@rehearsal-db/core 0.1.0-beta.12 → 0.1.0-beta.13

package/src/cli/source_commands.mjs

@@ -13,7 +13,10 @@ import {
   pruneBaselineGenerations,
   verifyActiveBaseline,
 } from "../baseline/artifact.mjs";
-import { readPrivacyKey } from "../baseline/privacy_engine.mjs";
+import {
+  createPrivacyEngine,
+  readPrivacyKey,
+} from "../baseline/privacy_engine.mjs";
 import { loadRehearsalConfig } from "../project/configuration.mjs";
 import {
   createSourceAccessPlan,
@@ -21,6 +24,7 @@ import {
 } from "../source/access.mjs";
 import { streamApprovedSupabaseAssets } from "../source/asset_transfer.mjs";
 import { refreshPostgresqlBaseline } from "../source/baseline.mjs";
+import { resolvePrivacyMappedAssets } from "../source/privacy_paths.mjs";
 import {
   applyPostgresqlSourceAccess,
   planPostgresqlSourceAccessRetirement,
@@ -114,6 +118,15 @@ export const runSourceBaselineRefresh = async ({ planOptions }) => {
       join(loaded.projectRoot, sourcePolicy.reader.credentialFile),
     ),
   ]);
+  const privacyPolicy = JSON.parse(privacyPolicyBytes.toString("utf8"));
+  const assetPrivacyEngine = createPrivacyEngine({
+    policy: privacyPolicy,
+    key: privacyKey,
+  });
+  const assetDeclarations = resolvePrivacyMappedAssets({
+    sourcePolicy,
+    privacyPolicy,
+  });
   return refreshPostgresqlBaseline({
     connectionString,
     sourcePolicy,
@@ -133,10 +146,12 @@ export const runSourceBaselineRefresh = async ({ planOptions }) => {
           baseUrl:
             process.env[sourcePolicy.assetReader.baseUrlEnvironmentVariable],
           token: process.env[sourcePolicy.assetReader.tokenEnvironmentVariable],
-          declarations: sourcePolicy.assets,
+          declarations: assetDeclarations,
           maximumObjects: sourcePolicy.assetReader.maximumObjects,
           maximumObjectBytes: sourcePolicy.assetReader.maximumObjectBytes,
           maximumTotalBytes: sourcePolicy.assetReader.maximumTotalBytes,
+          pathMapper: ({ mapping, value }) =>
+            assetPrivacyEngine.remapPath({ mapping, value }),
         })
       : [],
   });
@@ -244,9 +259,15 @@ export const buildRefreshWorkflowPlan = async (planOptions) => {
 };
 
 export const createRefreshWorkflow =
-  ({ runRuntimeStack, prepareDependentTargets, topologyCommandEnvironment }) =>
+  ({
+    runRuntimeStack,
+    prepareDependentTargets,
+    topologyCommandEnvironment,
+    buildPlan = buildRefreshWorkflowPlan,
+    refreshBaseline = runSourceBaselineRefresh,
+  }) =>
   async ({ flags, planOptions }) => {
-    const context = await buildRefreshWorkflowPlan(planOptions);
+    const context = await buildPlan(planOptions);
     if (!flags.refreshConfirmation) {
       return { mode: "preview", plan: context.plan };
     }
@@ -259,7 +280,7 @@ export const createRefreshWorkflow =
     let runtime;
     let preparations = [];
     try {
-      refreshed = await runSourceBaselineRefresh({ planOptions });
+      refreshed = await refreshBaseline({ planOptions });
       const stack = await runRuntimeStack({
         command: "reset",
         flags,

package/src/project/setup.mjs

@@ -23,6 +23,11 @@ import {
   renderDetectedPostgresqlConfig,
 } from "./configuration.mjs";
 import { resolveRuntimeTarget } from "../targets/target.mjs";
+export {
+  assertSupportedRehearsalNodeRuntime,
+  inspectRehearsalNodeRuntime,
+} from "../shared/node_runtime.mjs";
+import { assertSupportedRehearsalNodeRuntime } from "../shared/node_runtime.mjs";
 
 const CONFIG_PATH = "rehearsal.config.mjs";
 const LOCAL_SUPABASE_CONFIG_PATH =
@@ -82,29 +87,6 @@ export const isRehearsalPortAvailable = async (port) => {
   return canBindToPort(port);
 };
 
-export const inspectRehearsalNodeRuntime = (
-  version = process.versions.node,
-) => {
-  const major = Number.parseInt(String(version).split(".")[0], 10);
-  return {
-    version: String(version),
-    major,
-    supported: major === 24,
-  };
-};
-
-export const assertSupportedRehearsalNodeRuntime = (
-  version = process.versions.node,
-) => {
-  const runtime = inspectRehearsalNodeRuntime(version);
-  if (!runtime.supported) {
-    throw new Error(
-      `Rehearsal setup requires Node.js 24; this shell is using Node.js ${runtime.version}. Switch to Node.js 24, then rerun setup. With nvm: nvm install 24 && nvm use 24.`,
-    );
-  }
-  return runtime;
-};
-
 export const findAvailableRehearsalPorts = async ({
   isAvailable = isRehearsalPortAvailable,
 } = {}) => {

package/src/runtime/plan.mjs

@@ -22,6 +22,10 @@ import {
 import { createCandidateMigrationReceipt } from "./restore.mjs";
 import { readMigrationFileInventory } from "./migration_history.mjs";
 import { REHEARSAL_VERSION } from "../shared/diagnostics.mjs";
+import {
+  inspectRehearsalNodeRuntime,
+  REHEARSAL_NODE_LABEL,
+} from "../shared/node_runtime.mjs";
 import { readRehearsalServiceEnvironment } from "./service_environment.mjs";
 import {
   readBoundRuntimeSanitizationPolicy,
@@ -357,17 +361,17 @@ export const runRehearsalDoctor = async (options = {}) => {
     };
   }
   const { config, paths, projectRoot } = loaded;
-  const nodeMajor = Number(process.versions.node.split(".")[0]);
+  const nodeRuntime = inspectRehearsalNodeRuntime();
   const checkDefinitions = [
     {
       id: "node",
       label: "Node.js compatibility",
       run: async () => {
-        if (nodeMajor !== 24)
+        if (!nodeRuntime.supported)
           throw new Error(`Node ${process.versions.node} is unsupported.`);
         return `Node ${process.versions.node}`;
       },
-      remediation: "Use Node.js 24.",
+      remediation: `Use ${REHEARSAL_NODE_LABEL}. Node.js 24 LTS is recommended.`,
     },
     {
       id: "operating-system",

package/src/runtime/restore.mjs

@@ -194,11 +194,19 @@ const buildIdentitySequenceSql = (table) =>
       const schema = tableSchema(table);
       const relation = qualifiedRelation(table);
       const columnName = quoteIdentifier(column.name);
-      return `select setval(
-	pg_get_serial_sequence(${quoteLiteral(`${schema}.${table.name}`)}, ${quoteLiteral(column.name)}),
-	coalesce((select max(${columnName}) from ${relation}), 1),
-	exists(select 1 from ${relation})
-);`;
+      const sequenceValueQuery = `select max(${columnName})::bigint, exists(select 1 from ${relation}) from ${relation}`;
+      return `do $rehearsal_sequence$
+declare
+	sequence_name text := pg_get_serial_sequence(${quoteLiteral(`${schema}.${table.name}`)}, ${quoteLiteral(column.name)});
+	maximum_value bigint;
+	has_rows boolean;
+begin
+	if sequence_name is not null then
+		execute ${quoteLiteral(sequenceValueQuery)} into maximum_value, has_rows;
+		perform setval(sequence_name, coalesce(maximum_value, 1), has_rows);
+	end if;
+end
+$rehearsal_sequence$;`;
     })
     .join("\n");
 

package/src/shared/diagnostics.mjs

@@ -94,6 +94,13 @@ export class RehearsalError extends Error {
 const inferCategory = (error) => {
   const message = String(error?.message ?? error);
   if (/checksum/iu.test(message)) return "baseline_checksum_mismatch";
+  if (
+    /container\b.*\b(?:is not ready|starting|unhealthy)|health(?:check)?\b.*\b(?:failed|starting|unhealthy)|out of memory|\boom\b|no space left|resource temporarily unavailable/iu.test(
+      message,
+    )
+  ) {
+    return "runtime_dependency_failure";
+  }
   if (/candidate|migration history diverges/iu.test(message)) {
     return "migration_candidate_failure";
   }

package/src/shared/node_runtime.mjs

@@ -0,0 +1,31 @@
+/**
+ * Supported Node.js release lines. Keep this aligned with package.json and the
+ * verification matrix.
+ */
+
+export const REHEARSAL_NODE_MAJORS = Object.freeze([22, 24, 26]);
+export const REHEARSAL_NODE_LABEL = "Node.js 22, 24, or 26";
+export const REHEARSAL_RECOMMENDED_NODE_MAJOR = 24;
+
+export const inspectRehearsalNodeRuntime = (
+  version = process.versions.node,
+) => {
+  const major = Number.parseInt(String(version).split(".")[0], 10);
+  return {
+    version: String(version),
+    major,
+    supported: REHEARSAL_NODE_MAJORS.includes(major),
+  };
+};
+
+export const assertSupportedRehearsalNodeRuntime = (
+  version = process.versions.node,
+) => {
+  const runtime = inspectRehearsalNodeRuntime(version);
+  if (!runtime.supported) {
+    throw new Error(
+      `Rehearsal requires ${REHEARSAL_NODE_LABEL}; this shell is using Node.js ${runtime.version}. Switch to a supported release, then rerun setup. With nvm: nvm install --lts && nvm use --lts.`,
+    );
+  }
+  return runtime;
+};

package/src/source/access.mjs

@@ -50,6 +50,13 @@ const positiveInteger = (value, label) => {
 const canonicalJson = (value) => `${JSON.stringify(value, null, "\t")}\n`;
 const sha256 = (value) => createHash("sha256").update(value).digest("hex");
 
+export const externalViewDefinitionFingerprint = (definition) => {
+  if (typeof definition !== "string" || !definition.trim()) {
+    throw new Error("External view definition must be a non-empty string.");
+  }
+  return sha256(definition.trim());
+};
+
 export const sourceTargetFingerprint = (connectionString) => {
   let target;
   try {
@@ -95,24 +102,74 @@ export const validateSourceAccessPolicy = (policy) => {
     throw new Error("Source access policy must use accessVersion 1.");
   }
   fingerprint(policy.targetFingerprint, "sourcePolicy.targetFingerprint");
-  envKey(
-    policy.administratorEnvironmentVariable,
-    "sourcePolicy.administratorEnvironmentVariable",
-  );
   if (!isObject(policy.reader))
     throw new Error("sourcePolicy.reader must be an object.");
+  const readerMode = policy.reader.mode ?? "managed";
+  if (!["managed", "external"].includes(readerMode)) {
+    throw new Error("sourcePolicy.reader.mode must be managed or external.");
+  }
   knownKeys(
     policy.reader,
-    ["role", "ownerRole", "credentialFile", "validForMinutes"],
+    readerMode === "managed"
+      ? ["mode", "role", "ownerRole", "credentialFile", "validForMinutes"]
+      : [
+          "mode",
+          "role",
+          "connectionEnvironmentVariable",
+          "credentialFile",
+          "maximumValidForMinutes",
+        ],
     "sourcePolicy.reader",
   );
+  let administratorEnvironmentVariable;
+  if (readerMode === "managed") {
+    administratorEnvironmentVariable = envKey(
+      policy.administratorEnvironmentVariable,
+      "sourcePolicy.administratorEnvironmentVariable",
+    );
+  } else if (policy.administratorEnvironmentVariable !== undefined) {
+    throw new Error(
+      "sourcePolicy.administratorEnvironmentVariable is not allowed for an external reader.",
+    );
+  }
   const role = identifier(policy.reader.role, "sourcePolicy.reader.role");
-  const ownerRole = identifier(
-    policy.reader.ownerRole,
-    "sourcePolicy.reader.ownerRole",
-  );
-  if (role === ownerRole)
-    throw new Error("Source reader and owner roles must differ.");
+  let ownerRole;
+  let validForMinutes;
+  let connectionEnvironmentVariable;
+  let maximumValidForMinutes;
+  if (readerMode === "managed") {
+    ownerRole = identifier(
+      policy.reader.ownerRole,
+      "sourcePolicy.reader.ownerRole",
+    );
+    if (role === ownerRole)
+      throw new Error("Source reader and owner roles must differ.");
+    if (
+      !Number.isSafeInteger(policy.reader.validForMinutes) ||
+      policy.reader.validForMinutes < 5 ||
+      policy.reader.validForMinutes > 240
+    ) {
+      throw new Error(
+        "sourcePolicy.reader.validForMinutes must be from 5 through 240.",
+      );
+    }
+    validForMinutes = policy.reader.validForMinutes;
+  } else {
+    connectionEnvironmentVariable = envKey(
+      policy.reader.connectionEnvironmentVariable,
+      "sourcePolicy.reader.connectionEnvironmentVariable",
+    );
+    if (
+      !Number.isSafeInteger(policy.reader.maximumValidForMinutes) ||
+      policy.reader.maximumValidForMinutes < 5 ||
+      policy.reader.maximumValidForMinutes > 240
+    ) {
+      throw new Error(
+        "sourcePolicy.reader.maximumValidForMinutes must be from 5 through 240.",
+      );
+    }
+    maximumValidForMinutes = policy.reader.maximumValidForMinutes;
+  }
   if (
     typeof policy.reader.credentialFile !== "string" ||
     !policy.reader.credentialFile.startsWith(".rehearsal/") ||
@@ -122,15 +179,6 @@ export const validateSourceAccessPolicy = (policy) => {
       "sourcePolicy.reader.credentialFile must stay under .rehearsal/.",
     );
   }
-  if (
-    !Number.isSafeInteger(policy.reader.validForMinutes) ||
-    policy.reader.validForMinutes < 5 ||
-    policy.reader.validForMinutes > 240
-  ) {
-    throw new Error(
-      "sourcePolicy.reader.validForMinutes must be from 5 through 240.",
-    );
-  }
   const exportSchema = identifier(
     policy.exportSchema,
     "sourcePolicy.exportSchema",
@@ -185,6 +233,7 @@ export const validateSourceAccessPolicy = (policy) => {
         "columns",
         "orderBy",
         "rowScope",
+        "viewDefinitionSha256",
       ],
       label,
     );
@@ -235,6 +284,17 @@ export const validateSourceAccessPolicy = (policy) => {
       throw new Error(`${label}.orderBy must name unique exported columns.`);
     }
     const orderBy = Object.freeze([...relation.orderBy]);
+    let viewDefinitionSha256;
+    if (readerMode === "external") {
+      viewDefinitionSha256 = fingerprint(
+        relation.viewDefinitionSha256,
+        `${label}.viewDefinitionSha256`,
+      );
+    } else if (relation.viewDefinitionSha256 !== undefined) {
+      throw new Error(
+        `${label}.viewDefinitionSha256 is supported only for an external reader.`,
+      );
+    }
     if (!isObject(relation.rowScope))
       throw new Error(`${label}.rowScope must be an object.`);
     knownKeys(
@@ -282,6 +342,7 @@ export const validateSourceAccessPolicy = (policy) => {
       columns,
       orderBy,
       rowScope,
+      ...(viewDefinitionSha256 ? { viewDefinitionSha256 } : {}),
     });
   });
   const assets = policy.assets ?? [];
@@ -290,29 +351,79 @@ export const validateSourceAccessPolicy = (policy) => {
   const normalizedAssets = assets.map((asset, index) => {
     const label = `sourcePolicy.assets[${index}]`;
     if (!isObject(asset)) throw new Error(`${label} must be an object.`);
-    knownKeys(asset, ["bucket", "prefix", "rights"], label);
+    knownKeys(
+      asset,
+      [
+        "bucket",
+        "prefix",
+        "prefixEnvironmentVariable",
+        "rights",
+        "pathMapping",
+      ],
+      label,
+    );
     if (!/^[a-z0-9][a-z0-9.-]{0,99}$/u.test(asset.bucket ?? "")) {
       throw new Error(`${label}.bucket is invalid.`);
     }
-    const prefixParts =
-      typeof asset.prefix === "string"
-        ? asset.prefix.replace(/\/$/u, "").split("/")
-        : [];
-    if (
-      typeof asset.prefix !== "string" ||
-      !asset.prefix ||
-      asset.prefix.startsWith("/") ||
-      prefixParts.some((part) => !part || part === "." || part === "..")
-    ) {
-      throw new Error(`${label}.prefix is unsafe.`);
+    const hasFixedPrefix = asset.prefix !== undefined;
+    const hasPrivatePrefix = asset.prefixEnvironmentVariable !== undefined;
+    if (hasFixedPrefix === hasPrivatePrefix) {
+      throw new Error(
+        `${label} must declare exactly one of prefix or prefixEnvironmentVariable.`,
+      );
+    }
+    if (hasFixedPrefix) {
+      const prefixParts =
+        typeof asset.prefix === "string"
+          ? asset.prefix.replace(/\/$/u, "").split("/")
+          : [];
+      if (
+        typeof asset.prefix !== "string" ||
+        !asset.prefix ||
+        asset.prefix.startsWith("/") ||
+        prefixParts.some((part) => !part || part === "." || part === "..")
+      ) {
+        throw new Error(`${label}.prefix is unsafe.`);
+      }
+    } else {
+      envKey(
+        asset.prefixEnvironmentVariable,
+        `${label}.prefixEnvironmentVariable`,
+      );
     }
     if (!["approved-public", "approved-owner"].includes(asset.rights)) {
       throw new Error(`${label}.rights must be explicitly approved.`);
     }
+    if (
+      asset.pathMapping !== undefined &&
+      !/^[a-z][a-z0-9-]{0,62}$/u.test(asset.pathMapping)
+    ) {
+      throw new Error(`${label}.pathMapping is invalid.`);
+    }
+    if (hasPrivatePrefix && asset.rights !== "approved-owner") {
+      throw new Error(
+        `${label}.prefixEnvironmentVariable requires approved-owner rights.`,
+      );
+    }
+    if (hasPrivatePrefix && asset.pathMapping === undefined) {
+      throw new Error(
+        `${label}.prefixEnvironmentVariable requires pathMapping.`,
+      );
+    }
+    if (hasFixedPrefix && asset.pathMapping !== undefined) {
+      throw new Error(
+        `${label}.pathMapping requires prefixEnvironmentVariable so the raw identity stays out of tracked policy.`,
+      );
+    }
     return Object.freeze({
       bucket: asset.bucket,
-      prefix: asset.prefix,
+      ...(hasFixedPrefix
+        ? { prefix: asset.prefix }
+        : { prefixEnvironmentVariable: asset.prefixEnvironmentVariable }),
       rights: asset.rights,
+      ...(asset.pathMapping === undefined
+        ? {}
+        : { pathMapping: asset.pathMapping }),
     });
   });
   let assetReader = null;
@@ -368,12 +479,16 @@ export const validateSourceAccessPolicy = (policy) => {
   return Object.freeze({
     accessVersion: 1,
     targetFingerprint: policy.targetFingerprint,
-    administratorEnvironmentVariable: policy.administratorEnvironmentVariable,
+    ...(administratorEnvironmentVariable
+      ? { administratorEnvironmentVariable }
+      : {}),
     reader: Object.freeze({
+      mode: readerMode,
       role,
-      ownerRole,
       credentialFile: policy.reader.credentialFile,
-      validForMinutes: policy.reader.validForMinutes,
+      ...(readerMode === "managed"
+        ? { ownerRole, validForMinutes }
+        : { connectionEnvironmentVariable, maximumValidForMinutes }),
     }),
     exportSchema,
     migrationLedger,
@@ -389,10 +504,18 @@ export const createSourceAccessPlan = ({
 }) => {
   const normalized = validateSourceAccessPolicy(policy);
   const sourceCredential =
-    environment[normalized.administratorEnvironmentVariable];
+    environment[
+      normalized.reader.mode === "managed"
+        ? normalized.administratorEnvironmentVariable
+        : normalized.reader.connectionEnvironmentVariable
+    ];
   if (!sourceCredential) {
     throw new Error(
-      `Source preparation requires ${normalized.administratorEnvironmentVariable}; the value is read from the environment and never printed.`,
+      `Source preparation requires ${
+        normalized.reader.mode === "managed"
+          ? normalized.administratorEnvironmentVariable
+          : normalized.reader.connectionEnvironmentVariable
+      }; the value is read from the environment and never printed.`,
     );
   }
   const actualTarget = sourceTargetFingerprint(sourceCredential);
@@ -411,6 +534,16 @@ export const createSourceAccessPlan = ({
         return [relation.view, sha256(value)];
       }),
   );
+  const assetPrefixReceipts = Object.fromEntries(
+    normalized.assets
+      .filter((asset) => asset.prefixEnvironmentVariable)
+      .map((asset) => {
+        const key = asset.prefixEnvironmentVariable;
+        const value = environment[key];
+        if (!value) throw new Error(`Source preparation requires ${key}.`);
+        return [`${asset.bucket}:${asset.pathMapping}`, sha256(value)];
+      }),
+  );
   if (normalized.assetReader) {
     const baseUrl =
       environment[normalized.assetReader.baseUrlEnvironmentVariable];
@@ -435,10 +568,21 @@ export const createSourceAccessPlan = ({
     targetFingerprint: normalized.targetFingerprint,
     exportSchema: normalized.exportSchema,
     reader: {
+      mode: normalized.reader.mode,
       role: normalized.reader.role,
-      ownerRole: normalized.reader.ownerRole,
-      validForMinutes: normalized.reader.validForMinutes,
       credentialFile: normalized.reader.credentialFile,
+      ...(normalized.reader.mode === "managed"
+        ? {
+            ownerRole: normalized.reader.ownerRole,
+            validForMinutes: normalized.reader.validForMinutes,
+            sourceChanges: true,
+          }
+        : {
+            connectionEnvironmentVariable:
+              normalized.reader.connectionEnvironmentVariable,
+            maximumValidForMinutes: normalized.reader.maximumValidForMinutes,
+            sourceChanges: false,
+          }),
     },
     relations: normalized.relations.map((relation) => ({
       source: relation.source,
@@ -446,6 +590,9 @@ export const createSourceAccessPlan = ({
       targetTable: relation.targetTable,
       columns: relation.columns,
       orderBy: relation.orderBy,
+      ...(relation.viewDefinitionSha256
+        ? { viewDefinitionSha256: relation.viewDefinitionSha256 }
+        : {}),
       rowScope: {
         kind: relation.rowScope.kind,
         ...(relation.rowScope.kind === "approved-owner"
@@ -456,7 +603,15 @@ export const createSourceAccessPlan = ({
           : {}),
       },
     })),
-    assets: normalized.assets,
+    assets: normalized.assets.map((asset) =>
+      asset.prefixEnvironmentVariable
+        ? {
+            ...asset,
+            prefixValueSha256:
+              assetPrefixReceipts[`${asset.bucket}:${asset.pathMapping}`],
+          }
+        : asset,
+    ),
     assetReader: normalized.assetReader
       ? {
           endpointFingerprint: normalized.assetReader.endpointFingerprint,
@@ -465,13 +620,23 @@ export const createSourceAccessPlan = ({
           maximumTotalBytes: normalized.assetReader.maximumTotalBytes,
         }
       : null,
-    denyChecks: [
-      "raw relation reads",
-      "writes",
-      "role creation and escalation",
-      "network functions",
-      "unrelated private assets",
-    ],
+    denyChecks:
+      normalized.reader.mode === "managed"
+        ? [
+            "raw relation reads",
+            "writes",
+            "role creation and escalation",
+            "network functions",
+            "unrelated private assets",
+          ]
+        : [
+            "all non-system readable columns match the approved views and migration ledger",
+            "no relation, column, schema, or database writes",
+            "no inherited roles or privileged role attributes",
+            "no executable non-system security-definer functions",
+            "database-enforced credential expiration",
+            "unrelated private assets",
+          ],
   };
   return Object.freeze({
     policy: normalized,
@@ -480,6 +645,9 @@ export const createSourceAccessPlan = ({
   });
 };
 
+export const sourceAccessPolicyFingerprint = (policy) =>
+  sha256(canonicalJson(validateSourceAccessPolicy(policy)));
+
 export const assetEndpointFingerprint = (value) => {
   let endpoint;
   try {
@@ -525,6 +693,10 @@ export const createSourceRetirementPlan = ({
   if (!Array.isArray(receipt.views) || !Array.isArray(receipt.relations)) {
     throw new Error("Source access receipt object inventory is invalid.");
   }
+  const accessMode = receipt.accessMode ?? "managed";
+  if (!["managed", "external"].includes(accessMode)) {
+    throw new Error("Source access receipt mode is invalid.");
+  }
   const relations = receipt.relations.map((relation, index) => {
     if (!isObject(relation))
       throw new Error(`receipt.relations[${index}] is invalid.`);
@@ -560,6 +732,7 @@ export const createSourceRetirementPlan = ({
   const review = {
     planVersion: 1,
     operation: "retire-source-access",
+    accessMode,
     targetFingerprint: target,
     preparationDigest: fingerprint(receipt.planDigest, "receipt.planDigest"),
     exportSchema: identifier(receipt.exportSchema, "receipt.exportSchema"),
@@ -569,7 +742,9 @@ export const createSourceRetirementPlan = ({
     relations,
     migrationLedger: ledger,
     readerRole: identifier(receipt.readerRole, "receipt.readerRole"),
-    ownerRole: identifier(receipt.ownerRole, "receipt.ownerRole"),
+    ...(accessMode === "managed"
+      ? { ownerRole: identifier(receipt.ownerRole, "receipt.ownerRole") }
+      : {}),
   };
   return Object.freeze({
     review: Object.freeze(review),