@portaidentity/server 1.7.3 → 1.8.0

package/dist/portability/plan-support.d.ts

@@ -0,0 +1,137 @@
+/** Small deterministic helpers shared by portability planning steps. */
+import type { ImportClientRow, ImportOrganizationRow, ImportUserRow } from './import-repository.js';
+import type { PortabilityAction, PortabilityActionCounts, PortabilityEntityType, PortabilityImportMode, PortabilityManifest, PortabilityNaturalKey, PortabilityResultError, PortabilityResultErrorCode, PortabilityResultItem } from './types.js';
+/** Entity groups in their required parent-before-child order. */
+export declare const entityOrder: readonly PortabilityEntityType[];
+/** Mutable accumulator used only while assembling a safe result. */
+export interface PlanAccumulator {
+    readonly items: PortabilityResultItem[];
+    readonly errors: PortabilityResultError[];
+    readonly summary: Record<PortabilityEntityType, PortabilityActionCounts>;
+}
+/** @returns Zeroed action counts for every fixed entity group. */
+export declare function emptySummary(): Record<PortabilityEntityType, PortabilityActionCounts>;
+/**
+ * @param parts - Normalized natural-key components
+ * @returns Components joined with an unambiguous internal separator
+ */
+export declare function key(...parts: readonly string[]): string;
+/**
+ * @param value - Stored or validated slug
+ * @returns Lowercase trimmed slug used only for matching
+ */
+export declare function normalizedSlug(value: string): string;
+/**
+ * @param value - External RBAC claim value
+ * @returns Trimmed value with case and inner content preserved
+ */
+export declare function normalizedRbac(value: string): string;
+/**
+ * @param value - User email identity
+ * @returns Trimmed lowercase identity used for matching
+ */
+export declare function normalizedEmail(value: string): string;
+/**
+ * @param left - First normalized portable value
+ * @param right - Second normalized portable value
+ * @returns Whether both values serialize identically
+ */
+export declare function sameValue(left: unknown, right: unknown): boolean;
+/**
+ * @param rows - Destination or manifest records
+ * @param selectKey - Normalized key selector
+ * @returns Every row grouped without discarding ambiguous matches
+ */
+export declare function groupByKey<Row>(rows: readonly Row[], selectKey: (row: Row) => string): Map<string, Row[]>;
+/**
+ * @param matches - Destination rows sharing a normalized key
+ * @returns Fixed cardinality state used by dependency validation
+ */
+export declare function dependencyState<Row>(matches: readonly Row[] | undefined): 'resolved' | 'missing' | 'ambiguous';
+/**
+ * Add an action and increment its group count.
+ *
+ * @param accumulator - Result being assembled
+ * @param entityType - Manifest collection
+ * @param action - Planned action
+ * @param naturalKey - Safe public identity
+ * @param credentialWillBeGenerated - Whether a new confidential client needs one secret
+ */
+export declare function addItem(accumulator: PlanAccumulator, entityType: PortabilityEntityType, action: PortabilityAction, naturalKey: PortabilityNaturalKey, credentialWillBeGenerated?: boolean): void;
+/**
+ * Add one bounded public error while retaining the complete rejected count.
+ *
+ * @param accumulator - Result being assembled
+ * @param entityType - Rejected manifest collection
+ * @param naturalKey - Safe public identity
+ * @param code - Fixed non-reflective rejection code
+ * @param countRejected - Whether the error represents a manifest record in aggregate counts
+ */
+export declare function addError(accumulator: PlanAccumulator, entityType: PortabilityEntityType, naturalKey: PortabilityNaturalKey, code: PortabilityResultErrorCode, countRejected?: boolean): void;
+/**
+ * Check whether an application-qualified record belongs to the manifest selection.
+ *
+ * @param manifest - Strict normalized import manifest
+ * @param applicationSlug - Application owner named by one record
+ * @returns Whether the record is inside the declared application scope
+ */
+export declare function applicationIsSelected(manifest: PortabilityManifest, applicationSlug: string): boolean;
+/**
+ * Validate scope metadata that may have no corresponding manifest record.
+ *
+ * @param manifest - Strict normalized import manifest
+ * @param accumulator - Result being assembled
+ * @param organizations - Destination organizations grouped by normalized slug
+ * @param manifestOrganizations - Organization slugs created by this manifest
+ */
+export declare function validateRootScope(manifest: PortabilityManifest, accumulator: PlanAccumulator, organizations: ReadonlyMap<string, readonly ImportOrganizationRow[]>, manifestOrganizations: ReadonlySet<string>): void;
+/**
+ * @param mode - Preview or apply behavior
+ * @param exists - Whether one compatible destination record exists
+ * @param mutableValuesMatch - Whether all portable mutable values already match
+ * @returns Create, update, or skip action
+ */
+export declare function recordAction(mode: PortabilityImportMode, exists: boolean, mutableValuesMatch: boolean): PortabilityAction;
+/**
+ * @param left - First safe result outcome
+ * @param right - Second safe result outcome
+ * @returns Stable dependency-order comparison
+ */
+export declare function compareOutcomes(left: Pick<PortabilityResultItem, 'entity_type' | 'natural_key'>, right: Pick<PortabilityResultItem, 'entity_type' | 'natural_key'>): number;
+/**
+ * @param manifest - Strict normalized manifest
+ * @param accumulator - Result being assembled
+ * @returns Stable identities for every record rejected as a duplicate
+ */
+export declare function rejectDuplicates(manifest: PortabilityManifest, accumulator: PlanAccumulator): ReadonlySet<string>;
+/** Create the stable identity used to exclude a rejected duplicate from ordinary planning. */
+export declare function recordIdentity(entityType: PortabilityEntityType, naturalKey: PortabilityNaturalKey): string;
+/**
+ * @param source - Portable organization fields
+ * @param destination - Existing destination organization
+ * @param destinationAssets - Existing validated image bytes by branding slot
+ * @returns Whether every mutable organization field and asset matches
+ */
+export declare function organizationMatches(source: PortabilityManifest['organizations'][number], destination: ImportOrganizationRow, destinationAssets: ReadonlyMap<'logo' | 'favicon', {
+    readonly content_type: string;
+    readonly data: Buffer;
+}>): boolean;
+/**
+ * @param source - Portable user profile
+ * @param destination - Existing destination user
+ * @returns Whether portable fields match while ignoring authentication and lock state
+ */
+export declare function userMatches(source: PortabilityManifest['users'][number], destination: ImportUserRow): boolean;
+/**
+ * @param source - Portable OIDC client
+ * @param destination - Existing destination client
+ * @returns Whether every mutable protocol and lifecycle field matches
+ */
+export declare function clientMutableValuesMatch(source: PortabilityManifest['clients'][number], destination: ImportClientRow): boolean;
+/**
+ * @param manifestHasParent - Whether the manifest creates or matches the parent itself
+ * @param matches - Destination rows sharing the normalized parent key
+ * @returns Fixed safe error, or null when the parent resolves
+ */
+export declare function parentError<Row>(manifestHasParent: boolean, matches: readonly Row[] | undefined): PortabilityResultErrorCode | null;
+//# sourceMappingURL=plan-support.d.ts.map

package/dist/portability/plan-support.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan-support.d.ts","sourceRoot":"","sources":["../../src/portability/plan-support.ts"],"names":[],"mappings":"AAAA,wEAAwE;AAExE,OAAO,KAAK,EAAE,eAAe,EAAE,qBAAqB,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACpG,OAAO,KAAK,EACV,iBAAiB,EACjB,uBAAuB,EACvB,qBAAqB,EACrB,qBAAqB,EACrB,mBAAmB,EACnB,qBAAqB,EACrB,sBAAsB,EACtB,0BAA0B,EAC1B,qBAAqB,EACtB,MAAM,YAAY,CAAC;AAEpB,iEAAiE;AACjE,eAAO,MAAM,WAAW,EAAE,SAAS,qBAAqB,EAYvD,CAAC;AAEF,oEAAoE;AACpE,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,qBAAqB,EAAE,CAAC;IACxC,QAAQ,CAAC,MAAM,EAAE,sBAAsB,EAAE,CAAC;IAC1C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,qBAAqB,EAAE,uBAAuB,CAAC,CAAC;CAC1E;AAED,kEAAkE;AAClE,wBAAgB,YAAY,IAAI,MAAM,CAAC,qBAAqB,EAAE,uBAAuB,CAAC,CAOrF;AAED;;;GAGG;AACH,wBAAgB,GAAG,CAAC,GAAG,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAEvD;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAErD;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAEhE;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAC5B,IAAI,EAAE,SAAS,GAAG,EAAE,EACpB,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,MAAM,GAC9B,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAOpB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,EACjC,OAAO,EAAE,SAAS,GAAG,EAAE,GAAG,SAAS,GAClC,UAAU,GAAG,SAAS,GAAG,WAAW,CAGtC;AAED;;;;;;;;GAQG;AACH,wBAAgB,OAAO,CACrB,WAAW,EAAE,eAAe,EAC5B,UAAU,EAAE,qBAAqB,EACjC,MAAM,EAAE,iBAAiB,EACzB,UAAU,EAAE,qBAAqB,EACjC,yBAAyB,UAAQ,GAChC,IAAI,CAWN;AAED;;;;;;;;GAQG;AACH,wBAAgB,QAAQ,CACtB,WAAW,EAAE,eAAe,EAC5B,UAAU,EAAE,qBAAqB,EACjC,UAAU,EAAE,qBAAqB,EACjC,IAAI,EAAE,0BAA0B,EAChC,aAAa,UAAO,GACnB,IAAI,CAQN;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,mBAAmB,EAC7B,eAAe,EAAE,MAAM,GACtB,OAAO,CAOT;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,mBAAmB,EAC7B,WAAW,EAAE,eAAe,EAC5B,aAAa,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,qBAAqB,EAAE,CAAC,EACpE,qBAAqB,EAAE,WAAW,CAAC,MAAM,CAAC,GACzC,IAAI,CAsBN;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,qBAAqB,EAC3B,MAAM,EAAE,OAAO,EACf,kBAAkB,EAAE,OAAO,GAC1B,iBAAiB,CAInB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,IAAI,CAAC,qBAAqB,EAAE,aAAa,GAAG,aAAa,CAAC,EAChE,KAAK,EAAE,IAAI,CAAC,qBAAqB,EAAE,aAAa,GAAG,aAAa,CAAC,GAChE,MAAM,CAMR;AA8CD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,mBAAmB,EAC7B,WAAW,EAAE,eAAe,GAC3B,WAAW,CAAC,MAAM,CAAC,CAgBrB;AAED,8FAA8F;AAC9F,wBAAgB,cAAc,CAC5B,UAAU,EAAE,qBAAqB,EACjC,UAAU,EAAE,qBAAqB,GAChC,MAAM,CAER;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,mBAAmB,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,EACpD,WAAW,EAAE,qBAAqB,EAClC,iBAAiB,EAAE,WAAW,CAC5B,MAAM,GAAG,SAAS,EAClB;IAAE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CACzD,GACA,OAAO,CA2BT;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CACzB,MAAM,EAAE,mBAAmB,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,EAC5C,WAAW,EAAE,aAAa,GACzB,OAAO,CA0BT;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,mBAAmB,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,EAC9C,WAAW,EAAE,eAAe,GAC3B,OAAO,CAcT;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAC7B,iBAAiB,EAAE,OAAO,EAC1B,OAAO,EAAE,SAAS,GAAG,EAAE,GAAG,SAAS,GAClC,0BAA0B,GAAG,IAAI,CAKnC"}

package/dist/portability/plan-support.js

@@ -0,0 +1,336 @@
+/** Small deterministic helpers shared by portability planning steps. */
+/** Entity groups in their required parent-before-child order. */
+export const entityOrder = [
+    'organizations',
+    'applications',
+    'application_modules',
+    'roles',
+    'permissions',
+    'claim_definitions',
+    'role_permission_mappings',
+    'users',
+    'user_role_assignments',
+    'user_claim_values',
+    'clients',
+];
+/** @returns Zeroed action counts for every fixed entity group. */
+export function emptySummary() {
+    return Object.fromEntries(entityOrder.map((entityType) => [
+        entityType,
+        { created: 0, updated: 0, skipped: 0, rejected: 0 },
+    ]));
+}
+/**
+ * @param parts - Normalized natural-key components
+ * @returns Components joined with an unambiguous internal separator
+ */
+export function key(...parts) {
+    return parts.join('\u001f');
+}
+/**
+ * @param value - Stored or validated slug
+ * @returns Lowercase trimmed slug used only for matching
+ */
+export function normalizedSlug(value) {
+    return value.trim().toLowerCase();
+}
+/**
+ * @param value - External RBAC claim value
+ * @returns Trimmed value with case and inner content preserved
+ */
+export function normalizedRbac(value) {
+    return value.trim();
+}
+/**
+ * @param value - User email identity
+ * @returns Trimmed lowercase identity used for matching
+ */
+export function normalizedEmail(value) {
+    return value.trim().toLowerCase();
+}
+/**
+ * @param left - First normalized portable value
+ * @param right - Second normalized portable value
+ * @returns Whether both values serialize identically
+ */
+export function sameValue(left, right) {
+    return JSON.stringify(left) === JSON.stringify(right);
+}
+/**
+ * @param rows - Destination or manifest records
+ * @param selectKey - Normalized key selector
+ * @returns Every row grouped without discarding ambiguous matches
+ */
+export function groupByKey(rows, selectKey) {
+    const grouped = new Map();
+    for (const row of rows) {
+        const rowKey = selectKey(row);
+        grouped.set(rowKey, [...(grouped.get(rowKey) ?? []), row]);
+    }
+    return grouped;
+}
+/**
+ * @param matches - Destination rows sharing a normalized key
+ * @returns Fixed cardinality state used by dependency validation
+ */
+export function dependencyState(matches) {
+    if (matches === undefined || matches.length === 0)
+        return 'missing';
+    return matches.length === 1 ? 'resolved' : 'ambiguous';
+}
+/**
+ * Add an action and increment its group count.
+ *
+ * @param accumulator - Result being assembled
+ * @param entityType - Manifest collection
+ * @param action - Planned action
+ * @param naturalKey - Safe public identity
+ * @param credentialWillBeGenerated - Whether a new confidential client needs one secret
+ */
+export function addItem(accumulator, entityType, action, naturalKey, credentialWillBeGenerated = false) {
+    accumulator.summary[entityType] = {
+        ...accumulator.summary[entityType],
+        [action]: accumulator.summary[entityType][action] + 1,
+    };
+    accumulator.items.push({
+        entity_type: entityType,
+        action,
+        natural_key: naturalKey,
+        ...(credentialWillBeGenerated ? { credential_will_be_generated: true } : {}),
+    });
+}
+/**
+ * Add one bounded public error while retaining the complete rejected count.
+ *
+ * @param accumulator - Result being assembled
+ * @param entityType - Rejected manifest collection
+ * @param naturalKey - Safe public identity
+ * @param code - Fixed non-reflective rejection code
+ * @param countRejected - Whether the error represents a manifest record in aggregate counts
+ */
+export function addError(accumulator, entityType, naturalKey, code, countRejected = true) {
+    if (countRejected)
+        accumulator.summary[entityType] = {
+            ...accumulator.summary[entityType],
+            rejected: accumulator.summary[entityType].rejected + 1,
+        };
+    if (accumulator.errors.length < 100)
+        accumulator.errors.push({ entity_type: entityType, natural_key: naturalKey, code });
+}
+/**
+ * Check whether an application-qualified record belongs to the manifest selection.
+ *
+ * @param manifest - Strict normalized import manifest
+ * @param applicationSlug - Application owner named by one record
+ * @returns Whether the record is inside the declared application scope
+ */
+export function applicationIsSelected(manifest, applicationSlug) {
+    return (manifest.application_selection.all_applications ||
+        manifest.application_selection.application_slugs.some((selected) => normalizedSlug(selected) === normalizedSlug(applicationSlug)));
+}
+/**
+ * Validate scope metadata that may have no corresponding manifest record.
+ *
+ * @param manifest - Strict normalized import manifest
+ * @param accumulator - Result being assembled
+ * @param organizations - Destination organizations grouped by normalized slug
+ * @param manifestOrganizations - Organization slugs created by this manifest
+ */
+export function validateRootScope(manifest, accumulator, organizations, manifestOrganizations) {
+    if (manifest.scope.kind === 'organization') {
+        const selected = normalizedSlug(manifest.scope.organization_slug);
+        const matches = organizations.get(selected);
+        const code = selected === 'porta-admin' || matches?.[0]?.is_super_admin
+            ? 'control_plane_record'
+            : (matches?.length ?? 0) > 1
+                ? 'ambiguous_dependency'
+                : matches?.[0] === undefined && !manifestOrganizations.has(selected)
+                    ? 'missing_dependency'
+                    : null;
+        if (code !== null)
+            addError(accumulator, 'organizations', { slug: selected }, code, false);
+    }
+    if (manifest.application_selection.application_slugs.some((slug) => normalizedSlug(slug) === 'porta-admin')) {
+        addError(accumulator, 'applications', { slug: 'porta-admin' }, 'control_plane_record', false);
+    }
+}
+/**
+ * @param mode - Preview or apply behavior
+ * @param exists - Whether one compatible destination record exists
+ * @param mutableValuesMatch - Whether all portable mutable values already match
+ * @returns Create, update, or skip action
+ */
+export function recordAction(mode, exists, mutableValuesMatch) {
+    if (!exists)
+        return 'created';
+    if (mode === 'keep-existing' || mutableValuesMatch)
+        return 'skipped';
+    return 'updated';
+}
+/**
+ * @param left - First safe result outcome
+ * @param right - Second safe result outcome
+ * @returns Stable dependency-order comparison
+ */
+export function compareOutcomes(left, right) {
+    const groupOrder = entityOrder.indexOf(left.entity_type) - entityOrder.indexOf(right.entity_type);
+    if (groupOrder !== 0)
+        return groupOrder;
+    const leftKey = Object.values(left.natural_key).join('\u001f');
+    const rightKey = Object.values(right.natural_key).join('\u001f');
+    return leftKey < rightKey ? -1 : leftKey > rightKey ? 1 : 0;
+}
+/** Return public natural keys for all manifest collections. */
+function manifestNaturalKeys(manifest) {
+    return {
+        organizations: manifest.organizations.map(({ slug }) => ({ slug })),
+        applications: manifest.applications.map(({ slug }) => ({ slug })),
+        application_modules: manifest.application_modules.map(({ application_slug, slug }) => ({
+            application_slug,
+            slug,
+        })),
+        roles: manifest.roles.map(({ application_slug, slug }) => ({ application_slug, slug })),
+        permissions: manifest.permissions.map(({ application_slug, slug }) => ({
+            application_slug,
+            slug,
+        })),
+        claim_definitions: manifest.claim_definitions.map(({ application_slug, claim_name }) => ({
+            application_slug,
+            claim_name,
+        })),
+        role_permission_mappings: manifest.role_permission_mappings.map(({ application_slug, role_slug }) => ({ application_slug, role_slug })),
+        users: manifest.users.map(({ organization_slug, email }) => ({ organization_slug, email })),
+        user_role_assignments: manifest.user_role_assignments.map(({ organization_slug, email, application_slug, role_slug }) => ({
+            organization_slug,
+            email,
+            application_slug,
+            role_slug,
+        })),
+        user_claim_values: manifest.user_claim_values.map(({ organization_slug, email, application_slug, claim_name }) => ({
+            organization_slug,
+            email,
+            application_slug,
+            claim_name,
+        })),
+        clients: manifest.clients.map(({ client_id }) => ({ client_id })),
+    };
+}
+/**
+ * @param manifest - Strict normalized manifest
+ * @param accumulator - Result being assembled
+ * @returns Stable identities for every record rejected as a duplicate
+ */
+export function rejectDuplicates(manifest, accumulator) {
+    const duplicateRecords = new Set();
+    const keysByType = manifestNaturalKeys(manifest);
+    for (const entityType of entityOrder) {
+        const grouped = groupByKey(keysByType[entityType], (naturalKey) => Object.values(naturalKey).join('\u001f'));
+        for (const matches of grouped.values()) {
+            if (matches.length < 2)
+                continue;
+            for (const naturalKey of matches) {
+                duplicateRecords.add(recordIdentity(entityType, naturalKey));
+                addError(accumulator, entityType, naturalKey, 'duplicate_natural_key');
+            }
+        }
+    }
+    return duplicateRecords;
+}
+/** Create the stable identity used to exclude a rejected duplicate from ordinary planning. */
+export function recordIdentity(entityType, naturalKey) {
+    return `${entityType}\u001e${Object.values(naturalKey).join('\u001f')}`;
+}
+/**
+ * @param source - Portable organization fields
+ * @param destination - Existing destination organization
+ * @param destinationAssets - Existing validated image bytes by branding slot
+ * @returns Whether every mutable organization field and asset matches
+ */
+export function organizationMatches(source, destination, destinationAssets) {
+    const logo = destinationAssets.get('logo');
+    const favicon = destinationAssets.get('favicon');
+    const logoMatches = source.branding.logo_asset === null
+        ? logo === undefined
+        : logo?.content_type === source.branding.logo_asset.media_type &&
+            logo.data.toString('base64') === source.branding.logo_asset.content_base64;
+    const faviconMatches = source.branding.favicon_asset === null
+        ? favicon === undefined
+        : favicon?.content_type === source.branding.favicon_asset.media_type &&
+            favicon.data.toString('base64') === source.branding.favicon_asset.content_base64;
+    return (source.name === destination.name &&
+        source.status === destination.status &&
+        source.default_locale === destination.default_locale &&
+        sameValue(source.default_login_methods, destination.default_login_methods) &&
+        source.two_factor_policy === destination.two_factor_policy &&
+        source.branding.logo_url === destination.branding_logo_url &&
+        source.branding.favicon_url === destination.branding_favicon_url &&
+        source.branding.primary_color === destination.branding_primary_color &&
+        source.branding.company_name === destination.branding_company_name &&
+        source.branding.custom_css === destination.branding_custom_css &&
+        logoMatches &&
+        faviconMatches);
+}
+/**
+ * @param source - Portable user profile
+ * @param destination - Existing destination user
+ * @returns Whether portable fields match while ignoring authentication and lock state
+ */
+export function userMatches(source, destination) {
+    return sameValue(source, {
+        organization_slug: destination.organization_slug,
+        email: normalizedEmail(destination.email),
+        email_verified: destination.email_verified,
+        given_name: destination.given_name,
+        family_name: destination.family_name,
+        middle_name: destination.middle_name,
+        nickname: destination.nickname,
+        preferred_username: destination.preferred_username,
+        profile_url: destination.profile_url,
+        picture_url: destination.picture_url,
+        website_url: destination.website_url,
+        gender: destination.gender,
+        birthdate: destination.birthdate,
+        zoneinfo: destination.zoneinfo,
+        locale: destination.locale,
+        phone_number: destination.phone_number,
+        phone_number_verified: destination.phone_number_verified,
+        address_street: destination.address_street,
+        address_locality: destination.address_locality,
+        address_region: destination.address_region,
+        address_postal_code: destination.address_postal_code,
+        address_country: destination.address_country,
+        status: destination.status,
+    });
+}
+/**
+ * @param source - Portable OIDC client
+ * @param destination - Existing destination client
+ * @returns Whether every mutable protocol and lifecycle field matches
+ */
+export function clientMutableValuesMatch(source, destination) {
+    return (source.name === destination.name &&
+        source.status === destination.status &&
+        sameValue(source.grant_types, destination.grant_types) &&
+        sameValue(source.response_types, destination.response_types) &&
+        source.scope === destination.scope &&
+        sameValue(source.login_methods, destination.login_methods) &&
+        source.token_endpoint_auth_method === destination.token_endpoint_auth_method &&
+        sameValue(source.redirect_uris, destination.redirect_uris) &&
+        sameValue(source.post_logout_redirect_uris, destination.post_logout_redirect_uris) &&
+        sameValue(source.allowed_origins, destination.allowed_origins) &&
+        source.require_pkce === destination.require_pkce);
+}
+/**
+ * @param manifestHasParent - Whether the manifest creates or matches the parent itself
+ * @param matches - Destination rows sharing the normalized parent key
+ * @returns Fixed safe error, or null when the parent resolves
+ */
+export function parentError(manifestHasParent, matches) {
+    if (manifestHasParent)
+        return null;
+    const state = dependencyState(matches);
+    if (state === 'resolved')
+        return null;
+    return state === 'ambiguous' ? 'ambiguous_dependency' : 'missing_dependency';
+}
+//# sourceMappingURL=plan-support.js.map

package/dist/portability/plan-support.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan-support.js","sourceRoot":"","sources":["../../src/portability/plan-support.ts"],"names":[],"mappings":"AAAA,wEAAwE;AAexE,iEAAiE;AACjE,MAAM,CAAC,MAAM,WAAW,GAAqC;IAC3D,eAAe;IACf,cAAc;IACd,qBAAqB;IACrB,OAAO;IACP,aAAa;IACb,mBAAmB;IACnB,0BAA0B;IAC1B,OAAO;IACP,uBAAuB;IACvB,mBAAmB;IACnB,SAAS;CACV,CAAC;AASF,kEAAkE;AAClE,MAAM,UAAU,YAAY;IAC1B,OAAO,MAAM,CAAC,WAAW,CACvB,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC;QAC9B,UAAU;QACV,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE;KACpD,CAAC,CACuD,CAAC;AAC9D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,GAAG,CAAC,GAAG,KAAwB;IAC7C,OAAO,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAC9B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACpC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACpC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,IAAa,EAAE,KAAc;IACrD,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AACxD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CACxB,IAAoB,EACpB,SAA+B;IAE/B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAiB,CAAC;IACzC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,OAAmC;IAEnC,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACpE,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC;AACzD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,OAAO,CACrB,WAA4B,EAC5B,UAAiC,EACjC,MAAyB,EACzB,UAAiC,EACjC,yBAAyB,GAAG,KAAK;IAEjC,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG;QAChC,GAAG,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC;QAClC,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;KACtD,CAAC;IACF,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC;QACrB,WAAW,EAAE,UAAU;QACvB,MAAM;QACN,WAAW,EAAE,UAAU;QACvB,GAAG,CAAC,yBAAyB,CAAC,CAAC,CAAC,EAAE,4BAA4B,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7E,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,QAAQ,CACtB,WAA4B,EAC5B,UAAiC,EACjC,UAAiC,EACjC,IAAgC,EAChC,aAAa,GAAG,IAAI;IAEpB,IAAI,aAAa;QACf,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG;YAChC,GAAG,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC;YAClC,QAAQ,EAAE,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,QAAQ,GAAG,CAAC;SACvD,CAAC;IACJ,IAAI,WAAW,CAAC,MAAM,CAAC,MAAM,GAAG,GAAG;QACjC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;AACxF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAA6B,EAC7B,eAAuB;IAEvB,OAAO,CACL,QAAQ,CAAC,qBAAqB,CAAC,gBAAgB;QAC/C,QAAQ,CAAC,qBAAqB,CAAC,iBAAiB,CAAC,IAAI,CACnD,CAAC,QAAQ,EAAE,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,cAAc,CAAC,eAAe,CAAC,CAC3E,CACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAA6B,EAC7B,WAA4B,EAC5B,aAAoE,EACpE,qBAA0C;IAE1C,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAClE,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5C,MAAM,IAAI,GACR,QAAQ,KAAK,aAAa,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc;YACxD,CAAC,CAAC,sBAAsB;YACxB,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;gBAC1B,CAAC,CAAC,sBAAsB;gBACxB,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC;oBAClE,CAAC,CAAC,oBAAoB;oBACtB,CAAC,CAAC,IAAI,CAAC;QACf,IAAI,IAAI,KAAK,IAAI;YAAE,QAAQ,CAAC,WAAW,EAAE,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAC7F,CAAC;IAED,IACE,QAAQ,CAAC,qBAAqB,CAAC,iBAAiB,CAAC,IAAI,CACnD,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,aAAa,CACjD,EACD,CAAC;QACD,QAAQ,CAAC,WAAW,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,sBAAsB,EAAE,KAAK,CAAC,CAAC;IAChG,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAC1B,IAA2B,EAC3B,MAAe,EACf,kBAA2B;IAE3B,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,IAAI,IAAI,KAAK,eAAe,IAAI,kBAAkB;QAAE,OAAO,SAAS,CAAC;IACrE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAgE,EAChE,KAAiE;IAEjE,MAAM,UAAU,GAAG,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAClG,IAAI,UAAU,KAAK,CAAC;QAAE,OAAO,UAAU,CAAC;IACxC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjE,OAAO,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED,+DAA+D;AAC/D,SAAS,mBAAmB,CAC1B,QAA6B;IAE7B,OAAO;QACL,aAAa,EAAE,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QACnE,YAAY,EAAE,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QACjE,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;YACrF,gBAAgB;YAChB,IAAI;SACL,CAAC,CAAC;QACH,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;QACvF,WAAW,EAAE,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;YACrE,gBAAgB;YAChB,IAAI;SACL,CAAC,CAAC;QACH,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;YACvF,gBAAgB;YAChB,UAAU;SACX,CAAC,CAAC;QACH,wBAAwB,EAAE,QAAQ,CAAC,wBAAwB,CAAC,GAAG,CAC7D,CAAC,EAAE,gBAAgB,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,gBAAgB,EAAE,SAAS,EAAE,CAAC,CACvE;QACD,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3F,qBAAqB,EAAE,QAAQ,CAAC,qBAAqB,CAAC,GAAG,CACvD,CAAC,EAAE,iBAAiB,EAAE,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;YAC9D,iBAAiB;YACjB,KAAK;YACL,gBAAgB;YAChB,SAAS;SACV,CAAC,CACH;QACD,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB,CAAC,GAAG,CAC/C,CAAC,EAAE,iBAAiB,EAAE,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;YAC/D,iBAAiB;YACjB,KAAK;YACL,gBAAgB;YAChB,UAAU;SACX,CAAC,CACH;QACD,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;KAClE,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAA6B,EAC7B,WAA4B;IAE5B,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC3C,MAAM,UAAU,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IACjD,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE,CAChE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CACzC,CAAC;QACF,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YACvC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;gBAAE,SAAS;YACjC,KAAK,MAAM,UAAU,IAAI,OAAO,EAAE,CAAC;gBACjC,gBAAgB,CAAC,GAAG,CAAC,cAAc,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;gBAC7D,QAAQ,CAAC,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,uBAAuB,CAAC,CAAC;YACzE,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,cAAc,CAC5B,UAAiC,EACjC,UAAiC;IAEjC,OAAO,GAAG,UAAU,SAAS,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC1E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAoD,EACpD,WAAkC,EAClC,iBAGC;IAED,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACjD,MAAM,WAAW,GACf,MAAM,CAAC,QAAQ,CAAC,UAAU,KAAK,IAAI;QACjC,CAAC,CAAC,IAAI,KAAK,SAAS;QACpB,CAAC,CAAC,IAAI,EAAE,YAAY,KAAK,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU;YAC5D,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,cAAc,CAAC;IACjF,MAAM,cAAc,GAClB,MAAM,CAAC,QAAQ,CAAC,aAAa,KAAK,IAAI;QACpC,CAAC,CAAC,OAAO,KAAK,SAAS;QACvB,CAAC,CAAC,OAAO,EAAE,YAAY,KAAK,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,UAAU;YAClE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,cAAc,CAAC;IACvF,OAAO,CACL,MAAM,CAAC,IAAI,KAAK,WAAW,CAAC,IAAI;QAChC,MAAM,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM;QACpC,MAAM,CAAC,cAAc,KAAK,WAAW,CAAC,cAAc;QACpD,SAAS,CAAC,MAAM,CAAC,qBAAqB,EAAE,WAAW,CAAC,qBAAqB,CAAC;QAC1E,MAAM,CAAC,iBAAiB,KAAK,WAAW,CAAC,iBAAiB;QAC1D,MAAM,CAAC,QAAQ,CAAC,QAAQ,KAAK,WAAW,CAAC,iBAAiB;QAC1D,MAAM,CAAC,QAAQ,CAAC,WAAW,KAAK,WAAW,CAAC,oBAAoB;QAChE,MAAM,CAAC,QAAQ,CAAC,aAAa,KAAK,WAAW,CAAC,sBAAsB;QACpE,MAAM,CAAC,QAAQ,CAAC,YAAY,KAAK,WAAW,CAAC,qBAAqB;QAClE,MAAM,CAAC,QAAQ,CAAC,UAAU,KAAK,WAAW,CAAC,mBAAmB;QAC9D,WAAW;QACX,cAAc,CACf,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CACzB,MAA4C,EAC5C,WAA0B;IAE1B,OAAO,SAAS,CAAC,MAAM,EAAE;QACvB,iBAAiB,EAAE,WAAW,CAAC,iBAAiB;QAChD,KAAK,EAAE,eAAe,CAAC,WAAW,CAAC,KAAK,CAAC;QACzC,cAAc,EAAE,WAAW,CAAC,cAAc;QAC1C,UAAU,EAAE,WAAW,CAAC,UAAU;QAClC,WAAW,EAAE,WAAW,CAAC,WAAW;QACpC,WAAW,EAAE,WAAW,CAAC,WAAW;QACpC,QAAQ,EAAE,WAAW,CAAC,QAAQ;QAC9B,kBAAkB,EAAE,WAAW,CAAC,kBAAkB;QAClD,WAAW,EAAE,WAAW,CAAC,WAAW;QACpC,WAAW,EAAE,WAAW,CAAC,WAAW;QACpC,WAAW,EAAE,WAAW,CAAC,WAAW;QACpC,MAAM,EAAE,WAAW,CAAC,MAAM;QAC1B,SAAS,EAAE,WAAW,CAAC,SAAS;QAChC,QAAQ,EAAE,WAAW,CAAC,QAAQ;QAC9B,MAAM,EAAE,WAAW,CAAC,MAAM;QAC1B,YAAY,EAAE,WAAW,CAAC,YAAY;QACtC,qBAAqB,EAAE,WAAW,CAAC,qBAAqB;QACxD,cAAc,EAAE,WAAW,CAAC,cAAc;QAC1C,gBAAgB,EAAE,WAAW,CAAC,gBAAgB;QAC9C,cAAc,EAAE,WAAW,CAAC,cAAc;QAC1C,mBAAmB,EAAE,WAAW,CAAC,mBAAmB;QACpD,eAAe,EAAE,WAAW,CAAC,eAAe;QAC5C,MAAM,EAAE,WAAW,CAAC,MAAM;KAC3B,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CACtC,MAA8C,EAC9C,WAA4B;IAE5B,OAAO,CACL,MAAM,CAAC,IAAI,KAAK,WAAW,CAAC,IAAI;QAChC,MAAM,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM;QACpC,SAAS,CAAC,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,WAAW,CAAC;QACtD,SAAS,CAAC,MAAM,CAAC,cAAc,EAAE,WAAW,CAAC,cAAc,CAAC;QAC5D,MAAM,CAAC,KAAK,KAAK,WAAW,CAAC,KAAK;QAClC,SAAS,CAAC,MAAM,CAAC,aAAa,EAAE,WAAW,CAAC,aAAa,CAAC;QAC1D,MAAM,CAAC,0BAA0B,KAAK,WAAW,CAAC,0BAA0B;QAC5E,SAAS,CAAC,MAAM,CAAC,aAAa,EAAE,WAAW,CAAC,aAAa,CAAC;QAC1D,SAAS,CAAC,MAAM,CAAC,yBAAyB,EAAE,WAAW,CAAC,yBAAyB,CAAC;QAClF,SAAS,CAAC,MAAM,CAAC,eAAe,EAAE,WAAW,CAAC,eAAe,CAAC;QAC9D,MAAM,CAAC,YAAY,KAAK,WAAW,CAAC,YAAY,CACjD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CACzB,iBAA0B,EAC1B,OAAmC;IAEnC,IAAI,iBAAiB;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,KAAK,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,oBAAoB,CAAC;AAC/E,CAAC"}

package/dist/portability/plan.d.ts

@@ -0,0 +1,34 @@
+/** Mutation-free normalization, dependency resolution, and import action planning. */
+import { type PortabilityImportSnapshot } from './import-repository.js';
+import type { PortabilityImportMode, PortabilityManifest, PortabilityResult } from './types.js';
+/** Internal resolved plan retained for the later atomic writer. */
+export interface ResolvedPortabilityPlan {
+    /** Strict normalized manifest used to build every action. */
+    readonly manifest: PortabilityManifest;
+    /** Destination snapshot containing private relationship identifiers. */
+    readonly snapshot: PortabilityImportSnapshot;
+    /** Safe public result from the same snapshot. */
+    readonly result: PortabilityResult;
+}
+/**
+ * Build the resolved plan using the current request-owned transaction.
+ *
+ * Apply uses this boundary so preview and mutation share the same normalization,
+ * compatibility, and dependency checks.
+ *
+ * @param input - Manifest received by the service
+ * @param mode - Requested preview or apply behavior
+ * @returns Normalized manifest, private snapshot, and safe public result
+ */
+export declare function buildResolvedPortabilityPlan(input: PortabilityManifest, mode: PortabilityImportMode): Promise<ResolvedPortabilityPlan>;
+/**
+ * Build a safe preview result without changing product, credential, or audit records.
+ *
+ * @param manifest - Complete manifest received from an import request
+ * @param mode - Import behavior represented by the plan
+ * @returns Ordered safe plan result
+ * @example
+ * const preview = await buildPortabilityPlan(manifest, 'dry-run');
+ */
+export declare function buildPortabilityPlan(manifest: PortabilityManifest, mode: PortabilityImportMode): Promise<PortabilityResult>;
+//# sourceMappingURL=plan.d.ts.map

package/dist/portability/plan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan.d.ts","sourceRoot":"","sources":["../../src/portability/plan.ts"],"names":[],"mappings":"AAAA,sFAAsF;AAItF,OAAO,EAEL,KAAK,yBAAyB,EAC/B,MAAM,wBAAwB,CAAC;AAyBhC,OAAO,KAAK,EAEV,qBAAqB,EACrB,mBAAmB,EACnB,iBAAiB,EAElB,MAAM,YAAY,CAAC;AAEpB,mEAAmE;AACnE,MAAM,WAAW,uBAAuB;IACtC,6DAA6D;IAC7D,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;IACvC,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,EAAE,yBAAyB,CAAC;IAC7C,iDAAiD;IACjD,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;CACpC;AAED;;;;;;;;;GASG;AACH,wBAAsB,4BAA4B,CAChD,KAAK,EAAE,mBAAmB,EAC1B,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,uBAAuB,CAAC,CAumBlC;AAED;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,mBAAmB,EAC7B,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,iBAAiB,CAAC,CAI5B"}