@tiangong-lca/cli 0.1.0 → 0.1.2

package/dist/src/lib/dataset-maintenance-protected-run.d.ts

@@ -0,0 +1,252 @@
+import { buildAliasPlanRequest } from './dataset-maintenance-alias-request.js';
+import { writePrivateImmutableJson } from './dataset-maintenance-protected-artifacts.js';
+import { parseMaintenancePlan, type DatasetMaintenancePlan, type DatasetMaintenanceRemoteRow, type JsonObject } from './dataset-maintenance-contract.js';
+import { PROTECTED_EXECUTION_CONTRACT, assertProtectedApprovalBindings, assertProtectedFreezeMatchesPlan, buildProtectedAdmitRequest, buildProtectedExecutionIdentity, buildProtectedPreflightRequest, parseProtectedAdmissionProof, parseProtectedApproval, parseProtectedFreeze, parseProtectedGateProof, parseProtectedPreflightProof, parseProtectedStatusProof, type DatasetMaintenanceProtectedApproval, type DatasetMaintenanceProtectedFreeze, type ProtectedAdmissionProof, type ProtectedExecutionIdentity, type ProtectedExecutionStatusProof, type ProtectedGateProof, type ProtectedPreflightProof, type ProtectedReportStatus } from './dataset-maintenance-protected-contract.js';
+import { verifyProtectedExecution, type ProtectedVerificationResult } from './dataset-maintenance-protected-verify.js';
+import { admitMaintenanceAliasExecution, captureMaintenanceAliasExecutionGate, fetchMaintenanceAccountRows, preflightMaintenanceAliasExecution, readMaintenanceAliasExecution, resolveMaintenanceRemoteContext, type DatasetMaintenanceRemoteContext } from './dataset-maintenance-remote.js';
+import type { FetchLike } from './http.js';
+import { withStateFileLock } from './state-lock.js';
+export type RunDatasetMaintenanceProtectedOptions = {
+    planPath: string;
+    freezePath: string;
+    approvalPath: string;
+    outDir: string;
+    commit: boolean;
+    statusOnly: boolean;
+    approveExecution?: string;
+    confirm?: string;
+    waitSeconds?: number;
+    pollMs?: number;
+    pageSize?: number;
+    timeoutMs?: number;
+    env: NodeJS.ProcessEnv;
+    fetchImpl: FetchLike;
+    now?: Date;
+    sleep?: (ms: number) => Promise<void>;
+};
+export type DatasetMaintenanceProtectedReport = {
+    schema_version: typeof PROTECTED_EXECUTION_CONTRACT.report_schema;
+    generated_at_utc: string;
+    mode: 'commit' | 'status_only';
+    status: ProtectedReportStatus;
+    request_id: string;
+    identity_sha256: string;
+    plan_sha256: string;
+    operation_id: string;
+    actor: {
+        user_id: string;
+        email: string;
+    };
+    project_ref: string;
+    admission: ProtectedAdmissionProof | null;
+    database_status: ProtectedExecutionStatusProof | null;
+    issues: Array<{
+        code: string;
+        message: string;
+        details?: unknown;
+    }>;
+    artifacts: {
+        execution_seal: string;
+        preflight_evidence: string;
+        gate_receipts: string;
+        submission_attempt: string;
+        admission_response: string;
+        admission_transport_error: string;
+        status_progress: string;
+        primary_readback: string;
+        reference_readback: string;
+        audit_readback: string;
+        derivative_readback: string;
+        terminal_report: string;
+        attempt_report: string;
+    };
+};
+type PreparedProtectedExecution = {
+    planPath: string;
+    planDir: string;
+    freezePath: string;
+    approvalPath: string;
+    outDir: string;
+    plan: DatasetMaintenancePlan;
+    freeze: DatasetMaintenanceProtectedFreeze;
+    approval: DatasetMaintenanceProtectedApproval;
+    identity: ProtectedExecutionIdentity;
+    aliasPlanRequest: JsonObject;
+    artifacts: DatasetMaintenanceProtectedReport['artifacts'];
+};
+declare function normalizeWaitSeconds(value?: number): number;
+declare function normalizePollMs(value?: number): number;
+declare function clock(options: RunDatasetMaintenanceProtectedOptions): Date;
+declare function errorDetails(error: unknown): {
+    name: string;
+    message: string;
+    code: string | null;
+};
+declare function readArtifact(options: {
+    filePath: string;
+    label: string;
+}): {
+    resolved: string;
+    value: unknown;
+    text: string;
+    file_sha256: string;
+};
+declare function assertCanonicalParsedArtifact(options: {
+    label: string;
+    text: string;
+    value: unknown;
+}): void;
+declare function appendPrivateJsonLine(filePath: string, value: unknown): string;
+declare function nextAttemptReportPath(outDir: string): string;
+declare function allocateAttemptArtifacts(prepared: PreparedProtectedExecution): PreparedProtectedExecution;
+type ProtectedPreparationDependencies = {
+    readArtifact: typeof readArtifact;
+    parsePlan: typeof parseMaintenancePlan;
+    buildAliasPlan: typeof buildAliasPlanRequest;
+    parseFreeze: typeof parseProtectedFreeze;
+    parseApproval: typeof parseProtectedApproval;
+    assertFreezeMatchesPlan: typeof assertProtectedFreezeMatchesPlan;
+    assertApprovalBindings: typeof assertProtectedApprovalBindings;
+    buildIdentity: typeof buildProtectedExecutionIdentity;
+};
+declare function prepareProtectedExecutionWithDependencies(options: RunDatasetMaintenanceProtectedOptions, dependencies: ProtectedPreparationDependencies): PreparedProtectedExecution;
+declare function prepareProtectedExecution(options: RunDatasetMaintenanceProtectedOptions): PreparedProtectedExecution;
+declare function assertContextBindings(options: {
+    prepared: PreparedProtectedExecution;
+    context: DatasetMaintenanceRemoteContext;
+    confirm?: string;
+    commit: boolean;
+}): void;
+declare function projectedRows(options: {
+    plan: DatasetMaintenancePlan;
+    planDir: string;
+    currentRows: DatasetMaintenanceRemoteRow[];
+}): DatasetMaintenanceRemoteRow[];
+declare function assertStrictBeforeState(options: {
+    prepared: PreparedProtectedExecution;
+    currentRows: DatasetMaintenanceRemoteRow[];
+    completeness: unknown;
+}): void;
+declare function assertSupportSnapshots(options: {
+    prepared: PreparedProtectedExecution;
+    context: DatasetMaintenanceRemoteContext;
+}): Promise<void>;
+declare function assertDerivativeBaselines(options: {
+    prepared: PreparedProtectedExecution;
+    context: DatasetMaintenanceRemoteContext;
+}): Promise<void>;
+type ProtectedGateDependencies = {
+    captureGate: typeof captureMaintenanceAliasExecutionGate;
+    parseGate: typeof parseProtectedGateProof;
+    appendReceipt: typeof appendPrivateJsonLine;
+    nowIso: () => string;
+};
+declare function captureProtectedGatesWithDependencies(options: {
+    prepared: PreparedProtectedExecution;
+    context: DatasetMaintenanceRemoteContext;
+    preflight: ProtectedPreflightProof;
+    receiptPath: string;
+}, dependencies: ProtectedGateDependencies): Promise<{
+    proofs: ProtectedGateProof[];
+    results: {
+        primary_support_plan: ProtectedGateProof['result'];
+        execution_unused: ProtectedGateProof['result'];
+        derivative_quiescence: ProtectedGateProof['result'];
+    };
+}>;
+declare function captureProtectedGates(options: {
+    prepared: PreparedProtectedExecution;
+    context: DatasetMaintenanceRemoteContext;
+    preflight: ProtectedPreflightProof;
+    receiptPath: string;
+}): Promise<{
+    proofs: ProtectedGateProof[];
+    results: {
+        primary_support_plan: ProtectedGateProof['result'];
+        execution_unused: ProtectedGateProof['result'];
+        derivative_quiescence: ProtectedGateProof['result'];
+    };
+}>;
+declare function validateExistingMarker(markerPath: string, identity: ProtectedExecutionIdentity): JsonObject | null;
+type ProtectedReadDependencies = {
+    readExecution: typeof readMaintenanceAliasExecution;
+    parseStatus: typeof parseProtectedStatusProof;
+    verifyExecution: typeof verifyProtectedExecution;
+    nowMs: () => number;
+};
+declare function readAndVerifyWithDependencies(options: {
+    command: RunDatasetMaintenanceProtectedOptions;
+    prepared: PreparedProtectedExecution;
+    context: DatasetMaintenanceRemoteContext;
+}, dependencies: ProtectedReadDependencies): Promise<{
+    proof: ProtectedExecutionStatusProof | null;
+    verification: ProtectedVerificationResult;
+}>;
+declare function readAndVerify(options: {
+    command: RunDatasetMaintenanceProtectedOptions;
+    prepared: PreparedProtectedExecution;
+    context: DatasetMaintenanceRemoteContext;
+}): Promise<{
+    proof: ProtectedExecutionStatusProof | null;
+    verification: ProtectedVerificationResult;
+}>;
+declare function buildReport(options: {
+    command: RunDatasetMaintenanceProtectedOptions;
+    prepared: PreparedProtectedExecution;
+    admission: ProtectedAdmissionProof | null;
+    proof: ProtectedExecutionStatusProof | null;
+    verification: ProtectedVerificationResult;
+}): DatasetMaintenanceProtectedReport;
+declare function canonicalTerminalReport(report: DatasetMaintenanceProtectedReport): JsonObject;
+declare function persistVerificationArtifacts(options: {
+    prepared: PreparedProtectedExecution;
+    proof: ProtectedExecutionStatusProof | null;
+    verification: ProtectedVerificationResult;
+    report: DatasetMaintenanceProtectedReport;
+}): void;
+type ProtectedRuntimeDependencies = {
+    withStateLock: typeof withStateFileLock;
+    resolveContext: typeof resolveMaintenanceRemoteContext;
+    fetchAccountRows: typeof fetchMaintenanceAccountRows;
+    assertSupport: typeof assertSupportSnapshots;
+    assertBaselines: typeof assertDerivativeBaselines;
+    buildPreflightRequest: typeof buildProtectedPreflightRequest;
+    preflightExecution: typeof preflightMaintenanceAliasExecution;
+    parsePreflight: typeof parseProtectedPreflightProof;
+    captureGates: typeof captureProtectedGates;
+    buildAdmitRequest: typeof buildProtectedAdmitRequest;
+    admitExecution: typeof admitMaintenanceAliasExecution;
+    parseAdmission: typeof parseProtectedAdmissionProof;
+    readAndVerify: typeof readAndVerify;
+};
+declare function runPreparedProtectedExecution(options: RunDatasetMaintenanceProtectedOptions, basePrepared: PreparedProtectedExecution, dependencies: ProtectedRuntimeDependencies): Promise<DatasetMaintenanceProtectedReport>;
+export declare function runDatasetMaintenanceProtected(options: RunDatasetMaintenanceProtectedOptions): Promise<DatasetMaintenanceProtectedReport>;
+export declare const __testInternals: {
+    allocateAttemptArtifacts: typeof allocateAttemptArtifacts;
+    appendPrivateJsonLine: typeof appendPrivateJsonLine;
+    assertCanonicalParsedArtifact: typeof assertCanonicalParsedArtifact;
+    assertContextBindings: typeof assertContextBindings;
+    assertDerivativeBaselines: typeof assertDerivativeBaselines;
+    assertStrictBeforeState: typeof assertStrictBeforeState;
+    assertSupportSnapshots: typeof assertSupportSnapshots;
+    buildReport: typeof buildReport;
+    canonicalTerminalReport: typeof canonicalTerminalReport;
+    clock: typeof clock;
+    errorDetails: typeof errorDetails;
+    nextAttemptReportPath: typeof nextAttemptReportPath;
+    normalizePollMs: typeof normalizePollMs;
+    normalizeWaitSeconds: typeof normalizeWaitSeconds;
+    prepareProtectedExecution: typeof prepareProtectedExecution;
+    prepareProtectedExecutionWithDependencies: typeof prepareProtectedExecutionWithDependencies;
+    projectedRows: typeof projectedRows;
+    readArtifact: typeof readArtifact;
+    readAndVerify: typeof readAndVerify;
+    readAndVerifyWithDependencies: typeof readAndVerifyWithDependencies;
+    runPreparedProtectedExecution: typeof runPreparedProtectedExecution;
+    captureProtectedGates: typeof captureProtectedGates;
+    captureProtectedGatesWithDependencies: typeof captureProtectedGatesWithDependencies;
+    persistVerificationArtifacts: typeof persistVerificationArtifacts;
+    validateExistingMarker: typeof validateExistingMarker;
+    writePrivateImmutableJson: typeof writePrivateImmutableJson;
+};
+export {};

package/dist/src/lib/dataset-maintenance-protected-seal.d.ts

@@ -0,0 +1,93 @@
+import { readProtectedJsonArtifact, readProtectedTextArtifact, materializePrivateArtifactDirectoryAtomically, writePrivateImmutableJson, writePrivateImmutableText } from './dataset-maintenance-protected-artifacts.js';
+import { parseProtectedFreeze } from './dataset-maintenance-protected-contract.js';
+import { parseProtectedApprovalRequest, sealProtectedApproval } from './dataset-maintenance-protected-preparation.js';
+export declare const PROTECTED_APPROVAL_SEAL_ARTIFACTS: {
+    readonly human_approval_text: 'protected-human-approval.txt';
+    readonly approval: 'protected-approval.json';
+    readonly report: 'protected-approval-seal-report.json';
+};
+export type SealDatasetMaintenanceProtectedApprovalOptions = {
+    freezePath: string;
+    approvalRequestPath: string;
+    humanApprovalPath: string;
+    outDir: string;
+    approveFreezeFile: string;
+    approveRequest: string;
+    approveText: string;
+    confirm: string;
+    approvedAtUtc: string;
+    now?: Date;
+};
+export type DatasetMaintenanceProtectedApprovalSealReport = {
+    schema_version: 'dataset-alias-protected-approval-seal-report.v1';
+    generated_at_utc: string;
+    approval_authority_at_utc: string;
+    status: 'sealed';
+    execution_submitted: false;
+    environment: 'production';
+    project_ref: string;
+    account: {
+        user_id: string;
+        email: string;
+    };
+    plan_sha256: string;
+    operation_id: string;
+    freeze_file_sha256: string;
+    freeze_sha256: string;
+    approval_request_file_sha256: string;
+    approval_request_sha256: string;
+    approval_text_sha256: string;
+    approval_file_sha256: string;
+    approval_identity_sha256: string;
+    assertions: {
+        byte_exact_human_text: true;
+        explicit_freeze_file_hash: true;
+        explicit_request_hash: true;
+        explicit_text_hash: true;
+        explicit_account_confirmation: true;
+        authentication_calls: 0;
+        network_calls: 0;
+        database_calls: 0;
+        preflight_calls: 0;
+        gate_calls: 0;
+        admission_calls: 0;
+        execution_calls: 0;
+    };
+    artifacts: {
+        human_approval_text: string;
+        approval: string;
+        report: string;
+    };
+    artifact_sha256: {
+        human_approval_text: string;
+        approval: string;
+        report: null;
+    };
+};
+type SealProtectedDependencies = {
+    readJson: typeof readProtectedJsonArtifact;
+    readText: typeof readProtectedTextArtifact;
+    parseFreeze: typeof parseProtectedFreeze;
+    parseApprovalRequest: typeof parseProtectedApprovalRequest;
+    sealApproval: typeof sealProtectedApproval;
+    writeJson: typeof writePrivateImmutableJson;
+    writeText: typeof writePrivateImmutableText;
+    materializeArtifacts: typeof materializePrivateArtifactDirectoryAtomically;
+};
+declare function requiredToken(value: string, label: string): string;
+declare function requiredHash(value: string, label: string): string;
+declare function assertCanonicalJsonArtifact(options: {
+    label: string;
+    text: string;
+    value: unknown;
+}): void;
+declare function artifactPaths(outDir: string): DatasetMaintenanceProtectedApprovalSealReport['artifacts'];
+export declare function sealDatasetMaintenanceProtectedApproval(options: SealDatasetMaintenanceProtectedApprovalOptions, dependencies?: SealProtectedDependencies): Promise<DatasetMaintenanceProtectedApprovalSealReport>;
+export declare const __testInternals: {
+    DEFAULT_SEAL_DEPENDENCIES: SealProtectedDependencies;
+    artifactPaths: typeof artifactPaths;
+    assertCanonicalJsonArtifact: typeof assertCanonicalJsonArtifact;
+    requiredHash: typeof requiredHash;
+    requiredToken: typeof requiredToken;
+};
+export {};

package/dist/src/lib/dataset-maintenance-protected-toolchain.d.ts

@@ -0,0 +1,31 @@
+export declare const PROTECTED_TOOLCHAIN_EVIDENCE_SCHEMA: 'dataset-alias-protected-toolchain-evidence.v1';
+export type DatasetMaintenanceProtectedToolchainEvidence = {
+    schema_version: typeof PROTECTED_TOOLCHAIN_EVIDENCE_SCHEMA;
+    environment: 'production';
+    project_ref: string;
+    verified_at_utc: string;
+    database_engine: {
+        repository: 'tiangong-lca/database-engine';
+        production_main_commit_sha: string;
+        production_readback_evidence_sha256: string;
+        status: 'released_and_read_back';
+    };
+    cli: {
+        repository: 'tiangong-lca/tiangong-cli';
+        package_name: '@tiangong-lca/cli';
+        package_version: string;
+        release_commit_sha: string;
+        release_evidence_sha256: string;
+        status: 'published_and_verified';
+    };
+    workspace: {
+        repository: 'tiangong-lca/workspace';
+        integration_commit_sha: string;
+        integration_issue_url: string;
+        status: 'integrated';
+    };
+};
+export declare function parseProtectedToolchainEvidence(value: unknown, expected: {
+    projectRef: string;
+    cliVersion: string;
+}): DatasetMaintenanceProtectedToolchainEvidence;

package/dist/src/lib/dataset-maintenance-protected-verify.d.ts

@@ -0,0 +1,99 @@
+import { type DatasetMaintenancePlan, type DatasetMaintenanceRemoteRow } from './dataset-maintenance-contract.js';
+import { type ProtectedDerivativeSnapshot, type ProtectedExecutionIdentity, type ProtectedExecutionStatusProof, type ProtectedReportStatus, type ProtectedTerminalTargetProof } from './dataset-maintenance-protected-contract.js';
+import { fetchMaintenanceAccountRows, fetchMaintenanceDerivativeTargetRows, type DatasetMaintenanceDerivativeRemoteRow, type DatasetMaintenanceRemoteContext } from './dataset-maintenance-remote.js';
+export type ProtectedVerificationIssue = {
+    code: string;
+    message: string;
+    details?: unknown;
+};
+export type ProtectedLiveDerivativeReadback = {
+    table: 'flows' | 'processes';
+    id: string;
+    version: string;
+    user_id: string;
+    state_code: 0;
+    json_ordered_sha256: string;
+    extracted_md_present: true;
+    embedding_ft_present: true;
+    embedding_ft_at: string;
+};
+export type ProtectedVerificationResult = {
+    status: ProtectedReportStatus;
+    issues: ProtectedVerificationIssue[];
+    account_readback: {
+        rows: DatasetMaintenanceRemoteRow[];
+        source_urls: string[];
+        completeness: unknown;
+    } | null;
+    derivative_readback: {
+        rows: ProtectedLiveDerivativeReadback[];
+        snapshots: ProtectedDerivativeSnapshot[];
+        source_urls: string[];
+    } | null;
+};
+export declare function inspectProtectedLiveDerivative(row: DatasetMaintenanceDerivativeRemoteRow): ProtectedLiveDerivativeReadback | null;
+declare function expectedFinalRows(options: {
+    plan: DatasetMaintenancePlan;
+    planDir: string;
+    rows: DatasetMaintenanceRemoteRow[];
+}): DatasetMaintenanceRemoteRow[];
+declare function verifyStatusStructure(options: {
+    identity: ProtectedExecutionIdentity;
+    proof: ProtectedExecutionStatusProof;
+}): ProtectedVerificationIssue[];
+declare function verifyAuditClosure(proof: ProtectedExecutionStatusProof): ProtectedVerificationIssue[];
+declare function verifyTerminalTargets(options: {
+    identity: ProtectedExecutionIdentity;
+    proof: ProtectedExecutionStatusProof;
+}): ProtectedVerificationIssue[];
+declare function verifyFinalAccountRows(options: {
+    plan: DatasetMaintenancePlan;
+    planDir: string;
+    rows: DatasetMaintenanceRemoteRow[];
+    completeness: unknown;
+}): ProtectedVerificationIssue[];
+declare function matchLiveTargets(options: {
+    proofs: ProtectedTerminalTargetProof[];
+    live: ProtectedLiveDerivativeReadback[];
+    snapshots: ProtectedDerivativeSnapshot[];
+    primaryClosure: unknown;
+    plan: DatasetMaintenancePlan;
+    identity: ProtectedExecutionIdentity;
+}): ProtectedVerificationIssue[];
+declare function fetchProtectedDerivativeSnapshots(options: {
+    context: DatasetMaintenanceRemoteContext;
+    identity: ProtectedExecutionIdentity;
+}): Promise<ProtectedDerivativeSnapshot[]>;
+type ProtectedVerificationDependencies = {
+    fetchAccountRows: typeof fetchMaintenanceAccountRows;
+    fetchDerivativeRows: typeof fetchMaintenanceDerivativeTargetRows;
+    fetchSnapshots: typeof fetchProtectedDerivativeSnapshots;
+};
+declare function verifyProtectedExecutionWithDependencies(options: {
+    plan: DatasetMaintenancePlan;
+    planDir: string;
+    identity: ProtectedExecutionIdentity;
+    proof: ProtectedExecutionStatusProof;
+    context: DatasetMaintenanceRemoteContext;
+    pageSize?: number;
+}, dependencies: ProtectedVerificationDependencies): Promise<ProtectedVerificationResult>;
+export declare function verifyProtectedExecution(options: {
+    plan: DatasetMaintenancePlan;
+    planDir: string;
+    identity: ProtectedExecutionIdentity;
+    proof: ProtectedExecutionStatusProof;
+    context: DatasetMaintenanceRemoteContext;
+    pageSize?: number;
+}): Promise<ProtectedVerificationResult>;
+export declare const __testInternals: {
+    expectedFinalRows: typeof expectedFinalRows;
+    fetchProtectedDerivativeSnapshots: typeof fetchProtectedDerivativeSnapshots;
+    inspectProtectedLiveDerivative: typeof inspectProtectedLiveDerivative;
+    matchLiveTargets: typeof matchLiveTargets;
+    verifyAuditClosure: typeof verifyAuditClosure;
+    verifyFinalAccountRows: typeof verifyFinalAccountRows;
+    verifyStatusStructure: typeof verifyStatusStructure;
+    verifyTerminalTargets: typeof verifyTerminalTargets;
+    verifyProtectedExecutionWithDependencies: typeof verifyProtectedExecutionWithDependencies;
+};
+export {};

package/dist/src/lib/dataset-maintenance-remote.d.ts

@@ -0,0 +1,212 @@
+import type { FetchLike, ResponseLike } from './http.js';
+import { type DatasetMaintenanceTableCompleteness, type DatasetMaintenanceSnapshotCompleteness } from './dataset-maintenance-pagination.js';
+import { type DatasetMaintenanceMutableTable, type DatasetMaintenanceRemoteRow, type DatasetMaintenanceScanTable, type JsonObject } from './dataset-maintenance-contract.js';
+export type DatasetMaintenanceRemoteContext = {
+    project_ref: string;
+    rest_base_url: string;
+    publishable_key: string;
+    access_token: string;
+    account: {
+        user_id: string;
+        email: string;
+        session_source: string;
+    };
+    fetch_impl: FetchLike;
+    timeout_ms: number;
+};
+export type DatasetMaintenanceDerivativeRemoteRow = {
+    table: 'flows' | 'processes';
+    id: string;
+    version: string;
+    user_id: string;
+    state_code: number;
+    raw: JsonObject;
+};
+export declare function normalizeMaintenancePageSize(value?: number): number;
+export declare function normalizeMaintenanceTimeout(value?: number): number;
+declare function fetchJsonResponse(options: {
+    context: Pick<DatasetMaintenanceRemoteContext, 'publishable_key' | 'access_token' | 'fetch_impl' | 'timeout_ms'>;
+    url: string;
+    init?: RequestInit;
+    label: string;
+    redactResponseDetails?: boolean;
+}): Promise<{
+    body: unknown;
+    headers: ResponseLike['headers'];
+}>;
+declare function fetchJson(options: {
+    context: Pick<DatasetMaintenanceRemoteContext, 'publishable_key' | 'access_token' | 'fetch_impl' | 'timeout_ms'>;
+    url: string;
+    init?: RequestInit;
+    label: string;
+    redactResponseDetails?: boolean;
+}): Promise<unknown>;
+declare function selectForTable(table: DatasetMaintenanceScanTable, includeJson?: boolean): string;
+declare function normalizeRemoteRow(table: DatasetMaintenanceScanTable, value: unknown, includeJson?: boolean): DatasetMaintenanceRemoteRow | null;
+declare function normalizeRemoteRows(table: DatasetMaintenanceScanTable, value: unknown, label: string, includeJson?: boolean): DatasetMaintenanceRemoteRow[];
+export declare function resolveMaintenanceRemoteContext(options: {
+    env: NodeJS.ProcessEnv;
+    fetchImpl: FetchLike;
+    timeoutMs?: number;
+    now?: Date;
+}): Promise<DatasetMaintenanceRemoteContext>;
+export declare function fetchMaintenanceExactRows(options: {
+    context: DatasetMaintenanceRemoteContext;
+    table: DatasetMaintenanceScanTable;
+    id: string;
+    version: string;
+    includeJson?: boolean;
+}): Promise<{
+    rows: DatasetMaintenanceRemoteRow[];
+    source_url: string;
+}>;
+export declare function fetchMaintenanceAccountRows(options: {
+    context: DatasetMaintenanceRemoteContext;
+    userId: string;
+    pageSize?: number;
+}): Promise<{
+    rows: DatasetMaintenanceRemoteRow[];
+    source_urls: string[];
+    completeness: DatasetMaintenanceSnapshotCompleteness<DatasetMaintenanceScanTable>;
+}>;
+export declare function fetchMaintenanceAccountTableRows(options: {
+    context: DatasetMaintenanceRemoteContext;
+    userId: string;
+    table: DatasetMaintenanceScanTable;
+    stateCode?: number;
+    includeJson?: boolean;
+    pageSize?: number;
+}): Promise<{
+    rows: DatasetMaintenanceRemoteRow[];
+    source_urls: string[];
+    completeness: DatasetMaintenanceTableCompleteness;
+}>;
+/**
+ * Read every row visible to the authenticated owner for one maintenance table.
+ *
+ * This deliberately omits a user_id predicate. It is a SELECT-only RLS view used
+ * by destructive maintenance admission to prove that a draft flow has no inbound
+ * reference from either an owner row or another row visible to the owner session.
+ */
+export declare function fetchMaintenanceVisibleTableRows(options: {
+    context: DatasetMaintenanceRemoteContext;
+    table: DatasetMaintenanceScanTable;
+    includeJson?: boolean;
+    pageSize?: number;
+}): Promise<{
+    rows: DatasetMaintenanceRemoteRow[];
+    source_urls: string[];
+    completeness: DatasetMaintenanceTableCompleteness;
+}>;
+export type MaintenanceRpcDomainFailure = JsonObject & {
+    ok: false;
+    code: string;
+    status: string | number;
+};
+export declare function isMaintenanceRpcDomainFailure(value: unknown): value is MaintenanceRpcDomainFailure;
+export declare function preflightMaintenanceAliasExecution(options: {
+    context: DatasetMaintenanceRemoteContext;
+    request: JsonObject;
+}): Promise<JsonObject>;
+export declare function admitMaintenanceAliasExecution(options: {
+    context: DatasetMaintenanceRemoteContext;
+    request: JsonObject;
+}): Promise<JsonObject>;
+export declare function captureMaintenanceAliasExecutionGate(options: {
+    context: DatasetMaintenanceRemoteContext;
+    requestId: string;
+    preflightToken: string;
+    gateName: 'primary_support_plan' | 'execution_unused' | 'derivative_quiescence';
+}): Promise<JsonObject>;
+export declare function readMaintenanceAliasExecution(options: {
+    context: DatasetMaintenanceRemoteContext;
+    requestId: string;
+}): Promise<JsonObject>;
+export declare function fetchMaintenanceDerivativeTargetRows(options: {
+    context: DatasetMaintenanceRemoteContext;
+    targets: Array<{
+        table: 'flows' | 'processes';
+        id: string;
+        version: string;
+    }>;
+    concurrency?: number;
+}): Promise<{
+    rows: DatasetMaintenanceDerivativeRemoteRow[];
+    source_urls: string[];
+}>;
+export declare function fetchMaintenanceDerivativeSnapshot(options: {
+    context: DatasetMaintenanceRemoteContext;
+    table?: 'flows' | 'processes';
+    id: string;
+    version: string;
+}): Promise<JsonObject>;
+export declare function applyMaintenanceDerivativeRebuild(options: {
+    context: DatasetMaintenanceRemoteContext;
+    plan: JsonObject;
+}): Promise<JsonObject>;
+export declare function readMaintenanceDerivativeRebuild(options: {
+    context: DatasetMaintenanceRemoteContext;
+    requestId: string;
+}): Promise<JsonObject>;
+export declare function applyMaintenanceAliasPlan(options: {
+    context: DatasetMaintenanceRemoteContext;
+    plan: JsonObject;
+}): Promise<JsonObject>;
+export declare function preflightMaintenanceFlowIdentityScope(options: {
+    context: DatasetMaintenanceRemoteContext;
+    request: JsonObject;
+}): Promise<JsonObject>;
+export declare function lookupMaintenanceFlowIdentityScope(options: {
+    context: DatasetMaintenanceRemoteContext;
+    request: JsonObject;
+}): Promise<JsonObject>;
+export declare function rewriteMaintenanceFlowIdentityProcess(options: {
+    context: DatasetMaintenanceRemoteContext;
+    scopeId: string;
+    request: JsonObject;
+    authorization: JsonObject;
+}): Promise<JsonObject>;
+export declare function readMaintenanceFlowIdentityScope(options: {
+    context: DatasetMaintenanceRemoteContext;
+    scopeId: string;
+}): Promise<JsonObject>;
+export declare function finalizeMaintenanceFlowIdentityScope(options: {
+    context: DatasetMaintenanceRemoteContext;
+    scopeId: string;
+    request: JsonObject;
+    authorization: JsonObject;
+}): Promise<JsonObject>;
+export declare function recoverMaintenanceFlowIdentityScope(options: {
+    context: DatasetMaintenanceRemoteContext;
+    scopeId: string;
+    request: JsonObject;
+}): Promise<JsonObject>;
+export declare function attestMaintenanceFlowIdentityCapture(options: {
+    context: DatasetMaintenanceRemoteContext;
+    request: JsonObject;
+}): Promise<JsonObject>;
+export declare function saveDraftMaintenanceRow(options: {
+    context: DatasetMaintenanceRemoteContext;
+    table: DatasetMaintenanceMutableTable;
+    id: string;
+    version: string;
+    payload: JsonObject;
+    modelId: string | null;
+    ruleVerification: boolean | null;
+    audit: JsonObject;
+}): Promise<JsonObject>;
+export declare function deleteMaintenanceRow(options: {
+    context: DatasetMaintenanceRemoteContext;
+    table: DatasetMaintenanceMutableTable;
+    id: string;
+    version: string;
+    audit: JsonObject;
+}): Promise<JsonObject>;
+export declare const __testInternals: {
+    fetchJson: typeof fetchJson;
+    fetchJsonResponse: typeof fetchJsonResponse;
+    normalizeRemoteRow: typeof normalizeRemoteRow;
+    normalizeRemoteRows: typeof normalizeRemoteRows;
+    selectForTable: typeof selectForTable;
+};
+export {};