Skip to content
Code Recycle

Component · for humans & their agents

Entity Identity Key

verified · first-partyactively maintained$0 during beta (was $69)

Two systems hold the same company and something hashes "the name" into a join key. It is wrong in both directions, and it is wrong silently.

by parsley · Code Recycle moderator

Get it free — beta

Every claim on this page is refundable if it is untrue — refund policy.

Verified: 93 tests

And the opposite error is worse: too little evidence collapses two DIFFERENT entities into one key, and a merge is destructive -- the losing record's data is gone, with nothing recording that it existed.

A DETERMINISTIC IDENTITY KEY for the same real-world entity as seen by two different systems -- built from a DECLARED SCHEMA of identifying fields, with an evidence floor, not from hashing whatever name string happened to be on hand.

THE SILENT FAILURE. Two systems each hold a record for the same company, person or property, and something downstream decides they are the same thing -- usually by hashing "the name" into a join key. That key is wrong IN BOTH DIRECTIONS, and it is wrong silently: nothing throws, nothing logs, the merge or the duplicate just happens.

UNICODE NORMALIZATION. A name typed on macOS and the same name typed elsewhere can differ in composed versus decomposed form. Byte equality says they are different companies; a human says they are obviously the same. The join silently fails and you get a duplicate.

And the opposite error is worse: too little evidence collapses two DIFFERENT entities into one key, and a merge is destructive -- the losing record's data is gone, with nothing recording that it existed.

SO THERE IS AN EVIDENCE FLOOR. Below it the key is refused rather than issued. A key that always exists is a key that sometimes means "these two records share a common first word", and a system built on it merges strangers.

VERIFIED: 93 tests, measured by running the suite.

DELIVERY: signed download of a hash-verified tarball, immediately on purchase. Permissive licence: unlimited products, unlimited clients, unlimited seats, no attribution, perpetual and irrevocable. One restriction, do not republish the source as source.

Interface

What you call, and what comes back. Types and signatures only — the implementation ships with the source.

  export function buildIdentityKey(schema: EntitySchema, values: unknown): IdentityKeyResult;
  export function buildCanonicalString(entityType: string, components: readonly ComponentResult[]): string;
  export function normalizeFieldValue(kind: FieldKind, raw: unknown): FieldNormalizeOutcome;
  export function defineEntitySchema(input: DefineEntitySchemaInput): EntitySchema;
  export function isFieldKind(value: unknown): value is FieldKind;
  export type FieldStatus = "present" | "absent" | "invalid";
  export type IdentityKeyRefusalReason = "invalid-values" | "unknown-value-keys" | "insufficient-signal";

01Capabilities

Does

  • + Entity resolution
  • + Duplicate and sybil detection
  • + Unicode normalization and folding

Doesn’t

  • No exclusions declared

02Requirements & stack

Depends on

No declared dependencies

Credentials needed

None declared

Stack

typescript

03Community

No endorsements yet

No verified confirmations yet — be the first.

Confirmations come from verified purchasers, installers, vetted reviewers, or an installation outcome your org reported through the agent tools. They grade quality — security is verified separately, and community votes can never override the security gate.

Open an issue

Sign in to confirm — weight comes from verified usage, not vote count.

0 open · 0 answered · 0 fixed · 1 said it worked

04Trust Passport

Full passport →
–/100

0/0 automated components pass. An automated score is never a security guarantee.

✓ Verified · first-partyreviewed Sep 20, 2026 · re-verification due Dec 19, 2026
  • publisher identity Publisher status verified; 1 verification(s) on file
  • malicious pattern scan No known malicious-behavior patterns across 15 source file(s) plus listing text
  • capability contract All 1 observed capability reference(s) match the declared manifest (1 declared as cited source(s), not contacted)
  • agent safety scan No injection patterns in agent-readable content
  • provenance No release signature or provenance attestation
  • behavioral sandbox Not performed in this environment — requires the production isolated runner (docs/sandbox-requirements.md). No untrusted code is ever executed on the application host.

Every listing must pass this review before it can be sold, and it is re-run on every release. Verification describes what we checked — it is not a guarantee that the software is safe.

VersionChannelReleasedNotes
1.0.0stableAug 6, 2026First public release.