@rehearsal-db/core 0.1.0-beta.15 → 0.1.0-beta.16

package/dist/src/cli/runtime_action_handlers.mjs

@@ -0,0 +1,201 @@
+/** Database runtime action handlers shared by guided and scripted CLI flows. */
+import * as prompts from "@clack/prompts";
+import { buildApplicationEnvironment, runHttpProofs, startApplicationSession, } from "../application/session.mjs";
+import { exactCommands, renderedCommand, silentCommand, } from "./command_contract.mjs";
+import { topologyCommandEnvironment, topologyEnvironmentFiles, } from "./runtime_commands.mjs";
+import { formatDuration, isHumanTerminal, terminalStyle, useStyledPrompts, } from "./terminal.mjs";
+const RUNTIME_ACTIONS = [
+    "run",
+    "start",
+    "migrate",
+    "reset",
+    "status",
+    "stop",
+    "discard",
+    "verify",
+];
+const isRuntimeAction = (command) => RUNTIME_ACTIONS.includes(command);
+export const createRuntimeActionHandlers = ({ prepareCandidateConfirmation, prepareDependentTargets, proveRuntimeStack, runRuntimeStack, }) => [
+    {
+        ...exactCommands("runtime-action", RUNTIME_ACTIONS, async () => silentCommand()),
+        matches: ({ command, flags }) => isRuntimeAction(command) && !(command === "run" && flags.dryRun),
+        handle: async ({ command, flags, planOptions, guided, state }) => {
+            if (!isRuntimeAction(command)) {
+                throw new Error(`Unsupported runtime action: ${command}.`);
+            }
+            if (flags.dryRun && command !== "run") {
+                throw new Error("--dry-run is supported only by rehearsal run.");
+            }
+            if (!(await prepareCandidateConfirmation({
+                command,
+                flags,
+                planOptions,
+                session: state,
+            }))) {
+                return silentCommand();
+            }
+            const stack = await runRuntimeStack({
+                command,
+                flags,
+                planOptions,
+                session: state,
+            });
+            const { runtime, topology } = stack;
+            const stackEnvironment = topologyCommandEnvironment(topology);
+            const preparations = ["run", "reset", "migrate"].includes(command)
+                ? prepareDependentTargets({
+                    topology,
+                    environment: stackEnvironment,
+                })
+                : [];
+            let applicationProof;
+            let dependentProofs = [];
+            let httpProofResults = [];
+            let applicationReadiness;
+            if (command === "run") {
+                const applicationConfig = topology.primary.config.application;
+                const mappedApplicationEnvironment = Object.keys(applicationConfig.environmentVariables).length
+                    ? await buildApplicationEnvironment({
+                        files: topologyEnvironmentFiles(topology),
+                        mappings: applicationConfig.environmentVariables,
+                    })
+                    : {};
+                const proofEnvironment = {
+                    ...stackEnvironment,
+                    ...mappedApplicationEnvironment,
+                };
+                const proofLabel = topology.targets.length > 1
+                    ? "project-owned dependent and application proofs"
+                    : "project-owned application proof";
+                const proofSpinner = useStyledPrompts(flags) ? prompts.spinner() : null;
+                if (proofSpinner) {
+                    proofSpinner.start(`Running the ${proofLabel}.`);
+                }
+                else if (isHumanTerminal(flags)) {
+                    console.log(`${terminalStyle(flags, "36", "→")} Running the ${proofLabel}.`);
+                }
+                let applicationSession;
+                try {
+                    if (applicationConfig.readiness) {
+                        applicationSession = await startApplicationSession({
+                            command: applicationConfig.startCommand,
+                            cwd: topology.projectRoot,
+                            files: topologyEnvironmentFiles(topology),
+                            mappings: applicationConfig.environmentVariables,
+                            readiness: applicationConfig.readiness,
+                        });
+                        applicationReadiness = applicationSession.ready;
+                    }
+                    ({ applicationProof, dependentProofs } = await proveRuntimeStack({
+                        topology,
+                        planOptions,
+                        environment: proofEnvironment,
+                    }));
+                    if (applicationConfig.httpProofs.length) {
+                        httpProofResults = await runHttpProofs({
+                            checks: applicationConfig.httpProofs,
+                        });
+                    }
+                }
+                catch (error) {
+                    if (proofSpinner)
+                        proofSpinner.stop("A project proof failed.");
+                    throw error;
+                }
+                finally {
+                    await applicationSession?.stop();
+                }
+                if (proofSpinner) {
+                    proofSpinner.stop("Project proofs passed.");
+                }
+                else if (isHumanTerminal(flags)) {
+                    console.log(`${terminalStyle(flags, "32", "✓")} Project proofs passed.`);
+                }
+            }
+            const data = command === "run"
+                ? {
+                    runtime,
+                    preparations,
+                    dependentProofs,
+                    applicationProof,
+                    applicationReadiness,
+                    httpProofResults,
+                }
+                : preparations.length
+                    ? { ...runtime, preparations }
+                    : runtime;
+            if (guided) {
+                state.lastGuidedDetails = [
+                    runtime.output,
+                    ...preparations.map((preparation) => preparation.output),
+                    ...dependentProofs.map((proof) => proof.output),
+                    applicationProof?.output,
+                ]
+                    .filter(Boolean)
+                    .join("\n");
+            }
+            return renderedCommand({
+                data,
+                render: (value) => {
+                    const runtimeResult = "runtime" in value ? value.runtime : value;
+                    const renderedPreparations = "preparations" in value ? value.preparations : [];
+                    const renderedDependentProofs = "dependentProofs" in value ? value.dependentProofs : [];
+                    const renderedApplicationProof = "applicationProof" in value ? value.applicationProof : undefined;
+                    const renderedApplicationReadiness = "applicationReadiness" in value
+                        ? value.applicationReadiness
+                        : undefined;
+                    const renderedHttpProofResults = "httpProofResults" in value ? value.httpProofResults : [];
+                    const nextAction = {
+                        run: "Next: run rehearsal open for hands-on testing, then rehearsal verify.",
+                        start: "Next: run rehearsal open for hands-on testing or rehearsal status.",
+                        migrate: "Next: run rehearsal verify to prove the current runtime.",
+                        reset: "Next: run rehearsal open or rehearsal verify.",
+                        status: "Next: run rehearsal verify, reset, stop, or discard.",
+                        stop: "Next: run rehearsal start when you want to resume.",
+                        discard: "The disposable runtime was removed; the immutable baseline remains.",
+                        verify: "Next: continue testing, reset to the baseline, or stop the runtime.",
+                    }[runtimeResult.action];
+                    if (guided) {
+                        const title = runtimeResult.action === "run"
+                            ? "REHEARSAL PASSED"
+                            : "ACTION COMPLETE";
+                        return [
+                            title,
+                            `✓ ${runtimeResult.action} completed in ${formatDuration(runtimeResult.durationMs)}`,
+                            ...renderedPreparations.map((preparation) => `✓ ${preparation.target} preparation passed: ${preparation.command}`),
+                            ...renderedDependentProofs.map((proof) => `✓ ${proof.target} proof passed: ${proof.command}`),
+                            renderedApplicationProof
+                                ? `✓ Application proof passed: ${renderedApplicationProof.command}`
+                                : null,
+                            renderedApplicationReadiness
+                                ? `✓ Application became ready at ${renderedApplicationReadiness.url}`
+                                : null,
+                            ...renderedHttpProofResults.map((proof) => `✓ ${proof.kind} HTTP proof passed: ${proof.name}`),
+                            "",
+                            "Technical output is available from Show details in the guide.",
+                        ]
+                            .filter(Boolean)
+                            .join("\n");
+                    }
+                    return [
+                        runtimeResult.output ||
+                            `Rehearsal ${runtimeResult.action} completed.`,
+                        ...renderedPreparations.map((preparation) => `${preparation.target} preparation passed: ${preparation.command}`),
+                        ...renderedDependentProofs.map((proof) => `${proof.target} proof passed: ${proof.command}`),
+                        renderedApplicationProof
+                            ? `Application proof passed: ${renderedApplicationProof.command}`
+                            : null,
+                        renderedApplicationReadiness
+                            ? `Application readiness passed: ${renderedApplicationReadiness.url}`
+                            : null,
+                        ...renderedHttpProofResults.map((proof) => `${proof.kind} HTTP proof passed: ${proof.name}`),
+                        nextAction ? "" : null,
+                        nextAction,
+                    ]
+                        .filter((entry) => entry !== null)
+                        .join("\n");
+                },
+            });
+        },
+    },
+];

package/dist/src/cli/runtime_commands.d.mts

@@ -10,6 +10,7 @@ import type { RuntimeTopologyTarget } from "../runtime/topology.mjs";
 import type { InstalledPackageFingerprint } from "../shared/operation_guard.mjs";
 import type { RehearsalCliFlags } from "./arguments.mjs";
 import type { RehearsalErrorCategory } from "../shared/diagnostics.mjs";
+import type { CliSessionState } from "./command_contract.mjs";
 type RuntimeTopology = Awaited<ReturnType<typeof loadRuntimeTopology>>;
 type RuntimeAction = "run" | "start" | "migrate" | "reset" | "status" | "stop" | "discard" | "verify";
 interface ManagerReceipt {
@@ -188,9 +189,10 @@ export declare const createRuntimeCommands: ({ packageRoot, projectRoot, manager
     managerPath: string;
     getActivePackageFingerprint: () => InstalledPackageFingerprint | undefined;
 }) => {
-    openRuntimeApplication: ({ flags, planOptions, onReady, }: {
+    openRuntimeApplication: ({ flags, planOptions, session: commandSession, onReady, }: {
         flags: RehearsalCliFlags;
         planOptions: RehearsalConfigPathOptions;
+        session: CliSessionState;
         onReady?: Parameters<typeof holdApplicationSession>[0]["onReady"];
     }) => Promise<{
         action: string;
@@ -221,10 +223,11 @@ export declare const createRuntimeCommands: ({ packageRoot, projectRoot, manager
             diagnostics: import("../application/session.mjs").ApplicationDiagnostics;
         };
     }>;
-    prepareCandidateConfirmation: ({ command, flags, planOptions, }: {
+    prepareCandidateConfirmation: ({ command, flags, planOptions, session, }: {
         command: RuntimeAction;
         flags: RehearsalCliFlags;
         planOptions: RehearsalConfigPathOptions;
+        session: CliSessionState;
     }) => Promise<boolean>;
     prepareDependentTargets: ({ topology, environment, }: {
         topology: RuntimeTopology;
@@ -256,10 +259,11 @@ export declare const createRuntimeCommands: ({ packageRoot, projectRoot, manager
         confirmation?: string;
         targetName?: string;
     }) => ManagerReceipt;
-    runRuntimeStack: ({ command, flags, planOptions, }: {
+    runRuntimeStack: ({ command, flags, planOptions, session, }: {
         command: RuntimeAction;
         flags: RehearsalCliFlags;
         planOptions: RehearsalConfigPathOptions;
+        session: CliSessionState;
     }) => Promise<RuntimeStackResult>;
 };
 export {};

package/dist/src/cli/runtime_commands.mjs

@@ -403,15 +403,15 @@ export const createRuntimeCommands = ({ packageRoot, projectRoot, managerPath, g
             output: String(redactDiagnosticValue(String(result.stdout ?? "").trim())),
         };
     };
-    const runRuntimeStack = async ({ command, flags, planOptions, }) => {
-        const topology = flags.runtimeTopology ??
+    const runRuntimeStack = async ({ command, flags, planOptions, session, }) => {
+        const topology = session.runtimeTopology ??
             (await loadRuntimeTopology(planOptions));
         const reverse = ["stop", "discard"].includes(command);
         const targets = reverse
             ? [...topology.targets].reverse()
             : topology.targets;
         const results = targets.map((target) => {
-            const confirmation = flags.targetConfirmations?.get(target.configPath);
+            const confirmation = session.targetConfirmations?.get(target.configPath);
             return runManager({
                 action: command,
                 flags,
@@ -479,7 +479,7 @@ export const createRuntimeCommands = ({ packageRoot, projectRoot, managerPath, g
         });
         return { applicationProof, dependentProofs };
     };
-    const openRuntimeApplication = async ({ flags, planOptions, onReady = () => undefined, }) => {
+    const openRuntimeApplication = async ({ flags, planOptions, session: commandSession, onReady = () => undefined, }) => {
         const topology = await loadRuntimeTopology(planOptions);
         const application = topology.primary.config.application;
         if (!application.readiness) {
@@ -498,16 +498,18 @@ export const createRuntimeCommands = ({ packageRoot, projectRoot, managerPath, g
         if (runtimeReceipts.some((present) => !present)) {
             throw new Error("rehearsal open requires an existing verified runtime. Run rehearsal run first.");
         }
-        flags.runtimeTopology = topology;
+        commandSession.runtimeTopology = topology;
         const started = await runRuntimeStack({
             command: "start",
             flags,
             planOptions,
+            session: commandSession,
         });
         const verified = await runRuntimeStack({
             command: "verify",
             flags,
             planOptions,
+            session: commandSession,
         });
         const preparations = prepareDependentTargets({
             topology,
@@ -534,12 +536,12 @@ export const createRuntimeCommands = ({ packageRoot, projectRoot, managerPath, g
             },
         };
     };
-    const prepareCandidateConfirmation = async ({ command, flags, planOptions, }) => {
+    const prepareCandidateConfirmation = async ({ command, flags, planOptions, session, }) => {
         if (!["run", "migrate"].includes(command) || flags.dryRun)
             return true;
         const summary = await topologyCandidateSummary(planOptions);
-        flags.runtimeTopology = summary.topology;
-        flags.targetConfirmations = new Map(summary.targets.map((target) => [
+        session.runtimeTopology = summary.topology;
+        session.targetConfirmations = new Map(summary.targets.map((target) => [
             target.configPath,
             target.candidateSha256,
         ]));

package/dist/src/cli/source_command_handlers.d.mts

@@ -0,0 +1,8 @@
+/** Temporary source-access and privacy-safe baseline refresh command handlers. */
+import { createRefreshWorkflow } from "./source_commands.mjs";
+import type { CommandDefinition } from "./command_contract.mjs";
+type RefreshWorkflow = ReturnType<typeof createRefreshWorkflow>;
+export declare const createSourceCommandHandlers: ({ runRefreshWorkflow, }: {
+    runRefreshWorkflow: RefreshWorkflow;
+}) => readonly CommandDefinition[];
+export {};

package/dist/src/cli/source_command_handlers.mjs

@@ -0,0 +1,62 @@
+/** Temporary source-access and privacy-safe baseline refresh command handlers. */
+import { createSourceAccessPlan } from "../source/access.mjs";
+import { formatCount } from "../shared/human_output.mjs";
+import { createRefreshWorkflow, loadPreparationContext, runSourceAccess, runSourceBaselineRefresh, runSourceRetirement, } from "./source_commands.mjs";
+import { formatBytes, renderRefreshWorkflow, renderSourceAccessPlan, renderSourceRetirement, } from "./renderers.mjs";
+import { exactCommands, renderedCommand } from "./command_contract.mjs";
+export const createSourceCommandHandlers = ({ runRefreshWorkflow, }) => [
+    exactCommands("source-plan", ["source plan"], async ({ flags, planOptions }) => {
+        const { sourcePolicy } = await loadPreparationContext(planOptions);
+        const data = createSourceAccessPlan({ policy: sourcePolicy });
+        return renderedCommand({
+            data,
+            render: renderSourceAccessPlan,
+        });
+    }),
+    exactCommands("source-apply", ["source apply"], async ({ flags, planOptions }) => {
+        const data = await runSourceAccess({ flags, planOptions });
+        return renderedCommand({
+            data,
+            render: (result) => result.mode === "preview"
+                ? renderSourceAccessPlan(result.plan)
+                : [
+                    "SOURCE ACCESS — READY",
+                    `${result.receipt.accessMode === "external" ? "External" : "Temporary"} reader expires: ${result.receipt.expiresAt}`,
+                    result.receipt.accessMode === "external"
+                        ? "Rehearsal made no source-side changes."
+                        : "Rehearsal created only the reviewed temporary source access.",
+                    `Local credential: ${result.credentialFile}`,
+                    "",
+                    "Next: run rehearsal baseline refresh, then retire source access.",
+                ].join("\n"),
+        });
+    }),
+    exactCommands("source-retire", ["source retire"], async ({ flags, planOptions }) => {
+        const data = await runSourceRetirement({ flags, planOptions });
+        return renderedCommand({ data, render: renderSourceRetirement });
+    }),
+    exactCommands("baseline-refresh", ["baseline refresh"], async ({ flags, planOptions }) => {
+        const data = await runSourceBaselineRefresh({ planOptions });
+        return renderedCommand({
+            data,
+            render: (result) => [
+                `Activated refreshed baseline ${result.generationId}.`,
+                `${formatCount(result.manifest.rowCount, "sanitized row")} across ${formatCount(Object.keys(result.manifest.tableCounts).length, "table")}.`,
+                `Source estimate: ${formatCount(result.estimate.rows, "row")}, ${formatBytes(result.estimate.bytes)}.`,
+                "",
+                "Next: run rehearsal source retire, then rehearsal doctor.",
+            ].join("\n"),
+        });
+    }),
+    exactCommands("refresh", ["refresh"], async ({ flags, planOptions, state }) => {
+        const data = await runRefreshWorkflow({
+            flags,
+            planOptions,
+            session: state,
+        });
+        return renderedCommand({
+            data,
+            render: (result) => renderRefreshWorkflow(result),
+        });
+    }),
+];

package/dist/src/cli/source_commands.d.mts

@@ -4,6 +4,7 @@
  */
 import type { RehearsalConfigPathOptions } from "../project/configuration.mjs";
 import type { RehearsalCliFlags } from "./arguments.mjs";
+import type { CliSessionState } from "./command_contract.mjs";
 import { loadRuntimeTopology } from "../runtime/topology.mjs";
 import type { RuntimeTopologyTarget } from "../runtime/topology.mjs";
 type RuntimeTopology = Awaited<ReturnType<typeof loadRuntimeTopology>>;
@@ -327,6 +328,7 @@ export declare const createRefreshWorkflow: ({ runRuntimeStack, prepareDependent
         command: "reset";
         flags: RehearsalCliFlags;
         planOptions: RehearsalConfigPathOptions;
+        session: CliSessionState;
     }) => Promise<{
         runtime: unknown;
         topology: RuntimeTopology;
@@ -338,7 +340,9 @@ export declare const createRefreshWorkflow: ({ runRuntimeStack, prepareDependent
     topologyCommandEnvironment: (topology: RuntimeTopology) => NodeJS.ProcessEnv;
     buildPlan?: (options: RehearsalConfigPathOptions) => Promise<RefreshPlanContext>;
     refreshBaseline?: typeof runSourceBaselineRefresh;
-}) => ({ flags, planOptions }: SourceCommandInput) => Promise<{
+}) => ({ flags, planOptions, session, }: SourceCommandInput & {
+    session: CliSessionState;
+}) => Promise<{
     mode: "preview";
     plan: {
         review: {

package/dist/src/cli/source_commands.mjs

@@ -224,7 +224,7 @@ export const buildRefreshWorkflowPlan = async (planOptions) => {
         },
     };
 };
-export const createRefreshWorkflow = ({ runRuntimeStack, prepareDependentTargets, topologyCommandEnvironment, buildPlan = buildRefreshWorkflowPlan, refreshBaseline = runSourceBaselineRefresh, }) => async ({ flags, planOptions }) => {
+export const createRefreshWorkflow = ({ runRuntimeStack, prepareDependentTargets, topologyCommandEnvironment, buildPlan = buildRefreshWorkflowPlan, refreshBaseline = runSourceBaselineRefresh, }) => async ({ flags, planOptions, session, }) => {
     const context = await buildPlan(planOptions);
     if (!flags.refreshConfirmation) {
         return { mode: "preview", plan: context.plan };
@@ -241,6 +241,7 @@ export const createRefreshWorkflow = ({ runRuntimeStack, prepareDependentTargets
             command: "reset",
             flags,
             planOptions,
+            session,
         });
         runtime = stack.runtime;
         preparations = prepareDependentTargets({
@@ -259,6 +260,7 @@ export const createRefreshWorkflow = ({ runRuntimeStack, prepareDependentTargets
                     command: "reset",
                     flags,
                     planOptions,
+                    session,
                 });
                 prepareDependentTargets({
                     topology: rollback.topology,

package/dist/src/identity/claim.d.mts

@@ -1,144 +1,5 @@
-/** Associate a reviewed copied owner graph with one verified local Auth identity. */
-import type { SupabaseStorageTransfer } from "./storage.mjs";
-declare const SUPPORTED_IDENTITY_PROVIDERS: readonly ["email", "github", "google"];
-type JsonObject = Record<string, unknown>;
-type IdentityProvider = (typeof SUPPORTED_IDENTITY_PROVIDERS)[number];
-type SubjectIdentityProvider = Exclude<IdentityProvider, "email">;
-type IdentityStrategy = "transfer" | "preserve-audit";
-type PathValueType = "text" | "jsonb";
-interface Relation {
-    readonly schema: string;
-    readonly table: string;
-}
-interface PatternDefaultMatcher {
-    readonly kind: "pattern";
-    readonly pattern: string;
-}
-interface ExactDefaultMatcher {
-    readonly kind: "exact";
-    readonly value: unknown;
-}
-type SignupDefaultMatcher = PatternDefaultMatcher | ExactDefaultMatcher;
-interface VerifiedEmailMatcher {
-    readonly type: "verified-email";
-    readonly providers: readonly IdentityProvider[];
-    readonly emailEnvironmentVariable: string;
-    readonly approvedEmailSha256: string;
-}
-interface ProviderSubjectMatcher {
-    readonly type: "provider-subject";
-    readonly provider: SubjectIdentityProvider;
-    readonly subjectEnvironmentVariable: string;
-    readonly approvedSubjectSha256: string;
-}
-type IdentityMatcher = VerifiedEmailMatcher | ProviderSubjectMatcher;
-interface IdentityReference extends Relation {
-    readonly column: string;
-    readonly required: boolean;
-    readonly strategy: IdentityStrategy;
-}
-interface JsonIdentityReference extends Relation {
-    readonly column: string;
-    readonly path: readonly string[];
-}
-interface SignupDefaultDeclaration {
-    readonly table: Relation;
-    readonly identityColumn: string;
-    readonly ignoredColumns: readonly string[];
-    readonly values: Readonly<Record<string, SignupDefaultMatcher>>;
-}
-interface PathIdentityReference extends Relation {
-    readonly column: string;
-    readonly valueType: PathValueType;
-}
-interface IdentityAsset {
-    readonly bucket: string;
-    readonly prefix: string;
-    readonly rewritePath: boolean;
-}
-interface IdentityTokenHook {
-    readonly function: Readonly<{
-        schema: string;
-        name: string;
-    }>;
-    readonly expectedClaims: JsonObject;
-}
-export interface IdentityDeclaration {
-    readonly name: string;
-    readonly matcher: IdentityMatcher;
-    readonly placeholderUserId: string;
-    readonly references: readonly IdentityReference[];
-    readonly jsonReferences: readonly JsonIdentityReference[];
-    readonly signupDefaults: readonly SignupDefaultDeclaration[];
-    readonly pathReferences: readonly PathIdentityReference[];
-    readonly assets: readonly IdentityAsset[];
-    readonly claims: JsonObject;
-    readonly tokenHook: IdentityTokenHook | null;
-}
-export interface IdentityPolicy {
-    readonly identityVersion: 1;
-    readonly identities: readonly IdentityDeclaration[];
-}
-interface IdentityClaimReview {
-    readonly planVersion: 3;
-    readonly operation: "claim-local-identity";
-    readonly name: string;
-    readonly matcher: IdentityMatcher;
-    readonly placeholderUserId: string;
-    readonly references: readonly IdentityReference[];
-    readonly jsonReferences: readonly JsonIdentityReference[];
-    readonly signupDefaults: readonly Readonly<{
-        table: Relation;
-        identityColumn: string;
-        ignoredColumns: readonly string[];
-        valuesSha256: string;
-    }>[];
-    readonly pathReferences: readonly PathIdentityReference[];
-    readonly assets: readonly IdentityAsset[];
-    readonly claimKeys: readonly string[];
-    readonly claimsSha256: string;
-    readonly tokenHook: Readonly<{
-        function: Readonly<{
-            schema: string;
-            name: string;
-        }>;
-        expectedClaimsSha256: string;
-    }> | null;
-}
-export interface IdentityClaimPlan {
-    readonly identity: IdentityDeclaration;
-    readonly review: Readonly<IdentityClaimReview>;
-    readonly digest: string;
-}
-interface QueryResult<Row extends JsonObject = JsonObject> {
-    readonly rows: Row[];
-}
-interface IdentityDatabaseClient {
-    connect?(): Promise<void>;
-    end?(): Promise<void>;
-    query<Row extends JsonObject = JsonObject>(sql: string, parameters?: readonly unknown[]): Promise<QueryResult<Row>>;
-}
-type IdentityClientFactory = (connectionString: string) => IdentityDatabaseClient | Promise<IdentityDatabaseClient>;
-export declare const validateIdentityPolicy: (policy: unknown) => IdentityPolicy;
-export declare const createIdentityClaimPlan: ({ policy, name, environment, }: {
-    policy: unknown;
-    name: string;
-    environment?: Readonly<Record<string, string | undefined>>;
-}) => IdentityClaimPlan;
-export declare const applyIdentityClaim: ({ plan, confirmation, connectionString, clientFactory, storageTransfer, }: {
-    plan: IdentityClaimPlan;
-    confirmation: string;
-    connectionString: string;
-    clientFactory?: IdentityClientFactory;
-    storageTransfer?: SupabaseStorageTransfer;
-}) => Promise<{
-    name: string;
-    provider: IdentityProvider;
-    claimed: true;
-    removedSignupDefaults: number;
-    tokenHookVerified: boolean;
-    placeholderRetainedForAudit: boolean;
-    storageObjectsTransferred: number;
-    idempotent: boolean;
-}>;
-export {};
+/** Stable public facade for local identity claim planning and execution. */
+export type { IdentityClaimPlan, IdentityDeclaration, IdentityPolicy, } from "./claim_contract.mjs";
+export { applyIdentityClaim } from "./claim_executor.mjs";
+export { createIdentityClaimPlan } from "./claim_plan.mjs";
+export { validateIdentityPolicy } from "./claim_policy.mjs";