@rehearsal-db/core 0.1.0-beta.9 → 0.1.0-rc.2

package/dist/src/baseline/privacy_pipeline.mjs

@@ -0,0 +1,127 @@
+/** Resolve reviewed bindings and execute the dependency-aware row privacy pipeline. */
+import { createHash } from "node:crypto";
+import { PRIVACY_KEY_BYTES } from "./privacy_key.mjs";
+import { validateExecutablePrivacyPolicy } from "./privacy_policy.mjs";
+import { executePrivacyDeclaration } from "./privacy_rule_registry.mjs";
+import { remapPrivacyPath } from "./privacy_transforms.mjs";
+import { IDENTIFIER, isPrivacyObject } from "./privacy_validation_shared.mjs";
+export const createPrivacyEngine = ({ policy, key, environment = process.env, }) => {
+    const normalized = validateExecutablePrivacyPolicy(policy);
+    const secret = Buffer.isBuffer(key) ? key : Buffer.from(key ?? "");
+    if (secret.length < PRIVACY_KEY_BYTES) {
+        throw new Error(`Privacy key must contain at least ${PRIVACY_KEY_BYTES} bytes.`);
+    }
+    const bindingValues = new Map(Object.entries(normalized.bindings).map(([name, binding]) => {
+        const value = environment[binding.environmentVariable];
+        if (typeof value !== "string" || !value) {
+            throw new Error(`Privacy binding ${name} requires ${binding.environmentVariable}.`);
+        }
+        const receipt = createHash("sha256").update(value).digest("hex");
+        if (receipt !== binding.approvedValueSha256) {
+            throw new Error(`Privacy binding ${name} does not match its review receipt.`);
+        }
+        return [name, value];
+    }));
+    const tables = new Map(normalized.tables.map((table) => [
+        table.schema === "public" ? table.name : `${table.schema}.${table.name}`,
+        table,
+    ]));
+    return Object.freeze({
+        keyFingerprint: createHash("sha256").update(secret).digest("hex"),
+        remapPath({ mapping: mappingName, value, }) {
+            const mapping = normalized.pathMappings[mappingName];
+            if (!mapping) {
+                throw new Error(`Privacy path mapping ${mappingName} is not declared.`);
+            }
+            return remapPrivacyPath({
+                key: secret,
+                mapping,
+                bindingValue: bindingValues.get(mapping.binding),
+                value,
+                label: `Privacy path mapping ${mappingName}`,
+            });
+        },
+        sanitize(record) {
+            if (!isPrivacyObject(record) ||
+                typeof (record.schema ?? "public") !== "string" ||
+                !IDENTIFIER.test(String(record.schema ?? "public")) ||
+                typeof record.table !== "string" ||
+                !IDENTIFIER.test(record.table) ||
+                !isPrivacyObject(record.row)) {
+                throw new Error("Source record has an invalid privacy-engine shape.");
+            }
+            const schema = String(record.schema ?? "public");
+            const rowSource = record.row;
+            const relation = schema === "public" ? record.table : `${schema}.${record.table}`;
+            const table = tables.get(relation);
+            if (!table) {
+                throw new Error(`Privacy policy does not classify table ${relation}.`);
+            }
+            if (table.sourceRows === "EXCLUDE")
+                return null;
+            const actual = Object.keys(rowSource).sort();
+            const expected = table.columns.map((column) => column.name).sort();
+            if (actual.join("\0") !== expected.join("\0")) {
+                throw new Error(`Source table ${relation} contains an unclassified or missing column.`);
+            }
+            let ownerApproved;
+            if (table.ownerBinding) {
+                const approvedValue = bindingValues.get(table.ownerBinding.binding);
+                const owners = table.ownerBinding.columns.map((column) => rowSource[column]);
+                for (const owner of owners) {
+                    if (owner === null) {
+                        if (table.ownerBinding.nullBehavior !== "otherwise") {
+                            throw new Error(`${relation} has an invalid owner binding value.`);
+                        }
+                        continue;
+                    }
+                    if (!["string", "number"].includes(typeof owner) ||
+                        owner === "" ||
+                        (typeof owner === "number" && !Number.isFinite(owner))) {
+                        throw new Error(`${relation} has an invalid owner binding value.`);
+                    }
+                }
+                ownerApproved = owners.some((owner) => owner !== null && String(owner) === approvedValue);
+            }
+            const sanitizedColumns = new Map();
+            const resolvingColumns = new Set();
+            const sanitizeColumn = (columnName) => {
+                if (sanitizedColumns.has(columnName)) {
+                    return sanitizedColumns.get(columnName);
+                }
+                if (resolvingColumns.has(columnName)) {
+                    throw new Error(`${relation} contains a cyclic digest dependency.`);
+                }
+                const column = table.columns.find((entry) => entry.name === columnName);
+                if (!column) {
+                    throw new Error(`${relation} digest references unknown column ${columnName}.`);
+                }
+                resolvingColumns.add(columnName);
+                try {
+                    const transformed = executePrivacyDeclaration({
+                        declaration: column,
+                        value: rowSource[column.name],
+                        key: secret,
+                        path: `${relation}.${column.name}`,
+                        ownerApproved,
+                        pathMappings: normalized.pathMappings,
+                        bindingValues,
+                        resolveInput: sanitizeColumn,
+                    });
+                    sanitizedColumns.set(columnName, transformed);
+                    return transformed;
+                }
+                finally {
+                    resolvingColumns.delete(columnName);
+                }
+            };
+            const row = Object.fromEntries(table.columns.flatMap((column) => {
+                const transformed = sanitizeColumn(column.name);
+                return transformed === undefined ? [] : [[column.name, transformed]];
+            }));
+            return schema === "public"
+                ? { table: record.table, row }
+                : { schema, table: record.table, row };
+        },
+    });
+};

package/dist/src/baseline/privacy_policy.d.mts

@@ -0,0 +1,6 @@
+/**
+ * Validate and normalize the complete reviewed privacy policy version 2.
+ */
+import type { ExecutablePrivacyPolicy } from "./privacy_contract.mjs";
+export type { ExecutablePrivacyPolicy, PrivacyColumn, PrivacyEngine, PrivacyForeignKey, PrivacySourceRecord, PrivacyTable, } from "./privacy_contract.mjs";
+export declare const validateExecutablePrivacyPolicy: (policy: unknown) => ExecutablePrivacyPolicy;

package/dist/src/baseline/privacy_policy.mjs

@@ -0,0 +1,237 @@
+/**
+ * Validate and normalize the complete reviewed privacy policy version 2.
+ */
+import { validatePrivacyDependencyGraph } from "./privacy_dependency_graph.mjs";
+import { validatePrivacyRecipe } from "./privacy_recipe_validation.mjs";
+import { ACTIONS, BINDING_NAME, DEFAULT_PATH_MAXIMUM_BYTES, DEFAULT_PATH_MAXIMUM_SEGMENTS, ENVIRONMENT_KEY, HEX_64, assertKnownKeys as knownKeys, isPrivacyObject as isObject, validateIdentifier as identifier, validateNonEmpty as nonEmpty, validatePositiveInteger as positiveInteger, } from "./privacy_validation_shared.mjs";
+export const validateExecutablePrivacyPolicy = (policy) => {
+    if (!isObject(policy))
+        throw new Error("Privacy policy must be an object.");
+    knownKeys(policy, [
+        "policyVersion",
+        "draft",
+        "migrationCutoff",
+        "bindings",
+        "pathMappings",
+        "tables",
+    ], "policy");
+    if (policy.policyVersion !== 2) {
+        throw new Error("Executable privacy policies must use policyVersion 2.");
+    }
+    if (policy.draft === true) {
+        throw new Error("The privacy policy is still a REVIEW REQUIRED draft.");
+    }
+    if (typeof policy.migrationCutoff !== "string" ||
+        !/^\d{14}$/u.test(policy.migrationCutoff)) {
+        throw new Error("Privacy policy migrationCutoff must be a timestamp version.");
+    }
+    if (!Array.isArray(policy.tables) || policy.tables.length === 0) {
+        throw new Error("Privacy policy must classify at least one table.");
+    }
+    if (policy.bindings !== undefined && !isObject(policy.bindings)) {
+        throw new Error("policy.bindings must be an object.");
+    }
+    const bindings = Object.fromEntries(Object.entries(policy.bindings ?? {}).map(([name, binding]) => {
+        if (!BINDING_NAME.test(name) || !isObject(binding)) {
+            throw new Error("policy.bindings contains an invalid binding.");
+        }
+        knownKeys(binding, ["environmentVariable", "approvedValueSha256"], `policy.bindings.${name}`);
+        if (typeof binding.environmentVariable !== "string" ||
+            !ENVIRONMENT_KEY.test(binding.environmentVariable)) {
+            throw new Error(`policy.bindings.${name}.environmentVariable is invalid.`);
+        }
+        if (typeof binding.approvedValueSha256 !== "string" ||
+            !HEX_64.test(binding.approvedValueSha256)) {
+            throw new Error(`policy.bindings.${name}.approvedValueSha256 must be a lowercase SHA-256 receipt.`);
+        }
+        return [
+            name,
+            Object.freeze({
+                environmentVariable: binding.environmentVariable,
+                approvedValueSha256: binding.approvedValueSha256,
+            }),
+        ];
+    }));
+    if (policy.pathMappings !== undefined && !isObject(policy.pathMappings)) {
+        throw new Error("policy.pathMappings must be an object.");
+    }
+    const pathMappings = Object.fromEntries(Object.entries(policy.pathMappings ?? {}).map(([name, mapping]) => {
+        const label = `policy.pathMappings.${name}`;
+        if (!BINDING_NAME.test(name) || !isObject(mapping)) {
+            throw new Error("policy.pathMappings contains an invalid mapping.");
+        }
+        knownKeys(mapping, [
+            "binding",
+            "format",
+            "namespace",
+            "maxLength",
+            "maximumBytes",
+            "maximumSegments",
+        ], label);
+        if (typeof mapping.binding !== "string" ||
+            !Object.hasOwn(bindings, mapping.binding)) {
+            throw new Error(`${label}.binding references an unknown binding.`);
+        }
+        if (typeof mapping.format !== "string" ||
+            !["uuid", "text"].includes(mapping.format)) {
+            throw new Error(`${label}.format must be uuid or text.`);
+        }
+        const normalized = {
+            binding: mapping.binding,
+            format: mapping.format,
+            namespace: nonEmpty(mapping.namespace, `${label}.namespace`),
+            maximumBytes: positiveInteger(mapping.maximumBytes ?? DEFAULT_PATH_MAXIMUM_BYTES, `${label}.maximumBytes`, 16_384),
+            maximumSegments: positiveInteger(mapping.maximumSegments ?? DEFAULT_PATH_MAXIMUM_SEGMENTS, `${label}.maximumSegments`, 256),
+        };
+        if (mapping.format === "text") {
+            return [
+                name,
+                Object.freeze({
+                    ...normalized,
+                    maxLength: positiveInteger(mapping.maxLength, `${label}.maxLength`, 1_024),
+                }),
+            ];
+        }
+        else if (mapping.maxLength !== undefined) {
+            throw new Error(`${label}.maxLength is supported only for text.`);
+        }
+        return [name, Object.freeze(normalized)];
+    }));
+    const names = new Set();
+    const tables = policy.tables.map((table, tableIndex) => {
+        const label = `policy.tables[${tableIndex}]`;
+        if (!isObject(table))
+            throw new Error(`${label} must be an object.`);
+        knownKeys(table, ["schema", "name", "sourceRows", "ownerBinding", "columns"], label);
+        const schema = identifier(table.schema ?? "public", `${label}.schema`);
+        const name = identifier(table.name, `${label}.name`);
+        const key = schema === "public" ? name : `${schema}.${name}`;
+        if (names.has(key))
+            throw new Error(`Privacy policy duplicates table ${key}.`);
+        names.add(key);
+        if (typeof table.sourceRows !== "string" ||
+            !["STREAM AND SANITIZE", "EXCLUDE"].includes(table.sourceRows)) {
+            throw new Error(`${label}.sourceRows is unsupported.`);
+        }
+        if (!Array.isArray(table.columns) || table.columns.length === 0) {
+            throw new Error(`${label}.columns must not be empty.`);
+        }
+        const sourceRows = table.sourceRows;
+        const columnNames = new Set();
+        const columns = table.columns.map((column, columnIndex) => {
+            const columnLabel = `${label}.columns[${columnIndex}]`;
+            if (!isObject(column))
+                throw new Error(`${columnLabel} must be an object.`);
+            knownKeys(column, ["name", "action", "recipe", "generated", "identity", "foreignKey"], columnLabel);
+            const columnName = identifier(column.name, `${columnLabel}.name`);
+            if (columnNames.has(columnName)) {
+                throw new Error(`Privacy policy duplicates column ${name}.${columnName}.`);
+            }
+            columnNames.add(columnName);
+            const action = String(column.action ?? "").toUpperCase();
+            if (!ACTIONS.has(action))
+                throw new Error(`${columnLabel}.action is unsupported.`);
+            if (typeof column.generated !== "string" ||
+                !["ALWAYS", "NEVER"].includes(column.generated)) {
+                throw new Error(`${columnLabel}.generated must be ALWAYS or NEVER.`);
+            }
+            if (typeof column.identity !== "string" ||
+                !["YES", "NO"].includes(column.identity)) {
+                throw new Error(`${columnLabel}.identity must be YES or NO.`);
+            }
+            if (column.foreignKey !== null) {
+                if (!isObject(column.foreignKey)) {
+                    throw new Error(`${columnLabel}.foreignKey must be null or an object.`);
+                }
+                knownKeys(column.foreignKey, ["schema", "table", "column"], `${columnLabel}.foreignKey`);
+                identifier(column.foreignKey.schema, `${columnLabel}.foreignKey.schema`);
+                identifier(column.foreignKey.table, `${columnLabel}.foreignKey.table`);
+                identifier(column.foreignKey.column, `${columnLabel}.foreignKey.column`);
+            }
+            return Object.freeze({
+                ...column,
+                name: columnName,
+                action: action,
+                recipe: validatePrivacyRecipe(action, column.recipe, columnLabel),
+                generated: column.generated,
+                identity: column.identity,
+                foreignKey: column.foreignKey,
+            });
+        });
+        let ownerBinding = null;
+        if (table.ownerBinding !== undefined && table.ownerBinding !== null) {
+            if (!isObject(table.ownerBinding)) {
+                throw new Error(`${label}.ownerBinding must be an object.`);
+            }
+            knownKeys(table.ownerBinding, ["binding", "column", "columns", "match", "nullBehavior"], `${label}.ownerBinding`);
+            const binding = nonEmpty(table.ownerBinding.binding, `${label}.ownerBinding.binding`);
+            const hasColumn = table.ownerBinding.column !== undefined;
+            const hasColumns = table.ownerBinding.columns !== undefined;
+            if (hasColumn === hasColumns) {
+                throw new Error(`${label}.ownerBinding must declare exactly one of column or columns.`);
+            }
+            let ownerColumns;
+            if (hasColumn) {
+                if (table.ownerBinding.match !== undefined) {
+                    throw new Error(`${label}.ownerBinding.match is supported only with columns.`);
+                }
+                ownerColumns = [
+                    identifier(table.ownerBinding.column, `${label}.ownerBinding.column`),
+                ];
+            }
+            else {
+                if (!Array.isArray(table.ownerBinding.columns) ||
+                    table.ownerBinding.columns.length === 0 ||
+                    table.ownerBinding.columns.length > 16) {
+                    throw new Error(`${label}.ownerBinding.columns must contain 1 through 16 columns.`);
+                }
+                if (table.ownerBinding.match !== "any") {
+                    throw new Error(`${label}.ownerBinding.match must be any when columns are used.`);
+                }
+                ownerColumns = table.ownerBinding.columns.map((column, index) => identifier(column, `${label}.ownerBinding.columns[${index}]`));
+                if (new Set(ownerColumns).size !== ownerColumns.length) {
+                    throw new Error(`${label}.ownerBinding.columns must not contain duplicates.`);
+                }
+            }
+            if (table.ownerBinding.nullBehavior !== undefined &&
+                table.ownerBinding.nullBehavior !== "otherwise") {
+                throw new Error(`${label}.ownerBinding.nullBehavior must be otherwise when declared.`);
+            }
+            if (!Object.hasOwn(bindings, binding)) {
+                throw new Error(`${label}.ownerBinding references an unknown binding.`);
+            }
+            for (const column of ownerColumns) {
+                if (!columnNames.has(column)) {
+                    throw new Error(`${label}.ownerBinding references an unknown column.`);
+                }
+                const ownerColumn = columns.find((entry) => entry.name === column);
+                if (!ownerColumn || ownerColumn.action !== "PSEUDONYMIZE") {
+                    throw new Error(`${label}.ownerBinding columns must be explicitly pseudonymized.`);
+                }
+            }
+            ownerBinding = Object.freeze({
+                binding,
+                columns: Object.freeze(ownerColumns),
+                match: "any",
+                ...(table.ownerBinding.nullBehavior === undefined
+                    ? {}
+                    : { nullBehavior: table.ownerBinding.nullBehavior }),
+            });
+        }
+        return Object.freeze({
+            schema,
+            name,
+            sourceRows,
+            ownerBinding,
+            columns: Object.freeze(columns),
+        });
+    });
+    validatePrivacyDependencyGraph({ tables, bindings, pathMappings });
+    return Object.freeze({
+        policyVersion: 2,
+        migrationCutoff: policy.migrationCutoff,
+        bindings: Object.freeze(bindings),
+        pathMappings: Object.freeze(pathMappings),
+        tables: Object.freeze(tables),
+    });
+};

package/dist/src/baseline/privacy_recipe_validation.d.mts

@@ -0,0 +1,5 @@
+/**
+ * Validate and normalize reviewed privacy recipes for policy version 2.
+ */
+import type { NormalizedRecipe, PrivacyAction } from "./privacy_contract.mjs";
+export declare const validatePrivacyRecipe: (action: PrivacyAction, recipe: unknown, label: string, depth?: number) => NormalizedRecipe;

package/dist/src/baseline/privacy_recipe_validation.mjs

@@ -0,0 +1,289 @@
+/**
+ * Validate and normalize reviewed privacy recipes for policy version 2.
+ */
+import { validateStructuredJsonRecipe } from "./privacy_structured_json.mjs";
+import { ACTIONS, BINDING_NAME, DATE_REPRESENTATIONS, DERIVATION_KINDS, GTIN_LENGTHS, HEX_LENGTHS, MAXIMUM_ENUM_VALUES, MAXIMUM_POLICY_DEPTH, MAXIMUM_TEXT_SUBSTITUTION_BYTES, MAXIMUM_URL_LENGTH, PSEUDONYM_FORMATS, URL_PATH_PREFIX, URL_TOKEN_LENGTH, assertKnownKeys as knownKeys, isPrivacyObject as isObject, validateHttpsLoopbackOrigin as httpsLoopbackOrigin, validateIdentifier as identifier, validateNonEmpty as nonEmpty, validatePositiveInteger as positiveInteger, validateReviewedScalar as reviewedScalar, } from "./privacy_validation_shared.mjs";
+const validateNestedDeclaration = (declaration, label, { allowRequired = false, depth = 0, } = {}) => {
+    if (!isObject(declaration))
+        throw new Error(`${label} must be an object.`);
+    knownKeys(declaration, allowRequired ? ["action", "recipe", "required"] : ["action", "recipe"], label);
+    if (allowRequired &&
+        declaration.required !== undefined &&
+        typeof declaration.required !== "boolean") {
+        throw new Error(`${label}.required must be true or false.`);
+    }
+    const action = String(declaration.action ?? "").toUpperCase();
+    if (!ACTIONS.has(action))
+        throw new Error(`${label}.action is unsupported.`);
+    return Object.freeze({
+        action: action,
+        recipe: validatePrivacyRecipe(action, declaration.recipe, label, depth + 1),
+        ...(allowRequired ? { required: declaration.required !== false } : {}),
+    });
+};
+export const validatePrivacyRecipe = (action, recipe, label, depth = 0) => {
+    if (depth > MAXIMUM_POLICY_DEPTH) {
+        throw new Error(`${label}.recipe exceeds the supported nesting depth.`);
+    }
+    if (action === "KEEP" || action === "EXCLUDE") {
+        if (recipe !== undefined && recipe !== null) {
+            throw new Error(`${label}.recipe is not allowed for ${action}.`);
+        }
+        return null;
+    }
+    if (!isObject(recipe)) {
+        throw new Error(`${label}.recipe is required for ${action}.`);
+    }
+    if (action === "PSEUDONYMIZE") {
+        knownKeys(recipe, [
+            "format",
+            "namespace",
+            "maxLength",
+            "length",
+            "allowedLengths",
+            "origin",
+        ], `${label}.recipe`);
+        if (typeof recipe.format !== "string" ||
+            !PSEUDONYM_FORMATS.has(recipe.format)) {
+            throw new Error(`${label}.recipe.format is unsupported.`);
+        }
+        const normalized = {
+            format: recipe.format,
+            namespace: nonEmpty(recipe.namespace, `${label}.recipe.namespace`),
+        };
+        if (recipe.format === "text") {
+            normalized.maxLength = positiveInteger(recipe.maxLength, `${label}.recipe.maxLength`, 1_024);
+        }
+        else if (recipe.format === "url") {
+            normalized.origin = httpsLoopbackOrigin(recipe.origin, `${label}.recipe.origin`);
+            normalized.maxLength = positiveInteger(recipe.maxLength, `${label}.recipe.maxLength`, MAXIMUM_URL_LENGTH);
+            const outputLength = normalized.origin.length + URL_PATH_PREFIX.length + URL_TOKEN_LENGTH;
+            if (normalized.maxLength < outputLength) {
+                throw new Error(`${label}.recipe.maxLength must allow the complete pseudonymous URL (${outputLength} characters).`);
+            }
+        }
+        else if (recipe.maxLength !== undefined) {
+            throw new Error(`${label}.recipe.maxLength is supported only for text and url pseudonyms.`);
+        }
+        if (recipe.format === "hex") {
+            if (typeof recipe.length !== "number" ||
+                !HEX_LENGTHS.has(recipe.length)) {
+                throw new Error(`${label}.recipe.length must be 32 or 64 for hex.`);
+            }
+            normalized.length = recipe.length;
+        }
+        else if (recipe.format === "gtin") {
+            const hasLength = Object.hasOwn(recipe, "length");
+            const hasAllowedLengths = Object.hasOwn(recipe, "allowedLengths");
+            if (hasLength === hasAllowedLengths) {
+                throw new Error(`${label}.recipe must declare exactly one of length or allowedLengths for gtin.`);
+            }
+            if (hasLength) {
+                if (typeof recipe.length !== "number" ||
+                    !GTIN_LENGTHS.has(recipe.length)) {
+                    throw new Error(`${label}.recipe.length must be 8, 12, 13, or 14 for gtin.`);
+                }
+                normalized.length = recipe.length;
+            }
+            else {
+                if (!Array.isArray(recipe.allowedLengths) ||
+                    recipe.allowedLengths.length === 0) {
+                    throw new Error(`${label}.recipe.allowedLengths must contain reviewed GTIN lengths 8, 12, 13, or 14.`);
+                }
+                const allowedLengths = recipe.allowedLengths.map((length) => {
+                    if (typeof length !== "number" || !GTIN_LENGTHS.has(length)) {
+                        throw new Error(`${label}.recipe.allowedLengths must contain reviewed GTIN lengths 8, 12, 13, or 14.`);
+                    }
+                    return length;
+                });
+                if (new Set(allowedLengths).size !== allowedLengths.length) {
+                    throw new Error(`${label}.recipe.allowedLengths must not contain duplicates.`);
+                }
+                normalized.allowedLengths = Object.freeze(allowedLengths);
+            }
+        }
+        else if (recipe.length !== undefined ||
+            recipe.allowedLengths !== undefined ||
+            (recipe.origin !== undefined && recipe.format !== "url")) {
+            throw new Error(`${label}.recipe shape controls do not match its pseudonym format.`);
+        }
+        return Object.freeze(normalized);
+    }
+    if (action === "REPLACE") {
+        knownKeys(recipe, ["kind", "value"], `${label}.recipe`);
+        if (recipe.kind !== "constant" || !Object.hasOwn(recipe, "value")) {
+            throw new Error(`${label}.recipe must be an explicit constant.`);
+        }
+        if (typeof recipe.value === "function" || recipe.value === undefined) {
+            throw new Error(`${label}.recipe.value must be JSON-compatible.`);
+        }
+        JSON.stringify(recipe.value);
+        return Object.freeze({ kind: "constant", value: recipe.value });
+    }
+    knownKeys(recipe, [
+        "kind",
+        "days",
+        "group",
+        "representation",
+        "format",
+        "length",
+        "namespace",
+        "inputs",
+        "mapping",
+        "binding",
+        "fields",
+        "items",
+        "variants",
+        "keys",
+        "values",
+        "approved",
+        "otherwise",
+        "allowNull",
+        "maximumBytes",
+        "maximumDepth",
+        "maximumItems",
+    ], `${label}.recipe`);
+    if (typeof recipe.kind !== "string" || !DERIVATION_KINDS.has(recipe.kind)) {
+        throw new Error(`${label}.recipe.kind is unsupported.`);
+    }
+    if (recipe.kind === "enum") {
+        if (Object.keys(recipe).some((key) => !["kind", "values", "allowNull"].includes(key))) {
+            throw new Error(`${label}.recipe contains fields not used by enum.`);
+        }
+        if (!Array.isArray(recipe.values) ||
+            recipe.values.length === 0 ||
+            recipe.values.length > MAXIMUM_ENUM_VALUES) {
+            throw new Error(`${label}.recipe.values must contain 1 through ${MAXIMUM_ENUM_VALUES} reviewed scalars.`);
+        }
+        if (recipe.allowNull !== undefined &&
+            typeof recipe.allowNull !== "boolean") {
+            throw new Error(`${label}.recipe.allowNull must be true or false.`);
+        }
+        const values = Array.from(recipe.values, (value, index) => reviewedScalar(value, `${label}.recipe.values[${index}]`));
+        const identities = values.map((value) => JSON.stringify([typeof value, value]));
+        if (new Set(identities).size !== identities.length) {
+            throw new Error(`${label}.recipe.values must not contain duplicates.`);
+        }
+        return Object.freeze({
+            kind: "enum",
+            allowNull: recipe.allowNull === true,
+            values: Object.freeze(values),
+        });
+    }
+    if (recipe.kind === "validated-string") {
+        if (Object.keys(recipe).some((key) => !["kind", "format", "maximumBytes", "allowNull"].includes(key))) {
+            throw new Error(`${label}.recipe contains fields not used by validated-string.`);
+        }
+        if (recipe.format !== "portable-code") {
+            throw new Error(`${label}.recipe.format must be portable-code for validated-string.`);
+        }
+        const maximumBytes = positiveInteger(recipe.maximumBytes, `${label}.recipe.maximumBytes`, 1_024);
+        if (recipe.allowNull !== undefined &&
+            typeof recipe.allowNull !== "boolean") {
+            throw new Error(`${label}.recipe.allowNull must be true or false.`);
+        }
+        return Object.freeze({
+            kind: "validated-string",
+            format: "portable-code",
+            maximumBytes,
+            allowNull: recipe.allowNull === true,
+        });
+    }
+    if (recipe.kind === "digest") {
+        if (Object.keys(recipe).some((key) => !["kind", "format", "length", "namespace", "inputs"].includes(key))) {
+            throw new Error(`${label}.recipe contains fields not used by digest.`);
+        }
+        if (recipe.format !== "hex") {
+            throw new Error(`${label}.recipe.format must be hex for digest.`);
+        }
+        if (typeof recipe.length !== "number" || !HEX_LENGTHS.has(recipe.length)) {
+            throw new Error(`${label}.recipe.length must be 32 or 64 for digest.`);
+        }
+        if (!Array.isArray(recipe.inputs) ||
+            recipe.inputs.length === 0 ||
+            recipe.inputs.length > 32) {
+            throw new Error(`${label}.recipe.inputs must contain 1 through 32 columns.`);
+        }
+        const inputs = recipe.inputs.map((input, index) => identifier(input, `${label}.recipe.inputs[${index}]`));
+        if (new Set(inputs).size !== inputs.length) {
+            throw new Error(`${label}.recipe.inputs must not contain duplicates.`);
+        }
+        return Object.freeze({
+            kind: "digest",
+            format: "hex",
+            length: recipe.length,
+            namespace: nonEmpty(recipe.namespace, `${label}.recipe.namespace`),
+            inputs: Object.freeze(inputs),
+        });
+    }
+    if (recipe.kind === "date-shift") {
+        const days = positiveInteger(recipe.days, `${label}.recipe.days`, 3_650);
+        if (Object.keys(recipe).some((key) => !["kind", "days", "group", "representation"].includes(key))) {
+            throw new Error(`${label}.recipe contains fields not used by date-shift.`);
+        }
+        if (recipe.group !== undefined &&
+            (typeof recipe.group !== "string" || !BINDING_NAME.test(recipe.group))) {
+            throw new Error(`${label}.recipe.group is invalid.`);
+        }
+        const representation = recipe.representation === undefined
+            ? "iso-string"
+            : recipe.representation;
+        if (typeof representation !== "string" ||
+            !DATE_REPRESENTATIONS.has(representation)) {
+            throw new Error(`${label}.recipe.representation must be iso-string or epoch-milliseconds.`);
+        }
+        return Object.freeze({
+            kind: "date-shift",
+            days,
+            representation: representation,
+            ...(recipe.group === undefined ? {} : { group: recipe.group }),
+        });
+    }
+    if (recipe.kind === "path-map") {
+        if (Object.keys(recipe).some((key) => !["kind", "mapping"].includes(key))) {
+            throw new Error(`${label}.recipe contains fields not used by path-map.`);
+        }
+        if (typeof recipe.mapping !== "string" ||
+            !BINDING_NAME.test(recipe.mapping)) {
+            throw new Error(`${label}.recipe.mapping is invalid.`);
+        }
+        return Object.freeze({ kind: "path-map", mapping: recipe.mapping });
+    }
+    if (recipe.kind === "binding-substitute") {
+        if (Object.keys(recipe).some((key) => !["kind", "binding", "format", "namespace", "maximumBytes"].includes(key))) {
+            throw new Error(`${label}.recipe contains fields not used by binding-substitute.`);
+        }
+        if (typeof recipe.binding !== "string" ||
+            !BINDING_NAME.test(recipe.binding)) {
+            throw new Error(`${label}.recipe.binding is invalid.`);
+        }
+        if (recipe.format !== "uuid") {
+            throw new Error(`${label}.recipe.format must be uuid.`);
+        }
+        return Object.freeze({
+            kind: "binding-substitute",
+            binding: recipe.binding,
+            format: "uuid",
+            namespace: nonEmpty(recipe.namespace, `${label}.recipe.namespace`),
+            maximumBytes: positiveInteger(recipe.maximumBytes, `${label}.recipe.maximumBytes`, MAXIMUM_TEXT_SUBSTITUTION_BYTES),
+        });
+    }
+    if (recipe.kind === "approved-owner") {
+        if (Object.keys(recipe).some((key) => !["kind", "approved", "otherwise"].includes(key))) {
+            throw new Error(`${label}.recipe contains fields not used by approved-owner.`);
+        }
+        return Object.freeze({
+            kind: "approved-owner",
+            approved: validateNestedDeclaration(recipe.approved, `${label}.recipe.approved`, { depth }),
+            otherwise: validateNestedDeclaration(recipe.otherwise, `${label}.recipe.otherwise`, { depth }),
+        });
+    }
+    return validateStructuredJsonRecipe({
+        recipe,
+        label,
+        depth,
+        maximumPolicyDepth: MAXIMUM_POLICY_DEPTH,
+        validateDeclaration: validateNestedDeclaration,
+        validatePseudonymRecipe: (nestedRecipe, nestedLabel, nestedDepth) => validatePrivacyRecipe("PSEUDONYMIZE", nestedRecipe, nestedLabel, nestedDepth),
+    });
+};