@rehearsal-db/core 0.1.0-beta.9 → 0.1.0-rc.2

package/dist/src/baseline/preparation.mjs

@@ -0,0 +1,295 @@
+/**
+ * Purpose: Inspect explicit local synthetic records and migration evidence, then
+ * create a fail-closed sanitization-policy draft for human review.
+ */
+import { createReadStream } from "node:fs";
+import { access, lstat, mkdir, open, readFile } from "node:fs/promises";
+import { createInterface } from "node:readline";
+import { dirname, isAbsolute, relative, resolve, sep } from "node:path";
+import { loadRehearsalConfig } from "../project/configuration.mjs";
+import { buildMigrationLedgerInventory, } from "../runtime/migration_history.mjs";
+const identifierPattern = /^[a-z][a-z0-9_]{0,62}$/u;
+const storageBucketPattern = /^[a-z0-9][a-z0-9.-]{0,99}$/u;
+const hasErrorCode = (error, code) => typeof error === "object" &&
+    error !== null &&
+    "code" in error &&
+    error.code === code;
+const resolveProjectInput = (projectRoot, value, label) => {
+    if (typeof value !== "string" || value.trim() === "") {
+        throw new Error(`${label} is required.`);
+    }
+    const path = resolve(projectRoot, value);
+    const owned = relative(projectRoot, path);
+    if (owned === "" ||
+        owned === ".." ||
+        owned.startsWith(`..${sep}`) ||
+        isAbsolute(owned)) {
+        throw new Error(`${label} must be a file inside the project root.`);
+    }
+    return path;
+};
+const pathExists = (path) => access(path)
+    .then(() => true)
+    .catch((error) => {
+    if (hasErrorCode(error, "ENOENT"))
+        return false;
+    throw error;
+});
+const assertRegularInput = async (path, label) => {
+    let stats;
+    try {
+        stats = await lstat(path);
+    }
+    catch (error) {
+        if (hasErrorCode(error, "ENOENT"))
+            throw new Error(`${label} does not exist.`);
+        throw error;
+    }
+    if (stats.isSymbolicLink() || !stats.isFile()) {
+        throw new Error(`${label} must be a regular project-local file.`);
+    }
+};
+const inspectSyntheticRecords = async (path) => {
+    const tables = new Map();
+    let rowCount = 0;
+    const lines = createInterface({
+        input: createReadStream(path, { encoding: "utf8" }),
+        crlfDelay: Infinity,
+    });
+    for await (const line of lines) {
+        if (!line.trim())
+            continue;
+        let record;
+        try {
+            record = JSON.parse(line);
+        }
+        catch (error) {
+            throw new Error("Synthetic baseline input contains invalid NDJSON.", {
+                cause: error,
+            });
+        }
+        if (typeof record !== "object" ||
+            record === null ||
+            Array.isArray(record) ||
+            !("table" in record) ||
+            typeof record.table !== "string" ||
+            !("row" in record) ||
+            typeof record.row !== "object" ||
+            record.row === null ||
+            Array.isArray(record.row) ||
+            ("schema" in record &&
+                record.schema !== undefined &&
+                typeof record.schema !== "string")) {
+            throw new Error("A synthetic baseline record has an invalid shape.");
+        }
+        const schema = "schema" in record && typeof record.schema === "string"
+            ? record.schema
+            : "public";
+        if (!identifierPattern.test(schema) ||
+            !identifierPattern.test(record.table)) {
+            throw new Error("A synthetic baseline record has an invalid shape.");
+        }
+        const columns = Object.keys(record.row);
+        if (columns.length === 0 ||
+            columns.some((column) => !identifierPattern.test(column))) {
+            throw new Error(`Synthetic baseline table ${record.table} has invalid or empty columns.`);
+        }
+        const key = schema === "public" ? record.table : `${schema}.${record.table}`;
+        const table = tables.get(key) ?? {
+            schema,
+            name: record.table,
+            rowCount: 0,
+            columns: new Set(),
+        };
+        table.rowCount += 1;
+        for (const column of columns)
+            table.columns.add(column);
+        tables.set(key, table);
+        rowCount += 1;
+    }
+    if (rowCount === 0) {
+        throw new Error("Synthetic baseline input contains no records.");
+    }
+    return {
+        rowCount,
+        tables: [...tables.values()]
+            .sort((left, right) => left.name.localeCompare(right.name))
+            .map((table) => ({
+            schema: table.schema,
+            name: table.name,
+            rowCount: table.rowCount,
+            columns: [...table.columns].sort(),
+        })),
+    };
+};
+const inspectAssetManifest = async (path, projectRoot) => {
+    let manifest;
+    try {
+        manifest = JSON.parse(await readFile(path, "utf8"));
+    }
+    catch (error) {
+        throw new Error("Storage asset manifest contains invalid JSON.", {
+            cause: error,
+        });
+    }
+    if (!Array.isArray(manifest)) {
+        throw new Error("Storage asset manifest must be a JSON array.");
+    }
+    const destinations = new Set();
+    for (const [index, asset] of manifest.entries()) {
+        if (typeof asset !== "object" ||
+            asset === null ||
+            Array.isArray(asset) ||
+            !("bucket" in asset) ||
+            typeof asset.bucket !== "string" ||
+            !storageBucketPattern.test(asset.bucket) ||
+            !("objectPath" in asset) ||
+            typeof asset.objectPath !== "string" ||
+            !asset.objectPath ||
+            asset.objectPath
+                .split("/")
+                .some((segment) => !segment || segment === "." || segment === "..") ||
+            !("file" in asset) ||
+            typeof asset.file !== "string" ||
+            !asset.file.trim() ||
+            ("contentType" in asset &&
+                asset.contentType !== undefined &&
+                typeof asset.contentType !== "string")) {
+            throw new Error(`Storage asset manifest entry ${index + 1} has an invalid shape.`);
+        }
+        const destination = `${asset.bucket}/${asset.objectPath}`;
+        if (destinations.has(destination)) {
+            throw new Error(`Duplicate Storage asset destination: ${destination}.`);
+        }
+        destinations.add(destination);
+        const assetFile = resolveProjectInput(projectRoot, asset.file, `Storage asset file in entry ${index + 1}`);
+        await assertRegularInput(assetFile, `Storage asset file in entry ${index + 1}`);
+    }
+    return { assetCount: manifest.length };
+};
+export const inspectBaselineInputFiles = async ({ projectRoot = process.cwd(), configPath, recordsPath, ledgerPath, assetsPath, }) => {
+    const loaded = await loadRehearsalConfig({
+        projectRoot,
+        ...(configPath === undefined ? {} : { configPath }),
+    });
+    const records = resolveProjectInput(loaded.projectRoot, recordsPath, "Synthetic records path");
+    const ledger = resolveProjectInput(loaded.projectRoot, ledgerPath, "Migration ledger path");
+    const assets = assetsPath
+        ? resolveProjectInput(loaded.projectRoot, assetsPath, "Storage asset manifest path")
+        : undefined;
+    await Promise.all([
+        assertRegularInput(records, "Synthetic records path"),
+        assertRegularInput(ledger, "Migration ledger path"),
+        ...(assets
+            ? [assertRegularInput(assets, "Storage asset manifest path")]
+            : []),
+    ]);
+    let ledgerRows;
+    try {
+        ledgerRows = JSON.parse(await readFile(ledger, "utf8"));
+    }
+    catch (error) {
+        throw new Error("Migration ledger contains invalid JSON.", {
+            cause: error,
+        });
+    }
+    const [inspection, assetInspection] = await Promise.all([
+        inspectSyntheticRecords(records),
+        assets
+            ? inspectAssetManifest(assets, loaded.projectRoot)
+            : Promise.resolve({ assetCount: 0 }),
+    ]);
+    const migrationHistory = buildMigrationLedgerInventory(ledgerRows, "Synthetic migration ledger");
+    const latestMigration = migrationHistory.at(-1);
+    if (!latestMigration) {
+        throw new Error("Synthetic migration ledger is empty or unavailable.");
+    }
+    return {
+        projectRoot: loaded.projectRoot,
+        recordsPath: relative(loaded.projectRoot, records),
+        ledgerPath: relative(loaded.projectRoot, ledger),
+        ...(assets ? { assetsPath: relative(loaded.projectRoot, assets) } : {}),
+        migrationHistory,
+        migrationCutoff: latestMigration.version,
+        migrationCount: migrationHistory.length,
+        rowCount: inspection.rowCount,
+        tables: inspection.tables,
+        assetCount: assetInspection.assetCount,
+    };
+};
+const renderPolicyDraft = ({ migrationCutoff, tables, }) => `${JSON.stringify({
+    policyVersion: 1,
+    draft: true,
+    migrationCutoff,
+    tables: tables.map((table) => ({
+        ...(table.schema === "public" ? {} : { schema: table.schema }),
+        name: table.name,
+        group: "synthetic",
+        sourceRows: "STREAM AND SANITIZE",
+        columns: table.columns.map((name) => ({
+            name,
+            action: "REVIEW REQUIRED",
+            generated: "REVIEW REQUIRED",
+            identity: "REVIEW REQUIRED",
+            foreignKey: "REVIEW REQUIRED",
+        })),
+    })),
+}, null, 2)}\n`;
+export const planBaselinePreparation = async ({ projectRoot = process.cwd(), configPath, recordsPath, ledgerPath, }) => {
+    const loaded = await loadRehearsalConfig({
+        projectRoot,
+        ...(configPath === undefined ? {} : { configPath }),
+    });
+    const inspection = await inspectBaselineInputFiles({
+        projectRoot: loaded.projectRoot,
+        ...(configPath === undefined ? {} : { configPath }),
+        recordsPath,
+        ledgerPath,
+    });
+    const destination = loaded.paths.sanitizationPolicy;
+    if (await pathExists(destination)) {
+        throw new Error(`Rehearsal baseline preparation will not overwrite ${relative(loaded.projectRoot, destination)}.`);
+    }
+    return {
+        projectRoot: loaded.projectRoot,
+        destination,
+        destinationRelative: relative(loaded.projectRoot, destination),
+        recordsPath: inspection.recordsPath,
+        ledgerPath: inspection.ledgerPath,
+        migrationCutoff: inspection.migrationCutoff,
+        migrationCount: inspection.migrationCount,
+        rowCount: inspection.rowCount,
+        tables: inspection.tables,
+        content: renderPolicyDraft({
+            migrationCutoff: inspection.migrationCutoff,
+            tables: inspection.tables,
+        }),
+    };
+};
+export const applyBaselinePreparation = async (plan) => {
+    if (await pathExists(plan.destination)) {
+        throw new Error(`Rehearsal baseline preparation will not overwrite ${plan.destinationRelative}.`);
+    }
+    await mkdir(dirname(plan.destination), { recursive: true, mode: 0o700 });
+    const handle = await open(plan.destination, "wx", 0o600);
+    try {
+        await handle.writeFile(plan.content);
+        await handle.sync();
+    }
+    finally {
+        await handle.close();
+    }
+};
+export const summarizeBaselinePreparation = (plan, { mode }) => ({
+    mode,
+    destination: plan.destinationRelative,
+    recordsPath: plan.recordsPath,
+    ledgerPath: plan.ledgerPath,
+    migrationCutoff: plan.migrationCutoff,
+    migrationCount: plan.migrationCount,
+    rowCount: plan.rowCount,
+    tables: plan.tables,
+    nextAction: mode === "written"
+        ? `Review every REVIEW REQUIRED decision in ${plan.destinationRelative}, remove draft only after review, then create the baseline.`
+        : "Review this schema-only summary, then rerun with --write to create the draft.",
+});

package/dist/src/baseline/privacy_contract.d.mts

@@ -0,0 +1,147 @@
+/** Typed, normalized contract shared by privacy validation and execution stages. */
+export type PrivacyAction = "KEEP" | "PSEUDONYMIZE" | "REPLACE" | "EXCLUDE" | "DERIVE";
+export type PrivacyObject = Record<string, unknown>;
+export interface PseudonymRecipe {
+    format: "uuid" | "email" | "text" | "integer" | "hex" | "gtin" | "url";
+    namespace: string;
+    maxLength?: number;
+    length?: number;
+    allowedLengths?: readonly number[];
+    origin?: string;
+}
+export interface ConstantRecipe {
+    kind: "constant";
+    value: unknown;
+}
+export interface DateShiftRecipe {
+    kind: "date-shift";
+    days: number;
+    representation: "iso-string" | "epoch-milliseconds";
+    group?: string;
+}
+export interface EnumRecipe {
+    kind: "enum";
+    allowNull: boolean;
+    values: readonly (string | number | boolean)[];
+}
+export interface ValidatedStringRecipe {
+    kind: "validated-string";
+    format: "portable-code";
+    maximumBytes: number;
+    allowNull: boolean;
+}
+export interface DigestRecipe {
+    kind: "digest";
+    format: "hex";
+    length: number;
+    namespace: string;
+    inputs: readonly string[];
+}
+export interface BindingSubstituteRecipe {
+    kind: "binding-substitute";
+    binding: string;
+    format: "uuid";
+    namespace: string;
+    maximumBytes: number;
+}
+export interface PathMapRecipe {
+    kind: "path-map";
+    mapping: string;
+}
+export interface ApprovedOwnerRecipe {
+    kind: "approved-owner";
+    approved: NormalizedDeclaration;
+    otherwise: NormalizedDeclaration;
+}
+export interface JsonArrayRecipe {
+    kind: "json-array";
+    allowNull: boolean;
+    maximumBytes: number;
+    maximumDepth: number;
+    maximumItems: number;
+    items: NormalizedDeclaration;
+}
+export interface JsonObjectRecipe {
+    kind: "json-object";
+    allowNull: boolean;
+    maximumBytes: number;
+    maximumDepth: number;
+    fields: Readonly<Record<string, NormalizedDeclaration>>;
+}
+export interface JsonUnionRecipe {
+    kind: "json-union";
+    allowNull: boolean;
+    maximumBytes: number;
+    maximumDepth: number;
+    maximumItems: number;
+    variants: Readonly<Record<string, NormalizedDeclaration>>;
+}
+export interface JsonDictionaryRecipe {
+    kind: "json-dictionary";
+    allowNull: boolean;
+    maximumBytes: number;
+    maximumDepth: number;
+    maximumItems: number;
+    keys: Readonly<Record<string, unknown>>;
+    values: NormalizedDeclaration;
+}
+export type DerivationRecipe = DateShiftRecipe | EnumRecipe | ValidatedStringRecipe | DigestRecipe | BindingSubstituteRecipe | PathMapRecipe | ApprovedOwnerRecipe | JsonArrayRecipe | JsonObjectRecipe | JsonUnionRecipe | JsonDictionaryRecipe;
+export type NormalizedRecipe = PseudonymRecipe | ConstantRecipe | DerivationRecipe | null;
+export interface NormalizedDeclaration {
+    action: PrivacyAction;
+    recipe: NormalizedRecipe;
+    required?: boolean;
+}
+export interface PrivacyBinding {
+    environmentVariable: string;
+    approvedValueSha256: string;
+}
+export interface PrivacyPathMapping extends PseudonymRecipe {
+    binding: string;
+    format: "uuid" | "text";
+    maximumBytes: number;
+    maximumSegments: number;
+}
+export interface PrivacyForeignKey {
+    readonly schema: string;
+    readonly table: string;
+    readonly column: string;
+}
+export interface PrivacyColumn extends NormalizedDeclaration {
+    name: string;
+    generated: "ALWAYS" | "NEVER";
+    identity: "YES" | "NO";
+    foreignKey: PrivacyForeignKey | null;
+}
+export interface PrivacyTable {
+    schema: string;
+    name: string;
+    sourceRows: "STREAM AND SANITIZE" | "EXCLUDE";
+    ownerBinding: Readonly<{
+        binding: string;
+        columns: readonly string[];
+        match: "any";
+        nullBehavior?: "otherwise";
+    }> | null;
+    columns: readonly PrivacyColumn[];
+}
+export interface ExecutablePrivacyPolicy {
+    readonly policyVersion: 2;
+    readonly migrationCutoff: string;
+    readonly bindings: Readonly<Record<string, PrivacyBinding>>;
+    readonly pathMappings: Readonly<Record<string, PrivacyPathMapping>>;
+    readonly tables: readonly PrivacyTable[];
+}
+export interface PrivacySourceRecord {
+    schema?: string;
+    table: string;
+    row: Record<string, unknown>;
+}
+export interface PrivacyEngine {
+    readonly keyFingerprint: string;
+    remapPath(input: {
+        mapping: string;
+        value: string;
+    }): string;
+    sanitize(record: unknown): PrivacySourceRecord | null;
+}

package/dist/src/baseline/privacy_contract.mjs

@@ -0,0 +1,2 @@
+/** Typed, normalized contract shared by privacy validation and execution stages. */
+export {};

package/dist/src/baseline/privacy_dependency_graph.d.mts

@@ -0,0 +1,7 @@
+/** Validate cross-rule bindings, dependencies, and shared deterministic groups. */
+import type { PrivacyBinding, PrivacyPathMapping, PrivacyTable } from "./privacy_contract.mjs";
+export declare const validatePrivacyDependencyGraph: ({ tables, bindings, pathMappings, }: {
+    tables: readonly PrivacyTable[];
+    bindings: Readonly<Record<string, PrivacyBinding>>;
+    pathMappings: Readonly<Record<string, PrivacyPathMapping>>;
+}) => void;

package/dist/src/baseline/privacy_dependency_graph.mjs

@@ -0,0 +1,110 @@
+/** Validate cross-rule bindings, dependencies, and shared deterministic groups. */
+import { structuredJsonDeclarations } from "./privacy_structured_json.mjs";
+const usesApprovedOwner = (declaration) => (declaration.recipe !== null &&
+    "kind" in declaration.recipe &&
+    declaration.recipe.kind === "approved-owner") ||
+    structuredJsonDeclarations(declaration.recipe).some(usesApprovedOwner);
+const visitRecipes = (declaration, visit) => {
+    visit(declaration.recipe);
+    if (declaration.recipe !== null &&
+        "kind" in declaration.recipe &&
+        declaration.recipe.kind === "approved-owner") {
+        visitRecipes(declaration.recipe.approved, visit);
+        visitRecipes(declaration.recipe.otherwise, visit);
+    }
+    else {
+        structuredJsonDeclarations(declaration.recipe).forEach((nested) => visitRecipes(nested, visit));
+    }
+};
+const digestInputs = (declaration) => {
+    if (declaration.recipe !== null &&
+        "kind" in declaration.recipe &&
+        declaration.recipe.kind === "digest") {
+        return [...declaration.recipe.inputs];
+    }
+    if (declaration.recipe !== null &&
+        "kind" in declaration.recipe &&
+        declaration.recipe.kind === "approved-owner") {
+        return [
+            ...digestInputs(declaration.recipe.approved),
+            ...digestInputs(declaration.recipe.otherwise),
+        ];
+    }
+    return structuredJsonDeclarations(declaration.recipe).flatMap(digestInputs);
+};
+const validateTableDependencies = ({ table, index, bindings, pathMappings, }) => {
+    const label = `policy.tables[${index}]`;
+    if (table.columns.some(usesApprovedOwner) && !table.ownerBinding) {
+        throw new Error(`${label} uses approved-owner without ownerBinding.`);
+    }
+    for (const column of table.columns) {
+        visitRecipes(column, (recipe) => {
+            if (recipe &&
+                "kind" in recipe &&
+                recipe.kind === "path-map" &&
+                !Object.hasOwn(pathMappings, recipe.mapping)) {
+                throw new Error(`${label} references unknown path mapping ${recipe.mapping}.`);
+            }
+            if (recipe !== null &&
+                "kind" in recipe &&
+                recipe.kind === "binding-substitute" &&
+                !Object.hasOwn(bindings, recipe.binding)) {
+                throw new Error(`${label} references unknown privacy binding ${recipe.binding}.`);
+            }
+        });
+    }
+    const dependencies = new Map(table.columns.map((column) => [column.name, []]));
+    for (const column of table.columns) {
+        const inputs = [...new Set(digestInputs(column))];
+        for (const input of inputs) {
+            const inputColumn = table.columns.find((entry) => entry.name === input);
+            if (!inputColumn) {
+                throw new Error(`${label}.${column.name} digest references unknown column ${input}.`);
+            }
+            if (inputColumn.action === "EXCLUDE") {
+                throw new Error(`${label}.${column.name} digest input ${input} is excluded instead of sanitized.`);
+            }
+        }
+        dependencies.set(column.name, inputs);
+    }
+    const resolved = new Set();
+    const resolving = new Set();
+    const visitDependency = (columnName) => {
+        if (resolved.has(columnName))
+            return;
+        if (resolving.has(columnName)) {
+            throw new Error(`${label} contains a cyclic digest dependency.`);
+        }
+        resolving.add(columnName);
+        for (const input of dependencies.get(columnName) ?? []) {
+            visitDependency(input);
+        }
+        resolving.delete(columnName);
+        resolved.add(columnName);
+    };
+    table.columns.forEach((column) => visitDependency(column.name));
+};
+export const validatePrivacyDependencyGraph = ({ tables, bindings, pathMappings, }) => {
+    tables.forEach((table, index) => validateTableDependencies({ table, index, bindings, pathMappings }));
+    const dateShiftGroups = new Map();
+    const validateDateShiftGroup = (declaration) => {
+        const recipe = declaration.recipe;
+        if (!recipe || !("kind" in recipe))
+            return;
+        if (recipe.kind === "date-shift" && recipe.group) {
+            const existing = dateShiftGroups.get(recipe.group);
+            if (existing !== undefined && existing !== recipe.days) {
+                throw new Error(`Privacy date-shift group ${recipe.group} must use one days value.`);
+            }
+            dateShiftGroups.set(recipe.group, recipe.days);
+        }
+        if (recipe.kind === "approved-owner") {
+            validateDateShiftGroup(recipe.approved);
+            validateDateShiftGroup(recipe.otherwise);
+        }
+        else {
+            structuredJsonDeclarations(recipe).forEach(validateDateShiftGroup);
+        }
+    };
+    tables.forEach((table) => table.columns.forEach(validateDateShiftGroup));
+};

package/dist/src/baseline/privacy_engine.d.mts

@@ -0,0 +1,5 @@
+/** Stable public facade for the versioned, fail-closed privacy pipeline. */
+export { validateExecutablePrivacyPolicy } from "./privacy_policy.mjs";
+export { createPrivacyEngine } from "./privacy_pipeline.mjs";
+export { assertPrivacyKeyFingerprint, createPrivacyKey, readPrivacyKey, } from "./privacy_key.mjs";
+export type { ExecutablePrivacyPolicy, PrivacyColumn, PrivacyEngine, PrivacyForeignKey, PrivacySourceRecord, PrivacyTable, } from "./privacy_policy.mjs";

package/dist/src/baseline/privacy_engine.mjs

@@ -0,0 +1,4 @@
+/** Stable public facade for the versioned, fail-closed privacy pipeline. */
+export { validateExecutablePrivacyPolicy } from "./privacy_policy.mjs";
+export { createPrivacyEngine } from "./privacy_pipeline.mjs";
+export { assertPrivacyKeyFingerprint, createPrivacyKey, readPrivacyKey, } from "./privacy_key.mjs";

package/dist/src/baseline/privacy_key.d.mts

@@ -0,0 +1,7 @@
+/** Create and verify the owner-only secret used by deterministic privacy rules. */
+export declare const PRIVACY_KEY_BYTES = 32;
+export declare const createPrivacyKey: (path: string) => Promise<{
+    fingerprint: string;
+}>;
+export declare const readPrivacyKey: (path: string) => Promise<Buffer>;
+export declare const assertPrivacyKeyFingerprint: (key: Uint8Array, expected: unknown) => void;

package/dist/src/baseline/privacy_key.mjs

@@ -0,0 +1,42 @@
+/** Create and verify the owner-only secret used by deterministic privacy rules. */
+import { createHash, randomBytes } from "node:crypto";
+import { chmod, mkdir, open, readFile, stat } from "node:fs/promises";
+import { dirname } from "node:path";
+export const PRIVACY_KEY_BYTES = 32;
+const HEX_64 = /^[a-f0-9]{64}$/u;
+export const createPrivacyKey = async (path) => {
+    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+    const key = randomBytes(PRIVACY_KEY_BYTES);
+    const handle = await open(path, "wx", 0o600);
+    try {
+        await handle.writeFile(`${key.toString("base64")}\n`);
+        await handle.sync();
+    }
+    finally {
+        await handle.close();
+    }
+    await chmod(path, 0o600);
+    return { fingerprint: createHash("sha256").update(key).digest("hex") };
+};
+export const readPrivacyKey = async (path) => {
+    const details = await stat(path);
+    if (!details.isFile() || (details.mode & 0o077) !== 0) {
+        throw new Error("Privacy key must be an owner-only regular file.");
+    }
+    const encoded = (await readFile(path, "utf8")).trim();
+    const key = Buffer.from(encoded, "base64");
+    if (key.length !== PRIVACY_KEY_BYTES ||
+        !/^[A-Za-z0-9+/]+={0,2}$/u.test(encoded)) {
+        throw new Error("Privacy key file is invalid.");
+    }
+    return key;
+};
+export const assertPrivacyKeyFingerprint = (key, expected) => {
+    if (typeof expected !== "string" || !HEX_64.test(expected)) {
+        throw new Error("Privacy key fingerprint is invalid.");
+    }
+    const actual = createHash("sha256").update(key).digest("hex");
+    if (actual !== expected) {
+        throw new Error("Privacy key does not match the reviewed baseline receipt.");
+    }
+};

package/dist/src/baseline/privacy_pipeline.d.mts

@@ -0,0 +1,7 @@
+/** Resolve reviewed bindings and execute the dependency-aware row privacy pipeline. */
+import type { PrivacyEngine } from "./privacy_contract.mjs";
+export declare const createPrivacyEngine: ({ policy, key, environment, }: {
+    policy: unknown;
+    key: Uint8Array | string;
+    environment?: NodeJS.ProcessEnv;
+}) => Readonly<PrivacyEngine>;