@rehearsal-db/core 0.1.0-beta.14 → 0.1.0-beta.16

package/dist/src/baseline/privacy_transforms.mjs

@@ -0,0 +1,142 @@
+/** Deterministic primitive, identifier-shape, URL, and path transformations. */
+import { createHmac } from "node:crypto";
+import { URL_PATH_PREFIX, URL_TOKEN_LENGTH, UUID, } from "./privacy_validation_shared.mjs";
+export const privacyDigest = (key, namespace, value) => {
+    const serialized = JSON.stringify(value);
+    if (serialized === undefined) {
+        throw new Error("Privacy input must be JSON-compatible.");
+    }
+    return createHmac("sha256", key)
+        .update(namespace)
+        .update("\0")
+        .update(serialized)
+        .digest();
+};
+const gtinCheckDigit = (payload) => {
+    const sum = [...payload]
+        .reverse()
+        .reduce((total, digit, index) => total + Number(digit) * (index % 2 === 0 ? 3 : 1), 0);
+    return String((10 - (sum % 10)) % 10);
+};
+const isValidGtin = (value, length) => typeof value === "string" &&
+    value.length === length &&
+    /^\d+$/u.test(value) &&
+    value.at(-1) === gtinCheckDigit(value.slice(0, -1));
+export const pseudonymize = (key, recipe, value) => {
+    if (value === null)
+        return null;
+    const bytes = privacyDigest(key, recipe.namespace, value);
+    if (recipe.format === "uuid") {
+        const copy = Buffer.from(bytes.subarray(0, 16));
+        copy[6] = (copy[6] & 0x0f) | 0x40;
+        copy[8] = (copy[8] & 0x3f) | 0x80;
+        const hex = copy.toString("hex");
+        return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+    }
+    if (recipe.format === "email") {
+        return `rehearsal+${bytes.toString("hex").slice(0, 24)}@example.invalid`;
+    }
+    if (recipe.format === "integer") {
+        return Number(bytes.readBigUInt64BE(0) % 9007199254740991n) + 1;
+    }
+    if (recipe.format === "hex") {
+        return bytes.toString("hex").slice(0, recipe.length);
+    }
+    if (recipe.format === "gtin") {
+        const allowedLengths = recipe.allowedLengths ??
+            (recipe.length === undefined ? [] : [recipe.length]);
+        const sourceLength = typeof value === "string" ? value.length : null;
+        if (sourceLength === null ||
+            !allowedLengths.includes(sourceLength) ||
+            !isValidGtin(value, sourceLength)) {
+            if (recipe.length !== undefined) {
+                throw new Error(`A gtin pseudonym source must be a valid normalized GTIN-${recipe.length} string.`);
+            }
+            throw new Error(`A gtin pseudonym source must be a valid normalized GTIN string with an allowed length (${allowedLengths.join(", ")}).`);
+        }
+        const modulus = 10n ** BigInt(sourceLength - 1);
+        const payload = (BigInt(`0x${bytes.toString("hex")}`) % modulus)
+            .toString()
+            .padStart(sourceLength - 1, "0");
+        return `${payload}${gtinCheckDigit(payload)}`;
+    }
+    if (recipe.format === "url") {
+        if (typeof value !== "string" ||
+            value.trim() !== value ||
+            /\s/u.test(value)) {
+            throw new Error("A url pseudonym source must be a valid HTTPS URL.");
+        }
+        let source;
+        try {
+            source = new URL(value);
+        }
+        catch {
+            throw new Error("A url pseudonym source must be a valid HTTPS URL.");
+        }
+        if (source.protocol !== "https:") {
+            throw new Error("A url pseudonym source must be a valid HTTPS URL.");
+        }
+        const output = `${recipe.origin}${URL_PATH_PREFIX}${bytes
+            .toString("hex")
+            .slice(0, URL_TOKEN_LENGTH)}`;
+        if (output.length > recipe.maxLength) {
+            throw new Error("A url pseudonym exceeded its reviewed maximum length.");
+        }
+        return output;
+    }
+    const token = `rehearsal_${bytes.toString("hex")}`;
+    return token.slice(0, recipe.maxLength);
+};
+export const remapPrivacyPath = ({ key, mapping, bindingValue, value, label, }) => {
+    if (typeof value !== "string") {
+        throw new Error(`${label} must be a Storage-style path string.`);
+    }
+    if (Buffer.byteLength(value) > mapping.maximumBytes) {
+        throw new Error(`${label} exceeds its reviewed byte limit.`);
+    }
+    const segments = value.split("/");
+    if (!value ||
+        value.startsWith("/") ||
+        value.endsWith("/") ||
+        segments.length > mapping.maximumSegments ||
+        segments.some((segment) => !segment || segment === "." || segment === "..")) {
+        throw new Error(`${label} is not a safe bounded Storage path.`);
+    }
+    if (typeof bindingValue !== "string" ||
+        !bindingValue ||
+        bindingValue.includes("/") ||
+        bindingValue === "." ||
+        bindingValue === "..") {
+        throw new Error(`${label} has an invalid reviewed identity binding.`);
+    }
+    if (segments[0] !== bindingValue) {
+        throw new Error(`${label} does not begin with its exact reviewed identity.`);
+    }
+    const destination = [
+        String(pseudonymize(key, mapping, bindingValue)),
+        ...segments.slice(1),
+    ].join("/");
+    if (Buffer.byteLength(destination) > mapping.maximumBytes) {
+        throw new Error(`${label} destination exceeds its reviewed byte limit.`);
+    }
+    return destination;
+};
+export const substitutePrivacyBinding = ({ key, recipe, bindingValue, value, label, }) => {
+    if (typeof bindingValue !== "string" || !UUID.test(bindingValue)) {
+        throw new Error(`${label} has an invalid reviewed UUID binding.`);
+    }
+    if (value === null)
+        return null;
+    if (typeof value !== "string") {
+        throw new Error(`${label} must be text or null for binding substitution.`);
+    }
+    if (Buffer.byteLength(value) > recipe.maximumBytes) {
+        throw new Error(`${label} exceeds its reviewed byte limit.`);
+    }
+    const replacement = String(pseudonymize(key, recipe, bindingValue));
+    const destination = value.replaceAll(bindingValue, replacement);
+    if (Buffer.byteLength(destination) > recipe.maximumBytes) {
+        throw new Error(`${label} destination exceeds its reviewed byte limit.`);
+    }
+    return destination;
+};

package/dist/src/baseline/privacy_validation_shared.d.mts

@@ -0,0 +1,31 @@
+/** Redacted primitive validators and closed vocabulary for privacy policy v2. */
+import type { PrivacyObject } from "./privacy_contract.mjs";
+export declare const IDENTIFIER: RegExp;
+export declare const BINDING_NAME: RegExp;
+export declare const ENVIRONMENT_KEY: RegExp;
+export declare const HEX_64: RegExp;
+export declare const UUID: RegExp;
+export declare const PORTABLE_CODE: RegExp;
+export declare const ACTIONS: Set<string>;
+export declare const PSEUDONYM_FORMATS: Set<string>;
+export declare const HEX_LENGTHS: Set<number>;
+export declare const GTIN_LENGTHS: Set<number>;
+export declare const DATE_REPRESENTATIONS: Set<string>;
+export declare const DERIVATION_KINDS: Set<string>;
+export declare const URL_PATH_PREFIX = "/rehearsal/";
+export declare const URL_TOKEN_LENGTH = 32;
+export declare const MAXIMUM_URL_LENGTH = 2048;
+export declare const MAXIMUM_TEXT_SUBSTITUTION_BYTES = 65536;
+export declare const LOOPBACK_HOSTNAMES: Set<string>;
+export declare const DEFAULT_PATH_MAXIMUM_BYTES = 2048;
+export declare const DEFAULT_PATH_MAXIMUM_SEGMENTS = 32;
+export declare const MAXIMUM_POLICY_DEPTH = 16;
+export declare const MAXIMUM_ENUM_VALUES = 128;
+export declare const MAXIMUM_ENUM_STRING_BYTES = 256;
+export declare const isPrivacyObject: (value: unknown) => value is PrivacyObject;
+export declare const assertKnownKeys: (value: PrivacyObject, allowed: readonly string[], label: string) => void;
+export declare const validateIdentifier: (value: unknown, label: string) => string;
+export declare const validateNonEmpty: (value: unknown, label: string) => string;
+export declare const validatePositiveInteger: (value: unknown, label: string, maximum?: number) => number;
+export declare const validateReviewedScalar: (value: unknown, label: string) => string | number | boolean;
+export declare const validateHttpsLoopbackOrigin: (value: unknown, label: string) => string;

package/dist/src/baseline/privacy_validation_shared.mjs

@@ -0,0 +1,127 @@
+/** Redacted primitive validators and closed vocabulary for privacy policy v2. */
+export const IDENTIFIER = /^[a-z][a-z0-9_]{0,62}$/u;
+export const BINDING_NAME = /^[a-z][a-z0-9-]{0,62}$/u;
+export const ENVIRONMENT_KEY = /^[A-Z][A-Z0-9_]*$/u;
+export const HEX_64 = /^[a-f0-9]{64}$/u;
+export const UUID = /^[a-f0-9]{8}-[a-f0-9]{4}-[1-5][a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/iu;
+export const PORTABLE_CODE = /^[A-Za-z0-9][A-Za-z0-9_-]*$/u;
+export const ACTIONS = new Set([
+    "KEEP",
+    "PSEUDONYMIZE",
+    "REPLACE",
+    "EXCLUDE",
+    "DERIVE",
+]);
+export const PSEUDONYM_FORMATS = new Set([
+    "uuid",
+    "email",
+    "text",
+    "integer",
+    "hex",
+    "gtin",
+    "url",
+]);
+export const HEX_LENGTHS = new Set([32, 64]);
+export const GTIN_LENGTHS = new Set([8, 12, 13, 14]);
+export const DATE_REPRESENTATIONS = new Set([
+    "iso-string",
+    "epoch-milliseconds",
+]);
+export const DERIVATION_KINDS = new Set([
+    "date-shift",
+    "digest",
+    "enum",
+    "validated-string",
+    "path-map",
+    "json-object",
+    "json-array",
+    "json-union",
+    "json-dictionary",
+    "approved-owner",
+    "binding-substitute",
+]);
+export const URL_PATH_PREFIX = "/rehearsal/";
+export const URL_TOKEN_LENGTH = 32;
+export const MAXIMUM_URL_LENGTH = 2_048;
+export const MAXIMUM_TEXT_SUBSTITUTION_BYTES = 65_536;
+export const LOOPBACK_HOSTNAMES = new Set([
+    "127.0.0.1",
+    "::1",
+    "[::1]",
+    "localhost",
+]);
+export const DEFAULT_PATH_MAXIMUM_BYTES = 2_048;
+export const DEFAULT_PATH_MAXIMUM_SEGMENTS = 32;
+export const MAXIMUM_POLICY_DEPTH = 16;
+export const MAXIMUM_ENUM_VALUES = 128;
+export const MAXIMUM_ENUM_STRING_BYTES = 256;
+export const isPrivacyObject = (value) => value !== null &&
+    typeof value === "object" &&
+    !Array.isArray(value) &&
+    Object.getPrototypeOf(value) === Object.prototype;
+export const assertKnownKeys = (value, allowed, label) => {
+    for (const key of Object.keys(value)) {
+        if (!allowed.includes(key))
+            throw new Error(`${label}.${key} is unknown.`);
+    }
+};
+export const validateIdentifier = (value, label) => {
+    if (typeof value !== "string" || !IDENTIFIER.test(value)) {
+        throw new Error(`${label} must be a lowercase PostgreSQL identifier.`);
+    }
+    return value;
+};
+export const validateNonEmpty = (value, label) => {
+    if (typeof value !== "string" || !value.trim()) {
+        throw new Error(`${label} must be a non-empty string.`);
+    }
+    return value.trim();
+};
+export const validatePositiveInteger = (value, label, maximum = Number.MAX_SAFE_INTEGER) => {
+    if (typeof value !== "number" ||
+        !Number.isSafeInteger(value) ||
+        value < 1 ||
+        value > maximum) {
+        throw new Error(`${label} must be an integer from 1 through ${maximum}.`);
+    }
+    return value;
+};
+export const validateReviewedScalar = (value, label) => {
+    if (typeof value === "string") {
+        if (Buffer.byteLength(value) > MAXIMUM_ENUM_STRING_BYTES) {
+            throw new Error(`${label} must contain at most ${MAXIMUM_ENUM_STRING_BYTES} UTF-8 bytes.`);
+        }
+        return value;
+    }
+    if (typeof value === "boolean")
+        return value;
+    if (typeof value === "number" &&
+        Number.isFinite(value) &&
+        !Object.is(value, -0)) {
+        return value;
+    }
+    throw new Error(`${label} must be a JSON string, finite number, or boolean.`);
+};
+export const validateHttpsLoopbackOrigin = (value, label) => {
+    if (typeof value !== "string" || value.trim() !== value || !value) {
+        throw new Error(`${label} must be a safe HTTPS loopback origin.`);
+    }
+    let parsed;
+    try {
+        parsed = new URL(value);
+    }
+    catch {
+        throw new Error(`${label} must be a safe HTTPS loopback origin.`);
+    }
+    if (parsed.protocol !== "https:" ||
+        !LOOPBACK_HOSTNAMES.has(parsed.hostname) ||
+        ![parsed.origin, `${parsed.origin}/`].includes(value) ||
+        parsed.username ||
+        parsed.password ||
+        (parsed.pathname !== "/" && parsed.pathname !== "") ||
+        parsed.search ||
+        parsed.hash) {
+        throw new Error(`${label} must be a safe HTTPS loopback origin.`);
+    }
+    return parsed.origin;
+};

package/dist/src/baseline/sanitization_policy.d.mts

@@ -0,0 +1,69 @@
+/**
+ * Generic, fail-closed sanitization policy validation and value operations.
+ * Projects own the policy, schema inventory, pseudonym keys, and derivation logic.
+ */
+import { type ExecutablePrivacyPolicy } from "./privacy_engine.mjs";
+export declare const SANITIZATION_ACTIONS: Readonly<{
+    KEEP: "KEEP";
+    PSEUDONYMIZE: "PSEUDONYMIZE";
+    REPLACE: "REPLACE";
+    EXCLUDE: "EXCLUDE";
+    DERIVE: "DERIVE";
+}>;
+export declare const EXCLUDED_VALUE: unique symbol;
+export type SanitizationAction = (typeof SANITIZATION_ACTIONS)[keyof typeof SANITIZATION_ACTIONS];
+export interface LegacySanitizationPolicyColumn extends PolicyObject {
+    readonly name: string;
+    readonly action: SanitizationAction;
+    readonly generated: "ALWAYS" | "NEVER";
+    readonly identity: "YES" | "NO";
+    readonly foreignKey: Readonly<{
+        schema: string;
+        table: string;
+        column: string;
+    }> | null;
+}
+export interface LegacySanitizationPolicyTable {
+    readonly schema?: string;
+    readonly name: string;
+    readonly sourceRows: "STREAM AND SANITIZE" | "EXCLUDE";
+    readonly columns: readonly LegacySanitizationPolicyColumn[];
+}
+export interface LegacySanitizationPolicy {
+    readonly policyVersion: 1;
+    readonly migrationCutoff: string;
+    readonly tables: readonly LegacySanitizationPolicyTable[];
+}
+export type RuntimeSanitizationPolicy = LegacySanitizationPolicy | ExecutablePrivacyPolicy;
+type PolicyObject = Record<string, unknown>;
+type SanitizationCallback = (value: unknown, context: Record<string, unknown>) => unknown;
+export declare const normalizeSanitizationAction: (action: unknown) => SanitizationAction;
+export declare const validateRuntimeSanitizationPolicy: (policy: unknown) => RuntimeSanitizationPolicy;
+export declare const readBoundRuntimeSanitizationPolicy: ({ bytes, expectedSha256, }: {
+    bytes: Uint8Array | string;
+    expectedSha256: string;
+}) => RuntimeSanitizationPolicy;
+export declare const validateSanitizationCoverage: ({ policy, schemaTables, }: {
+    policy: unknown;
+    schemaTables: unknown;
+}) => Readonly<{
+    policyVersion: unknown;
+    tableCount: number;
+    columnCount: number;
+    tables: readonly {
+        schema: string;
+        columns: {
+            name: string;
+            action: SanitizationAction;
+        }[];
+    }[];
+}>;
+export declare const applySanitizationAction: ({ action, value, replace, pseudonymize, derive, context, }: {
+    action: unknown;
+    value: unknown;
+    replace?: SanitizationCallback;
+    pseudonymize?: SanitizationCallback;
+    derive?: SanitizationCallback;
+    context?: Record<string, unknown>;
+}) => unknown | typeof EXCLUDED_VALUE;
+export {};

package/dist/src/baseline/sanitization_policy.mjs

@@ -0,0 +1,227 @@
+/**
+ * Generic, fail-closed sanitization policy validation and value operations.
+ * Projects own the policy, schema inventory, pseudonym keys, and derivation logic.
+ */
+import { createHash } from "node:crypto";
+import { validateExecutablePrivacyPolicy, } from "./privacy_engine.mjs";
+export const SANITIZATION_ACTIONS = Object.freeze({
+    KEEP: "KEEP",
+    PSEUDONYMIZE: "PSEUDONYMIZE",
+    REPLACE: "REPLACE",
+    EXCLUDE: "EXCLUDE",
+    DERIVE: "DERIVE",
+});
+export const EXCLUDED_VALUE = Symbol("REHEARSAL_EXCLUDED_VALUE");
+const isPolicyObject = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+const assertPolicyObject = (value, label) => {
+    if (!isPolicyObject(value))
+        throw new Error(`${label} must be an object.`);
+    return value;
+};
+const actionAliases = new Map([
+    ["KEEP", SANITIZATION_ACTIONS.KEEP],
+    ["KEEP EXACTLY", SANITIZATION_ACTIONS.KEEP],
+    ["PSEUDONYMIZE", SANITIZATION_ACTIONS.PSEUDONYMIZE],
+    ["REPLACE", SANITIZATION_ACTIONS.REPLACE],
+    ["REPLACE WITH SYNTHETIC", SANITIZATION_ACTIONS.REPLACE],
+    ["EXCLUDE", SANITIZATION_ACTIONS.EXCLUDE],
+    ["DERIVE", SANITIZATION_ACTIONS.DERIVE],
+]);
+const identifierPattern = /^[a-z][a-z0-9_]{0,62}$/u;
+const assertIdentifier = (value, label) => {
+    if (typeof value !== "string" || !identifierPattern.test(value)) {
+        throw new Error(`${label} must be a lowercase PostgreSQL identifier.`);
+    }
+    return value;
+};
+const tableSchema = (table) => assertIdentifier(table.schema ?? "public", "Sanitization policy table schema");
+export const normalizeSanitizationAction = (action) => {
+    const normalized = actionAliases.get(String(action ?? "")
+        .trim()
+        .toUpperCase());
+    if (!normalized) {
+        throw new Error(`Unknown Rehearsal sanitization action: ${action}.`);
+    }
+    return normalized;
+};
+export const validateRuntimeSanitizationPolicy = (policy) => {
+    if (!isPolicyObject(policy)) {
+        throw new Error("A Rehearsal sanitization policy object is required.");
+    }
+    if (policy.draft === true) {
+        throw new Error("The sanitization policy is still a REVIEW REQUIRED draft.");
+    }
+    if (policy.policyVersion === 2) {
+        return validateExecutablePrivacyPolicy(policy);
+    }
+    if (policy.policyVersion !== 1) {
+        throw new Error("The sanitization policy must use policyVersion 1 or 2.");
+    }
+    if (typeof policy.migrationCutoff !== "string" ||
+        !/^\d{14}$/u.test(policy.migrationCutoff)) {
+        throw new Error("The sanitization policy must declare a timestamp migrationCutoff.");
+    }
+    if (!Array.isArray(policy.tables) || policy.tables.length === 0) {
+        throw new Error("The sanitization policy does not list tables.");
+    }
+    const tables = new Set();
+    for (const tableValue of policy.tables) {
+        const table = assertPolicyObject(tableValue, "Sanitization policy table");
+        const schemaName = assertIdentifier(tableSchema(table), "Sanitization policy table schema");
+        const tableName = assertIdentifier(table?.name, "Sanitization policy table name");
+        const key = schemaName === "public" ? tableName : `${schemaName}.${tableName}`;
+        if (tables.has(key)) {
+            throw new Error(`Sanitization policy duplicates table ${key}.`);
+        }
+        tables.add(key);
+        if (typeof table.sourceRows !== "string" ||
+            !["STREAM AND SANITIZE", "EXCLUDE"].includes(table.sourceRows)) {
+            throw new Error(`Sanitization policy table ${tableName} has an invalid sourceRows decision.`);
+        }
+        if (!Array.isArray(table.columns) || table.columns.length === 0) {
+            throw new Error(`Sanitization policy table ${tableName} must list its columns.`);
+        }
+        const columns = new Set();
+        for (const columnValue of table.columns) {
+            const column = assertPolicyObject(columnValue, `Sanitization policy column in ${tableName}`);
+            const columnName = assertIdentifier(column?.name, `Sanitization policy column in ${tableName}`);
+            if (columns.has(columnName)) {
+                throw new Error(`Sanitization policy duplicates column ${tableName}.${columnName}.`);
+            }
+            columns.add(columnName);
+            normalizeSanitizationAction(column.action);
+            if (typeof column.generated !== "string" ||
+                !["ALWAYS", "NEVER"].includes(column.generated)) {
+                throw new Error(`Sanitization policy column ${tableName}.${columnName} must classify generated as ALWAYS or NEVER.`);
+            }
+            if (typeof column.identity !== "string" ||
+                !["YES", "NO"].includes(column.identity)) {
+                throw new Error(`Sanitization policy column ${tableName}.${columnName} must classify identity as YES or NO.`);
+            }
+            if (column.foreignKey !== null) {
+                if (!column.foreignKey ||
+                    typeof column.foreignKey !== "object" ||
+                    Array.isArray(column.foreignKey)) {
+                    throw new Error(`Sanitization policy column ${tableName}.${columnName} has an invalid foreignKey decision.`);
+                }
+                const foreignKey = column.foreignKey;
+                assertIdentifier(foreignKey.schema, `Foreign-key schema for ${tableName}.${columnName}`);
+                assertIdentifier(foreignKey.table, `Foreign-key table for ${tableName}.${columnName}`);
+                assertIdentifier(foreignKey.column, `Foreign-key column for ${tableName}.${columnName}`);
+            }
+        }
+    }
+    return policy;
+};
+export const readBoundRuntimeSanitizationPolicy = ({ bytes, expectedSha256, }) => {
+    const source = Buffer.isBuffer(bytes) ? bytes : Buffer.from(bytes);
+    const policy = validateRuntimeSanitizationPolicy(JSON.parse(source.toString("utf8")));
+    const actualSha256 = createHash("sha256").update(source).digest("hex");
+    if (actualSha256 !== expectedSha256) {
+        throw new Error("The active sanitization policy does not match the reviewed baseline policy checksum.");
+    }
+    return policy;
+};
+const indexTables = (tables, label) => {
+    if (!Array.isArray(tables))
+        throw new Error(`${label} must be an array.`);
+    const index = new Map();
+    for (const tableValue of tables) {
+        const table = assertPolicyObject(tableValue, `${label} table`);
+        const schema = assertIdentifier(tableSchema(table), `${label} table schema`);
+        const name = assertIdentifier(table?.name, `${label} table name`);
+        const key = schema === "public" ? name : `${schema}.${name}`;
+        if (index.has(key))
+            throw new Error(`${label} duplicates table ${key}.`);
+        if (!Array.isArray(table.columns)) {
+            throw new Error(`${label} table ${name} must list its columns.`);
+        }
+        const columns = new Map();
+        for (const column of table.columns) {
+            const columnName = assertIdentifier(typeof column === "string"
+                ? column
+                : isPolicyObject(column)
+                    ? column.name
+                    : undefined, `${label} column name`);
+            if (columns.has(columnName)) {
+                throw new Error(`${label} duplicates column ${name}.${columnName}.`);
+            }
+            columns.set(columnName, column);
+        }
+        index.set(key, { table: { ...table, schema }, columns });
+    }
+    return index;
+};
+export const validateSanitizationCoverage = ({ policy, schemaTables, }) => {
+    if (!isPolicyObject(policy)) {
+        throw new Error("A Rehearsal sanitization policy object is required.");
+    }
+    const schema = indexTables(schemaTables, "Schema inventory");
+    const classified = indexTables(policy.tables, "Sanitization policy");
+    const normalizedTables = [];
+    for (const [tableName, schemaEntry] of schema) {
+        const policyEntry = classified.get(tableName);
+        if (!policyEntry) {
+            throw new Error(`Sanitization policy does not classify table ${tableName}.`);
+        }
+        const normalizedColumns = [];
+        for (const columnName of schemaEntry.columns.keys()) {
+            const column = policyEntry.columns.get(columnName);
+            if (!column) {
+                throw new Error(`Sanitization policy does not classify column ${tableName}.${columnName}.`);
+            }
+            const policyColumn = assertPolicyObject(column, `Sanitization policy column ${tableName}.${columnName}`);
+            normalizedColumns.push({
+                ...policyColumn,
+                name: columnName,
+                action: normalizeSanitizationAction(policyColumn.action),
+            });
+        }
+        for (const columnName of policyEntry.columns.keys()) {
+            if (!schemaEntry.columns.has(columnName)) {
+                throw new Error(`Sanitization policy references unknown column ${tableName}.${columnName}.`);
+            }
+        }
+        normalizedTables.push({
+            ...policyEntry.table,
+            schema: tableSchema(policyEntry.table),
+            columns: normalizedColumns,
+        });
+    }
+    for (const tableName of classified.keys()) {
+        if (!schema.has(tableName)) {
+            throw new Error(`Sanitization policy references unknown table ${tableName}.`);
+        }
+    }
+    return Object.freeze({
+        policyVersion: policy.policyVersion,
+        tableCount: normalizedTables.length,
+        columnCount: normalizedTables.reduce((total, table) => total + table.columns.length, 0),
+        tables: Object.freeze(normalizedTables),
+    });
+};
+export const applySanitizationAction = ({ action, value, replace, pseudonymize, derive, context = {}, }) => {
+    switch (normalizeSanitizationAction(action)) {
+        case SANITIZATION_ACTIONS.KEEP:
+            return value;
+        case SANITIZATION_ACTIONS.EXCLUDE:
+            return EXCLUDED_VALUE;
+        case SANITIZATION_ACTIONS.REPLACE:
+            if (typeof replace !== "function") {
+                throw new Error("REPLACE requires a project-owned replacement function.");
+            }
+            return replace(value, context);
+        case SANITIZATION_ACTIONS.PSEUDONYMIZE:
+            if (typeof pseudonymize !== "function") {
+                throw new Error("PSEUDONYMIZE requires a project-owned pseudonymization function.");
+            }
+            return pseudonymize(value, context);
+        case SANITIZATION_ACTIONS.DERIVE:
+            if (typeof derive !== "function") {
+                throw new Error("DERIVE requires a project-owned derivation function.");
+            }
+            return derive(value, context);
+        default:
+            throw new Error("Unreachable Rehearsal sanitization action.");
+    }
+};

package/dist/src/baseline/schema_snapshot.d.mts

@@ -0,0 +1,19 @@
+/**
+ * Purpose: Capture and compare bounded, data-free PostgreSQL public-schema
+ * snapshots for a local Rehearsal runtime. Do not run directly.
+ */
+export declare const assertProductionSchemaDump: (schemaSql: string) => string;
+export declare const compareProductionSchemaDumps: ({ expected, actual, }: {
+    expected: string;
+    actual: string;
+}) => string;
+export declare const captureSupabasePublicSchema: ({ repositoryRoot, artifactRoot, arguments_, }: {
+    repositoryRoot: string;
+    artifactRoot: string;
+    arguments_: readonly string[];
+}) => Promise<string>;
+export declare const captureLocalPublicSchema: ({ repositoryRoot, artifactRoot, workdir, }: {
+    repositoryRoot: string;
+    artifactRoot: string;
+    workdir: string;
+}) => Promise<string>;