+  } catch (error) {
+    fail("fixture_source_json_invalid", error instanceof Error ? error.message : String(error), seed.repository_path);
+  }
+  const actual = hashCanonical(value).slice("sha256:".length);
+  if (actual !== expected) fail("fixture_source_digest_mismatch", "projected source changed; create a new registry version", seed.repository_path);
+}
+
+function versionedGeneric(seed) {
+  const payload = structuredClone(seed);
+  payload.schema_version ??= "1.0";
+  delete payload.version_id;
+  delete payload.versionId;
+  const stableRef = createStableRef(payload.stable_ref);
+  return deepFreeze({ ...payload, version_id: createVersionId({ stableRef, payload }) });
+}
+
+function materialize(seed, sourceRecords = new Map()) {
+  verifyProjectedSource(seed);
+  switch (seed.record_kind) {
+    case "claim": return createClaim(seed);
+    case "evidence_link": return createEvidenceLink(seed);
+    case "validation_report": return createValidationReport(seed);
+    case "governance_decision": return createGovernanceDecision(seed);
+    case "policy_disposition": return createPolicyDisposition(seed);
+    case "operation": return defineOperation(seed);
+    case "execution_receipt": {
+      const source = sourceRecords.get(seed.fixture_record_ref);
+      if (!source || source.record_kind !== "executable_fixture") {
+        fail("fixture_receipt_source_missing", "execution receipt must reference an executable fixture", seed.stable_ref);
+      }
+      if (seed.fixture_version_id !== undefined && seed.fixture_version_id !== source.version_id) {
+        fail("fixture_receipt_version_mismatch", "execution receipt fixture_version_id must match the executable fixture VersionID", seed.stable_ref);
+      }
+      return versionedGeneric({ ...seed, fixture_version_id: source.version_id });
+    }
+    default: return versionedGeneric(seed);
+  }
+}
+
+function validateSeed(seed) {
+  if (!plainObject(seed)) fail("fixture_registry_invalid", "registry source must contain an object");
+  if (seed.schema_version !== "1.0") fail("fixture_schema_version_unsupported", "registry schema_version must be 1.0", "schema_version");
+  if (seed.fixture_ref !== FIXTURE_MANIFEST_REF) fail("fixture_manifest_ref_invalid", `fixture_ref must be ${FIXTURE_MANIFEST_REF}`, "fixture_ref");
+  if (!Array.isArray(seed.records)) fail("fixture_records_required", "registry records must be an array", "records");
+  const refs = seed.records.map((record, index) => {
+    if (!plainObject(record)) fail("fixture_record_invalid", "registry records must be objects", `records/${index}`);
+    try { return createStableRef(record.stable_ref); } catch (error) {
+      fail(error.code ?? "fixture_stable_ref_invalid", error.message, `records/${index}/stable_ref`);
+    }
+  });
+  if (new Set(refs).size !== refs.length) fail("fixture_stable_ref_duplicate", "fixture StableRefs must be unique", "records");
+  if (!refs.includes(EDITORIAL_PROFILE_REF)) fail("fixture_editorial_profile_missing", `fixture must contain ${EDITORIAL_PROFILE_REF}`, "records");
+}
+
+export function loadRegistrySeed(source = REGISTRY_SOURCE_URL) {
+  const file = source instanceof URL ? fileURLToPath(source) : path.resolve(String(source));
+  if (!fs.existsSync(file) || fs.lstatSync(file).isSymbolicLink() || !fs.lstatSync(file).isFile()) {
+    fail("fixture_registry_file_invalid", "registry source must be a regular non-symlink file", file);
+  }
+  let seed;
+  try { seed = parseStrictJson(fs.readFileSync(file, "utf8")); } catch (error) {
+    fail("fixture_registry_json_invalid", error instanceof Error ? error.message : String(error), file);
+  }
+  validateSeed(seed);
+  return deepFreeze(seed);
+}
+
+export function createAgentNativeFixture(input = {}) {
+  const seed = input.seed ?? loadRegistrySeed(input.source);
+  validateSeed(seed);
+  const materializedSources = new Map(seed.records
+    .filter((record) => record.record_kind !== "execution_receipt")
+    .map((record) => materialize(record))
+    .map((record) => [record.stable_ref, record]));
+  const records = seed.records.map((record) => record.record_kind === "execution_receipt"
+    ? materialize(record, materializedSources)
+    : materializedSources.get(record.stable_ref)).sort((left, right) => (
+    left.stable_ref < right.stable_ref ? -1 : left.stable_ref > right.stable_ref ? 1 : 0
+  ));
+  const entries = records.map((record) => ({
+    content_sha256: hashCanonical(record).slice("sha256:".length),
+    stable_ref: record.stable_ref,
+    version_id: record.version_id,
+  }));
+  const manifest = createManifest({ manifest_ref: seed.fixture_ref, entries, schema_version: seed.schema_version });
+  return deepFreeze({ fixture_ref: seed.fixture_ref, manifest, records, schema_version: seed.schema_version });
+}
+
+export const agentNativeFixture = createAgentNativeFixture();

package/scripts/agent-native/identity.mjs

@@ -0,0 +1,184 @@
+import { deepFreeze, hashCanonical } from "./canonical-json.mjs";
+
+export class IdentityError extends TypeError {
+  constructor(code, message, path = "") {
+    super(message);
+    this.name = "IdentityError";
+    this.code = code;
+    if (path) this.path = path;
+  }
+}
+
+const KEBAB = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+export const STABLE_REF_KINDS = Object.freeze([
+  "profile", "artifact", "claim", "evidence", "validation", "governance", "operation", "task", "proposal", "view",
+  "agent", "validator", "observer", "governor", "capability", "receipt", "run", "effect", "context", "manifest", "policy", "connector", "event", "snapshot", "source", "skill",
+]);
+const KIND_SET = new Set(STABLE_REF_KINDS);
+
+function fail(code, message, path) {
+  throw new IdentityError(code, message, path);
+}
+
+function inputValue(input, names) {
+  if (typeof input === "string") return input;
+  if (!input || typeof input !== "object") return undefined;
+  for (const name of names) if (Object.hasOwn(input, name)) return input[name];
+  return undefined;
+}
+
+function requireRef(value, path = "stable_ref") {
+  if (typeof value !== "string") fail("stable_ref_required", "StableRef must be a string", path);
+  const match = /^sg:([a-z0-9-]+)\/([a-z0-9]+(?:-[a-z0-9]+)*)$/.exec(value);
+  if (!match || !KIND_SET.has(match[1])) fail("stable_ref_invalid", "StableRef must match the governed sg:<kind>/<kebab-id> grammar", path);
+  return { stable_ref: value, kind: match[1], id: match[2] };
+}
+
+export function createStableRef(input) {
+  const value = typeof input === "string" ? input : undefined;
+  if (value) return requireRef(value).stable_ref;
+  const kind = inputValue(input, ["kind", "namespace", "type"]);
+  const id = inputValue(input, ["id", "opaque_id", "opaqueId"]);
+  if (typeof kind !== "string" || typeof id !== "string") fail("stable_ref_parts_required", "createStableRef requires kind and id");
+  if (!KIND_SET.has(kind) || !KEBAB.test(kind)) fail("stable_ref_kind_invalid", `unsupported StableRef kind ${kind}`, "kind");
+  if (!KEBAB.test(id)) fail("stable_ref_id_invalid", `StableRef id must be kebab-case: ${id}`, "id");
+  return `sg:${kind}/${id}`;
+}
+
+export const stableRef = createStableRef;
+
+export function parseStableRef(input) {
+  const value = inputValue(input, ["stable_ref", "stableRef", "ref", "value"]);
+  const parsed = requireRef(value, "stable_ref");
+  return deepFreeze({ ...parsed, stableRef: parsed.stable_ref, opaque_id: parsed.id, opaqueId: parsed.id });
+}
+
+export const parseRef = parseStableRef;
+
+function payloadOf(input) {
+  if (!input || typeof input !== "object" || Array.isArray(input)) return input;
+  if (Object.hasOwn(input, "payload")) return input.payload;
+  if (Object.hasOwn(input, "version_payload")) return input.version_payload;
+  if (Object.hasOwn(input, "versionPayload")) return input.versionPayload;
+  return input;
+}
+
+function versionContent(stable_ref, payload) {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
+    return { stable_ref, content: payload };
+  }
+  const copy = { ...payload };
+  delete copy.stable_ref;
+  delete copy.stableRef;
+  delete copy.ref;
+  delete copy.version_id;
+  delete copy.versionId;
+  return { stable_ref, ...copy };
+}
+
+function digestPayload(stable_ref, payload) {
+  return hashCanonical(versionContent(stable_ref, payload)).replace(/^sha256:/, "");
+}
+
+export function createVersionId(input) {
+  const payload = payloadOf(input);
+  const ref = inputValue(input, ["stable_ref", "stableRef", "ref"]) ?? (payload && typeof payload === "object" ? inputValue(payload, ["stable_ref", "stableRef", "ref"]) : undefined);
+  const stable_ref = createStableRef(ref);
+  return `${stable_ref}@sha256:${digestPayload(stable_ref, payload)}`;
+}
+
+export const versionId = createVersionId;
+
+const VERSION_RE = /^(sg:[a-z0-9-]+\/[a-z0-9]+(?:-[a-z0-9]+)*)@sha256:([a-f0-9]{64})$/;
+
+export function parseVersionId(input) {
+  const value = inputValue(input, ["version_id", "versionId", "id", "value"]);
+  if (typeof value !== "string") fail("version_id_required", "VersionID must be a string", "version_id");
+  const match = VERSION_RE.exec(value);
+  if (!match) fail("version_id_invalid", "VersionID must be StableRef@sha256:<64 lowercase hex>", "version_id");
+  const parsedRef = requireRef(match[1]);
+  const expectedRef = typeof input === "string" ? undefined : inputValue(input, ["stable_ref", "stableRef", "ref"]);
+  if (expectedRef !== undefined && createStableRef(expectedRef) !== parsedRef.stable_ref) fail("version_ref_mismatch", "VersionID StableRef does not match the supplied StableRef");
+  const payload = input && typeof input === "object" ? (Object.hasOwn(input, "payload") ? input.payload : Object.hasOwn(input, "version_payload") ? input.version_payload : undefined) : undefined;
+  if (payload !== undefined && digestPayload(parsedRef.stable_ref, payload) !== match[2]) fail("version_digest_mismatch", "VersionID digest does not match the supplied payload", "version_id");
+  return deepFreeze({ version_id: value, versionId: value, stable_ref: parsedRef.stable_ref, stableRef: parsedRef.stable_ref, digest: match[2], hash_suite: "sha256" });
+}
+
+export const parseVersion = parseVersionId;
+
+function normalizeEntry(entry, index) {
+  const hasIdentity = entry && typeof entry === "object" && (Object.hasOwn(entry, "stable_ref") || Object.hasOwn(entry, "stableRef") || Object.hasOwn(entry, "ref"));
+  const source = hasIdentity ? entry : entry?.object ?? entry?.record ?? entry?.value ?? entry;
+  if (!source || typeof source !== "object") fail("manifest_entry_invalid", "manifest entries must be objects", `/entries/${index}`);
+  const stable_ref = createStableRef(inputValue(source, ["stable_ref", "stableRef", "ref"]));
+  const version_id = inputValue(source, ["version_id", "versionId"]);
+  const hasContent = Object.hasOwn(source, "content");
+  const content = hasContent ? source.content : undefined;
+  if (hasContent && content && typeof content === "object" && !Array.isArray(content)) {
+    const contentRef = inputValue(content, ["stable_ref", "stableRef", "ref"]);
+    if (contentRef !== undefined && createStableRef(contentRef) !== stable_ref) {
+      fail("manifest_content_ref_mismatch", "manifest entry StableRef does not match its supplied content", `/entries/${index}/content/stable_ref`);
+    }
+    const contentVersion = inputValue(content, ["version_id", "versionId"]);
+    if (contentVersion !== undefined && contentVersion !== version_id) {
+      fail("manifest_content_version_mismatch", "manifest entry VersionID does not match its supplied content", `/entries/${index}/content/version_id`);
+    }
+  }
+  parseVersionId({ version_id, stable_ref, ...(hasContent ? { payload: content } : {}) });
+  let content_sha256 = inputValue(source, ["content_sha256", "contentHash", "sha256"]);
+  const expectedContentSha = hasContent ? hashCanonical(content).replace(/^sha256:/, "") : undefined;
+  if (content_sha256 === undefined && hasContent) content_sha256 = expectedContentSha;
+  if (typeof content_sha256 !== "string" || !/^[a-f0-9]{64}$/.test(content_sha256)) fail("manifest_content_hash_invalid", "manifest entry content_sha256 must be 64 lowercase hex characters", `/entries/${index}/content_sha256`);
+  if (hasContent && content_sha256 !== expectedContentSha) fail("manifest_content_digest_mismatch", "manifest entry content_sha256 does not match its supplied content", `/entries/${index}/content_sha256`);
+  return { stable_ref, version_id, content_sha256, ...(hasContent ? { content: structuredClone(content) } : {}) };
+}
+
+function manifestBody(manifest, includeVersion) {
+  const body = { schema_version: manifest.schema_version, manifest_ref: manifest.manifest_ref, entries: manifest.entries };
+  if (includeVersion) body.version_id = manifest.version_id;
+  return body;
+}
+
+export function createManifest(input = {}) {
+  const manifest_ref = createStableRef(inputValue(input, ["manifest_ref", "manifestRef", "ref"]));
+  const rawEntries = inputValue(input, ["entries", "objects", "records"]) ?? [];
+  if (!Array.isArray(rawEntries)) fail("manifest_entries_required", "manifest entries must be an array", "entries");
+  const entries = rawEntries.map(normalizeEntry).sort((left, right) => left.stable_ref < right.stable_ref ? -1 : left.stable_ref > right.stable_ref ? 1 : 0);
+  if (new Set(entries.map((entry) => entry.stable_ref)).size !== entries.length) fail("manifest_entry_duplicate", "manifest entries must have unique StableRefs", "entries");
+  const base = { schema_version: input.schema_version ?? input.schemaVersion ?? "1.0", manifest_ref, entries };
+  const version_id = `${manifest_ref}@sha256:${hashCanonical(base).replace(/^sha256:/, "")}`;
+  const sha256 = hashCanonical({ ...base, version_id }).replace(/^sha256:/, "");
+  return deepFreeze({ ...base, version_id, sha256 });
+}
+
+export const makeManifest = createManifest;
+
+export function verifyManifest(input) {
+  const manifest = input?.manifest ?? input;
+  const failures = [];
+  if (!manifest || typeof manifest !== "object") return { ok: false, failures: [{ code: "manifest_required", message: "manifest must be an object" }] };
+  let ref;
+  try { ref = createStableRef(manifest.manifest_ref); } catch (error) { failures.push({ code: error.code ?? "manifest_ref_invalid", message: error.message, path: "manifest_ref" }); }
+  const entries = manifest.entries;
+  if (!Array.isArray(entries)) failures.push({ code: "manifest_entries_required", message: "manifest entries must be an array", path: "entries" });
+  else {
+    const refs = [];
+    for (let index = 0; index < entries.length; index += 1) {
+      for (const alias of ["stableRef", "ref", "versionId", "contentHash"]) {
+        if (Object.hasOwn(entries[index] ?? {}, alias)) failures.push({ code: "manifest_alias_forbidden", message: `${alias} is not a canonical manifest entry key`, path: `/entries/${index}/${alias}` });
+      }
+      try { refs.push(normalizeEntry(entries[index], index).stable_ref); } catch (error) { failures.push({ code: error.code ?? "manifest_entry_invalid", message: error.message, path: error.path ?? `/entries/${index}` }); }
+    }
+    if (new Set(refs).size !== refs.length) failures.push({ code: "manifest_entry_duplicate", message: "manifest entries must be unique", path: "entries" });
+    if (refs.some((entry, index) => index > 0 && refs[index - 1] > entry)) failures.push({ code: "manifest_entries_unsorted", message: "manifest entries must be sorted by StableRef", path: "entries" });
+  }
+  if (failures.length === 0) {
+    const expectedVersion = `${ref}@sha256:${hashCanonical(manifestBody(manifest, false)).replace(/^sha256:/, "")}`;
+    const expectedSha = hashCanonical(manifestBody({ ...manifest, version_id: expectedVersion }, true)).replace(/^sha256:/, "");
+    if (manifest.version_id !== expectedVersion) failures.push({ code: "manifest_version_mismatch", message: "manifest VersionID does not match canonical entries", path: "version_id" });
+    if (manifest.sha256 !== expectedSha) failures.push({ code: "manifest_digest_mismatch", message: "manifest sha256 does not match canonical bytes", path: "sha256" });
+  }
+  return deepFreeze({ ok: failures.length === 0, failures });
+}
+
+export const validateManifest = verifyManifest;

package/scripts/agent-native/immutable-store.mjs

@@ -0,0 +1,102 @@
+import { canonicalize, cloneAndFreeze, deepFreeze } from "./canonical-json.mjs";
+import { parseStableRef, parseVersionId } from "./identity.mjs";
+
+export class ImmutableStoreError extends TypeError {
+  constructor(code, message, path = "") {
+    super(message);
+    this.name = "ImmutableStoreError";
+    this.code = code;
+    if (path) this.path = path;
+  }
+}
+
+function fail(code, message, path) {
+  throw new ImmutableStoreError(code, message, path);
+}
+
+function recordRef(record) {
+  const stable_ref = record?.stable_ref ?? record?.stableRef;
+  const version_id = record?.version_id ?? record?.versionId;
+  if (typeof stable_ref !== "string") fail("store_stable_ref_required", "append requires a StableRef", "stable_ref");
+  if (typeof version_id !== "string") fail("store_version_id_required", "append requires a VersionID", "version_id");
+  parseStableRef(stable_ref);
+  parseVersionId({ version_id, stable_ref, payload: record });
+  return { stable_ref, version_id };
+}
+
+function cloneRecord(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) fail("store_record_invalid", "append requires an object record");
+  try { canonicalize(value); } catch (error) { fail(error.code ?? "store_record_invalid", error.message); }
+  return cloneAndFreeze(value);
+}
+
+function compare(left, right) {
+  if (left < right) return -1;
+  if (left > right) return 1;
+  return 0;
+}
+
+/** Create an append-only in-memory store exposing only frozen copies. */
+export function createImmutableStore(input = {}) {
+  const byVersion = new Map();
+  const byStableRef = new Map();
+  const initial = input.entries ?? input.records ?? [];
+  if (!Array.isArray(initial)) fail("store_entries_required", "store entries must be an array", "entries");
+
+  const append = (candidate) => {
+    const value = !candidate?.stable_ref && !candidate?.stableRef
+      ? (candidate?.object ?? candidate?.record ?? candidate?.value ?? candidate)
+      : candidate;
+    const { stable_ref, version_id } = recordRef(value);
+    const frozen = cloneRecord(value);
+    const existing = byVersion.get(version_id);
+    if (existing) {
+      if (canonicalize(existing) !== canonicalize(frozen)) fail("store_version_conflict", "VersionID is already bound to different immutable bytes", "version_id");
+      return existing;
+    }
+    byVersion.set(version_id, frozen);
+    const versions = byStableRef.get(stable_ref) ?? [];
+    byStableRef.set(stable_ref, [...versions, frozen]);
+    return frozen;
+  };
+
+  for (const entry of initial) append(entry);
+
+  const entries = () => [...byVersion.values()].sort((left, right) => compare(left.stable_ref ?? left.stableRef, right.stable_ref ?? right.stableRef) || compare(left.version_id ?? left.versionId, right.version_id ?? right.versionId));
+  const resolve = (reference) => {
+    const value = typeof reference === "string" ? reference : reference?.stable_ref ?? reference?.stableRef ?? reference?.version_id ?? reference?.versionId;
+    if (typeof value !== "string") fail("store_reference_required", "resolve requires a StableRef or VersionID");
+    if (value.includes("@sha256:")) {
+      parseVersionId(value);
+      return byVersion.get(value);
+    }
+    try { parseStableRef(value); } catch (error) { fail(error.code ?? "store_reference_invalid", error.message); }
+    const versions = byStableRef.get(value) ?? [];
+    return versions.length === 0 ? undefined : versions[versions.length - 1];
+  };
+
+  const snapshot = () => deepFreeze({ entries: entries(), size: byVersion.size });
+  return deepFreeze({
+    append,
+    get: resolve,
+    resolve,
+    has: (reference) => resolve(reference) !== undefined,
+    entries: snapshot,
+    listEntries: snapshot,
+    all: snapshot,
+    snapshot,
+    get size() { return byVersion.size; },
+  });
+}
+
+export const createStore = createImmutableStore;
+
+export function appendImmutable(input) {
+  if (!input || typeof input !== "object") fail("store_input_required", "appendImmutable requires {store, record}");
+  const store = input.store ?? input.target;
+  const record = input.record ?? input.object ?? input.value;
+  if (!store || typeof store.append !== "function") fail("store_required", "appendImmutable requires an immutable store", "store");
+  return store.append(record);
+}
+
+export const appendObject = appendImmutable;

package/scripts/agent-native/knowledge.mjs

@@ -0,0 +1,168 @@
+import { createVersionId } from "./identity.mjs";
+import { deepFreeze } from "./canonical-json.mjs";
+
+const CONTROL_KEYS = new Set(["schema_version", "record_kind", "kind", "type", "version_id", "versionId"]);
+
+function clone(value) {
+  return value === undefined ? value : structuredClone(value);
+}
+
+function own(input, ...keys) {
+  for (const key of keys) if (Object.hasOwn(input, key)) return input[key];
+  return undefined;
+}
+
+function requiredObject(input, name) {
+  if (!input || typeof input !== "object" || Array.isArray(input)) throw new TypeError(`${name} expects an object parameter`);
+  return input;
+}
+
+function stableRefOf(input, name) {
+  const stableRef = own(input, "stable_ref", "stableRef");
+  if (typeof stableRef !== "string" || stableRef.length === 0) throw new TypeError(`${name}.stable_ref is required`);
+  return stableRef;
+}
+
+function canonicalFields(input, stableRef, recordKind) {
+  const fields = {};
+  for (const [key, value] of Object.entries(input)) {
+    if (!CONTROL_KEYS.has(key) && key !== "stable_ref" && key !== "stableRef") fields[key] = clone(value);
+  }
+  return { schema_version: "1.0", record_kind: recordKind, stable_ref: stableRef, ...fields };
+}
+
+function createRecord(input, recordKind, name) {
+  const source = requiredObject(input, name);
+  const stableRef = stableRefOf(source, name);
+  const record = canonicalFields(source, stableRef, recordKind);
+  const versionId = createVersionId({ stableRef, payload: record });
+  if (typeof versionId !== "string" || !/^sg:[^@]+@sha256:[a-f0-9]{64}$/.test(versionId)) {
+    throw new TypeError(`${name} received an invalid VersionID from the identity kernel`);
+  }
+  const supplied = own(source, "version_id", "versionId");
+  if (supplied !== undefined && supplied !== versionId) throw new TypeError(`${name}.version_id does not match its content`);
+  return deepFreeze({ ...record, version_id: versionId });
+}
+
+export function createClaim(input) {
+  return createRecord(input, "claim", "createClaim");
+}
+
+export const makeClaim = createClaim;
+
+export function createEvidenceLink(input) {
+  const source = requiredObject(input, "createEvidenceLink");
+  const normalized = { ...source };
+  const aliases = [
+    ["claim_ref", "claimRef"],
+    ["claim_version", "claimVersion"],
+    ["source_ref", "sourceRef"],
+    ["source_version", "sourceVersion"],
+    ["independence_group", "independenceGroup"],
+  ];
+  for (const [canonical, alias] of aliases) {
+    if (!Object.hasOwn(normalized, canonical) && Object.hasOwn(normalized, alias)) normalized[canonical] = normalized[alias];
+    delete normalized[alias];
+  }
+  const polarity = own(normalized, "polarity", "stance");
+  if (typeof polarity === "string") normalized.polarity = polarity.toUpperCase();
+  return createRecord(normalized, "evidence_link", "createEvidenceLink");
+}
+
+export const makeEvidenceLink = createEvidenceLink;
+export const createEvidence = createEvidenceLink;
+export const makeEvidence = createEvidenceLink;
+
+export function createAttestation(input) {
+  const source = requiredObject(input, "createAttestation");
+  const normalized = { ...source };
+  if (!Object.hasOwn(normalized, "claim_ref") && Object.hasOwn(normalized, "claimRef")) normalized.claim_ref = normalized.claimRef;
+  if (!Object.hasOwn(normalized, "claim_version") && Object.hasOwn(normalized, "claimVersion")) normalized.claim_version = normalized.claimVersion;
+  if (typeof normalized.polarity === "string") normalized.polarity = normalized.polarity.toUpperCase();
+  delete normalized.claimRef;
+  delete normalized.claimVersion;
+  return createRecord(normalized, "attestation", "createAttestation");
+}
+
+export const makeAttestation = createAttestation;
+
+export function createValidationReport(input) {
+  const source = requiredObject(input, "createValidationReport");
+  const normalized = { ...source };
+  if (!Object.hasOwn(normalized, "claim_ref") && Object.hasOwn(normalized, "claimRef")) normalized.claim_ref = normalized.claimRef;
+  if (!Object.hasOwn(normalized, "claim_version") && Object.hasOwn(normalized, "claimVersion")) normalized.claim_version = normalized.claimVersion;
+  if (!Object.hasOwn(normalized, "validator_version") && Object.hasOwn(normalized, "validatorVersion")) normalized.validator_version = normalized.validatorVersion;
+  if (typeof normalized.status === "string") normalized.status = normalized.status.toUpperCase();
+  delete normalized.claimRef;
+  delete normalized.claimVersion;
+  delete normalized.validatorVersion;
+  return createRecord(normalized, "validation_report", "createValidationReport");
+}
+
+export const makeValidationReport = createValidationReport;
+
+export function createGovernanceDecision(input) {
+  const source = requiredObject(input, "createGovernanceDecision");
+  const normalized = { ...source };
+  if (!Object.hasOwn(normalized, "claim_ref") && Object.hasOwn(normalized, "claimRef")) normalized.claim_ref = normalized.claimRef;
+  if (!Object.hasOwn(normalized, "claim_version") && Object.hasOwn(normalized, "claimVersion")) normalized.claim_version = normalized.claimVersion;
+  if (!Object.hasOwn(normalized, "policy_version") && Object.hasOwn(normalized, "policyVersion")) normalized.policy_version = normalized.policyVersion;
+  if (typeof normalized.decision === "string") normalized.decision = normalized.decision.toUpperCase();
+  delete normalized.claimRef;
+  delete normalized.claimVersion;
+  delete normalized.policyVersion;
+  return createRecord(normalized, "governance_decision", "createGovernanceDecision");
+}
+
+export const makeGovernanceDecision = createGovernanceDecision;
+
+export function createPolicyDisposition(input) {
+  const source = requiredObject(input, "createPolicyDisposition");
+  const normalized = { ...source };
+  if (!Object.hasOwn(normalized, "claim_ref") && Object.hasOwn(normalized, "claimRef")) normalized.claim_ref = normalized.claimRef;
+  if (!Object.hasOwn(normalized, "claim_version") && Object.hasOwn(normalized, "claimVersion")) normalized.claim_version = normalized.claimVersion;
+  if (!Object.hasOwn(normalized, "policy_version") && Object.hasOwn(normalized, "policyVersion")) normalized.policy_version = normalized.policyVersion;
+  delete normalized.claimRef;
+  delete normalized.claimVersion;
+  delete normalized.policyVersion;
+  return createRecord(normalized, "policy_disposition", "createPolicyDisposition");
+}
+
+export const makePolicyDisposition = createPolicyDisposition;
+
+function linksFrom(input) {
+  if (Array.isArray(input)) return input;
+  const source = requiredObject(input, "aggregateEvidence");
+  return own(source, "evidence_links", "evidenceLinks", "evidence") ?? [];
+}
+
+function polarityOf(link) {
+  const value = own(link, "polarity", "stance", "direction");
+  if (typeof value !== "string") return undefined;
+  const polarity = value.toUpperCase();
+  if (["SUPPORT", "SUPPORTED", "POSITIVE", "FOR"].includes(polarity)) return "SUPPORT";
+  if (["REFUTE", "REFUTED", "NEGATIVE", "AGAINST", "CONTRADICT"].includes(polarity)) return "REFUTE";
+  return undefined;
+}
+
+export function aggregateEvidence(input) {
+  const source = Array.isArray(input) ? {} : requiredObject(input, "aggregateEvidence");
+  const links = linksFrom(input).filter((link) => link && typeof link === "object");
+  const support = links.filter((link) => polarityOf(link) === "SUPPORT");
+  const refute = links.filter((link) => polarityOf(link) === "REFUTE");
+  const state = support.length && refute.length ? "BOTH" : support.length ? "SUPPORTED" : refute.length ? "REFUTED" : "NEITHER";
+  const groups = (items) => [...new Set(items.map((link) => own(link, "independence_group", "independenceGroup")).filter((value) => typeof value === "string"))].sort();
+  return deepFreeze({
+    claim_ref: own(source.claim, "stable_ref", "stableRef") ?? own(source, "claim_ref", "claimRef"),
+    claim_version: own(source.claim, "version_id", "versionId") ?? own(source, "claim_version", "claimVersion"),
+    state,
+    evidence_state: state,
+    support_count: support.length,
+    refute_count: refute.length,
+    support_groups: groups(support),
+    refute_groups: groups(refute),
+    evidence_links: links,
+  });
+}
+
+export const aggregateEvidenceState = aggregateEvidence;