textus 0.54.2 → 0.55.2

data/lib/textus/manifest/policy/predicates/schema_valid.rb

@@ -0,0 +1,41 @@
+module Textus
+  class Manifest
+    class Policy
+      module Predicates
+        class SchemaValid
+          def self.call(manifest:, actor:, action:, key:, schemas: nil, envelope: nil, extra: {})
+            return { pass: true } unless envelope
+            return { pass: true } if key.nil?
+
+            mentry = manifest.resolver.resolve(key).entry
+            schema_ref = mentry.schema
+            return { pass: true } unless schema_ref
+            return { pass: true } unless schemas
+
+            schema = schemas.fetch_or_nil(schema_ref)
+            return { pass: true } unless schema
+
+            frontmatter = envelope.meta&.dig("_meta") || envelope.meta || {}
+            begin
+              schema.validate!(frontmatter)
+              { pass: true }
+            rescue Textus::SchemaViolation => e
+              { pass: false, reason: schema_reason(e) }
+            end
+          rescue Textus::UnknownKey
+            { pass: true }
+          end
+
+          def self.schema_reason(err)
+            d = err.details
+            return err.message.dup unless d.is_a?(Hash)
+            return "missing required fields: #{Array(d["missing"]).join(", ")}" if d["missing"]
+            return "field '#{d["field"]}': #{d["reason"]}" if d["field"]
+
+            err.message.dup
+          end
+        end
+      end
+    end
+  end
+end

data/lib/textus/manifest/policy/predicates/target_is_canon.rb

@@ -0,0 +1,20 @@
+module Textus
+  class Manifest
+    class Policy
+      module Predicates
+        class TargetIsCanon
+          def self.call(manifest:, actor:, action:, key:, schemas: nil, envelope: nil, extra: {})
+            return { pass: true } if key.nil?
+
+            mentry = manifest.resolver.resolve(key).entry
+            kind = manifest.policy.declared_kind(mentry.lane.to_s)
+            pass = kind == :canon
+            { pass:, reason: pass ? nil : "target lane '#{mentry.lane}' is not canon (kind: #{kind})" }
+          rescue Textus::UnknownKey
+            { pass: true }
+          end
+        end
+      end
+    end
+  end
+end

data/lib/textus/manifest/policy/predicates.rb

@@ -0,0 +1,54 @@
+module Textus
+  class Manifest
+    class Policy
+      module Predicates
+        FLOOR = {
+          put: %w[lane_writable_by raw_lane_ingest_only],
+          key_delete: %w[lane_deletable_by],
+          key_mv: %w[lane_writable_by raw_lane_ingest_only],
+          accept: %w[author_held],
+          reject: %w[author_held],
+          propose: %w[lane_writable_by raw_lane_ingest_only],
+          key_mv_prefix: %w[lane_writable_by raw_lane_ingest_only],
+          key_delete_prefix: %w[lane_writable_by raw_lane_ingest_only],
+          ingest: %w[lane_writable_by raw_write_once],
+        }.freeze
+
+        CLASSES = {
+          "lane_writable_by" => "LaneWritableBy",
+          "author_held" => "AuthorHeld",
+          "target_is_canon" => "TargetIsCanon",
+          "etag_match" => "EtagMatch",
+          "schema_valid" => "SchemaValid",
+          "fresh_within" => "FreshWithin",
+          "raw_lane_ingest_only" => "RawLaneIngestOnly",
+          "raw_write_once" => "RawWriteOnce",
+          "lane_deletable_by" => "LaneDeletableBy",
+        }.freeze
+
+        module_function
+
+        def by_name(name)
+          short = CLASSES.fetch(name.to_s) do
+            raise Textus::UsageError.new("unknown predicate '#{name}'")
+          end
+          const_get(short)
+        end
+
+        def evaluate(manifest:, action:, actor:, key:, schemas: nil, envelope: nil, extra: {}, rule_predicates: [])
+          failures = []
+          (FLOOR.fetch(action, []) + rule_predicates).uniq.each do |pred_name|
+            result = by_name(pred_name).call(
+              manifest:, schemas:, actor:, action:, key:, envelope:, extra:,
+            )
+            next if result[:pass]
+            raise result[:error] if result[:error]
+
+            failures << [pred_name, result[:reason]]
+          end
+          raise Textus::GuardFailed.new(failures) unless failures.empty?
+        end
+      end
+    end
+  end
+end

data/lib/textus/manifest/policy/retention.rb

@@ -21,7 +21,7 @@ module Textus
           raise Textus::BadManifest.new("retention action must be one of #{ACTIONS.join("|")}, got #{raw["action"].inspect}")
         end
 
-        def ttl_seconds = Textus::Core::Duration.seconds(@ttl)
+        def ttl_seconds = Textus::Value::Duration.seconds(@ttl)
         def destructive? = true
       end
     end

data/lib/textus/manifest/schema/semantics/cross_field.rb

@@ -0,0 +1,53 @@
+module Textus
+  class Manifest
+    module Schema
+      module Semantics
+        module CrossField
+          def check_cross_field!(raw)
+            check_owners!(raw["lanes"], raw["entries"])
+            check_lane_kind_consistency!(raw)
+          end
+
+          def check_owners!(lanes, entries)
+            Array(lanes).each_with_index { |z, i| check_owner!(z["owner"], "$.lanes[#{i}]") }
+            Array(entries).each_with_index { |e, i| check_owner!(e["owner"], "$.entries[#{i}]") }
+          end
+
+          def check_owner!(owner, path)
+            return if owner.nil?
+            return if valid_owner?(owner)
+
+            raise BadManifest.new(
+              "invalid owner '#{owner}' at '#{path}' " \
+              "(expected <archetype> or <archetype>:<subject>, archetype one of: #{Textus::Value::Role::NAMES.join(", ")})",
+            )
+          end
+
+          def valid_owner?(token)
+            return false unless token.is_a?(String) && !token.empty?
+
+            archetype, subject = token.split(":", 2)
+            return false unless Textus::Value::Role::NAMES.include?(archetype)
+            return true if subject.nil?
+
+            OWNER_SUBJECT_PATTERN.match?(subject)
+          end
+
+          def check_lane_kind_consistency!(raw)
+            held = Capabilities.resolve(raw["roles"]).values.flatten.uniq
+
+            Array(raw["lanes"]).each_with_index do |z, i|
+              verb = KIND_REQUIRES_VERB[z["kind"]]
+              next if verb.nil? || held.include?(verb)
+
+              raise BadManifest.new(
+                "lane '#{z["name"]}' (#{z["kind"]}) at '$.lanes[#{i}]' " \
+                "needs a role with capability '#{verb}'; none declared",
+              )
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/textus/manifest/schema/semantics/invariants.rb

@@ -0,0 +1,125 @@
+module Textus
+  class Manifest
+    module Schema
+      module Semantics
+        module Invariants
+          def check_invariants!(raw)
+            check_roles!(raw["roles"])
+            check_lanes!(raw["lanes"])
+            check_entries!(raw["entries"])
+            check_rules!(raw["rules"])
+            check_single_queue!(raw)
+            check_single_machine!(raw)
+            walk(raw["audit"], AUDIT_KEYS, "$.audit") if raw["audit"].is_a?(Hash)
+          end
+
+          def check_roles!(roles)
+            return if roles.nil?
+
+            roles.each_with_index do |r, i|
+              path = "$.roles[#{i}]"
+              name = r["name"]
+              unless Textus::Value::Role::NAMES.include?(name)
+                raise BadManifest.new(
+                  "unknown role name '#{name}' at '#{path}' (allowed: #{Textus::Value::Role::NAMES.join(", ")})",
+                )
+              end
+              Array(r["can"]).each do |verb|
+                next if CAPABILITIES.include?(verb)
+
+                hint = %w[ingest fetch].include?(verb) ? " — the quarantine capability folded into 'converge' (ADR 0090)" : ""
+                raise BadManifest.new(
+                  "unknown capability '#{verb}' for role '#{name}' at '#{path}' " \
+                  "(known: #{CAPABILITIES.join(", ")})#{hint}",
+                )
+              end
+            end
+
+            author_holders = roles.count { |r| Array(r["can"]).include?("author") }
+            return if author_holders <= 1
+
+            raise BadManifest.new(
+              "manifest declares #{author_holders} roles with the author capability; at most one is allowed",
+            )
+          end
+
+          def check_lanes!(lanes)
+            Array(lanes).each_with_index do |z, i|
+              walk(z, LANE_KEYS, "$.lanes[#{i}]")
+              next unless %w[quarantine derived].include?(z["kind"])
+
+              raise BadManifest.new(
+                "lane kind '#{z["kind"]}' at '$.lanes[#{i}]' was folded into 'machine' (ADR 0091) — " \
+                "use `kind: machine`",
+              )
+            end
+          end
+
+          def check_entries!(entries)
+            Array(entries).each_with_index do |e, i|
+              path = "$.entries[#{i}]"
+              walk(e, ENTRY_KEYS, path)
+              check_publish_block!(e, path)
+              walk(e["source"], SOURCE_KEYS, "#{path}.source") if e.is_a?(Hash) && e["source"].is_a?(Hash)
+            end
+          end
+
+          def check_rules!(rules)
+            Array(rules).each_with_index do |r, i|
+              path = "$.rules[#{i}]"
+              walk(r, RULE_KEYS, path)
+              FIELD_REGISTRY.each_value do |meta|
+                next unless meta[:sub_keys]
+
+                value = r.is_a?(Hash) ? r[meta[:yaml_key]] : nil
+                walk(value, meta[:sub_keys], "#{path}.#{meta[:yaml_key]}") if value.is_a?(Hash)
+              end
+            end
+          end
+
+          def check_publish_block!(entry, path)
+            return unless entry.is_a?(Hash) && entry.key?("publish")
+
+            block = entry["publish"]
+            if block.is_a?(Hash)
+              raise BadManifest.new(
+                "publish: at '#{path}.publish' must be a list of targets (ADR 0094); the map form was retired.",
+              )
+            end
+            raise BadManifest.new("publish: must be a list of targets at '#{path}.publish'") unless block.is_a?(Array)
+
+            block.each_with_index do |t, i|
+              raise BadManifest.new("publish target ##{i} must be a mapping at '#{path}.publish'") unless t.is_a?(Hash)
+
+              walk(t, %w[to tree template inject_boot], "#{path}.publish[#{i}]")
+            end
+          end
+
+          def check_single_queue!(raw)
+            queues = Array(raw["lanes"]).select { |z| z["kind"] == "queue" }.map { |z| z["name"] }
+            return if queues.size <= 1
+
+            raise BadManifest.new("at most one lane may declare kind: queue (found: #{queues.join(", ")})")
+          end
+
+          def check_single_machine!(raw)
+            machines = Array(raw["lanes"]).select { |z| z["kind"] == "machine" }.map { |z| z["name"] }
+            return if machines.size <= 1
+
+            raise BadManifest.new("at most one lane may declare kind: machine (found: #{machines.join(", ")})")
+          end
+
+          def walk(hash, allowed, path)
+            return unless hash.is_a?(Hash)
+
+            hash.each_key do |k|
+              next if allowed.include?(k)
+
+              raise BadManifest.new("unknown key '#{k}' at '#{path}'")
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/textus/manifest/schema/semantics/migration.rb

@@ -0,0 +1,83 @@
+module Textus
+  class Manifest
+    module Schema
+      module Semantics
+        module Migration
+          def check_migration!(raw)
+            Array(raw["entries"]).each_with_index do |e, i|
+              path = "$.entries[#{i}]"
+              check_retired_publish_keys!(e, path)
+              check_retired_render_keys!(e, path)
+            end
+            check_rules_retired_keys!(raw["rules"])
+          end
+
+          def check_retired_publish_keys!(entry, path)
+            return unless entry.is_a?(Hash)
+
+            if entry.key?("publish_each")
+              raise BadManifest.new(
+                "publish_each was removed in 0.42.0 (ADR 0051) at '#{path}' — " \
+                "mirror the subtree with `publish: { tree: \"...\" }`.",
+              )
+            end
+            if entry.key?("publish_to")
+              raise BadManifest.new(
+                "publish_to was replaced by the publish: block in 0.43.0 (ADR 0052) at '#{path}' — " \
+                "use `publish: { to: [...] }`.",
+              )
+            end
+            if entry.key?("publish_tree")
+              raise BadManifest.new(
+                "publish_tree was replaced by the publish: block in 0.43.0 (ADR 0052) at '#{path}' — " \
+                "use `publish: { tree: \"...\" }`.",
+              )
+            end
+            return unless entry.key?("index_filename")
+
+            raise BadManifest.new(
+              "index_filename was removed in 0.43.0 (ADR 0053) at '#{path}'.",
+            )
+          end
+
+          def check_retired_render_keys!(entry, path)
+            return unless entry.is_a?(Hash)
+
+            if entry.key?("template")
+              raise BadManifest.new(
+                "entry-level `template:` was removed at '#{path}' (ADR 0094): rendering is a " \
+                "publish concern — `publish: [{ to:, template: }]`.",
+              )
+            end
+            if entry.key?("inject_boot")
+              raise BadManifest.new(
+                "entry-level `inject_boot:` was removed at '#{path}' (ADR 0094).",
+              )
+            end
+            return unless entry.key?("provenance")
+
+            raise BadManifest.new("entry-level `provenance:` was removed at '#{path}' (ADR 0094).")
+          end
+
+          def check_rules_retired_keys!(rules)
+            Array(rules).each_with_index do |r, i|
+              path = "$.rules[#{i}]"
+              { "lifecycle" => "age GC moved to `retention:` rule", "materialize" => "removed (ADR 0093)" }
+                .each do |old, hint|
+                  next unless r.is_a?(Hash) && r.key?(old)
+
+                  raise BadManifest.new("`#{old}:` was removed at '#{path}' (ADR 0093) — #{hint}.")
+                end
+              next unless r.is_a?(Hash) && r.key?("upkeep")
+
+              raise BadManifest.new(
+                "rule key `upkeep:` was removed (ADR 0093): move age-GC to `retention:` " \
+                "and production to the entry's `source:`",
+              )
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/textus/manifest/schema/semantics.rb

@@ -1,230 +1,25 @@
 # frozen_string_literal: true
 
+require_relative "semantics/invariants"
+require_relative "semantics/migration"
+require_relative "semantics/cross_field"
+
 module Textus
   class Manifest
     module Schema
       # Cross-field rules and ADR migration hints. Called by Validator.validate!
       # AFTER the structural dry-schema Contract passes. Operates on the raw hash.
       module Semantics
+        extend Invariants
+        extend Migration
+        extend CrossField
+
         module_function
 
         def check!(raw)
-          check_roles!(raw["roles"])
-          check_lanes!(raw["lanes"])
-          check_entries!(raw["entries"])
-          check_owners!(raw["lanes"], raw["entries"])
-          check_rules!(raw["rules"])
-          check_single_queue!(raw)
-          check_single_machine!(raw)
-          check_lane_kind_consistency!(raw)
-          walk(raw["audit"], AUDIT_KEYS, "$.audit") if raw["audit"].is_a?(Hash)
-        end
-
-        def check_roles!(roles)
-          return if roles.nil?
-
-          roles.each_with_index do |r, i|
-            path = "$.roles[#{i}]"
-            name = r["name"]
-            unless Textus::Role::NAMES.include?(name)
-              raise BadManifest.new(
-                "unknown role name '#{name}' at '#{path}' (allowed: #{Textus::Role::NAMES.join(", ")})",
-              )
-            end
-            Array(r["can"]).each do |verb|
-              next if CAPABILITIES.include?(verb)
-
-              hint = %w[ingest fetch].include?(verb) ? " — the quarantine capability folded into 'converge' (ADR 0090)" : ""
-              raise BadManifest.new(
-                "unknown capability '#{verb}' for role '#{name}' at '#{path}' " \
-                "(known: #{CAPABILITIES.join(", ")})#{hint}",
-              )
-            end
-          end
-
-          author_holders = roles.count { |r| Array(r["can"]).include?("author") }
-          return if author_holders <= 1
-
-          raise BadManifest.new(
-            "manifest declares #{author_holders} roles with the author capability; at most one is allowed",
-          )
-        end
-
-        def check_lanes!(lanes)
-          Array(lanes).each_with_index do |z, i|
-            walk(z, LANE_KEYS, "$.lanes[#{i}]")
-            next unless %w[quarantine derived].include?(z["kind"])
-
-            raise BadManifest.new(
-              "lane kind '#{z["kind"]}' at '$.lanes[#{i}]' was folded into 'machine' (ADR 0091) — " \
-              "use `kind: machine`",
-            )
-          end
-        end
-
-        def check_entries!(entries)
-          Array(entries).each_with_index do |e, i|
-            path = "$.entries[#{i}]"
-            check_retired_publish_keys!(e, path)
-            check_retired_render_keys!(e, path)
-            walk(e, ENTRY_KEYS, path)
-            check_publish_block!(e, path)
-            walk(e["source"], SOURCE_KEYS, "#{path}.source") if e.is_a?(Hash) && e["source"].is_a?(Hash)
-          end
-        end
-
-        def check_retired_publish_keys!(entry, path)
-          return unless entry.is_a?(Hash)
-
-          if entry.key?("publish_each")
-            raise BadManifest.new(
-              "publish_each was removed in 0.42.0 (ADR 0051) at '#{path}' — " \
-              "mirror the subtree with `publish: { tree: \"...\" }`.",
-            )
-          end
-          if entry.key?("publish_to")
-            raise BadManifest.new(
-              "publish_to was replaced by the publish: block in 0.43.0 (ADR 0052) at '#{path}' — " \
-              "use `publish: { to: [...] }`.",
-            )
-          end
-          if entry.key?("publish_tree")
-            raise BadManifest.new(
-              "publish_tree was replaced by the publish: block in 0.43.0 (ADR 0052) at '#{path}' — " \
-              "use `publish: { tree: \"...\" }`.",
-            )
-          end
-          return unless entry.key?("index_filename")
-
-          raise BadManifest.new(
-            "index_filename was removed in 0.43.0 (ADR 0053) at '#{path}'.",
-          )
-        end
-
-        def check_retired_render_keys!(entry, path)
-          return unless entry.is_a?(Hash)
-
-          if entry.key?("template")
-            raise BadManifest.new(
-              "entry-level `template:` was removed at '#{path}' (ADR 0094): rendering is a " \
-              "publish concern — `publish: [{ to:, template: }]`.",
-            )
-          end
-          if entry.key?("inject_boot")
-            raise BadManifest.new(
-              "entry-level `inject_boot:` was removed at '#{path}' (ADR 0094).",
-            )
-          end
-          return unless entry.key?("provenance")
-
-          raise BadManifest.new("entry-level `provenance:` was removed at '#{path}' (ADR 0094).")
-        end
-
-        def check_publish_block!(entry, path)
-          return unless entry.is_a?(Hash) && entry.key?("publish")
-
-          block = entry["publish"]
-          if block.is_a?(Hash)
-            raise BadManifest.new(
-              "publish: at '#{path}.publish' must be a list of targets (ADR 0094); the map form was retired.",
-            )
-          end
-          raise BadManifest.new("publish: must be a list of targets at '#{path}.publish'") unless block.is_a?(Array)
-
-          block.each_with_index do |t, i|
-            raise BadManifest.new("publish target ##{i} must be a mapping at '#{path}.publish'") unless t.is_a?(Hash)
-
-            walk(t, %w[to tree template inject_boot], "#{path}.publish[#{i}]")
-          end
-        end
-
-        def check_owners!(lanes, entries)
-          Array(lanes).each_with_index { |z, i| check_owner!(z["owner"], "$.lanes[#{i}]") }
-          Array(entries).each_with_index { |e, i| check_owner!(e["owner"], "$.entries[#{i}]") }
-        end
-
-        def check_owner!(owner, path)
-          return if owner.nil?
-          return if valid_owner?(owner)
-
-          raise BadManifest.new(
-            "invalid owner '#{owner}' at '#{path}' " \
-            "(expected <archetype> or <archetype>:<subject>, archetype one of: #{Textus::Role::NAMES.join(", ")})",
-          )
-        end
-
-        def valid_owner?(token)
-          return false unless token.is_a?(String) && !token.empty?
-
-          archetype, subject = token.split(":", 2)
-          return false unless Textus::Role::NAMES.include?(archetype)
-          return true if subject.nil?
-
-          OWNER_SUBJECT_PATTERN.match?(subject)
-        end
-
-        def check_rules!(rules)
-          Array(rules).each_with_index do |r, i|
-            path = "$.rules[#{i}]"
-            # Check retired keys BEFORE the generic walk so specific hints fire first.
-            { "lifecycle" => "age GC moved to `retention:` rule", "materialize" => "removed (ADR 0093)" }
-              .each do |old, hint|
-                next unless r.is_a?(Hash) && r.key?(old)
-
-                raise BadManifest.new("`#{old}:` was removed at '#{path}' (ADR 0093) — #{hint}.")
-              end
-            if r.is_a?(Hash) && r.key?("upkeep")
-              raise BadManifest.new(
-                "rule key `upkeep:` was removed (ADR 0093): move age-GC to `retention:` " \
-                "and production to the entry's `source:`",
-              )
-            end
-            walk(r, RULE_KEYS, path)
-            FIELD_REGISTRY.each_value do |meta|
-              next unless meta[:sub_keys]
-
-              value = r.is_a?(Hash) ? r[meta[:yaml_key]] : nil
-              walk(value, meta[:sub_keys], "#{path}.#{meta[:yaml_key]}") if value.is_a?(Hash)
-            end
-          end
-        end
-
-        def check_single_queue!(raw)
-          queues = Array(raw["lanes"]).select { |z| z["kind"] == "queue" }.map { |z| z["name"] }
-          return if queues.size <= 1
-
-          raise BadManifest.new("at most one lane may declare kind: queue (found: #{queues.join(", ")})")
-        end
-
-        def check_single_machine!(raw)
-          machines = Array(raw["lanes"]).select { |z| z["kind"] == "machine" }.map { |z| z["name"] }
-          return if machines.size <= 1
-
-          raise BadManifest.new("at most one lane may declare kind: machine (found: #{machines.join(", ")})")
-        end
-
-        def check_lane_kind_consistency!(raw)
-          held = Capabilities.resolve(raw["roles"]).values.flatten.uniq
-
-          Array(raw["lanes"]).each_with_index do |z, i|
-            verb = KIND_REQUIRES_VERB[z["kind"]]
-            next if verb.nil? || held.include?(verb)
-
-            raise BadManifest.new(
-              "lane '#{z["name"]}' (#{z["kind"]}) at '$.lanes[#{i}]' " \
-              "needs a role with capability '#{verb}'; none declared",
-            )
-          end
-        end
-
-        def walk(hash, allowed, path)
-          return unless hash.is_a?(Hash)
-
-          hash.each_key do |k|
-            next if allowed.include?(k)
-
-            raise BadManifest.new("unknown key '#{k}' at '#{path}'")
-          end
+          check_migration!(raw)
+          check_invariants!(raw)
+          check_cross_field!(raw)
         end
       end
     end

data/lib/textus/orchestration.rb

@@ -0,0 +1,55 @@
+module Textus
+  class Orchestration
+    ListKeysQuery = Data.define(:prefix, :lane)
+    MoveKeyCommand = Data.define(:old_key, :new_key, :if_etag, :dry_run)
+    DeleteKeyCommand = Data.define(:key, :if_etag)
+    AuditQuery = Data.define(:seq_since, :key, :lane, :role, :verb, :since, :correlation_id, :limit)
+
+    def initialize(list_keys:, move_key:, delete_key:, audit_entries:)
+      @list_keys = list_keys
+      @move_key = move_key
+      @delete_key = delete_key
+      @audit_entries = audit_entries
+    end
+
+    def list_keys(prefix:, lane:, call:)
+      query = ListKeysQuery.new(prefix: prefix, lane: lane)
+      normalize(@list_keys.call(query, call), key: "rows")
+    end
+
+    def move_key(old_key:, new_key:, call:, if_etag: nil, dry_run: false)
+      command = MoveKeyCommand.new(old_key: old_key, new_key: new_key, if_etag: if_etag, dry_run: dry_run)
+      normalize(@move_key.call(command, call), key: "move")
+    end
+
+    def delete_key(key:, call:, if_etag: nil)
+      command = DeleteKeyCommand.new(key: key, if_etag: if_etag)
+      normalize(@delete_key.call(command, call), key: "delete")
+    end
+
+    # rubocop:disable Metrics/ParameterLists
+    def audit_entries(call:, seq_since: nil, key: nil, lane: nil, role: nil, verb: nil, since: nil, correlation_id: nil, limit: nil)
+      query = AuditQuery.new(
+        seq_since: seq_since,
+        key: key,
+        lane: lane,
+        role: role,
+        verb: verb,
+        since: since,
+        correlation_id: correlation_id,
+        limit: limit,
+      )
+      normalize(@audit_entries.call(query, call), key: "rows")
+    end
+    # rubocop:enable Metrics/ParameterLists
+
+    private
+
+    def normalize(result, key:)
+      return result unless result.is_a?(Value::Result)
+      return result if result.failure?
+
+      Value::Result.success({ key => result.value })
+    end
+  end
+end