@rehearsal-db/core 0.1.0-beta.9 → 0.1.0-rc.2

package/dist/src/identity/claim_plan.d.mts

@@ -0,0 +1,8 @@
+/** Deterministic identity claim review, digest, and local matcher binding. */
+import type { IdentityClaimPlan } from "./claim_contract.mjs";
+export declare const createIdentityClaimPlan: ({ policy, name, environment, }: {
+    policy: unknown;
+    name: string;
+    environment?: Readonly<Record<string, string | undefined>>;
+}) => IdentityClaimPlan;
+export declare const getIdentityPlanMatchValue: (plan: IdentityClaimPlan) => string | undefined;

package/dist/src/identity/claim_plan.mjs

@@ -0,0 +1,61 @@
+/** Deterministic identity claim review, digest, and local matcher binding. */
+import { createHash } from "node:crypto";
+import { validateIdentityPolicy } from "./claim_policy.mjs";
+const canonical = (value) => `${JSON.stringify(value, null, "\t")}\n`;
+const hash = (value) => createHash("sha256").update(value).digest("hex");
+const identityPlanValues = new WeakMap();
+export const createIdentityClaimPlan = ({ policy, name, environment = process.env, }) => {
+    const normalized = validateIdentityPolicy(policy);
+    const identity = normalized.identities.find((entry) => entry.name === name);
+    if (!identity)
+        throw new Error(`Identity policy does not declare ${name}.`);
+    const matcher = identity.matcher;
+    const environmentVariable = matcher.type === "verified-email"
+        ? matcher.emailEnvironmentVariable
+        : matcher.subjectEnvironmentVariable;
+    const rawValue = environment[environmentVariable];
+    const matchValue = matcher.type === "verified-email"
+        ? rawValue?.trim().toLowerCase()
+        : rawValue?.trim();
+    const approvedSha256 = matcher.type === "verified-email"
+        ? matcher.approvedEmailSha256
+        : matcher.approvedSubjectSha256;
+    if (!matchValue || hash(matchValue) !== approvedSha256) {
+        throw new Error(matcher.type === "verified-email"
+            ? "Local identity email does not match the reviewed receipt."
+            : "Local identity provider subject does not match the reviewed receipt.");
+    }
+    const review = {
+        planVersion: 3,
+        operation: "claim-local-identity",
+        name: identity.name,
+        matcher,
+        placeholderUserId: identity.placeholderUserId,
+        references: identity.references,
+        jsonReferences: identity.jsonReferences,
+        signupDefaults: identity.signupDefaults.map((declaration) => ({
+            table: declaration.table,
+            identityColumn: declaration.identityColumn,
+            ignoredColumns: declaration.ignoredColumns,
+            valuesSha256: hash(canonical(declaration.values)),
+        })),
+        pathReferences: identity.pathReferences,
+        assets: identity.assets,
+        claimKeys: Object.keys(identity.claims).sort(),
+        claimsSha256: hash(canonical(identity.claims)),
+        tokenHook: identity.tokenHook
+            ? {
+                function: identity.tokenHook.function,
+                expectedClaimsSha256: hash(canonical(identity.tokenHook.expectedClaims)),
+            }
+            : null,
+    };
+    const plan = {
+        identity,
+        review: Object.freeze(review),
+        digest: hash(canonical(review)),
+    };
+    identityPlanValues.set(plan, matchValue);
+    return Object.freeze(plan);
+};
+export const getIdentityPlanMatchValue = (plan) => identityPlanValues.get(plan);

package/dist/src/identity/claim_policy.d.mts

@@ -0,0 +1,3 @@
+/** Validate and normalize the reviewed local identity policy. */
+import { type IdentityPolicy } from "./claim_contract.mjs";
+export declare const validateIdentityPolicy: (policy: unknown) => IdentityPolicy;

package/dist/src/identity/claim_policy.mjs

@@ -0,0 +1,377 @@
+/** Validate and normalize the reviewed local identity policy. */
+import { SUPPORTED_IDENTITY_PROVIDERS, } from "./claim_contract.mjs";
+const IDENTIFIER = /^[a-z][a-z0-9_]{0,62}$/u;
+const LABEL = /^[a-z0-9][a-z0-9-]{1,62}$/u;
+const UUID = /^[a-f0-9]{8}-[a-f0-9]{4}-[1-5][a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/iu;
+const SHA256 = /^[a-f0-9]{64}$/u;
+const ENVIRONMENT_KEY = /^[A-Z][A-Z0-9_]*$/u;
+const isObject = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+const id = (value, label) => {
+    if (typeof value !== "string" || !IDENTIFIER.test(value))
+        throw new Error(`${label} is not a safe identifier.`);
+    return value;
+};
+const keys = (value, allowed, label) => {
+    for (const key of Object.keys(value)) {
+        if (!allowed.includes(key))
+            throw new Error(`${label}.${key} is unknown.`);
+    }
+};
+const optionalArray = (value, label) => {
+    if (value === undefined)
+        return [];
+    if (!Array.isArray(value))
+        throw new Error(`${label} must be an array.`);
+    return value;
+};
+const relation = (value, label) => {
+    if (!isObject(value))
+        throw new Error(`${label} must be an object.`);
+    keys(value, ["schema", "table"], label);
+    return Object.freeze({
+        schema: id(value.schema, `${label}.schema`),
+        table: id(value.table, `${label}.table`),
+    });
+};
+const jsonValue = (value, label) => {
+    let serialized;
+    try {
+        serialized = JSON.stringify(value);
+    }
+    catch {
+        throw new Error(`${label} must be JSON-compatible.`);
+    }
+    if (serialized === undefined) {
+        throw new Error(`${label} must be JSON-compatible.`);
+    }
+    return JSON.parse(serialized);
+};
+const defaultMatcher = (value, label) => {
+    if (isObject(value) && value.kind === "pattern") {
+        keys(value, ["kind", "pattern"], label);
+        if (typeof value.pattern !== "string" ||
+            value.pattern.length > 256 ||
+            !value.pattern.startsWith("^") ||
+            !value.pattern.endsWith("$")) {
+            throw new Error(`${label}.pattern must be anchored and at most 256 characters.`);
+        }
+        try {
+            new RegExp(value.pattern, "u");
+        }
+        catch {
+            throw new Error(`${label}.pattern is invalid.`);
+        }
+        return Object.freeze({ kind: "pattern", pattern: value.pattern });
+    }
+    if (isObject(value) && value.kind === "exact") {
+        keys(value, ["kind", "value"], label);
+        return Object.freeze({
+            kind: "exact",
+            value: jsonValue(value.value, `${label}.value`),
+        });
+    }
+    return Object.freeze({ kind: "exact", value: jsonValue(value, label) });
+};
+function provider(value, label, { subject = false } = {}) {
+    if (typeof value !== "string" ||
+        !SUPPORTED_IDENTITY_PROVIDERS.includes(value)) {
+        throw new Error(`${label} is unsupported.`);
+    }
+    if (subject && value === "email") {
+        throw new Error(`${label} cannot use email with a provider-subject matcher.`);
+    }
+    return value;
+}
+const normalizeIdentityMatcher = (entry, label) => {
+    const legacyKeys = [
+        "provider",
+        "emailEnvironmentVariable",
+        "approvedEmailSha256",
+    ];
+    const hasLegacyMatcher = legacyKeys.some((key) => entry[key] !== undefined);
+    if (entry.matcher !== undefined && hasLegacyMatcher) {
+        throw new Error(`${label} cannot combine matcher with legacy provider and email fields.`);
+    }
+    if (entry.matcher === undefined) {
+        const legacyProvider = provider(entry.provider, `${label}.provider`);
+        if (typeof entry.emailEnvironmentVariable !== "string" ||
+            !ENVIRONMENT_KEY.test(entry.emailEnvironmentVariable)) {
+            throw new Error(`${label}.emailEnvironmentVariable is invalid.`);
+        }
+        if (typeof entry.approvedEmailSha256 !== "string" ||
+            !SHA256.test(entry.approvedEmailSha256)) {
+            throw new Error(`${label}.approvedEmailSha256 must be a SHA-256.`);
+        }
+        return Object.freeze({
+            type: "verified-email",
+            providers: Object.freeze([legacyProvider]),
+            emailEnvironmentVariable: entry.emailEnvironmentVariable,
+            approvedEmailSha256: entry.approvedEmailSha256,
+        });
+    }
+    if (!isObject(entry.matcher)) {
+        throw new Error(`${label}.matcher must be an object.`);
+    }
+    const matcherLabel = `${label}.matcher`;
+    if (entry.matcher.type === "verified-email") {
+        keys(entry.matcher, ["type", "providers", "emailEnvironmentVariable", "approvedEmailSha256"], matcherLabel);
+        if (!Array.isArray(entry.matcher.providers) ||
+            entry.matcher.providers.length === 0) {
+            throw new Error(`${matcherLabel}.providers must not be empty.`);
+        }
+        const providers = entry.matcher.providers.map((value, index) => provider(value, `${matcherLabel}.providers[${index}]`));
+        if (new Set(providers).size !== providers.length) {
+            throw new Error(`${matcherLabel}.providers must not contain duplicates.`);
+        }
+        if (typeof entry.matcher.emailEnvironmentVariable !== "string" ||
+            !ENVIRONMENT_KEY.test(entry.matcher.emailEnvironmentVariable)) {
+            throw new Error(`${matcherLabel}.emailEnvironmentVariable is invalid.`);
+        }
+        if (typeof entry.matcher.approvedEmailSha256 !== "string" ||
+            !SHA256.test(entry.matcher.approvedEmailSha256)) {
+            throw new Error(`${matcherLabel}.approvedEmailSha256 must be a SHA-256.`);
+        }
+        return Object.freeze({
+            type: "verified-email",
+            providers: Object.freeze(providers),
+            emailEnvironmentVariable: entry.matcher.emailEnvironmentVariable,
+            approvedEmailSha256: entry.matcher.approvedEmailSha256,
+        });
+    }
+    if (entry.matcher.type === "provider-subject") {
+        keys(entry.matcher, [
+            "type",
+            "provider",
+            "subjectEnvironmentVariable",
+            "approvedSubjectSha256",
+        ], matcherLabel);
+        const subjectProvider = provider(entry.matcher.provider, `${matcherLabel}.provider`, { subject: true });
+        if (typeof entry.matcher.subjectEnvironmentVariable !== "string" ||
+            !ENVIRONMENT_KEY.test(entry.matcher.subjectEnvironmentVariable)) {
+            throw new Error(`${matcherLabel}.subjectEnvironmentVariable is invalid.`);
+        }
+        if (typeof entry.matcher.approvedSubjectSha256 !== "string" ||
+            !SHA256.test(entry.matcher.approvedSubjectSha256)) {
+            throw new Error(`${matcherLabel}.approvedSubjectSha256 must be a SHA-256.`);
+        }
+        return Object.freeze({
+            type: "provider-subject",
+            provider: subjectProvider,
+            subjectEnvironmentVariable: entry.matcher.subjectEnvironmentVariable,
+            approvedSubjectSha256: entry.matcher.approvedSubjectSha256,
+        });
+    }
+    throw new Error(`${matcherLabel}.type is unsupported.`);
+};
+export const validateIdentityPolicy = (policy) => {
+    if (!isObject(policy) ||
+        policy.identityVersion !== 1 ||
+        !Array.isArray(policy.identities)) {
+        throw new Error("Identity policy must use identityVersion 1 and list identities.");
+    }
+    for (const key of Object.keys(policy)) {
+        if (!["identityVersion", "identities"].includes(key)) {
+            throw new Error(`identityPolicy.${key} is unknown.`);
+        }
+    }
+    const names = new Set();
+    const identities = policy.identities.map((entry, index) => {
+        const label = `identityPolicy.identities[${index}]`;
+        if (!isObject(entry))
+            throw new Error(`${label} must be an object.`);
+        for (const key of Object.keys(entry)) {
+            if (![
+                "name",
+                "matcher",
+                "provider",
+                "emailEnvironmentVariable",
+                "approvedEmailSha256",
+                "placeholderUserId",
+                "references",
+                "jsonReferences",
+                "signupDefaults",
+                "pathReferences",
+                "assets",
+                "claims",
+                "tokenHook",
+            ].includes(key)) {
+                throw new Error(`${label}.${key} is unknown.`);
+            }
+        }
+        if (typeof entry.name !== "string" || !LABEL.test(entry.name))
+            throw new Error(`${label}.name is invalid.`);
+        const name = entry.name;
+        if (names.has(name))
+            throw new Error(`Identity policy duplicates ${name}.`);
+        names.add(name);
+        const matcher = normalizeIdentityMatcher(entry, label);
+        if (typeof entry.placeholderUserId !== "string" ||
+            !UUID.test(entry.placeholderUserId))
+            throw new Error(`${label}.placeholderUserId is invalid.`);
+        const references = optionalArray(entry.references, `${label}.references`).map((reference, referenceIndex) => {
+            const referenceLabel = `${label}.references[${referenceIndex}]`;
+            if (!isObject(reference))
+                throw new Error(`${referenceLabel} must be an object.`);
+            keys(reference, ["schema", "table", "column", "required", "strategy"], referenceLabel);
+            if (reference.required !== undefined &&
+                typeof reference.required !== "boolean") {
+                throw new Error(`${referenceLabel}.required must be boolean.`);
+            }
+            if (reference.strategy !== undefined &&
+                !["transfer", "preserve-audit"].includes(reference.strategy)) {
+                throw new Error(`${referenceLabel}.strategy must be transfer or preserve-audit.`);
+            }
+            return Object.freeze({
+                schema: id(reference.schema, `${referenceLabel}.schema`),
+                table: id(reference.table, `${referenceLabel}.table`),
+                column: id(reference.column, `${referenceLabel}.column`),
+                required: reference.required === true,
+                strategy: (reference.strategy ?? "transfer"),
+            });
+        });
+        const jsonReferences = optionalArray(entry.jsonReferences, `${label}.jsonReferences`).map((reference, referenceIndex) => {
+            const referenceLabel = `${label}.jsonReferences[${referenceIndex}]`;
+            if (!isObject(reference))
+                throw new Error(`${referenceLabel} must be an object.`);
+            keys(reference, ["schema", "table", "column", "path"], referenceLabel);
+            if (!Array.isArray(reference.path) || reference.path.length === 0) {
+                throw new Error(`${referenceLabel}.path is invalid.`);
+            }
+            return {
+                schema: id(reference.schema, `${referenceLabel}.schema`),
+                table: id(reference.table, `${referenceLabel}.table`),
+                column: id(reference.column, `${referenceLabel}.column`),
+                path: reference.path.map((part, pathIndex) => id(part, `${referenceLabel}.path[${pathIndex}]`)),
+            };
+        });
+        const signupDefaults = optionalArray(entry.signupDefaults, `${label}.signupDefaults`).map((declaration, declarationIndex) => {
+            const declarationLabel = `${label}.signupDefaults[${declarationIndex}]`;
+            if (!isObject(declaration))
+                throw new Error(`${declarationLabel} must be an object.`);
+            keys(declaration, ["table", "identityColumn", "ignoredColumns", "values"], declarationLabel);
+            const table = relation(declaration.table, `${declarationLabel}.table`);
+            const identityColumn = id(declaration.identityColumn, `${declarationLabel}.identityColumn`);
+            if (!isObject(declaration.values)) {
+                throw new Error(`${declarationLabel}.values must be an object.`);
+            }
+            const values = Object.fromEntries(Object.entries(declaration.values).map(([column, value]) => [
+                id(column, `${declarationLabel}.values key`),
+                defaultMatcher(value, `${declarationLabel}.values.${column}`),
+            ]));
+            if (Object.keys(values).length === 0) {
+                throw new Error(`${declarationLabel}.values must not be empty.`);
+            }
+            const ignoredColumns = optionalArray(declaration.ignoredColumns, `${declarationLabel}.ignoredColumns`).map((column, columnIndex) => id(column, `${declarationLabel}.ignoredColumns[${columnIndex}]`));
+            if (new Set([identityColumn, ...ignoredColumns, ...Object.keys(values)])
+                .size !==
+                1 + ignoredColumns.length + Object.keys(values).length) {
+                throw new Error(`${declarationLabel} repeats a column.`);
+            }
+            if (!references.some((reference) => reference.schema === table.schema &&
+                reference.table === table.table &&
+                reference.column === identityColumn)) {
+                throw new Error(`${declarationLabel} must match a declared relational reference.`);
+            }
+            return Object.freeze({
+                table,
+                identityColumn,
+                ignoredColumns: Object.freeze(ignoredColumns),
+                values: Object.freeze(values),
+            });
+        });
+        const pathReferences = optionalArray(entry.pathReferences, `${label}.pathReferences`).map((reference, referenceIndex) => {
+            const referenceLabel = `${label}.pathReferences[${referenceIndex}]`;
+            if (!isObject(reference))
+                throw new Error(`${referenceLabel} must be an object.`);
+            keys(reference, ["schema", "table", "column", "valueType"], referenceLabel);
+            if (typeof reference.valueType !== "string" ||
+                !["text", "jsonb"].includes(reference.valueType)) {
+                throw new Error(`${referenceLabel}.valueType is unsupported.`);
+            }
+            return Object.freeze({
+                schema: id(reference.schema, `${referenceLabel}.schema`),
+                table: id(reference.table, `${referenceLabel}.table`),
+                column: id(reference.column, `${referenceLabel}.column`),
+                valueType: reference.valueType,
+            });
+        });
+        const assets = optionalArray(entry.assets, `${label}.assets`).map((asset, assetIndex) => {
+            const assetLabel = `${label}.assets[${assetIndex}]`;
+            if (!isObject(asset))
+                throw new Error(`${assetLabel} must be an object.`);
+            keys(asset, ["bucket", "prefix", "rewritePath"], assetLabel);
+            if (typeof asset.bucket !== "string" ||
+                !/^[a-z0-9][a-z0-9.-]{0,99}$/u.test(asset.bucket)) {
+                throw new Error(`${assetLabel}.bucket is invalid.`);
+            }
+            if (typeof asset.prefix !== "string" ||
+                !asset.prefix ||
+                asset.prefix.startsWith("/") ||
+                asset.prefix
+                    .replace(/\/$/u, "")
+                    .split("/")
+                    .some((part) => !part || part === "." || part === ".." || /[%_]/u.test(part))) {
+                throw new Error(`${assetLabel}.prefix is invalid.`);
+            }
+            if (asset.rewritePath !== undefined &&
+                typeof asset.rewritePath !== "boolean") {
+                throw new Error(`${assetLabel}.rewritePath must be boolean.`);
+            }
+            return Object.freeze({
+                bucket: asset.bucket,
+                prefix: asset.prefix,
+                rewritePath: asset.rewritePath === true,
+            });
+        });
+        for (const asset of assets) {
+            if (asset.rewritePath &&
+                asset.prefix !== `${entry.placeholderUserId.toLowerCase()}/`) {
+                throw new Error(`${label}.assets rewritePath requires the placeholder UUID prefix.`);
+            }
+        }
+        const rawClaims = entry.claims ?? {};
+        if (!isObject(rawClaims))
+            throw new Error(`${label}.claims must be an object.`);
+        const claims = jsonValue(rawClaims, `${label}.claims`);
+        if (!isObject(claims))
+            throw new Error(`${label}.claims must be an object.`);
+        let tokenHook = null;
+        if (entry.tokenHook != null) {
+            const hookLabel = `${label}.tokenHook`;
+            if (!isObject(entry.tokenHook))
+                throw new Error(`${hookLabel} must be an object.`);
+            keys(entry.tokenHook, ["function", "expectedClaims"], hookLabel);
+            if (!isObject(entry.tokenHook.function))
+                throw new Error(`${hookLabel}.function must be an object.`);
+            keys(entry.tokenHook.function, ["schema", "name"], `${hookLabel}.function`);
+            if (!isObject(entry.tokenHook.expectedClaims))
+                throw new Error(`${hookLabel}.expectedClaims must be an object.`);
+            const expectedClaims = jsonValue(entry.tokenHook.expectedClaims, `${hookLabel}.expectedClaims`);
+            if (!isObject(expectedClaims))
+                throw new Error(`${hookLabel}.expectedClaims must be an object.`);
+            tokenHook = Object.freeze({
+                function: Object.freeze({
+                    schema: id(entry.tokenHook.function.schema, `${hookLabel}.function.schema`),
+                    name: id(entry.tokenHook.function.name, `${hookLabel}.function.name`),
+                }),
+                expectedClaims: Object.freeze(expectedClaims),
+            });
+        }
+        return Object.freeze({
+            name,
+            matcher,
+            placeholderUserId: entry.placeholderUserId.toLowerCase(),
+            references: Object.freeze(references),
+            jsonReferences: Object.freeze(jsonReferences),
+            signupDefaults: Object.freeze(signupDefaults),
+            pathReferences: Object.freeze(pathReferences),
+            assets: Object.freeze(assets),
+            claims: Object.freeze(claims),
+            tokenHook,
+        });
+    });
+    return Object.freeze({
+        identityVersion: 1,
+        identities: Object.freeze(identities),
+    });
+};

package/dist/src/identity/claim_sql.d.mts

@@ -0,0 +1,10 @@
+/** Pure SQL planning for reviewed identity references. No function executes SQL. */
+import type { IdentityReference, JsonIdentityReference, PathIdentityReference, SignupDefaultDeclaration } from "./claim_contract.mjs";
+export declare const quoteIdentityIdentifier: (value: string) => string;
+export declare const planSignupDefaultInspection: (declaration: SignupDefaultDeclaration) => string;
+export declare const planSignupDefaultRemoval: (declaration: SignupDefaultDeclaration) => string;
+export declare const planRelationalReferenceTransfer: (reference: IdentityReference) => string;
+export declare const planRequiredReferenceCheck: (reference: IdentityReference) => string;
+export declare const planJsonReferenceTransfer: (reference: JsonIdentityReference) => string;
+export declare const planPathReferenceCount: (reference: PathIdentityReference) => string;
+export declare const planPathReferenceTransfer: (reference: PathIdentityReference) => string;

package/dist/src/identity/claim_sql.mjs

@@ -0,0 +1,46 @@
+/** Pure SQL planning for reviewed identity references. No function executes SQL. */
+const IDENTIFIER = /^[a-z][a-z0-9_]{0,62}$/u;
+export const quoteIdentityIdentifier = (value) => {
+    if (!IDENTIFIER.test(value)) {
+        throw new Error("Identity SQL identifier is not safe.");
+    }
+    return `"${value}"`;
+};
+const target = ({ schema, table }) => `${quoteIdentityIdentifier(schema)}.${quoteIdentityIdentifier(table)}`;
+export const planSignupDefaultInspection = (declaration) => `select candidate.${quoteIdentityIdentifier(declaration.identityColumn)}::text as identity,
+       to_jsonb(candidate) as row
+from ${target(declaration.table)} candidate
+where candidate.${quoteIdentityIdentifier(declaration.identityColumn)} in ($1::uuid, $2::uuid)
+for update`;
+export const planSignupDefaultRemoval = (declaration) => `delete from ${target(declaration.table)}
+where ${quoteIdentityIdentifier(declaration.identityColumn)} = $1::uuid`;
+export const planRelationalReferenceTransfer = (reference) => `update ${target(reference)}
+set ${quoteIdentityIdentifier(reference.column)} = $1::uuid
+where ${quoteIdentityIdentifier(reference.column)} = $2::uuid`;
+export const planRequiredReferenceCheck = (reference) => `select 1
+from ${target(reference)}
+where ${quoteIdentityIdentifier(reference.column)} = $1::uuid
+limit 1`;
+export const planJsonReferenceTransfer = (reference) => `update ${target(reference)}
+set ${quoteIdentityIdentifier(reference.column)} = jsonb_set(
+  ${quoteIdentityIdentifier(reference.column)}, $3::text[], to_jsonb($1::text), false
+)
+where ${quoteIdentityIdentifier(reference.column)} #>> $3::text[] = $2`;
+export const planPathReferenceCount = (reference) => {
+    const relation = target(reference);
+    const column = quoteIdentityIdentifier(reference.column);
+    return reference.valueType === "text"
+        ? `select count(*)::integer as count from ${relation} where ${column} like $1::text || '%'`
+        : `select count(*)::integer as count from ${relation} where ${column}::text like '%' || $1::text || '%'`;
+};
+export const planPathReferenceTransfer = (reference) => {
+    const relation = target(reference);
+    const column = quoteIdentityIdentifier(reference.column);
+    return reference.valueType === "text"
+        ? `update ${relation}
+set ${column} = $1::text || substring(${column} from char_length($2::text) + 1)
+where ${column} like $2::text || '%'`
+        : `update ${relation}
+set ${column} = replace(${column}::text, $2::text, $1::text)::jsonb
+where ${column}::text like '%' || $2::text || '%'`;
+};

package/dist/src/identity/claim_verification.d.mts

@@ -0,0 +1,13 @@
+/** Pure post-read checks used by the transactional identity executor. */
+import type { SignupDefaultDeclaration } from "./claim_contract.mjs";
+export interface DefaultInspection {
+    readonly matches: boolean;
+    readonly actualColumns: string[];
+    readonly mismatchedColumns: string[];
+}
+export declare const inspectDeclaredDefault: ({ row, declaration, }: {
+    row: unknown;
+    declaration: SignupDefaultDeclaration;
+}) => DefaultInspection;
+export declare const containsJson: (actual: unknown, expected: unknown) => boolean;
+export declare const valueKind: (value: unknown) => string;

package/dist/src/identity/claim_verification.mjs

@@ -0,0 +1,35 @@
+/** Pure post-read checks used by the transactional identity executor. */
+import { isDeepStrictEqual } from "node:util";
+const isObject = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+export const inspectDeclaredDefault = ({ row, declaration, }) => {
+    if (!isObject(row)) {
+        return { matches: false, actualColumns: [], mismatchedColumns: [] };
+    }
+    const comparable = { ...row };
+    delete comparable[declaration.identityColumn];
+    for (const column of declaration.ignoredColumns)
+        delete comparable[column];
+    const actualColumns = Object.keys(comparable).sort();
+    const declaredColumns = Object.keys(declaration.values).sort();
+    const mismatchedColumns = Object.entries(declaration.values)
+        .filter(([column, matcher]) => matcher.kind === "pattern"
+        ? typeof comparable[column] !== "string" ||
+            !new RegExp(matcher.pattern, "u").test(comparable[column])
+        : !isDeepStrictEqual(comparable[column], matcher.value))
+        .map(([column]) => column)
+        .sort();
+    return {
+        matches: isDeepStrictEqual(actualColumns, declaredColumns) &&
+            mismatchedColumns.length === 0,
+        actualColumns,
+        mismatchedColumns,
+    };
+};
+export const containsJson = (actual, expected) => {
+    if (!isObject(expected))
+        return isDeepStrictEqual(actual, expected);
+    if (!isObject(actual))
+        return false;
+    return Object.entries(expected).every(([key, value]) => containsJson(actual[key], value));
+};
+export const valueKind = (value) => value === null ? "null" : Array.isArray(value) ? "array" : typeof value;

package/dist/src/identity/connect.d.mts

@@ -0,0 +1,30 @@
+/** Read-only discovery and redacted review for the guided account connection. */
+import type { IdentityClaimPlan, IdentityClientFactory, IdentityProvider } from "./claim_contract.mjs";
+export interface IdentityConnectionPreview {
+    readonly name: string;
+    readonly provider: IdentityProvider;
+    readonly planDigest: string;
+    readonly relationalGroups: number;
+    readonly preservedAuditGroups: number;
+    readonly nestedJsonGroups: number;
+    readonly signupDefaults: number;
+    readonly storagePathGroups: number;
+    readonly assetScopes: number;
+    readonly claimKeys: number;
+    readonly tokenHookConfigured: boolean;
+    readonly associated: boolean;
+}
+export declare const inspectIdentityConnection: ({ plan, connectionString, clientFactory, }: {
+    plan: IdentityClaimPlan;
+    connectionString: string;
+    clientFactory?: IdentityClientFactory;
+}) => Promise<IdentityConnectionPreview>;
+export declare const waitForIdentityConnection: ({ plan, connectionString, clientFactory, inspect, signal, pollIntervalMs, timeoutMs, }: {
+    plan: IdentityClaimPlan;
+    connectionString: string;
+    clientFactory?: IdentityClientFactory;
+    inspect?: typeof inspectIdentityConnection;
+    signal?: AbortSignal;
+    pollIntervalMs?: number;
+    timeoutMs?: number;
+}) => Promise<IdentityConnectionPreview>;