@rehearsal-db/core 0.1.0-beta.12 → 0.1.0-beta.13

package/src/source/asset_transfer.mjs

@@ -42,6 +42,21 @@ const readError = (label, response) =>
     `${label} failed with HTTP ${response.status}; response content was withheld.`,
   );
 
+const canonicalContentType = (...values) => {
+  for (const value of values) {
+    if (typeof value !== "string") continue;
+    const mediaType = value.split(";", 1)[0].trim().toLowerCase();
+    if (
+      /^[a-z0-9][a-z0-9!#$&^_.+-]*\/[a-z0-9][a-z0-9!#$&^_.+-]*$/u.test(
+        mediaType,
+      )
+    ) {
+      return mediaType;
+    }
+  }
+  return "application/octet-stream";
+};
+
 const responseBody = async function* ({
   response,
   expectedBytes,
@@ -69,6 +84,7 @@ export const streamApprovedSupabaseAssets = async function* ({
   maximumObjects = 10_000,
   maximumObjectBytes = 50 * 1024 * 1024,
   maximumTotalBytes = 2 * 1024 * 1024 * 1024,
+  pathMapper,
 }) {
   const endpoint = safeBaseUrl(baseUrl);
   if (typeof token !== "string" || token.length < 16) {
@@ -156,13 +172,27 @@ export const streamApprovedSupabaseAssets = async function* ({
             );
           }
         }
+        if (declaration.pathMapping && typeof pathMapper !== "function") {
+          throw new Error(
+            "Storage path mapping requires the package-owned privacy mapper.",
+          );
+        }
+        const objectPath = declaration.pathMapping
+          ? safePath(
+              pathMapper({
+                mapping: declaration.pathMapping,
+                value: name,
+              }),
+              "Mapped Storage object path",
+            )
+          : name;
         yield {
           bucket: declaration.bucket,
-          objectPath: name,
-          contentType:
-            download.headers.get("content-type") ??
-            object.metadata?.mimetype ??
-            "application/octet-stream",
+          objectPath,
+          contentType: canonicalContentType(
+            object.metadata?.mimetype,
+            download.headers.get("content-type"),
+          ),
           content: responseBody({
             response: download,
             expectedBytes,

package/src/source/baseline.mjs

@@ -24,6 +24,7 @@ import {
   validateExecutablePrivacyPolicy,
 } from "../baseline/privacy_engine.mjs";
 import {
+  sourceAccessPolicyFingerprint,
   sourceTargetFingerprint,
   validateSourceAccessPolicy,
 } from "./access.mjs";
@@ -45,6 +46,15 @@ const quoteIdentifier = (value) => {
 
 const canonicalJson = (value) => `${JSON.stringify(value, null, "\t")}\n`;
 const sha256 = (value) => createHash("sha256").update(value).digest("hex");
+const parseEstimateValue = (value) => {
+  if (
+    (typeof value !== "string" && typeof value !== "number") ||
+    (typeof value === "string" && !/^(?:0|[1-9]\d*)$/u.test(value))
+  ) {
+    return Number.NaN;
+  }
+  return Number(value);
+};
 
 const normalizeLimits = (limits = {}) => {
   const normalized = { ...DEFAULT_LIMITS, ...limits };
@@ -132,10 +142,20 @@ const estimateExport = async (client, policy) => {
               coalesce(sum(pg_column_size(export_row)), 0)::bigint as bytes
        from ${quoteIdentifier(policy.exportSchema)}.${quoteIdentifier(relation.view)} export_row`,
     );
-    const tableRows = Number(result.rows[0].rows);
-    const tableBytes = Number(result.rows[0].bytes);
-    if (!Number.isSafeInteger(tableRows) || !Number.isSafeInteger(tableBytes)) {
-      throw new Error("Source export estimate exceeds safe numeric limits.");
+    const estimate = result.rows?.[0];
+    const tableRows = parseEstimateValue(estimate?.rows);
+    const tableBytes = parseEstimateValue(estimate?.bytes);
+    if (
+      !Number.isSafeInteger(tableRows) ||
+      !Number.isSafeInteger(tableBytes) ||
+      tableRows < 0 ||
+      tableBytes < 0 ||
+      !Number.isSafeInteger(rows + tableRows) ||
+      !Number.isSafeInteger(bytes + tableBytes)
+    ) {
+      throw new Error(
+        "Source export estimate is missing, negative, or exceeds safe numeric limits.",
+      );
     }
     rows += tableRows;
     bytes += tableBytes;
@@ -238,6 +258,14 @@ const streamSanitizedRecords = async function* ({
         const batch = await client.query(
           `fetch forward ${limits.batchRows} from ${quoteIdentifier(cursor)}`,
         );
+        if (
+          !Array.isArray(batch?.rows) ||
+          batch.rows.length > limits.batchRows
+        ) {
+          throw new Error(
+            "Source reader returned a malformed or oversized cursor batch.",
+          );
+        }
         if (batch.rows.length === 0) break;
         for (const row of batch.rows) {
           const sanitized = privacyEngine.sanitize({
@@ -295,6 +323,7 @@ export const refreshPostgresqlBaseline = async ({
     );
   }
   const expectedReceiptShape = {
+    accessMode: sourcePolicy.reader.mode,
     exportSchema: sourcePolicy.exportSchema,
     views: sourcePolicy.relations.map((relation) => relation.view).sort(),
     relations: sourcePolicy.relations.map((relation) => ({
@@ -303,19 +332,25 @@ export const refreshPostgresqlBaseline = async ({
     })),
     migrationLedger: sourcePolicy.migrationLedger,
     readerRole: sourcePolicy.reader.role,
-    ownerRole: sourcePolicy.reader.ownerRole,
+    ownerRole: sourcePolicy.reader.ownerRole ?? null,
   };
   const actualReceiptShape = {
+    accessMode: sourceAccessReceipt?.accessMode ?? "managed",
     exportSchema: sourceAccessReceipt?.exportSchema,
     views: [...(sourceAccessReceipt?.views ?? [])].sort(),
     relations: sourceAccessReceipt?.relations,
     migrationLedger: sourceAccessReceipt?.migrationLedger,
     readerRole: sourceAccessReceipt?.readerRole,
-    ownerRole: sourceAccessReceipt?.ownerRole,
+    ownerRole: sourceAccessReceipt?.ownerRole ?? null,
   };
+  const policyFingerprint = sourceAccessPolicyFingerprint(sourcePolicy);
   if (
     sourceAccessReceipt?.targetFingerprint !== sourcePolicy.targetFingerprint ||
     !/^[a-f0-9]{64}$/u.test(sourceAccessReceipt?.planDigest ?? "") ||
+    (sourcePolicy.reader.mode === "external" &&
+      sourceAccessReceipt?.policyFingerprint !== policyFingerprint) ||
+    (sourceAccessReceipt?.policyFingerprint !== undefined &&
+      sourceAccessReceipt.policyFingerprint !== policyFingerprint) ||
     new Date(sourceAccessReceipt.expiresAt).valueOf() <= Date.now() ||
     JSON.stringify(actualReceiptShape) !== JSON.stringify(expectedReceiptShape)
   ) {
@@ -388,6 +423,7 @@ export const refreshPostgresqlBaseline = async ({
           canonicalJson({
             targetFingerprint: sourceAccessReceipt.targetFingerprint,
             planDigest: sourceAccessReceipt.planDigest,
+            policyFingerprint: sourceAccessReceipt.policyFingerprint ?? null,
             expiresAt: sourceAccessReceipt.expiresAt,
           }),
         ),

package/src/source/external_reader.mjs

@@ -0,0 +1,255 @@
+/** Verify an externally provisioned PostgreSQL reader without source writes. */
+
+import pg from "pg";
+import { externalViewDefinitionFingerprint } from "./access.mjs";
+
+const { Client } = pg;
+
+const connect = async (connectionString, clientFactory) => {
+  const client = clientFactory
+    ? await clientFactory(connectionString)
+    : new Client({
+        connectionString,
+        application_name: "rehearsal-external-source-verification",
+      });
+  if (typeof client.connect === "function") await client.connect();
+  return client;
+};
+
+const columnKey = (schema, relation, column) =>
+  `${schema}\0${relation}\0${column}`;
+
+const expectedReadableColumns = (plan) =>
+  new Set([
+    ...plan.policy.relations.flatMap((relation) =>
+      relation.columns.map((column) =>
+        columnKey(plan.policy.exportSchema, relation.view, column),
+      ),
+    ),
+    ...[
+      plan.policy.migrationLedger.versionColumn,
+      plan.policy.migrationLedger.nameColumn,
+      plan.policy.migrationLedger.statementsColumn,
+    ].map((column) =>
+      columnKey(
+        plan.policy.migrationLedger.schema,
+        plan.policy.migrationLedger.table,
+        column,
+      ),
+    ),
+  ]);
+
+const count = (result, label) => {
+  const value = Number(result.rows[0]?.count);
+  if (!Number.isSafeInteger(value) || value < 0) {
+    throw new Error(`External source reader ${label} check was inconclusive.`);
+  }
+  return value;
+};
+
+export const verifyExternalPostgresqlReader = async ({
+  plan,
+  connectionString,
+  clientFactory,
+  now = new Date(),
+}) => {
+  if (plan.policy.reader.mode !== "external") {
+    throw new Error("External reader verification requires external mode.");
+  }
+  const client = await connect(connectionString, clientFactory);
+  let transactionOpen = false;
+  try {
+    await client.query("begin transaction read only");
+    transactionOpen = true;
+    const roleResult = await client.query(
+      `select rolname as role, rolcanlogin, rolvaliduntil,
+              rolsuper, rolcreaterole, rolcreatedb, rolreplication, rolbypassrls
+       from pg_roles where rolname = current_user`,
+    );
+    const role = roleResult.rows[0];
+    if (!role || role.role !== plan.policy.reader.role || !role.rolcanlogin) {
+      throw new Error(
+        "External source credential does not authenticate as the reviewed login role.",
+      );
+    }
+    if (
+      role.rolsuper ||
+      role.rolcreaterole ||
+      role.rolcreatedb ||
+      role.rolreplication ||
+      role.rolbypassrls
+    ) {
+      throw new Error("External source reader has privileged role attributes.");
+    }
+    const expiresAt = new Date(role.rolvaliduntil);
+    const maximumExpiration =
+      now.valueOf() + plan.policy.reader.maximumValidForMinutes * 60_000;
+    if (
+      !Number.isFinite(expiresAt.valueOf()) ||
+      expiresAt.valueOf() <= now.valueOf() ||
+      expiresAt.valueOf() > maximumExpiration
+    ) {
+      throw new Error(
+        "External source reader must have a future database-enforced expiration within the reviewed limit.",
+      );
+    }
+
+    const memberships = await client.query(
+      `select count(*)::integer as count
+       from pg_auth_members membership
+       join pg_roles member on member.oid = membership.member
+       where member.rolname = current_user`,
+    );
+    if (count(memberships, "role membership") !== 0) {
+      throw new Error(
+        "External source reader belongs to another database role.",
+      );
+    }
+
+    const databaseWrites = await client.query(
+      `select count(*)::integer as count
+       where has_database_privilege(current_user, current_database(), 'CREATE')`,
+    );
+    const schemaWrites = await client.query(
+      `select count(*)::integer as count
+       from pg_namespace
+       where nspname not like 'pg_temp_%'
+         and has_schema_privilege(current_user, oid, 'CREATE')`,
+    );
+    const relationWrites = await client.query(
+      `select count(*)::integer as count
+       from pg_class relation
+       join pg_namespace namespace on namespace.oid = relation.relnamespace
+       where namespace.nspname not in ('pg_catalog', 'information_schema')
+         and relation.relkind in ('r', 'p', 'v', 'm', 'f')
+         and (has_table_privilege(current_user, relation.oid, 'INSERT')
+           or has_table_privilege(current_user, relation.oid, 'UPDATE')
+           or has_table_privilege(current_user, relation.oid, 'DELETE')
+           or has_table_privilege(current_user, relation.oid, 'TRUNCATE')
+           or has_table_privilege(current_user, relation.oid, 'REFERENCES')
+           or has_table_privilege(current_user, relation.oid, 'TRIGGER'))`,
+    );
+    const columnWrites = await client.query(
+      `select count(*)::integer as count
+       from pg_class relation
+       join pg_namespace namespace on namespace.oid = relation.relnamespace
+       join pg_attribute attribute on attribute.attrelid = relation.oid
+       where namespace.nspname not in ('pg_catalog', 'information_schema')
+         and relation.relkind in ('r', 'p', 'v', 'm', 'f')
+         and attribute.attnum > 0 and not attribute.attisdropped
+         and (has_column_privilege(current_user, relation.oid, attribute.attnum, 'INSERT')
+           or has_column_privilege(current_user, relation.oid, attribute.attnum, 'UPDATE')
+           or has_column_privilege(current_user, relation.oid, attribute.attnum, 'REFERENCES'))`,
+    );
+    const sequenceAccess = await client.query(
+      `select count(*)::integer as count
+       from pg_class sequence
+       join pg_namespace namespace on namespace.oid = sequence.relnamespace
+       where namespace.nspname not in ('pg_catalog', 'information_schema')
+         and sequence.relkind = 'S'
+         and (has_sequence_privilege(current_user, sequence.oid, 'SELECT')
+           or has_sequence_privilege(current_user, sequence.oid, 'USAGE')
+           or has_sequence_privilege(current_user, sequence.oid, 'UPDATE'))`,
+    );
+    if (
+      [
+        databaseWrites,
+        schemaWrites,
+        relationWrites,
+        columnWrites,
+        sequenceAccess,
+      ].some((result) => count(result, "write or sequence privilege") !== 0)
+    ) {
+      throw new Error(
+        "External source reader has database write or sequence privileges.",
+      );
+    }
+
+    const readable = await client.query(
+      `select namespace.nspname as schema, relation.relname as relation,
+              attribute.attname as column
+       from pg_class relation
+       join pg_namespace namespace on namespace.oid = relation.relnamespace
+       join pg_attribute attribute on attribute.attrelid = relation.oid
+       where namespace.nspname not in ('pg_catalog', 'information_schema')
+         and namespace.nspname not like 'pg_toast%'
+         and relation.relkind in ('r', 'p', 'v', 'm', 'f')
+         and attribute.attnum > 0 and not attribute.attisdropped
+         and has_column_privilege(current_user, relation.oid, attribute.attnum, 'SELECT')
+       order by namespace.nspname, relation.relname, attribute.attnum`,
+    );
+    const expected = expectedReadableColumns(plan);
+    const actual = new Set(
+      readable.rows.map((row) =>
+        columnKey(row.schema, row.relation, row.column),
+      ),
+    );
+    if (
+      actual.size !== expected.size ||
+      [...actual].some((entry) => !expected.has(entry))
+    ) {
+      throw new Error(
+        "External source reader's readable columns do not exactly match the reviewed export surface.",
+      );
+    }
+
+    for (const relation of plan.policy.relations) {
+      const view = await client.query(
+        `select pg_get_viewdef(relation.oid, false) as definition,
+                relation.reloptions,
+                owner.rolname as owner
+         from pg_class relation
+         join pg_namespace namespace on namespace.oid = relation.relnamespace
+         join pg_roles owner on owner.oid = relation.relowner
+         where namespace.nspname = $1 and relation.relname = $2
+           and relation.relkind = 'v'`,
+        [plan.policy.exportSchema, relation.view],
+      );
+      const actual = view.rows[0];
+      if (!actual) {
+        throw new Error("An externally reviewed export view is missing.");
+      }
+      if (
+        !Array.isArray(actual.reloptions) ||
+        !actual.reloptions.includes("security_barrier=true")
+      ) {
+        throw new Error(
+          "External export views must enable PostgreSQL security_barrier.",
+        );
+      }
+      if (actual.owner === plan.policy.reader.role) {
+        throw new Error("External source reader must not own an export view.");
+      }
+      if (
+        externalViewDefinitionFingerprint(actual.definition) !==
+        relation.viewDefinitionSha256
+      ) {
+        throw new Error(
+          "External export view definition does not match its reviewed fingerprint.",
+        );
+      }
+    }
+
+    const securityDefiners = await client.query(
+      `select count(*)::integer as count
+       from pg_proc procedure
+       join pg_namespace namespace on namespace.oid = procedure.pronamespace
+       where namespace.nspname not in ('pg_catalog', 'information_schema')
+         and procedure.prosecdef
+         and has_function_privilege(current_user, procedure.oid, 'EXECUTE')`,
+    );
+    if (count(securityDefiners, "security-definer function") !== 0) {
+      throw new Error(
+        "External source reader can execute a non-system security-definer function.",
+      );
+    }
+    await client.query("rollback");
+    transactionOpen = false;
+    return Object.freeze({ expiresAt: expiresAt.toISOString() });
+  } catch (error) {
+    if (transactionOpen) await client.query("rollback").catch(() => undefined);
+    throw error;
+  } finally {
+    await client.end?.();
+  }
+};

package/src/source/postgresql_access.mjs

@@ -6,10 +6,10 @@
 import { createHash, randomBytes } from "node:crypto";
 import {
   chmod,
+  link,
   mkdir,
   open,
   readFile,
-  rename,
   rm,
   writeFile,
 } from "node:fs/promises";
@@ -18,8 +18,10 @@ import pg from "pg";
 import {
   assertSourceAccessConfirmation,
   createSourceRetirementPlan,
+  sourceAccessPolicyFingerprint,
   sourceTargetFingerprint,
 } from "./access.mjs";
+import { verifyExternalPostgresqlReader } from "./external_reader.mjs";
 
 const { Client } = pg;
 const IDENTIFIER = /^[a-z][a-z0-9_]{0,62}$/u;
@@ -180,6 +182,100 @@ const runDenyChecks = async (client, plan) => {
   }
 };
 
+const assertApprovedOwnerScopes = (plan, environment) => {
+  for (const relation of plan.policy.relations) {
+    if (relation.rowScope.kind !== "approved-owner") continue;
+    const value = environment[relation.rowScope.valueEnvironmentVariable];
+    if (
+      !value ||
+      createHash("sha256").update(value).digest("hex") !==
+        plan.review.relations.find((entry) => entry.view === relation.view)
+          ?.rowScope.valueSha256
+    ) {
+      throw new Error(
+        "Approved owner scope changed after the reviewed source-access preview.",
+      );
+    }
+  }
+};
+
+const buildSourceAccessReceipt = ({ plan, expiresAt }) => ({
+  receiptVersion: 1,
+  accessMode: plan.policy.reader.mode,
+  policyFingerprint: sourceAccessPolicyFingerprint(plan.policy),
+  targetFingerprint: plan.policy.targetFingerprint,
+  planDigest: plan.digest,
+  exportSchema: plan.policy.exportSchema,
+  views: plan.policy.relations.map((relation) => relation.view).sort(),
+  relations: plan.policy.relations.map((relation) => ({
+    ...relation.source,
+    columns: relation.columns,
+  })),
+  migrationLedger: plan.policy.migrationLedger,
+  readerRole: plan.policy.reader.role,
+  ...(plan.policy.reader.mode === "managed"
+    ? { ownerRole: plan.policy.reader.ownerRole }
+    : {}),
+  expiresAt,
+});
+
+const activateExternalPostgresqlSourceAccess = async ({
+  plan,
+  projectRoot,
+  environment,
+  clientFactory,
+  now,
+}) => {
+  const connectionString =
+    environment[plan.policy.reader.connectionEnvironmentVariable];
+  if (!connectionString) {
+    throw new Error(
+      `Missing ${plan.policy.reader.connectionEnvironmentVariable}.`,
+    );
+  }
+  assertTarget(plan, connectionString);
+  assertApprovedOwnerScopes(plan, environment);
+  const verified = await verifyExternalPostgresqlReader({
+    plan,
+    connectionString,
+    clientFactory,
+    now,
+  });
+  const credentialPath = ensureOwnedPath(
+    projectRoot,
+    plan.policy.reader.credentialFile,
+  );
+  const receiptPath = ensureOwnedPath(
+    projectRoot,
+    ".rehearsal/source-access-receipt.json",
+  );
+  const temporaryCredentialPath = `${credentialPath}.building-${process.pid}`;
+  const receipt = buildSourceAccessReceipt({
+    plan,
+    expiresAt: verified.expiresAt,
+  });
+  let receiptWritten = false;
+  try {
+    await writeExclusiveSecret(
+      temporaryCredentialPath,
+      `REHEARSAL_SOURCE_DATABASE_URL=${connectionString}\n`,
+    );
+    await writeFile(receiptPath, `${JSON.stringify(receipt, null, 2)}\n`, {
+      flag: "wx",
+      mode: 0o600,
+    });
+    receiptWritten = true;
+    await chmod(receiptPath, 0o600);
+    await link(temporaryCredentialPath, credentialPath);
+    await rm(temporaryCredentialPath, { force: true });
+  } catch (error) {
+    await rm(temporaryCredentialPath, { force: true });
+    if (receiptWritten) await rm(receiptPath, { force: true });
+    throw error;
+  }
+  return { receipt, credentialPath, receiptPath };
+};
+
 export const applyPostgresqlSourceAccess = async ({
   plan,
   confirmation,
@@ -189,26 +285,22 @@ export const applyPostgresqlSourceAccess = async ({
   now = new Date(),
 }) => {
   assertSourceAccessConfirmation(plan, confirmation);
+  if (plan.policy.reader.mode === "external") {
+    return activateExternalPostgresqlSourceAccess({
+      plan,
+      projectRoot,
+      environment,
+      clientFactory,
+      now,
+    });
+  }
   const administratorConnectionString =
     environment[plan.policy.administratorEnvironmentVariable];
   if (!administratorConnectionString) {
     throw new Error(`Missing ${plan.policy.administratorEnvironmentVariable}.`);
   }
   assertTarget(plan, administratorConnectionString);
-  for (const relation of plan.policy.relations) {
-    if (relation.rowScope.kind !== "approved-owner") continue;
-    const value = environment[relation.rowScope.valueEnvironmentVariable];
-    if (
-      !value ||
-      createHash("sha256").update(value).digest("hex") !==
-        plan.review.relations.find((entry) => entry.view === relation.view)
-          ?.rowScope.valueSha256
-    ) {
-      throw new Error(
-        "Approved owner scope changed after the reviewed source-access preview.",
-      );
-    }
-  }
+  assertApprovedOwnerScopes(plan, environment);
   const password = randomBytes(32).toString("base64url");
   const expiresAt = new Date(
     now.valueOf() + plan.policy.reader.validForMinutes * 60_000,
@@ -227,13 +319,28 @@ export const applyPostgresqlSourceAccess = async ({
     plan.policy.reader.role,
     password,
   );
-  await writeExclusiveSecret(
-    temporaryCredentialPath,
-    `REHEARSAL_SOURCE_DATABASE_URL=${readerUrl}\n`,
-  );
-  const client = await connection(administratorConnectionString, clientFactory);
-  let committed = false;
+  let receiptReserved = false;
+  let credentialLinked = false;
   try {
+    await writeExclusiveSecret(
+      temporaryCredentialPath,
+      `REHEARSAL_SOURCE_DATABASE_URL=${readerUrl}\n`,
+    );
+    const receiptReservation = await open(receiptPath, "wx", 0o600);
+    receiptReserved = true;
+    await receiptReservation.close();
+    await link(temporaryCredentialPath, credentialPath);
+    credentialLinked = true;
+    await rm(temporaryCredentialPath, { force: true });
+  } catch (error) {
+    await rm(temporaryCredentialPath, { force: true });
+    if (credentialLinked) await rm(credentialPath, { force: true });
+    if (receiptReserved) await rm(receiptPath, { force: true });
+    throw error;
+  }
+  let client;
+  try {
+    client = await connection(administratorConnectionString, clientFactory);
     await client.query("begin");
     await client.query(
       "select pg_advisory_xact_lock(hashtext('rehearsal-source-access'))",
@@ -318,32 +425,19 @@ export const applyPostgresqlSourceAccess = async ({
     );
     await runDenyChecks(client, plan);
     await client.query("commit");
-    committed = true;
   } catch (error) {
-    await client.query("rollback").catch(() => undefined);
+    await client?.query("rollback").catch(() => undefined);
+    await Promise.all([
+      rm(credentialPath, { force: true }),
+      rm(receiptPath, { force: true }),
+    ]);
     throw error;
   } finally {
-    await client.end?.();
-    if (!committed) await rm(temporaryCredentialPath, { force: true });
+    await client?.end?.();
   }
-  await rename(temporaryCredentialPath, credentialPath);
-  const receipt = {
-    receiptVersion: 1,
-    targetFingerprint: plan.policy.targetFingerprint,
-    planDigest: plan.digest,
-    exportSchema: plan.policy.exportSchema,
-    views: plan.policy.relations.map((relation) => relation.view).sort(),
-    relations: plan.policy.relations.map((relation) => ({
-      ...relation.source,
-      columns: relation.columns,
-    })),
-    migrationLedger: plan.policy.migrationLedger,
-    readerRole: plan.policy.reader.role,
-    ownerRole: plan.policy.reader.ownerRole,
-    expiresAt,
-  };
+  const receipt = buildSourceAccessReceipt({ plan, expiresAt });
   await writeFile(receiptPath, `${JSON.stringify(receipt, null, 2)}\n`, {
-    flag: "wx",
+    flag: "w",
     mode: 0o600,
   });
   await chmod(receiptPath, 0o600);
@@ -380,6 +474,13 @@ export const retirePostgresqlSourceAccess = async ({
       `Source retirement confirmation does not match. Expected ${plan.digest}.`,
     );
   }
+  if (plan.review.accessMode === "external") {
+    await Promise.all([
+      rm(ensureOwnedPath(projectRoot, credentialFile), { force: true }),
+      rm(plan.receiptPath, { force: true }),
+    ]);
+    return { retired: true, providerResourcesPreserved: true };
+  }
   const administratorConnectionString =
     environment[administratorEnvironmentVariable];
   if (!administratorConnectionString)