@rehearsal-db/core 0.1.0-beta.13 → 0.1.0-beta.15

package/dist/src/shared/diagnostics.mjs

@@ -0,0 +1,170 @@
+/**
+ * Purpose: Provide stable Rehearsal result, failure, redaction, and rendering
+ * contracts for humans and automation. Do not run directly; this module is reusable
+ * script infrastructure.
+ */
+import { createHash } from "node:crypto";
+import packageManifest from "../../package.json" with { type: "json" };
+export const REHEARSAL_RESULT_VERSION = 1;
+export const REHEARSAL_VERSION = packageManifest.version;
+export const REHEARSAL_EXIT_CODES = Object.freeze({
+    success: 0,
+    configuration_invalid: 2,
+    unsafe_environment: 3,
+    baseline_invalid: 4,
+    baseline_checksum_mismatch: 5,
+    migration_candidate_failure: 6,
+    migration_verification_failure: 7,
+    application_proof_failure: 8,
+    runtime_dependency_failure: 9,
+    internal_failure: 10,
+});
+const SECRET_KEY_PATTERN = /(?:authorization|cookie|credential|database[_-]?url|jwt|key|password|secret|service[_-]?role|token)/iu;
+const JWT_PATTERN = /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/gu;
+const CONNECTION_STRING_PATTERN = /\b(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?):\/\/[^\s"']+/giu;
+const BEARER_PATTERN = /\bBearer\s+[^\s"']+/giu;
+const SUPABASE_KEY_PATTERN = /\bsb_(?:publishable|secret)_[A-Za-z0-9_-]+\b/gu;
+const redactString = (value) => value
+    .replace(CONNECTION_STRING_PATTERN, "[REDACTED_CONNECTION_STRING]")
+    .replace(JWT_PATTERN, "[REDACTED_JWT]")
+    .replace(BEARER_PATTERN, "Bearer [REDACTED]")
+    .replace(SUPABASE_KEY_PATTERN, "[REDACTED_KEY]");
+export const redactDiagnosticValue = (value, key = "") => {
+    if (SECRET_KEY_PATTERN.test(key))
+        return "[REDACTED]";
+    if (typeof value === "string")
+        return redactString(value);
+    if (Array.isArray(value)) {
+        return value.map((entry) => redactDiagnosticValue(entry));
+    }
+    if (value && typeof value === "object") {
+        return Object.fromEntries(Object.entries(value).map(([entryKey, entryValue]) => [
+            entryKey,
+            redactDiagnosticValue(entryValue, entryKey),
+        ]));
+    }
+    return value;
+};
+const diagnosticIdFor = ({ category, code, message, }) => createHash("sha256")
+    .update(`${category}\0${code}\0${message}`)
+    .digest("hex")
+    .slice(0, 12);
+export class RehearsalError extends Error {
+    category;
+    code;
+    expected;
+    actual;
+    context;
+    refused;
+    suggestions;
+    diagnosticId;
+    exitCode;
+    constructor({ category, code, message, expected, actual, context, refused, suggestions = [], cause, }) {
+        super(message, { cause });
+        this.name = "RehearsalError";
+        if (!Object.hasOwn(REHEARSAL_EXIT_CODES, category)) {
+            throw new Error(`Unknown Rehearsal error category: ${category}.`);
+        }
+        this.category = category;
+        this.code = code;
+        this.expected = expected;
+        this.actual = actual;
+        this.context = context;
+        this.refused = refused;
+        this.suggestions = suggestions;
+        this.diagnosticId = diagnosticIdFor({ category, code, message });
+        this.exitCode = REHEARSAL_EXIT_CODES[category];
+    }
+}
+const errorMessage = (error) => error instanceof Error ? error.message : String(error);
+const inferCategory = (error) => {
+    const message = errorMessage(error);
+    if (/checksum/iu.test(message))
+        return "baseline_checksum_mismatch";
+    if (/container\b.*\b(?:is not ready|starting|unhealthy)|health(?:check)?\b.*\b(?:failed|starting|unhealthy)|out of memory|\boom\b|no space left|resource temporarily unavailable/iu.test(message)) {
+        return "runtime_dependency_failure";
+    }
+    if (/candidate|migration history diverges/iu.test(message)) {
+        return "migration_candidate_failure";
+    }
+    if (/baseline|artifact|generation|sanitization policy/iu.test(message)) {
+        return "baseline_invalid";
+    }
+    if (/migration|ledger|replay/iu.test(message)) {
+        return "migration_verification_failure";
+    }
+    if (/config|unknown rehearsal|unsupported rehearsal/iu.test(message)) {
+        return "configuration_invalid";
+    }
+    if (/loopback|hosted|unsafe|credential|outbound/iu.test(message)) {
+        return "unsafe_environment";
+    }
+    if (/docker|postgres(?:ql)?|supabase|runtime|command|enoent|node\.js|ports?\b/iu.test(message)) {
+        return "runtime_dependency_failure";
+    }
+    return "internal_failure";
+};
+export const normalizeRehearsalError = (error, overrides = {}) => {
+    if (error instanceof RehearsalError)
+        return error;
+    const message = errorMessage(error);
+    const category = overrides.category ?? inferCategory(error);
+    return new RehearsalError({
+        category,
+        code: overrides.code ?? category.toUpperCase(),
+        message,
+        expected: overrides.expected,
+        actual: overrides.actual,
+        context: overrides.context,
+        refused: overrides.refused ??
+            "Rehearsal stopped before performing the requested operation.",
+        suggestions: overrides.suggestions ?? [],
+        cause: error,
+    });
+};
+export const createRehearsalResult = ({ command, status, data, warnings = [], startedAt = new Date(), durationMs = 0, }) => redactDiagnosticValue({
+    schemaVersion: REHEARSAL_RESULT_VERSION,
+    rehearsalVersion: REHEARSAL_VERSION,
+    command,
+    status,
+    startedAt: startedAt.toISOString(),
+    durationMs,
+    warnings,
+    data,
+});
+export const serializeRehearsalError = (error, { debug = false } = {}) => {
+    const failure = normalizeRehearsalError(error);
+    return redactDiagnosticValue({
+        schemaVersion: REHEARSAL_RESULT_VERSION,
+        rehearsalVersion: REHEARSAL_VERSION,
+        status: "error",
+        error: {
+            category: failure.category,
+            code: failure.code,
+            message: failure.message,
+            expected: failure.expected,
+            actual: failure.actual,
+            context: failure.context,
+            refused: failure.refused,
+            suggestions: failure.suggestions,
+            diagnosticId: failure.diagnosticId,
+            ...(debug && failure.cause ? { cause: errorMessage(failure.cause) } : {}),
+        },
+    });
+};
+const formatValue = (value) => typeof value === "string" ? value : (JSON.stringify(value) ?? String(value));
+export const renderHumanError = (error, { debug = false } = {}) => {
+    const { error: failure } = serializeRehearsalError(error, { debug });
+    return [
+        `Rehearsal stopped: ${failure.message}`,
+        failure.expected ? `Expected: ${formatValue(failure.expected)}` : null,
+        failure.actual ? `Actual: ${formatValue(failure.actual)}` : null,
+        failure.context ? `Context: ${formatValue(failure.context)}` : null,
+        failure.refused ? `Refused: ${failure.refused}` : null,
+        ...(failure.suggestions ?? []).map((value) => `Try: ${value}`),
+        `Diagnostic: ${failure.diagnosticId} (${failure.category})`,
+        debug && failure.cause ? `Cause: ${failure.cause}` : null,
+    ]
+        .filter(Boolean)
+        .join("\n");
+};

package/dist/src/shared/human_output.d.mts

@@ -0,0 +1,2 @@
+/** Purpose: Keep human-facing Rehearsal counts grammatically consistent. */
+export declare const formatCount: (count: number, singular: string, plural?: string) => string;

package/{src → dist/src}/shared/human_output.mjs

@@ -1,4 +1,2 @@
 /** Purpose: Keep human-facing Rehearsal counts grammatically consistent. */
-
-export const formatCount = (count, singular, plural = `${singular}s`) =>
-  `${count} ${count === 1 ? singular : plural}`;
+export const formatCount = (count, singular, plural = `${singular}s`) => `${count} ${count === 1 ? singular : plural}`;

package/dist/src/shared/node_runtime.d.mts

@@ -0,0 +1,14 @@
+/**
+ * Supported Node.js release lines. Keep this aligned with package.json and the
+ * verification matrix.
+ */
+export interface RehearsalNodeRuntime {
+    version: string;
+    major: number;
+    supported: boolean;
+}
+export declare const REHEARSAL_NODE_MAJORS: readonly number[];
+export declare const REHEARSAL_NODE_LABEL = "Node.js 22, 24, or 26";
+export declare const REHEARSAL_RECOMMENDED_NODE_MAJOR = 24;
+export declare const inspectRehearsalNodeRuntime: (version?: string | number) => RehearsalNodeRuntime;
+export declare const assertSupportedRehearsalNodeRuntime: (version?: string | number) => RehearsalNodeRuntime;

package/dist/src/shared/node_runtime.mjs

@@ -0,0 +1,25 @@
+/**
+ * Supported Node.js release lines. Keep this aligned with package.json and the
+ * verification matrix.
+ */
+export const REHEARSAL_NODE_MAJORS = Object.freeze([
+    22, 24, 26,
+]);
+export const REHEARSAL_NODE_LABEL = "Node.js 22, 24, or 26";
+export const REHEARSAL_RECOMMENDED_NODE_MAJOR = 24;
+export const inspectRehearsalNodeRuntime = (version = process.versions.node) => {
+    const [majorText = ""] = String(version).split(".");
+    const major = Number.parseInt(majorText, 10);
+    return {
+        version: String(version),
+        major,
+        supported: REHEARSAL_NODE_MAJORS.includes(major),
+    };
+};
+export const assertSupportedRehearsalNodeRuntime = (version = process.versions.node) => {
+    const runtime = inspectRehearsalNodeRuntime(version);
+    if (!runtime.supported) {
+        throw new Error(`Rehearsal requires ${REHEARSAL_NODE_LABEL}; this shell is using Node.js ${runtime.version}. Switch to a supported release, then rerun setup. With nvm: nvm install --lts && nvm use --lts.`);
+    }
+    return runtime;
+};

package/dist/src/shared/operation_guard.d.mts

@@ -0,0 +1,22 @@
+/** Project-wide mutation lock and installed-package integrity guard. */
+export interface InstalledPackageFingerprint {
+    readonly files: number;
+    readonly sha256: string;
+}
+export interface ProjectOperation {
+    readonly command: string;
+    release(): Promise<void>;
+    releaseSync(): void;
+}
+export declare const createInstalledPackageFingerprint: ({ packageRoot, }: {
+    packageRoot: string;
+}) => InstalledPackageFingerprint;
+export declare const assertInstalledPackageFingerprint: ({ packageRoot, expected, }: {
+    packageRoot: string;
+    expected: InstalledPackageFingerprint;
+}) => InstalledPackageFingerprint;
+export declare const acquireProjectOperation: ({ projectRoot, command, }: {
+    projectRoot: string;
+    command: string;
+}) => Promise<ProjectOperation>;
+export declare const inspectProjectOperationLocks: () => Promise<string[]>;

package/dist/src/shared/operation_guard.mjs

@@ -0,0 +1,150 @@
+/** Project-wide mutation lock and installed-package integrity guard. */
+import { createHash, randomBytes } from "node:crypto";
+import { lstat, mkdir, readFile, readdir, realpath, rename, rm, stat, writeFile, } from "node:fs/promises";
+import { readFileSync, readdirSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, relative } from "node:path";
+const LOCK_ROOT = join(tmpdir(), "rehearsal-db-operation-locks");
+const hasErrorCode = (error, code) => typeof error === "object" &&
+    error !== null &&
+    "code" in error &&
+    error.code === code;
+const parseLockOwner = (source) => {
+    const value = JSON.parse(source);
+    if (typeof value !== "object" ||
+        value === null ||
+        !("pid" in value) ||
+        !Number.isSafeInteger(value.pid) ||
+        !("token" in value) ||
+        typeof value.token !== "string") {
+        throw new Error("The Rehearsal operation-lock owner is invalid.");
+    }
+    return value;
+};
+const digest = (value) => createHash("sha256").update(value).digest("hex");
+const packageFiles = (root, directory = root) => readdirSync(directory, { withFileTypes: true }).flatMap((entry) => {
+    const path = join(directory, entry.name);
+    if (entry.isDirectory())
+        return packageFiles(root, path);
+    if (!entry.isFile())
+        return [];
+    return [relative(root, path)];
+});
+export const createInstalledPackageFingerprint = ({ packageRoot, }) => {
+    const files = [
+        "package.json",
+        ...["dist/src", "dist/scripts/runtime"].flatMap((directory) => packageFiles(packageRoot, join(packageRoot, directory))),
+    ].sort();
+    const hash = createHash("sha256");
+    for (const file of files) {
+        hash.update(file);
+        hash.update("\0");
+        hash.update(readFileSync(join(packageRoot, file)));
+        hash.update("\0");
+    }
+    return Object.freeze({ files: files.length, sha256: hash.digest("hex") });
+};
+export const assertInstalledPackageFingerprint = ({ packageRoot, expected, }) => {
+    const actual = createInstalledPackageFingerprint({ packageRoot });
+    if (actual.files !== expected?.files || actual.sha256 !== expected?.sha256) {
+        throw new Error("The installed Rehearsal package changed during this operation. Reinstall the intended version, then start a new command.");
+    }
+    return actual;
+};
+const processIsAlive = (pid) => {
+    if (typeof pid !== "number" || !Number.isSafeInteger(pid) || pid < 1)
+        return false;
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return hasErrorCode(error, "EPERM");
+    }
+};
+const assertPrivateLockRoot = async () => {
+    await mkdir(LOCK_ROOT, { recursive: true, mode: 0o700 });
+    const details = await stat(LOCK_ROOT);
+    if (!details.isDirectory() ||
+        (details.mode & 0o077) !== 0 ||
+        (typeof process.getuid === "function" && details.uid !== process.getuid())) {
+        throw new Error("The Rehearsal operation-lock directory is not private.");
+    }
+};
+export const acquireProjectOperation = async ({ projectRoot, command, }) => {
+    await assertPrivateLockRoot();
+    const canonicalRoot = await realpath(projectRoot);
+    const projectHash = digest(canonicalRoot);
+    const lockDirectory = join(LOCK_ROOT, projectHash);
+    const ownerPath = join(lockDirectory, "owner.json");
+    const token = randomBytes(16).toString("hex");
+    const owner = {
+        formatVersion: 1,
+        pid: process.pid,
+        command,
+        projectHash,
+        token,
+        startedAt: new Date().toISOString(),
+    };
+    for (let attempt = 0; attempt < 2; attempt += 1) {
+        try {
+            await mkdir(lockDirectory, { mode: 0o700 });
+            await writeFile(ownerPath, `${JSON.stringify(owner)}\n`, {
+                mode: 0o600,
+                flag: "wx",
+            });
+            const assertOwnership = (current) => {
+                if (current.token !== token || current.pid !== process.pid) {
+                    throw new Error("The Rehearsal operation lock changed ownership unexpectedly.");
+                }
+            };
+            return Object.freeze({
+                command,
+                async release() {
+                    const current = parseLockOwner(await readFile(ownerPath, "utf8"));
+                    assertOwnership(current);
+                    await rm(lockDirectory, { recursive: true });
+                },
+                releaseSync() {
+                    const current = parseLockOwner(readFileSync(ownerPath, "utf8"));
+                    assertOwnership(current);
+                    rmSync(lockDirectory, { recursive: true });
+                },
+            });
+        }
+        catch (error) {
+            if (!hasErrorCode(error, "EEXIST") || attempt > 0)
+                throw error;
+            const details = await lstat(lockDirectory);
+            if (!details.isDirectory() || details.isSymbolicLink()) {
+                throw new Error("The Rehearsal operation lock is unsafe.");
+            }
+            let current;
+            try {
+                current = parseLockOwner(await readFile(ownerPath, "utf8"));
+            }
+            catch {
+                throw new Error("Another Rehearsal operation owns this project, or its lock is incomplete.");
+            }
+            if (processIsAlive(current.pid)) {
+                throw new Error(`Another Rehearsal operation is already running for this project (PID ${current.pid}).`);
+            }
+            const staleDirectory = `${lockDirectory}.stale-${token}`;
+            try {
+                await rename(lockDirectory, staleDirectory);
+            }
+            catch (renameError) {
+                if (hasErrorCode(renameError, "ENOENT"))
+                    continue;
+                throw renameError;
+            }
+            await rm(staleDirectory, { recursive: true });
+        }
+    }
+    throw new Error("Rehearsal could not acquire its project operation lock.");
+};
+export const inspectProjectOperationLocks = async () => readdir(LOCK_ROOT).catch((error) => {
+    if (hasErrorCode(error, "ENOENT"))
+        return [];
+    throw error;
+});

package/dist/src/shared/process_environment.d.mts

@@ -0,0 +1,15 @@
+/**
+ * Purpose: Build minimal child-process environments and validate loopback URLs for
+ * the project-neutral Rehearsal runtime. Do not run directly; this module is reusable
+ * script infrastructure.
+ */
+export type ProcessEnvironment = Record<string, string | undefined>;
+export interface CleanProcessEnvironmentOptions {
+    inheritedEnvironment?: ProcessEnvironment;
+    overrides?: ProcessEnvironment;
+    passthroughKeys?: readonly string[];
+}
+export declare const isLoopbackUrl: (value: string) => boolean;
+export declare const assertLoopbackUrl: (label: string, value: string) => void;
+export declare const pickEnvironmentVariables: (source: ProcessEnvironment, keys: readonly string[]) => Record<string, string>;
+export declare const createCleanProcessEnvironment: ({ inheritedEnvironment, overrides, passthroughKeys, }?: CleanProcessEnvironmentOptions) => Record<string, string>;

package/dist/src/shared/process_environment.mjs

@@ -0,0 +1,50 @@
+/**
+ * Purpose: Build minimal child-process environments and validate loopback URLs for
+ * the project-neutral Rehearsal runtime. Do not run directly; this module is reusable
+ * script infrastructure.
+ */
+const SAFE_SYSTEM_ENVIRONMENT_KEYS = Object.freeze([
+    "CI",
+    "COLORTERM",
+    "FORCE_COLOR",
+    "HOME",
+    "LANG",
+    "LANGUAGE",
+    "LC_ALL",
+    "LOGNAME",
+    "NO_COLOR",
+    "PATH",
+    "SHELL",
+    "TERM",
+    "TMP",
+    "TMPDIR",
+    "TEMP",
+    "USER",
+]);
+const LOOPBACK_HOSTNAMES = new Set(["127.0.0.1", "::1", "[::1]", "localhost"]);
+export const isLoopbackUrl = (value) => {
+    try {
+        const parsed = new URL(value);
+        return (["http:", "https:"].includes(parsed.protocol) &&
+            LOOPBACK_HOSTNAMES.has(parsed.hostname));
+    }
+    catch {
+        return false;
+    }
+};
+export const assertLoopbackUrl = (label, value) => {
+    if (!value || !isLoopbackUrl(value)) {
+        throw new Error(`${label} must use a loopback URL; received a non-local target.`);
+    }
+};
+export const pickEnvironmentVariables = (source, keys) => Object.fromEntries(keys.flatMap((key) => {
+    const value = source[key];
+    return value === undefined ? [] : [[key, value]];
+}));
+export const createCleanProcessEnvironment = ({ inheritedEnvironment = process.env, overrides = {}, passthroughKeys = [], } = {}) => ({
+    ...pickEnvironmentVariables(inheritedEnvironment, [
+        ...SAFE_SYSTEM_ENVIRONMENT_KEYS,
+        ...passthroughKeys,
+    ]),
+    ...pickEnvironmentVariables(overrides, Object.keys(overrides)),
+});

package/dist/src/source/access.d.mts

@@ -0,0 +1,165 @@
+/**
+ * Validate and digest the separately authorized source-access boundary.
+ * Plans contain no credentials or raw owner identifiers.
+ */
+export type SourceReader = Readonly<{
+    mode: "managed";
+    role: string;
+    ownerRole: string;
+    credentialFile: string;
+    validForMinutes: number;
+}> | Readonly<{
+    mode: "external";
+    role: string;
+    allowedMemberships: readonly string[];
+    connectionEnvironmentVariable: string;
+    credentialFile: string;
+    maximumValidForMinutes: number;
+}>;
+export type SourceRowScope = Readonly<{
+    kind: "approved-public";
+}> | Readonly<{
+    kind: "approved-owner";
+    column: string;
+    valueEnvironmentVariable: string;
+}>;
+export interface SourceRelation {
+    readonly source: Readonly<{
+        schema: string;
+        table: string;
+    }>;
+    readonly view: string;
+    readonly targetSchema: string;
+    readonly targetTable: string;
+    readonly columns: readonly string[];
+    readonly orderBy: readonly string[];
+    readonly rowScope: SourceRowScope;
+    readonly viewDefinitionSha256?: string;
+}
+export type SourceAsset = Readonly<{
+    bucket: string;
+    prefix: string;
+    rights: "approved-public" | "approved-owner";
+}> | Readonly<{
+    bucket: string;
+    prefixEnvironmentVariable: string;
+    rights: "approved-owner";
+    pathMapping: string;
+}>;
+export interface SourceAssetReader {
+    readonly endpointFingerprint: string;
+    readonly baseUrlEnvironmentVariable: string;
+    readonly tokenEnvironmentVariable: string;
+    readonly maximumObjects: number;
+    readonly maximumObjectBytes: number;
+    readonly maximumTotalBytes: number;
+}
+type SourceAssetReview = Extract<SourceAsset, {
+    prefix: string;
+}> | Readonly<Extract<SourceAsset, {
+    prefixEnvironmentVariable: string;
+}> & {
+    prefixValueSha256: string;
+}>;
+export interface SourceAccessPolicy {
+    readonly accessVersion: 1;
+    readonly targetFingerprint: string;
+    readonly administratorEnvironmentVariable?: string;
+    readonly reader: SourceReader;
+    readonly exportSchema: string;
+    readonly migrationLedger: Readonly<{
+        schema: string;
+        table: string;
+        versionColumn: string;
+        nameColumn: string;
+        statementsColumn: string;
+    }>;
+    readonly assetReader: Readonly<SourceAssetReader> | null;
+    readonly relations: readonly Readonly<SourceRelation>[];
+    readonly assets: readonly SourceAsset[];
+}
+export interface SourceAccessPlan {
+    readonly policy: Readonly<SourceAccessPolicy>;
+    readonly review: Readonly<{
+        planVersion: 1;
+        operation: "prepare-source-access";
+        targetFingerprint: string;
+        exportSchema: string;
+        reader: Readonly<{
+            mode: "managed";
+            role: string;
+            credentialFile: string;
+            ownerRole: string;
+            validForMinutes: number;
+            sourceChanges: true;
+        }> | Readonly<{
+            mode: "external";
+            role: string;
+            credentialFile: string;
+            connectionEnvironmentVariable: string;
+            allowedMemberships: readonly string[];
+            maximumValidForMinutes: number;
+            sourceChanges: false;
+        }>;
+        relations: readonly Readonly<{
+            source: Readonly<{
+                schema: string;
+                table: string;
+            }>;
+            view: string;
+            targetTable: string;
+            columns: readonly string[];
+            orderBy: readonly string[];
+            viewDefinitionSha256?: string;
+            rowScope: Readonly<{
+                kind: "approved-public";
+            }> | Readonly<{
+                kind: "approved-owner";
+                column: string;
+                valueSha256: string | undefined;
+            }>;
+        }>[];
+        assets: readonly SourceAssetReview[];
+        assetReader: Readonly<Record<string, unknown>> | null;
+        denyChecks: readonly string[];
+    }>;
+    readonly digest: string;
+}
+export interface SourceRetirementPlan {
+    readonly review: Readonly<{
+        planVersion: 1;
+        operation: "retire-source-access";
+        accessMode: "managed" | "external";
+        targetFingerprint: string;
+        preparationDigest: string;
+        exportSchema: string;
+        views: readonly string[];
+        relations: readonly Readonly<{
+            schema: string;
+            table: string;
+            columns: readonly string[];
+        }>[];
+        migrationLedger: Readonly<{
+            schema: string;
+            table: string;
+        }>;
+        readerRole: string;
+        ownerRole?: string;
+    }>;
+    readonly digest: string;
+}
+export declare const externalViewDefinitionFingerprint: (definition: string) => string;
+export declare const sourceTargetFingerprint: (connectionString: string) => string;
+export declare const validateSourceAccessPolicy: (policy: unknown) => Readonly<SourceAccessPolicy>;
+export declare const createSourceAccessPlan: ({ policy, environment, }: {
+    policy: unknown;
+    environment?: NodeJS.ProcessEnv;
+}) => Readonly<SourceAccessPlan>;
+export declare const sourceAccessPolicyFingerprint: (policy: unknown) => string;
+export declare const assetEndpointFingerprint: (value: string) => string;
+export declare const assertSourceAccessConfirmation: <Plan extends SourceAccessPlan>(plan: Plan, confirmation: string) => Plan;
+export declare const createSourceRetirementPlan: ({ receipt, targetFingerprint: target, }: {
+    receipt: unknown;
+    targetFingerprint: string;
+}) => Readonly<SourceRetirementPlan>;
+export {};