@openauditmodel/cli 0.1.0

package/dist/conformance/src/privacy/url-analysis.d.ts

@@ -0,0 +1,40 @@
+/**
+ * URL and connection-string analysis.
+ *
+ * Parsing is done with the WHATWG `URL` parser rather than a regular
+ * expression. URL grammar is genuinely difficult, and a regular expression that
+ * looks right will disagree with a real parser on exactly the inputs an attacker
+ * chooses. Nothing here resolves, fetches or opens anything: the parser is used
+ * as a grammar, offline.
+ */
+/** What was found in a value that parses as a URL. */
+export interface UrlAnalysis {
+    readonly scheme: string;
+    readonly hasUserinfo: boolean;
+    readonly hasPassword: boolean;
+    readonly hasQuery: boolean;
+    readonly hasFragment: boolean;
+}
+/** Parses a value as a URL and reports what it contains. Returns `undefined` if it is not a URL. */
+export declare function analyzeUrl(value: string): UrlAnalysis | undefined;
+/** True when a URL scheme identifies a data store or message broker. */
+export declare function isDataSystemScheme(scheme: string): boolean;
+export type ConnectionStringKind = "credentialed" | "uncredentialed";
+/**
+ * Recognises a key-value connection string such as
+ * `Server=...;Database=...;User Id=...;Password=...`.
+ *
+ * At least two recognised keys are required, so that an arbitrary
+ * semicolon-separated string is not mistaken for one. The pattern is a single
+ * bounded alternation over one key-value pair and cannot backtrack
+ * catastrophically.
+ */
+export declare function analyzeKeyValueConnectionString(value: string): ConnectionStringKind | undefined;
+/**
+ * Recognises a connection string in either URL or key-value form.
+ *
+ * A connection string without a credential is still reported, separately and at
+ * low severity: it discloses infrastructure, but calling it a credential when it
+ * carries none would be wrong.
+ */
+export declare function analyzeConnectionString(value: string): ConnectionStringKind | undefined;

package/dist/conformance/src/privacy/url-analysis.js

@@ -0,0 +1,148 @@
+/**
+ * URL and connection-string analysis.
+ *
+ * Parsing is done with the WHATWG `URL` parser rather than a regular
+ * expression. URL grammar is genuinely difficult, and a regular expression that
+ * looks right will disagree with a real parser on exactly the inputs an attacker
+ * chooses. Nothing here resolves, fetches or opens anything: the parser is used
+ * as a grammar, offline.
+ */
+/**
+ * Schemes whose URL form is a connection string: a locator for a data store or
+ * broker, which commonly carries credentials.
+ */
+const DATA_SYSTEM_SCHEMES = new Set([
+    "postgres:",
+    "postgresql:",
+    "mysql:",
+    "mariadb:",
+    "mongodb:",
+    "mongodb+srv:",
+    "redis:",
+    "rediss:",
+    "amqp:",
+    "amqps:",
+    "mssql:",
+    "sqlserver:",
+    "oracle:",
+    "jdbc:",
+    "cassandra:",
+    "clickhouse:",
+    "db2:",
+    "ftp:",
+    "ftps:",
+    "sftp:",
+    "smb:",
+]);
+/** Keys that appear in key-value connection strings. */
+const CONNECTION_STRING_KEYS = new Set([
+    "server",
+    "host",
+    "hostname",
+    "datasource",
+    "initialcatalog",
+    "database",
+    "userid",
+    "uid",
+    "username",
+    "user",
+    "password",
+    "pwd",
+    "port",
+    "endpoint",
+    "accountname",
+    "accountkey",
+    "sharedaccesskey",
+    "integratedsecurity",
+    "encrypt",
+    "trustservercertificate",
+]);
+/** Keys whose presence with a non-empty value means the string carries a credential. */
+const CONNECTION_STRING_SECRET_KEYS = new Set([
+    "password",
+    "pwd",
+    "accountkey",
+    "sharedaccesskey",
+]);
+/** Parses a value as a URL and reports what it contains. Returns `undefined` if it is not a URL. */
+export function analyzeUrl(value) {
+    const trimmed = value.trim();
+    if (!trimmed.includes(":")) {
+        return undefined;
+    }
+    let url;
+    try {
+        url = new URL(trimmed);
+    }
+    catch {
+        return undefined;
+    }
+    return {
+        scheme: url.protocol,
+        hasUserinfo: url.username !== "" || url.password !== "",
+        hasPassword: url.password !== "",
+        hasQuery: url.search !== "",
+        hasFragment: url.hash !== "",
+    };
+}
+/** True when a URL scheme identifies a data store or message broker. */
+export function isDataSystemScheme(scheme) {
+    return DATA_SYSTEM_SCHEMES.has(scheme.toLowerCase());
+}
+/**
+ * Recognises a key-value connection string such as
+ * `Server=...;Database=...;User Id=...;Password=...`.
+ *
+ * At least two recognised keys are required, so that an arbitrary
+ * semicolon-separated string is not mistaken for one. The pattern is a single
+ * bounded alternation over one key-value pair and cannot backtrack
+ * catastrophically.
+ */
+export function analyzeKeyValueConnectionString(value) {
+    if (!value.includes("=") || !value.includes(";")) {
+        return undefined;
+    }
+    if (value.length > 8192) {
+        return undefined;
+    }
+    let recognisedKeys = 0;
+    let credentialed = false;
+    for (const pair of value.split(";")) {
+        const separator = pair.indexOf("=");
+        if (separator <= 0) {
+            continue;
+        }
+        const key = pair
+            .slice(0, separator)
+            .trim()
+            .toLowerCase()
+            .replaceAll(/[-_. ]/g, "");
+        const hasValue = pair.slice(separator + 1).trim() !== "";
+        if (!CONNECTION_STRING_KEYS.has(key)) {
+            continue;
+        }
+        recognisedKeys += 1;
+        if (CONNECTION_STRING_SECRET_KEYS.has(key) && hasValue) {
+            credentialed = true;
+        }
+    }
+    if (recognisedKeys < 2) {
+        return undefined;
+    }
+    return credentialed ? "credentialed" : "uncredentialed";
+}
+/**
+ * Recognises a connection string in either URL or key-value form.
+ *
+ * A connection string without a credential is still reported, separately and at
+ * low severity: it discloses infrastructure, but calling it a credential when it
+ * carries none would be wrong.
+ */
+export function analyzeConnectionString(value) {
+    const url = analyzeUrl(value);
+    if (url !== undefined && isDataSystemScheme(url.scheme)) {
+        return url.hasPassword ? "credentialed" : "uncredentialed";
+    }
+    return analyzeKeyValueConnectionString(value);
+}
+//# sourceMappingURL=url-analysis.js.map

package/dist/conformance/src/privacy/url-analysis.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"url-analysis.js","sourceRoot":"","sources":["../../../../conformance/src/privacy/url-analysis.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAWH;;;GAGG;AACH,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAAC;IACvD,WAAW;IACX,aAAa;IACb,QAAQ;IACR,UAAU;IACV,UAAU;IACV,cAAc;IACd,QAAQ;IACR,SAAS;IACT,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,YAAY;IACZ,SAAS;IACT,OAAO;IACP,YAAY;IACZ,aAAa;IACb,MAAM;IACN,MAAM;IACN,OAAO;IACP,OAAO;IACP,MAAM;CACP,CAAC,CAAC;AAEH,wDAAwD;AACxD,MAAM,sBAAsB,GAAwB,IAAI,GAAG,CAAC;IAC1D,QAAQ;IACR,MAAM;IACN,UAAU;IACV,YAAY;IACZ,gBAAgB;IAChB,UAAU;IACV,QAAQ;IACR,KAAK;IACL,UAAU;IACV,MAAM;IACN,UAAU;IACV,KAAK;IACL,MAAM;IACN,UAAU;IACV,aAAa;IACb,YAAY;IACZ,iBAAiB;IACjB,oBAAoB;IACpB,SAAS;IACT,wBAAwB;CACzB,CAAC,CAAC;AAEH,wFAAwF;AACxF,MAAM,6BAA6B,GAAwB,IAAI,GAAG,CAAC;IACjE,UAAU;IACV,KAAK;IACL,YAAY;IACZ,iBAAiB;CAClB,CAAC,CAAC;AAEH,oGAAoG;AACpG,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO;QACL,MAAM,EAAE,GAAG,CAAC,QAAQ;QACpB,WAAW,EAAE,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE;QACvD,WAAW,EAAE,GAAG,CAAC,QAAQ,KAAK,EAAE;QAChC,QAAQ,EAAE,GAAG,CAAC,MAAM,KAAK,EAAE;QAC3B,WAAW,EAAE,GAAG,CAAC,IAAI,KAAK,EAAE;KAC7B,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAC/C,OAAO,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;AACvD,CAAC;AAID;;;;;;;;GAQG;AACH,MAAM,UAAU,+BAA+B,CAAC,KAAa;IAC3D,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACjD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,cAAc,GAAG,CAAC,CAAC;IACvB,IAAI,YAAY,GAAG,KAAK,CAAC;IAEzB,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;YACnB,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,IAAI;aACb,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC;aACnB,IAAI,EAAE;aACN,WAAW,EAAE;aACb,UAAU,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;QAEzD,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACrC,SAAS;QACX,CAAC;QACD,cAAc,IAAI,CAAC,CAAC;QACpB,IAAI,6BAA6B,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,QAAQ,EAAE,CAAC;YACvD,YAAY,GAAG,IAAI,CAAC;QACtB,CAAC;IACH,CAAC;IAED,IAAI,cAAc,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,YAAY,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,gBAAgB,CAAC;AAC1D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAa;IACnD,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,GAAG,KAAK,SAAS,IAAI,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACxD,OAAO,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,gBAAgB,CAAC;IAC7D,CAAC;IACD,OAAO,+BAA+B,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC"}

package/dist/conformance/src/profiles/check-profile.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Profile conformance checking for a single event.
+ *
+ * The order is fixed and matters: core validation first, then rule selection,
+ * then evaluation. An event that does not conform to the core model is reported
+ * as core-invalid and its profile rules are **not** evaluated, because a profile
+ * only ever adds requirements to a conforming event. Reporting profile
+ * conformance for an event the core rejects would be the one thing a profile
+ * must never do.
+ */
+import type { EventValidator } from "../validate-core.js";
+import { type ProfileCheckResult, type ProfileDefinition } from "./types.js";
+export interface CheckProfileOptions {
+    /** Validate against the canonical core schema first. Defaults to true. */
+    readonly validateCore?: boolean;
+}
+/**
+ * Checks one event against one profile.
+ *
+ * The input event is never modified: every step reads.
+ */
+export declare function checkProfile(event: unknown, label: string, profile: ProfileDefinition, validator: EventValidator, options?: CheckProfileOptions): ProfileCheckResult;

package/dist/conformance/src/profiles/check-profile.js

@@ -0,0 +1,72 @@
+import { resolvePointer } from "./resolve-pointer.js";
+import { eventName, selectRules } from "./select-rules.js";
+import { evaluateRule } from "./evaluate-rule.js";
+import { supportsCoreVersion, } from "./types.js";
+function eventIdentity(event) {
+    const resolved = resolvePointer(event, "/id");
+    return typeof resolved.value === "string" ? { eventId: resolved.value } : {};
+}
+/**
+ * Checks one event against one profile.
+ *
+ * The input event is never modified: every step reads.
+ */
+export function checkProfile(event, label, profile, validator, options = {}) {
+    const identity = eventIdentity(event);
+    const descriptor = { name: profile.name, version: profile.version };
+    const base = {
+        label,
+        ...identity,
+        profile: descriptor,
+        matchedRules: [],
+        errors: [],
+        warnings: [],
+        coreIssues: [],
+    };
+    if (options.validateCore !== false) {
+        const issues = validator.validateEvent(event);
+        if (issues.length > 0) {
+            const shown = issues.slice(0, 5).map((issue) => `${issue.path}  ${issue.message}`);
+            return {
+                ...base,
+                status: "core-invalid",
+                coreValid: false,
+                profileValid: false,
+                coreIssues: issues.length > shown.length
+                    ? [...shown, `and ${issues.length - shown.length} further core schema issues`]
+                    : shown,
+            };
+        }
+    }
+    // A profile states which core versions it applies to. An event declaring
+    // another version is outside its scope, not in violation of it.
+    const specVersion = resolvePointer(event, "/specVersion").value;
+    if (!supportsCoreVersion(profile, specVersion)) {
+        return { ...base, status: "not-applicable", coreValid: true, profileValid: true };
+    }
+    const name = eventName(event);
+    if (name === undefined) {
+        return { ...base, status: "not-applicable", coreValid: true, profileValid: true };
+    }
+    const rules = selectRules(profile, name);
+    if (rules.length === 0) {
+        return { ...base, status: "not-applicable", coreValid: true, profileValid: true };
+    }
+    const errors = [];
+    const warnings = [];
+    for (const rule of rules) {
+        const evaluation = evaluateRule(event, rule);
+        errors.push(...evaluation.errors);
+        warnings.push(...evaluation.warnings);
+    }
+    return {
+        ...base,
+        status: errors.length === 0 ? "conforming" : "violations",
+        coreValid: true,
+        profileValid: errors.length === 0,
+        matchedRules: rules.map((rule) => rule.id),
+        errors,
+        warnings,
+    };
+}
+//# sourceMappingURL=check-profile.js.map

package/dist/conformance/src/profiles/check-profile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-profile.js","sourceRoot":"","sources":["../../../../conformance/src/profiles/check-profile.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EACL,mBAAmB,GAIpB,MAAM,YAAY,CAAC;AAOpB,SAAS,aAAa,CAAC,KAAc;IACnC,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC9C,OAAO,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAC1B,KAAc,EACd,KAAa,EACb,OAA0B,EAC1B,SAAyB,EACzB,UAA+B,EAAE;IAEjC,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,UAAU,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;IAEpE,MAAM,IAAI,GAAG;QACX,KAAK;QACL,GAAG,QAAQ;QACX,OAAO,EAAE,UAAU;QACnB,YAAY,EAAE,EAAuB;QACrC,MAAM,EAAE,EAA+B;QACvC,QAAQ,EAAE,EAA+B;QACzC,UAAU,EAAE,EAAuB;KACpC,CAAC;IAEF,IAAI,OAAO,CAAC,YAAY,KAAK,KAAK,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YACnF,OAAO;gBACL,GAAG,IAAI;gBACP,MAAM,EAAE,cAAc;gBACtB,SAAS,EAAE,KAAK;gBAChB,YAAY,EAAE,KAAK;gBACnB,UAAU,EACR,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM;oBAC1B,CAAC,CAAC,CAAC,GAAG,KAAK,EAAE,OAAO,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,6BAA6B,CAAC;oBAC9E,CAAC,CAAC,KAAK;aACZ,CAAC;QACJ,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,gEAAgE;IAChE,MAAM,WAAW,GAAG,cAAc,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC,KAAK,CAAC;IAChE,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC;QAC/C,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,gBAAgB,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IACpF,CAAC;IAED,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,gBAAgB,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IACpF,CAAC;IAED,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACzC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,gBAAgB,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IACpF,CAAC;IAED,MAAM,MAAM,GAAqB,EAAE,CAAC;IACpC,MAAM,QAAQ,GAAqB,EAAE,CAAC;IAEtC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC7C,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;QAClC,QAAQ,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IAED,OAAO;QACL,GAAG,IAAI;QACP,MAAM,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY;QACzD,SAAS,EAAE,IAAI;QACf,YAAY,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;QACjC,YAAY,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,MAAM;QACN,QAAQ;KACT,CAAC;AACJ,CAAC"}

package/dist/conformance/src/profiles/evaluate-rule.d.ts

@@ -0,0 +1,27 @@
+import type { Condition, ProfileFinding, ProfileRule, RuleSeverity } from "./types.js";
+/** Default severity for a rule that does not declare one. */
+export declare const DEFAULT_RULE_SEVERITY: RuleSeverity;
+/**
+ * Whether a rule's condition holds.
+ *
+ * A condition is one path compared for equality against one scalar. When the
+ * path is absent the condition does **not** hold, so a conditional requirement
+ * contributes nothing rather than firing on missing data. That is deterministic
+ * and it is also the safer direction: a profile that demanded approval whenever
+ * it could not tell whether a role was privileged would fail every event that
+ * omitted the flag, including events the rule was never meant to govern.
+ */
+export declare function conditionHolds(event: unknown, condition: Condition): boolean;
+export interface RuleEvaluation {
+    readonly applied: boolean;
+    readonly errors: readonly ProfileFinding[];
+    readonly warnings: readonly ProfileFinding[];
+}
+/**
+ * Evaluates one rule against one event.
+ *
+ * `applied` is false when the rule's condition did not hold; the rule still
+ * counts as matched, because it governs the event, but it contributed no
+ * requirements.
+ */
+export declare function evaluateRule(event: unknown, rule: ProfileRule): RuleEvaluation;

package/dist/conformance/src/profiles/evaluate-rule.js

@@ -0,0 +1,87 @@
+/**
+ * Rule evaluation.
+ *
+ * Evaluation reads values and compares them. It never executes anything from a
+ * profile definition, never builds a function, never interprets an expression
+ * and never reaches outside the event it was given. Every check below is a
+ * presence test, a JSON type test or a strict scalar equality.
+ */
+import { concatPointer, isPresent, matchesMetadataType, jsonTypeOf, resolvePointer, } from "./resolve-pointer.js";
+const METADATA_POINTER = "/metadata";
+/** Default severity for a rule that does not declare one. */
+export const DEFAULT_RULE_SEVERITY = "error";
+/**
+ * Whether a rule's condition holds.
+ *
+ * A condition is one path compared for equality against one scalar. When the
+ * path is absent the condition does **not** hold, so a conditional requirement
+ * contributes nothing rather than firing on missing data. That is deterministic
+ * and it is also the safer direction: a profile that demanded approval whenever
+ * it could not tell whether a role was privileged would fail every event that
+ * omitted the flag, including events the rule was never meant to govern.
+ */
+export function conditionHolds(event, condition) {
+    const resolved = resolvePointer(event, condition.path);
+    if (!resolved.found) {
+        return false;
+    }
+    return Object.is(resolved.value, condition.equals);
+}
+function finding(ruleId, path, message, severity) {
+    return { ruleId, path, message, severity };
+}
+/**
+ * Evaluates one rule against one event.
+ *
+ * `applied` is false when the rule's condition did not hold; the rule still
+ * counts as matched, because it governs the event, but it contributed no
+ * requirements.
+ */
+export function evaluateRule(event, rule) {
+    if (rule.when !== undefined && !conditionHolds(event, rule.when)) {
+        return { applied: false, errors: [], warnings: [] };
+    }
+    const severity = rule.severity ?? DEFAULT_RULE_SEVERITY;
+    const failures = [];
+    const warnings = [];
+    for (const pointer of rule.requiredPaths ?? []) {
+        if (!isPresent(resolvePointer(event, pointer))) {
+            failures.push(finding(rule.id, pointer, "required by the profile, but absent or empty", severity));
+        }
+    }
+    for (const requirement of rule.requiredMetadata ?? []) {
+        const pointer = concatPointer(METADATA_POINTER, requirement.path);
+        const resolved = resolvePointer(event, pointer);
+        if (!isPresent(resolved)) {
+            failures.push(finding(rule.id, pointer, `required metadata of type "${requirement.type}", but absent or empty`, severity));
+            continue;
+        }
+        if (!matchesMetadataType(resolved.value, requirement.type)) {
+            failures.push(finding(rule.id, pointer, `required metadata must be of type "${requirement.type}", but is "${jsonTypeOf(resolved.value)}"`, severity));
+        }
+    }
+    for (const requirement of rule.requiredValues ?? []) {
+        const resolved = resolvePointer(event, requirement.path);
+        if (!resolved.found) {
+            failures.push(finding(rule.id, requirement.path, `required by the profile to equal ${JSON.stringify(requirement.equals)}, but absent`, severity));
+            continue;
+        }
+        if (!Object.is(resolved.value, requirement.equals)) {
+            // The expected value comes from the profile definition, not from the
+            // event, so quoting it discloses nothing about the event.
+            failures.push(finding(rule.id, requirement.path, `required by the profile to equal ${JSON.stringify(requirement.equals)}`, severity));
+        }
+    }
+    for (const pointer of rule.recommendedPaths ?? []) {
+        if (!isPresent(resolvePointer(event, pointer))) {
+            warnings.push(finding(rule.id, pointer, "recommended by the profile, but absent or empty", "warning"));
+        }
+    }
+    // A rule declared `info` or `warning` cannot fail conformance; its
+    // requirement violations are reported alongside the recommendations.
+    if (severity === "error") {
+        return { applied: true, errors: failures, warnings };
+    }
+    return { applied: true, errors: [], warnings: [...failures, ...warnings] };
+}
+//# sourceMappingURL=evaluate-rule.js.map

package/dist/conformance/src/profiles/evaluate-rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate-rule.js","sourceRoot":"","sources":["../../../../conformance/src/profiles/evaluate-rule.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EACL,aAAa,EACb,SAAS,EACT,mBAAmB,EACnB,UAAU,EACV,cAAc,GACf,MAAM,sBAAsB,CAAC;AAG9B,MAAM,gBAAgB,GAAG,WAAW,CAAC;AAErC,6DAA6D;AAC7D,MAAM,CAAC,MAAM,qBAAqB,GAAiB,OAAO,CAAC;AAE3D;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAAC,KAAc,EAAE,SAAoB;IACjE,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;IACvD,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACpB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,OAAO,CACd,MAAc,EACd,IAAY,EACZ,OAAe,EACf,QAAsB;IAEtB,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AAC7C,CAAC;AAQD;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,KAAc,EAAE,IAAiB;IAC5D,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACjE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACtD,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,qBAAqB,CAAC;IACxD,MAAM,QAAQ,GAAqB,EAAE,CAAC;IACtC,MAAM,QAAQ,GAAqB,EAAE,CAAC;IAEtC,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,aAAa,IAAI,EAAE,EAAE,CAAC;QAC/C,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;YAC/C,QAAQ,CAAC,IAAI,CACX,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,8CAA8C,EAAE,QAAQ,CAAC,CACpF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,MAAM,WAAW,IAAI,IAAI,CAAC,gBAAgB,IAAI,EAAE,EAAE,CAAC;QACtD,MAAM,OAAO,GAAG,aAAa,CAAC,gBAAgB,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;QAClE,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAEhD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,IAAI,CAAC,EAAE,EACP,OAAO,EACP,8BAA8B,WAAW,CAAC,IAAI,wBAAwB,EACtE,QAAQ,CACT,CACF,CAAC;YACF,SAAS;QACX,CAAC;QAED,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3D,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,IAAI,CAAC,EAAE,EACP,OAAO,EACP,sCAAsC,WAAW,CAAC,IAAI,cAAc,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,EACjG,QAAQ,CACT,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,MAAM,WAAW,IAAI,IAAI,CAAC,cAAc,IAAI,EAAE,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;QAEzD,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACpB,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,IAAI,CAAC,EAAE,EACP,WAAW,CAAC,IAAI,EAChB,oCAAoC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC,cAAc,EACpF,QAAQ,CACT,CACF,CAAC;YACF,SAAS;QACX,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;YACnD,qEAAqE;YACrE,0DAA0D;YAC1D,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,IAAI,CAAC,EAAE,EACP,WAAW,CAAC,IAAI,EAChB,oCAAoC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,EACxE,QAAQ,CACT,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,gBAAgB,IAAI,EAAE,EAAE,CAAC;QAClD,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;YAC/C,QAAQ,CAAC,IAAI,CACX,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,iDAAiD,EAAE,SAAS,CAAC,CACxF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,mEAAmE;IACnE,qEAAqE;IACrE,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IACvD,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,GAAG,QAAQ,EAAE,GAAG,QAAQ,CAAC,EAAE,CAAC;AAC7E,CAAC"}

package/dist/conformance/src/profiles/load-profile.d.ts

@@ -0,0 +1,30 @@
+import { supportsCoreVersion, type ProfileDefinition } from "./types.js";
+/** Re-exported so that existing import sites keep working. */
+export { supportsCoreVersion };
+/** File name a profile definition must use inside its directory. */
+export declare const PROFILE_DEFINITION_FILE = "profile.json";
+/**
+ * Largest profile definition that will be read. A profile is a small document;
+ * anything larger is a mistake or an attempt to exhaust memory.
+ */
+export declare const MAX_PROFILE_BYTES: number;
+export type ProfileLoadResult = {
+    readonly ok: true;
+    readonly profile: ProfileDefinition;
+    readonly file: string;
+} | {
+    readonly ok: false;
+    readonly error: string;
+    readonly issues?: readonly string[];
+};
+/** Absolute path of the directory profiles are loaded from. */
+export declare function profilesDirectory(): string;
+/** Names of the profiles that ship with the repository and carry a definition. */
+export declare function availableProfiles(): string[];
+/**
+ * Loads a profile definition by name and validates it.
+ *
+ * The name is checked against a strict token pattern and joined to the profiles
+ * directory, so `../` and absolute paths cannot escape it.
+ */
+export declare function loadProfile(name: string): ProfileLoadResult;

package/dist/conformance/src/profiles/load-profile.js

@@ -0,0 +1,95 @@
+/**
+ * Loading of profile definitions.
+ *
+ * Profiles are loaded **only** from the repository's own `profiles/` directory,
+ * by name, from a fixed file name. There is no path argument, no remote
+ * registry and no reference resolution: a profile is a set of requirements that
+ * decides whether an audit event is conforming, and letting a caller point that
+ * at an arbitrary file makes conformance mean whatever the caller wants.
+ */
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import path from "node:path";
+import { repositoryRoot, validateProfileDefinition } from "./validate-profile-definition.js";
+import { supportsCoreVersion } from "./types.js";
+/** Re-exported so that existing import sites keep working. */
+export { supportsCoreVersion };
+/** File name a profile definition must use inside its directory. */
+export const PROFILE_DEFINITION_FILE = "profile.json";
+/**
+ * Largest profile definition that will be read. A profile is a small document;
+ * anything larger is a mistake or an attempt to exhaust memory.
+ */
+export const MAX_PROFILE_BYTES = 256 * 1024;
+/** Profile names are directory names, restricted to the same token form as the schema. */
+const PROFILE_NAME = /^[a-z][a-z0-9]*(-[a-z0-9]+)*$/;
+/** Absolute path of the directory profiles are loaded from. */
+export function profilesDirectory() {
+    return path.join(repositoryRoot(), "profiles");
+}
+/** Names of the profiles that ship with the repository and carry a definition. */
+export function availableProfiles() {
+    const root = profilesDirectory();
+    if (!existsSync(root)) {
+        return [];
+    }
+    return readdirSync(root, { withFileTypes: true })
+        .filter((entry) => entry.isDirectory())
+        .map((entry) => entry.name)
+        .filter((name) => existsSync(path.join(root, name, PROFILE_DEFINITION_FILE)))
+        .sort((left, right) => left.localeCompare(right, "en"));
+}
+/**
+ * Loads a profile definition by name and validates it.
+ *
+ * The name is checked against a strict token pattern and joined to the profiles
+ * directory, so `../` and absolute paths cannot escape it.
+ */
+export function loadProfile(name) {
+    if (!PROFILE_NAME.test(name)) {
+        return {
+            ok: false,
+            error: `"${name}" is not a valid profile name`,
+        };
+    }
+    const file = path.join(profilesDirectory(), name, PROFILE_DEFINITION_FILE);
+    if (!existsSync(file)) {
+        const available = availableProfiles();
+        return {
+            ok: false,
+            error: available.length === 0
+                ? `no profile named "${name}" is available`
+                : `no profile named "${name}"; available profiles: ${available.join(", ")}`,
+        };
+    }
+    const size = statSync(file).size;
+    if (size > MAX_PROFILE_BYTES) {
+        return {
+            ok: false,
+            error: `profile definition is ${size} bytes, above the ${MAX_PROFILE_BYTES} byte limit`,
+        };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(file, "utf8"));
+    }
+    catch (cause) {
+        return { ok: false, error: `cannot parse profile definition: ${cause.message}` };
+    }
+    const issues = validateProfileDefinition(parsed);
+    if (issues.length > 0) {
+        return {
+            ok: false,
+            error: `profile definition "${name}" is not valid`,
+            issues: issues.map((issue) => `${issue.path}  ${issue.message}`),
+        };
+    }
+    const profile = parsed;
+    if (profile.name !== name) {
+        return {
+            ok: false,
+            error: `profile definition declares name "${profile.name}" but lives in directory "${name}"`,
+        };
+    }
+    return { ok: true, profile, file };
+}
+//# sourceMappingURL=load-profile.js.map

package/dist/conformance/src/profiles/load-profile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"load-profile.js","sourceRoot":"","sources":["../../../../conformance/src/profiles/load-profile.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC1E,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAC7F,OAAO,EAAE,mBAAmB,EAA0B,MAAM,YAAY,CAAC;AAEzE,8DAA8D;AAC9D,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAE/B,oEAAoE;AACpE,MAAM,CAAC,MAAM,uBAAuB,GAAG,cAAc,CAAC;AAEtD;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,GAAG,IAAI,CAAC;AAE5C,0FAA0F;AAC1F,MAAM,YAAY,GAAG,+BAA+B,CAAC;AAMrD,+DAA+D;AAC/D,MAAM,UAAU,iBAAiB;IAC/B,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,UAAU,CAAC,CAAC;AACjD,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,iBAAiB;IAC/B,MAAM,IAAI,GAAG,iBAAiB,EAAE,CAAC;IACjC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,WAAW,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;SAC9C,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;SACtC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,uBAAuB,CAAC,CAAC,CAAC;SAC5E,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,IAAI,IAAI,+BAA+B;SAC/C,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,CAAC;IAC3E,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;QACtC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EACH,SAAS,CAAC,MAAM,KAAK,CAAC;gBACpB,CAAC,CAAC,qBAAqB,IAAI,gBAAgB;gBAC3C,CAAC,CAAC,qBAAqB,IAAI,0BAA0B,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SAChF,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;IACjC,IAAI,IAAI,GAAG,iBAAiB,EAAE,CAAC;QAC7B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,yBAAyB,IAAI,qBAAqB,iBAAiB,aAAa;SACxF,CAAC;IACJ,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oCAAqC,KAAe,CAAC,OAAO,EAAE,EAAE,CAAC;IAC9F,CAAC;IAED,MAAM,MAAM,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;IACjD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,uBAAuB,IAAI,gBAAgB;YAClD,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;SACjE,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAA2B,CAAC;IAC5C,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAC1B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,qCAAqC,OAAO,CAAC,IAAI,6BAA6B,IAAI,GAAG;SAC7F,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACrC,CAAC"}

package/dist/conformance/src/profiles/resolve-pointer.d.ts

@@ -0,0 +1,44 @@
+/**
+ * RFC 6901 JSON Pointer resolution.
+ *
+ * Resolution reads own enumerable properties only. It never walks a prototype,
+ * never invokes an accessor and never evaluates anything: a profile definition
+ * is data, and a pointer taken from one must not be able to reach `__proto__`,
+ * `constructor` or any inherited member of the event being checked.
+ */
+/** Deepest pointer accepted, so that a hostile pointer cannot drive unbounded work. */
+export declare const MAX_POINTER_DEPTH = 32;
+export interface PointerResolution {
+    /** Whether the pointer resolved to a member that exists. */
+    readonly found: boolean;
+    readonly value: unknown;
+}
+/** Decodes one reference token: `~1` to `/`, then `~0` to `~`, in that order. */
+export declare function decodeReferenceToken(token: string): string;
+/** Splits a pointer into its decoded reference tokens, or `undefined` if malformed. */
+export declare function pointerTokens(pointer: string): string[] | undefined;
+/** Joins a base pointer and a relative pointer, as `/metadata` + `/role/id`. */
+export declare function concatPointer(base: string, relative: string): string;
+/**
+ * Resolves a JSON Pointer against a parsed JSON value.
+ *
+ * Returns `found: false` for a malformed pointer, a member that does not exist,
+ * an out-of-range array index, or any attempt to traverse a non-container.
+ */
+export declare function resolvePointer(root: unknown, pointer: string): PointerResolution;
+/**
+ * Whether a resolved value counts as **present** for a profile requirement.
+ *
+ * Present means: the member exists, is not null, and is not an empty string,
+ * array or object. `false` and `0` are present — they are answers, not absences,
+ * and a profile that could not require `mfa: false` to be recorded would be
+ * unable to distinguish "not recorded" from "recorded as false".
+ *
+ * This differs deliberately from the privacy linter's notion of a populated
+ * value, which excludes booleans because a credential cannot be `true`.
+ */
+export declare function isPresent(resolution: PointerResolution): boolean;
+/** JSON type of a value, using the profile metadata type vocabulary. */
+export declare function jsonTypeOf(value: unknown): string;
+/** Whether a value matches a declared metadata type. `integer` is a subset of `number`. */
+export declare function matchesMetadataType(value: unknown, expected: string): boolean;