@tiangong-lca/cli 0.1.0 → 0.1.2

package/dist/src/lib/dataset-maintenance-flow-identity-execution-contract.d.ts

@@ -0,0 +1,456 @@
+import { type FlowIdentityPlan, type FlowIdentityProcessManifest } from './dataset-maintenance-flow-identity-contract.js';
+import { type JsonObject } from './dataset-maintenance-contract.js';
+export type FlowIdentityFreeze = {
+    schema_version: 'dataset-flow-identity-freeze.v2';
+    generated_at_utc: string;
+    environment: 'production';
+    project_ref: string;
+    actor: {
+        user_id: string;
+        email: string;
+    };
+    plan_sha256: string;
+    operation_id: string;
+    capture_artifact_sha256: string;
+    receipt_id: string;
+    receipt_proof_sha256: string;
+    capture_request_sha256: string;
+    source_guard_set_sha256: string;
+    support_guard_set_sha256: string;
+    target_guard_set_sha256: string;
+    mapping_guard_set_sha256: string;
+    process_intent_set_sha256: string;
+    receipt_protected_closure_sha256: string;
+    capture_whole_scope_proof_sha256: string;
+    source_universe_artifact_sha256: string;
+    support_snapshot_artifact_sha256: string;
+    mapping_artifact_sha256: string;
+    process_manifest_artifact_sha256: string;
+    protected_closure_artifact_sha256: string;
+    policy_approval_text_sha256: string;
+    toolchain_evidence_sha256: string;
+    freeze_sha256: string;
+};
+export type FlowIdentityApproval = {
+    schema_version: 'dataset-flow-identity-execution-approval.v2';
+    approved_at_utc: string;
+    actor: {
+        user_id: string;
+        email: string;
+    };
+    plan_sha256: string;
+    freeze_sha256: string;
+    toolchain_evidence_sha256: string;
+    policy_approval_text_sha256: string;
+    execution_approval_request_sha256: string;
+    execution_approval_text_sha256: string;
+    execution_approval_identity_sha256: string;
+};
+export type FlowIdentityExecutionIdentity = {
+    request_id: string;
+    identity_sha256: string;
+    environment: 'production';
+    project_ref: string;
+    actor: {
+        user_id: string;
+        email: string;
+    };
+    target_visibility: 'owner_draft';
+    operation_id: string;
+    plan_sha256: string;
+    freeze_sha256: string;
+    receipt_id: string;
+    receipt_proof_sha256: string;
+    policy_approval_text_sha256: string;
+    execution_approval_request_sha256: string;
+    execution_approval_text_sha256: string;
+    execution_approval_identity_sha256: string;
+    toolchain_evidence_sha256: string;
+};
+/**
+ * A database-minted bearer capability for exactly one live CLI wrapper.
+ *
+ * The token is deliberately absent from every durable artifact type in this
+ * module.  Callers must keep this value in memory, rotate it after each
+ * successful write response, and discard it when the wrapper exits.
+ */
+export type FlowIdentityExecutionPermit = {
+    schema_version: 'dataset-flow-identity-execution-permit.v1';
+    invocation_id: string;
+    generation: number;
+    token: string;
+};
+export type FlowIdentityPermitResponse<T> = {
+    proof: T;
+    executionPermit: FlowIdentityExecutionPermit | null;
+};
+export type FlowIdentityScopePreflightProof = {
+    ok: true;
+    command: 'cmd_dataset_flow_identity_scope_preflight_guarded';
+    schema_version: 'dataset-flow-identity-scope-preflight-result.v2';
+    receipt_id: string;
+    receipt_proof_sha256: string;
+    scope_id: string;
+    operation_id: string;
+    plan_sha256: string;
+    scope_proof_sha256: string;
+    status: 'sealed' | 'running' | 'primary_complete' | 'derivatives_pending' | 'completed';
+    process_count: number;
+    mapping_count: number;
+    mapping_guard_set_sha256: string;
+    process_intent_set_sha256: string;
+    support_snapshot_count: number;
+    source_universe_count: 305;
+    rewrite_count: number;
+    next_ordinal: number;
+    audit_id: string;
+    replay: boolean;
+};
+export type FlowIdentityScopeLookupProof = {
+    ok: true;
+    command: 'cmd_dataset_flow_identity_scope_lookup';
+    schema_version: 'dataset-flow-identity-scope-lookup-result.v1';
+    read_only: true;
+    scope_id: string;
+    receipt_id: string;
+    receipt_proof_sha256: string;
+    mapping_guard_set_sha256: string;
+    process_intent_set_sha256: string;
+    operation_id: string;
+    plan_sha256: string;
+    scope_proof_sha256: string;
+    status: 'sealed' | 'running' | 'primary_complete' | 'derivatives_pending' | 'completed';
+    process_count: number;
+    mapping_count: number;
+    support_snapshot_count: number;
+    source_universe_count: 305;
+    rewrite_count: number;
+    next_ordinal: number;
+    audit_id: string;
+    whole_scope_proof_sha256: string;
+    execution_permit: null;
+};
+export type FlowIdentityScopeProof = FlowIdentityScopePreflightProof | FlowIdentityScopeLookupProof;
+export type FlowIdentityProcessProof = {
+    ok: true;
+    command: 'cmd_dataset_flow_identity_process_rewrite_guarded';
+    schema_version: 'dataset-flow-identity-process-rewrite-result.v2';
+    scope_id: string;
+    receipt_id: string;
+    receipt_proof_sha256: string;
+    mapping_guard_set_sha256: string;
+    process_intent_set_sha256: string;
+    invocation_id: string;
+    permit_generation_before: number;
+    ordinal: number;
+    process_id: string;
+    process_version: string;
+    process_request_sha256: string;
+    process_intent_proof_sha256: string;
+    desired_payload_sha256: string;
+    desired_exchange_set_sha256: string;
+    completed_process_count: number;
+    next_ordinal: number | null;
+    primary_complete: boolean;
+    before_payload_sha256: string;
+    before_exchange_set_sha256: string;
+    after_payload_sha256: string;
+    after_exchange_set_sha256: string;
+    rewrite_count: number;
+    audit_id: string;
+    derivative_batch_id: string;
+    status: 'completed';
+    replay: boolean;
+};
+export type FlowIdentityScopeProcessStatus = {
+    ordinal: number;
+    id: string;
+    version: string;
+    status: 'pending' | 'completed' | 'failed';
+    process_request_sha256: string | null;
+    process_intent_proof_sha256: string;
+    desired_payload_sha256: string;
+    desired_exchange_set_sha256: string;
+    rewrite_count: number;
+    audit_id: string | null;
+    before_payload_sha256: string;
+    before_exchange_set_sha256: string;
+    after_payload_sha256: string | null;
+    after_exchange_set_sha256: string | null;
+    derivative_batch_id: string | null;
+    derivative_request_id: string | null;
+    derivative_status: string | null;
+    causal_terminal_proof: unknown;
+    completed_at: string | null;
+    last_error: unknown;
+};
+export type FlowIdentityDerivativeResidue = {
+    http_requests: number;
+    embedding_jobs: number;
+    pending_jobs: number;
+    failure_rows: number;
+    other_active_fences: number;
+};
+export type FlowIdentityDerivativeTargetProof = {
+    ordinal: number;
+    id: string;
+    version: string;
+    original_batch_id: string;
+    effective_reference_id: string | null;
+    effective_reference_kind: 'protected_batch' | 'separate_compensation';
+    status: 'completed' | 'pending' | 'failed';
+    request_status: 'queued' | 'dispatching' | 'markdown_pending' | 'embedding_pending' | 'completed' | 'stale' | 'failed' | 'missing';
+    phase: string;
+    lineage_ok: boolean;
+    proposals_committed: boolean;
+    terminal_audit_present: boolean;
+    residue: FlowIdentityDerivativeResidue;
+    current_snapshot_sha256: string;
+    current_json_ordered_sha256: string;
+    causal_terminal_proof: boolean;
+};
+export type FlowIdentityDerivativeSetProof = {
+    ok: boolean;
+    schema_version: 'dataset-flow-identity-derivative-set-proof.v1';
+    scope_id: string;
+    status: 'failed' | 'compensation_required' | 'pending' | 'completed';
+    target_count: number;
+    completed_count: number;
+    pending_count: number;
+    failed_count: number;
+    causal_terminal_proof: boolean;
+    targets: FlowIdentityDerivativeTargetProof[];
+    compensation_targets: FlowIdentityCompensationTarget[];
+    proof_sha256: string;
+};
+export type FlowIdentityCompensationTarget = {
+    ordinal: number;
+    table: 'processes';
+    id: string;
+    version: string;
+    original_batch_id: string;
+    original_request_id?: string | null;
+    original_status: 'failed' | 'stale' | 'missing';
+    original_error?: unknown;
+    original_code?: string;
+    desired_payload_sha256: string;
+    current_json_ordered_sha256: string;
+    current_snapshot_sha256: string;
+    current_modified_at: string;
+    components: ['extracted_md', 'embedding_ft'];
+    reason_code: string;
+    operation_id_prefix: string;
+    latest_compensation_request_id: string | null;
+    latest_compensation_status: string | null;
+    latest_compensation_plan_sha256: string | null;
+    requires_new_plan_freeze_approval: true;
+    automatic_retry: false;
+};
+export type FlowIdentityWholeScopeProof = {
+    schema_version: 'dataset-flow-identity-whole-scope-proof.v2';
+    scope_id: string;
+    receipt_id: string;
+    primary_current: boolean;
+    audit_current: boolean;
+    source_guards_current: boolean;
+    support_guards_current: boolean;
+    target_guards_current: boolean;
+    approved_reference_residue_count: number;
+    protected_closure_current: boolean;
+    occurrence_closure_current: boolean;
+    derivatives_current: boolean;
+    primary_closure_sha256: string;
+    source_guard_set_sha256: string;
+    support_guard_set_sha256: string;
+    target_guard_set_sha256: string;
+    protected_closure_sha256: string;
+    derivative_proof_set_sha256: string;
+    causal_terminal_proof: boolean;
+    proof_sha256: string;
+};
+export type FlowIdentityScopeStatus = {
+    ok: boolean;
+    command: 'cmd_dataset_flow_identity_scope_read';
+    schema_version: 'dataset-flow-identity-scope-status.v2';
+    scope_id: string;
+    receipt_id: string;
+    receipt_proof_sha256: string;
+    mapping_guard_set_sha256: string;
+    process_intent_set_sha256: string;
+    operation_id: string;
+    plan_sha256: string;
+    scope_proof_sha256: string;
+    status: 'sealed' | 'running' | 'primary_complete' | 'derivatives_pending' | 'completed' | 'live_drift' | 'failed';
+    process_count: number;
+    rewrite_count: number;
+    completed_process_count: number;
+    pending_process_count: number;
+    failed_process_count: number;
+    completed_rewrite_count: number;
+    next_ordinal: number;
+    primary_complete: boolean;
+    primary_current: boolean;
+    live_guard_current: boolean;
+    derivatives_current: boolean;
+    derivative_pending_count: number;
+    derivative_failed_count: number;
+    derivative_set_proof: FlowIdentityDerivativeSetProof;
+    derivative_proof_set_sha256: string;
+    protected_closure_current: boolean;
+    protected_closure_proof: JsonObject;
+    processes: FlowIdentityScopeProcessStatus[];
+    terminal_proof_sha256: string | null;
+    completed_at: string | null;
+    cancellable: boolean;
+    strict_continuation_required: boolean;
+    whole_scope_proof: FlowIdentityWholeScopeProof;
+    whole_scope_proof_sha256: string;
+    code?: string;
+    compensation_required?: boolean;
+    automatic_retry?: false;
+    compensation_targets?: FlowIdentityCompensationTarget[];
+};
+export type FlowIdentityFinalizeProof = {
+    ok: boolean;
+    command: 'cmd_dataset_flow_identity_scope_finalize_guarded';
+    schema_version: 'dataset-flow-identity-scope-finalize-result.v2';
+    scope_id: string;
+    receipt_id: string;
+    receipt_proof_sha256: string;
+    mapping_guard_set_sha256: string;
+    process_intent_set_sha256: string;
+    operation_id: string;
+    plan_sha256: string;
+    scope_proof_sha256: string;
+    invocation_id: string;
+    permit_generation_before: number;
+    status: 'derivatives_pending' | 'completed' | 'live_drift' | 'failed';
+    process_count: number;
+    rewrite_count: number;
+    completed_process_count: number;
+    primary_closure_sha256: string;
+    protected_closure_sha256: string;
+    derivative_target_set_sha256: string;
+    derivative_proof_set_sha256: string;
+    primary_current: boolean;
+    live_guard_current: boolean;
+    derivatives_current: boolean;
+    terminal_proof_sha256: string | null;
+    whole_scope_proof: FlowIdentityWholeScopeProof;
+    whole_scope_proof_sha256: string;
+    audit_id: string | null;
+    replay: boolean;
+    code?: string;
+    compensation_required?: boolean;
+    automatic_retry?: false;
+    compensation_targets?: FlowIdentityCompensationTarget[];
+};
+declare function token(value: unknown, label: string): string;
+declare function hash(value: unknown, label: string): string;
+declare function uuid(value: unknown, label: string): string;
+declare function instant(value: unknown, label: string): string;
+declare function integer(value: unknown, label: string, minimum?: number): number;
+declare function deterministicUuidFromSha256(digest: string): string;
+export declare function computeFlowIdentityFreezeSha256(freeze: FlowIdentityFreeze): string;
+export declare function computeFlowIdentityApprovalIdentitySha256(approval: FlowIdentityApproval): string;
+export declare function parseFlowIdentityFreeze(value: unknown, plan: FlowIdentityPlan): FlowIdentityFreeze;
+export declare function parseFlowIdentityApproval(value: unknown, plan: FlowIdentityPlan, freeze: FlowIdentityFreeze): FlowIdentityApproval;
+export declare function buildFlowIdentityExecutionIdentity(options: {
+    plan: FlowIdentityPlan;
+    freeze: FlowIdentityFreeze;
+    approval: FlowIdentityApproval;
+}): FlowIdentityExecutionIdentity;
+export declare function buildFlowIdentityScopePreflightRequest(options: {
+    plan: FlowIdentityPlan;
+    identity: FlowIdentityExecutionIdentity;
+}): JsonObject;
+export declare function buildFlowIdentityScopeLookupRequest(options: {
+    identity: FlowIdentityExecutionIdentity;
+}): JsonObject;
+/**
+ * Removes the memory-only permit before a response enters a proof parser or
+ * durable artifact writer.  Exact proof parsers therefore cannot accidentally
+ * accept or persist the bearer token.
+ */
+export declare function splitFlowIdentityPermitResponse(options: {
+    value: unknown;
+    expectedGeneration: number;
+    expectedInvocationId?: string;
+    permitRequired: boolean;
+    permitForbidden?: boolean;
+    label: string;
+}): FlowIdentityPermitResponse<JsonObject>;
+export declare function computeFlowIdentityProcessRequestSha256(request: JsonObject): string;
+export declare function buildFlowIdentityProcessRequest(options: {
+    scopeProofSha256: string;
+    ordinal: number;
+    processIntentProofSha256: string;
+}): JsonObject;
+export declare function buildFlowIdentityFinalizeRequest(options: {
+    scopeProofSha256: string;
+    plan: FlowIdentityPlan;
+    status: FlowIdentityScopeStatus;
+}): JsonObject;
+export declare function parseFlowIdentityScopePreflightProof(value: unknown, plan: FlowIdentityPlan): FlowIdentityScopePreflightProof;
+export declare function parseFlowIdentityScopeLookupProof(value: unknown, plan: FlowIdentityPlan, identity: FlowIdentityExecutionIdentity): FlowIdentityScopeLookupProof;
+export declare function parseFlowIdentityProcessProof(options: {
+    value: unknown;
+    scopeId: string;
+    process: FlowIdentityProcessManifest;
+    requestSha256: string;
+    receiptId: string;
+    receiptProofSha256: string;
+    mappingGuardSetSha256: string;
+    processIntentSetSha256: string;
+    processIntentProofSha256: string;
+    processCount: number;
+    expectedInvocationId?: string;
+    expectedPermitGenerationBefore?: number;
+}): FlowIdentityProcessProof;
+declare function parseScopeProcess(value: unknown, expected: FlowIdentityProcessManifest): FlowIdentityScopeProcessStatus;
+declare function parseCompensationEnvelope(value: JsonObject, plan: FlowIdentityPlan, scopeId: string, source: 'scope_read' | 'finalize'): FlowIdentityCompensationTarget[];
+export declare function parseFlowIdentityDerivativeSetProof(options: {
+    value: unknown;
+    plan: FlowIdentityPlan;
+    scopeId: string;
+    processes: FlowIdentityScopeProcessStatus[];
+}): FlowIdentityDerivativeSetProof;
+export declare function parseFlowIdentityWholeScopeProof(options: {
+    value: unknown;
+    scopeId: string;
+    receiptId: string;
+}): FlowIdentityWholeScopeProof;
+export declare function parseFlowIdentityScopeStatus(value: unknown, plan: FlowIdentityPlan, scopeId: string, scopeProofSha256: string): FlowIdentityScopeStatus;
+export declare function flowIdentityScopeHasCurrentDerivativeClosure(status: FlowIdentityScopeStatus): boolean;
+export declare function flowIdentityScopeIsReadyToFinalize(status: FlowIdentityScopeStatus): boolean;
+export declare function parseFlowIdentityFinalizeProof(options: {
+    value: unknown;
+    plan: FlowIdentityPlan;
+    scopeId: string;
+    scopeProofSha256: string;
+    request: JsonObject;
+    expectedInvocationId?: string;
+    expectedPermitGenerationBefore?: number;
+}): FlowIdentityFinalizeProof;
+export declare function prepareFlowIdentityExecution(options: {
+    plan: unknown;
+    freeze: unknown;
+    approval: unknown;
+}): {
+    plan: FlowIdentityPlan;
+    freeze: FlowIdentityFreeze;
+    approval: FlowIdentityApproval;
+    identity: FlowIdentityExecutionIdentity;
+    preflightRequest: JsonObject;
+};
+export declare const __testInternals: {
+    deterministicUuidFromSha256: typeof deterministicUuidFromSha256;
+    hash: typeof hash;
+    instant: typeof instant;
+    integer: typeof integer;
+    parseScopeProcess: typeof parseScopeProcess;
+    parseCompensationEnvelope: typeof parseCompensationEnvelope;
+    token: typeof token;
+    uuid: typeof uuid;
+};
+export {};

package/dist/src/lib/dataset-maintenance-flow-identity-freeze.d.ts

@@ -0,0 +1,99 @@
+export type FlowIdentityExecutionApprovalRequestCore = {
+    schema_version: 'dataset-flow-identity-execution-approval-request.v3';
+    approved_at_utc: string;
+    environment: 'production';
+    project_ref: string;
+    actor: {
+        user_id: string;
+        email: string;
+    };
+    target_visibility: 'owner_draft';
+    plan_sha256: string;
+    operation_id: string;
+    plan_file_sha256: string;
+    freeze_file_sha256: string;
+    freeze_sha256: string;
+    receipt_id: string;
+    receipt_proof_sha256: string;
+    capture_request_sha256: string;
+    source_guard_set_sha256: string;
+    support_guard_set_sha256: string;
+    target_guard_set_sha256: string;
+    mapping_guard_set_sha256: string;
+    process_intent_set_sha256: string;
+    receipt_protected_closure_sha256: string;
+    capture_whole_scope_proof_sha256: string;
+    capture_artifact_sha256: string;
+    toolchain_evidence_sha256: string;
+    policy_approval_text_sha256: string;
+    semantic_source_count: 305;
+    mapping_count: number;
+    pending_count: number;
+    blocker_count: number;
+    orphan_count: number;
+    process_count: number;
+    rewrite_count: number;
+    state_code_changes: 0;
+    deletes: 0;
+    source_mutations: 0;
+    public_target_mutations: 0;
+    user_state_claim: 'authenticated_actor_state_100_plus_own_state_0';
+    approval_reusable: false;
+    maximum_wrapper_invocations: 1;
+    maximum_cli_apply_spawns: 1;
+    maximum_process_posts: number;
+    maximum_finalize_posts: 1;
+    max_process_concurrency: 1;
+    automatic_retry: false;
+};
+export type FlowIdentityApprovalRequest = FlowIdentityExecutionApprovalRequestCore & {
+    request_sha256: string;
+};
+export type FreezeFlowIdentityOptions = {
+    planPath: string;
+    toolchainEvidencePath: string;
+    expectedProjectRef: string;
+    confirm: string;
+    approvedAtUtc: string;
+    cliVersion: string;
+    outDir: string;
+    now?: Date;
+};
+export type FlowIdentityFreezeReport = {
+    schema_version: 'dataset-flow-identity-freeze-report.v2';
+    generated_at_utc: string;
+    status: 'frozen';
+    execution_submitted: false;
+    network_calls: 0;
+    database_calls: 0;
+    plan_sha256: string;
+    operation_id: string;
+    freeze_sha256: string;
+    freeze_file_sha256: string;
+    execution_approval_request_sha256: string;
+    execution_approval_text_sha256: string;
+    policy_approval_text_sha256: string;
+    artifacts: {
+        freeze: string;
+        approval_request: string;
+        approval_text: string;
+        report: string;
+    };
+};
+export declare const FLOW_IDENTITY_FREEZE_ARTIFACTS: {
+    readonly freeze: 'flow-identity-freeze.json';
+    readonly approval_request: 'flow-identity-execution-approval-request.json';
+    readonly approval_text: 'flow-identity-execution-approval-request.txt';
+    readonly report: 'flow-identity-freeze-report.json';
+};
+declare function canonicalTimestamp(value: string, label: string): string;
+declare function requestCore(value: FlowIdentityApprovalRequest): FlowIdentityExecutionApprovalRequestCore;
+export declare function computeFlowIdentityApprovalRequestSha256(request: FlowIdentityApprovalRequest): string;
+export declare function renderFlowIdentityExecutionApprovalText(core: FlowIdentityExecutionApprovalRequestCore, requestSha256: string): string;
+export declare function parseFlowIdentityApprovalRequest(value: unknown): FlowIdentityApprovalRequest;
+export declare function freezeFlowIdentity(options: FreezeFlowIdentityOptions): FlowIdentityFreezeReport;
+export declare const __testInternals: {
+    canonicalTimestamp: typeof canonicalTimestamp;
+    requestCore: typeof requestCore;
+};
+export {};

package/dist/src/lib/dataset-maintenance-flow-identity-plan.d.ts

@@ -0,0 +1,85 @@
+import { type FlowIdentityCollisionLedger, type FlowIdentityCompatibilityPolicy, type FlowIdentityCaptureRequest, type FlowIdentityDirection, type FlowIdentityLiveCapture, type FlowIdentityMapping, type FlowIdentityMappingEndpoint, type FlowIdentityOccurrence, type FlowIdentityPlan, type FlowIdentityPlanBundle, type FlowIdentityProcessTemplate, type FlowIdentityProtectedClosure, type FlowIdentityReference, type FlowIdentityReviewLedger, type FlowIdentityRewrite, type FlowIdentitySupportSnapshot } from './dataset-maintenance-flow-identity-contract.js';
+import { type DatasetMaintenanceRowSnapshot, type JsonObject } from './dataset-maintenance-contract.js';
+import { type FlowPayloadValidationResult } from './flow-payload-validation.js';
+import { type ProcessPayloadValidationResult } from './process-payload-validation.js';
+export type ValidationDeps = {
+    validateFlow: (payload: JsonObject) => FlowPayloadValidationResult;
+    validateProcess: (payload: JsonObject) => ProcessPayloadValidationResult;
+};
+export type BuildFlowIdentityPlanOptions = {
+    policy: unknown;
+    reviewLedger: unknown;
+    liveCapture: unknown;
+    now?: Date;
+    validation?: Partial<ValidationDeps>;
+};
+export type RunFlowIdentityPlanOptions = BuildFlowIdentityPlanOptions & {
+    outDir: string;
+};
+declare function rowKey(id: string, version: string): string;
+declare function indexRows(rows: DatasetMaintenanceRowSnapshot[], table: DatasetMaintenanceRowSnapshot['table']): Map<string, DatasetMaintenanceRowSnapshot>;
+declare function arrayOfObjects(value: unknown): JsonObject[] | null;
+declare function flowIdentity(payload: JsonObject): {
+    id: string;
+    version: string;
+} | null;
+export declare function flowType(payload: JsonObject): string | null;
+declare function flowClassificationInformation(payload: JsonObject): unknown;
+declare function flowSupportFacts(row: DatasetMaintenanceRowSnapshot, supportRows: DatasetMaintenanceRowSnapshot[], actorUserId: string): Omit<FlowIdentityMappingEndpoint, 'user_id' | 'state_code' | 'modified_at' | 'payload_sha256' | 'row_sha256'> | null;
+declare function flowGuardRowSha256(row: DatasetMaintenanceRowSnapshot): string | null;
+declare function processGuardRowSha256(row: DatasetMaintenanceRowSnapshot): string | null;
+declare function endpoint(row: DatasetMaintenanceRowSnapshot, supportRows: DatasetMaintenanceRowSnapshot[], actorUserId: string): FlowIdentityMappingEndpoint | null;
+declare function processExchanges(payload: JsonObject): JsonObject[] | null;
+declare function exchangeReference(exchange: JsonObject): FlowIdentityReference | null;
+declare function exchangeDirection(exchange: JsonObject): FlowIdentityDirection | null;
+declare function exchangeInternalId(exchange: JsonObject): string | null;
+declare function patchReference(reference: JsonObject, target: FlowIdentityReference): void;
+declare function collectOccurrences(processes: DatasetMaintenanceRowSnapshot[]): Map<string, FlowIdentityOccurrence[]>;
+declare function buildProtectedClosure(review: FlowIdentityReviewLedger, occurrenceIndex: Map<string, FlowIdentityOccurrence[]>): FlowIdentityProtectedClosure;
+declare function collisionLedger(options: {
+    desiredExchanges: JsonObject[];
+    rewrites: FlowIdentityRewrite[];
+}): FlowIdentityCollisionLedger;
+export declare function buildFlowIdentityCaptureRequest(options: {
+    requestId: string;
+    operationId: string;
+    policy: FlowIdentityCompatibilityPolicy;
+    capture: FlowIdentityLiveCapture;
+    mappings: FlowIdentityMapping[];
+    processTemplates: FlowIdentityProcessTemplate[];
+    protectedClosure: FlowIdentityProtectedClosure;
+}): FlowIdentityCaptureRequest;
+export declare function buildFlowIdentitySemantics(options: {
+    policy: FlowIdentityCompatibilityPolicy;
+    review: FlowIdentityReviewLedger;
+    capture: FlowIdentityLiveCapture;
+    validation: ValidationDeps;
+}): {
+    protectedClosure: FlowIdentityProtectedClosure;
+    mappings: FlowIdentityMapping[];
+    supportSnapshots: FlowIdentitySupportSnapshot[];
+    processTemplates: FlowIdentityProcessTemplate[];
+};
+export declare function buildFlowIdentityPlan(options: BuildFlowIdentityPlanOptions): FlowIdentityPlanBundle;
+export declare function runFlowIdentityPlan(options: RunFlowIdentityPlanOptions): FlowIdentityPlan;
+export declare const __testInternals: {
+    arrayOfObjects: typeof arrayOfObjects;
+    buildProtectedClosure: typeof buildProtectedClosure;
+    collectOccurrences: typeof collectOccurrences;
+    collisionLedger: typeof collisionLedger;
+    endpoint: typeof endpoint;
+    exchangeDirection: typeof exchangeDirection;
+    exchangeInternalId: typeof exchangeInternalId;
+    exchangeReference: typeof exchangeReference;
+    flowClassificationInformation: typeof flowClassificationInformation;
+    flowIdentity: typeof flowIdentity;
+    flowGuardRowSha256: typeof flowGuardRowSha256;
+    flowSupportFacts: typeof flowSupportFacts;
+    flowType: typeof flowType;
+    indexRows: typeof indexRows;
+    patchReference: typeof patchReference;
+    processGuardRowSha256: typeof processGuardRowSha256;
+    processExchanges: typeof processExchanges;
+    rowKey: typeof rowKey;
+};
+export {};