@checkstack/incident-backend 1.11.0 → 1.12.0

package/drizzle/meta/0006_snapshot.json

@@ -0,0 +1,353 @@
+{
+  "id": "ff7f73e0-3d6b-47a4-b759-000739af4ee6",
+  "prevId": "ad7ffe14-5ac3-4028-895f-efa6c8026073",
+  "version": "7",
+  "dialect": "postgresql",
+  "tables": {
+    "public.incident_links": {
+      "name": "incident_links",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "incident_id": {
+          "name": "incident_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "label": {
+          "name": "label",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "url": {
+          "name": "url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "visibility": {
+          "name": "visibility",
+          "type": "incident_content_visibility",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'public'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "incident_links_incident_url_unique": {
+          "name": "incident_links_incident_url_unique",
+          "columns": [
+            {
+              "expression": "incident_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "url",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "incident_links_incident_id_incidents_id_fk": {
+          "name": "incident_links_incident_id_incidents_id_fk",
+          "tableFrom": "incident_links",
+          "tableTo": "incidents",
+          "columnsFrom": [
+            "incident_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.incident_systems": {
+      "name": "incident_systems",
+      "schema": "",
+      "columns": {
+        "incident_id": {
+          "name": "incident_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "system_id": {
+          "name": "system_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "incident_systems_incident_id_incidents_id_fk": {
+          "name": "incident_systems_incident_id_incidents_id_fk",
+          "tableFrom": "incident_systems",
+          "tableTo": "incidents",
+          "columnsFrom": [
+            "incident_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "incident_systems_incident_id_system_id_pk": {
+          "name": "incident_systems_incident_id_system_id_pk",
+          "columns": [
+            "incident_id",
+            "system_id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.incident_updates": {
+      "name": "incident_updates",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "incident_id": {
+          "name": "incident_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "message": {
+          "name": "message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status_change": {
+          "name": "status_change",
+          "type": "incident_status",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "visibility": {
+          "name": "visibility",
+          "type": "incident_content_visibility",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'public'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "edited_at": {
+          "name": "edited_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "edit_history": {
+          "name": "edit_history",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "created_by": {
+          "name": "created_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "incident_updates_incident_id_incidents_id_fk": {
+          "name": "incident_updates_incident_id_incidents_id_fk",
+          "tableFrom": "incident_updates",
+          "tableTo": "incidents",
+          "columnsFrom": [
+            "incident_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.incidents": {
+      "name": "incidents",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "incident_status",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'investigating'"
+        },
+        "severity": {
+          "name": "severity",
+          "type": "incident_severity",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'major'"
+        },
+        "suppress_notifications": {
+          "name": "suppress_notifications",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "health_override": {
+          "name": "health_override",
+          "type": "incident_health_override",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    }
+  },
+  "enums": {
+    "public.incident_health_override": {
+      "name": "incident_health_override",
+      "schema": "public",
+      "values": [
+        "degraded",
+        "unhealthy"
+      ]
+    },
+    "public.incident_severity": {
+      "name": "incident_severity",
+      "schema": "public",
+      "values": [
+        "minor",
+        "major",
+        "critical"
+      ]
+    },
+    "public.incident_status": {
+      "name": "incident_status",
+      "schema": "public",
+      "values": [
+        "investigating",
+        "identified",
+        "fixing",
+        "monitoring",
+        "resolved"
+      ]
+    },
+    "public.incident_content_visibility": {
+      "name": "incident_content_visibility",
+      "schema": "public",
+      "values": [
+        "public",
+        "logged_in",
+        "internal"
+      ]
+    }
+  },
+  "schemas": {},
+  "sequences": {},
+  "roles": {},
+  "policies": {},
+  "views": {},
+  "_meta": {
+    "columns": {},
+    "schemas": {},
+    "tables": {}
+  }
+}

package/drizzle/meta/_journal.json

@@ -36,6 +36,20 @@
       "when": 1783287429703,
       "tag": "0004_flaky_malcolm_colcord",
       "breakpoints": true
+    },
+    {
+      "idx": 5,
+      "version": "7",
+      "when": 1783498751737,
+      "tag": "0005_real_leper_queen",
+      "breakpoints": true
+    },
+    {
+      "idx": 6,
+      "version": "7",
+      "when": 1783535507970,
+      "tag": "0006_last_princess_powerful",
+      "breakpoints": true
     }
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/incident-backend",
-  "version": "1.11.0",
+  "version": "1.12.0",
   "license": "Elastic-2.0",
   "type": "module",
   "main": "src/index.ts",
@@ -14,23 +14,23 @@
     "lint:code": "eslint . --max-warnings 0"
   },
   "dependencies": {
-    "@checkstack/ai-backend": "0.10.9",
+    "@checkstack/ai-backend": "0.10.10",
     "@checkstack/ai-common": "0.6.6",
-    "@checkstack/backend-api": "0.31.0",
+    "@checkstack/backend-api": "0.31.1",
     "@checkstack/cache-api": "0.3.19",
     "@checkstack/cache-utils": "0.2.24",
-    "@checkstack/incident-common": "1.9.0",
-    "@checkstack/catalog-common": "2.6.3",
-    "@checkstack/catalog-backend": "1.6.9",
-    "@checkstack/notification-common": "1.5.3",
+    "@checkstack/incident-common": "1.10.0",
+    "@checkstack/catalog-common": "2.7.0",
+    "@checkstack/catalog-backend": "1.7.0",
+    "@checkstack/notification-common": "1.6.0",
     "@checkstack/auth-common": "0.13.0",
-    "@checkstack/command-backend": "0.2.21",
+    "@checkstack/command-backend": "0.2.22",
     "@checkstack/signal-common": "0.2.17",
-    "@checkstack/status-page-backend": "0.4.8",
-    "@checkstack/status-page-common": "0.5.3",
-    "@checkstack/integration-backend": "0.7.3",
+    "@checkstack/status-page-backend": "0.5.0",
+    "@checkstack/status-page-common": "0.6.0",
+    "@checkstack/integration-backend": "0.7.4",
     "@checkstack/integration-common": "0.9.8",
-    "@checkstack/automation-backend": "0.11.0",
+    "@checkstack/automation-backend": "0.11.1",
     "@checkstack/automation-common": "0.10.0",
     "@checkstack/common": "0.22.0",
     "drizzle-orm": "^0.45.0",
@@ -41,7 +41,7 @@
   "devDependencies": {
     "@checkstack/drizzle-helper": "0.0.6",
     "@checkstack/scripts": "0.7.3",
-    "@checkstack/test-utils-backend": "0.1.55",
+    "@checkstack/test-utils-backend": "0.1.56",
     "@checkstack/tsconfig": "0.0.7",
     "@types/bun": "^1.0.0",
     "@types/pg": "^8.20.0",

package/src/ai/incident-add-link.test.ts

@@ -50,6 +50,7 @@ describe("incident.addLink tool", () => {
       incidentId: input.incidentId,
       label: input.label ?? null,
       url: input.url,
+      visibility: "public" as const,
       createdAt: new Date(),
     };
     const addLink = mock(() => Promise.resolve(created));

package/src/ai/incident-add-update.test.ts

@@ -45,7 +45,12 @@ describe("incident.addUpdate tool", () => {
   });
 
   test("execute (apply) posts via addUpdate", async () => {
-    const created = { id: "upd1", ...input, createdAt: new Date() };
+    const created = {
+      id: "upd1",
+      ...input,
+      visibility: "public" as const,
+      createdAt: new Date(),
+    };
     const addUpdate = mock(() => Promise.resolve(created));
     const rpcClient = fakeRpcClient({ addUpdate });
     const tool = createIncidentAddUpdateTool();

package/src/ai/incident-delete-update.test.ts

@@ -0,0 +1,59 @@
+import { describe, expect, test, mock } from "bun:test";
+import type { AuthUser, RpcClient } from "@checkstack/backend-api";
+import { createIncidentDeleteUpdateTool } from "./incident-delete-update";
+
+const principal: AuthUser = {
+  type: "user",
+  id: "u1",
+  accessRules: ["incident.incident.manage"],
+};
+
+function fakeRpcClient({
+  deleteUpdate,
+}: {
+  deleteUpdate: ReturnType<typeof mock>;
+}): RpcClient {
+  return {
+    forPlugin: () => ({ deleteUpdate }),
+  } as unknown as RpcClient;
+}
+
+describe("incident.deleteUpdate tool", () => {
+  test("declares destructive effect + the manage rule", () => {
+    const tool = createIncidentDeleteUpdateTool();
+    expect(tool.name).toBe("incident.deleteUpdate");
+    expect(tool.effect).toBe("destructive");
+    expect(tool.requiredAccessRules).toEqual(["incident.incident.manage"]);
+    expect(typeof tool.dryRun).toBe("function");
+  });
+
+  test("dryRun returns a payload and NEVER deletes the update", async () => {
+    const deleteUpdate = mock(() => Promise.resolve({ success: true }));
+    const rpcClient = fakeRpcClient({ deleteUpdate });
+    const tool = createIncidentDeleteUpdateTool();
+    const preview = await tool.dryRun!({
+      input: { id: "upd1", incidentId: "inc1" },
+      principal,
+      rpcClient,
+    });
+    expect(deleteUpdate).not.toHaveBeenCalled();
+    expect(preview.summary).toContain("permanent");
+    expect(preview.payload).toEqual({ id: "upd1", incidentId: "inc1" });
+  });
+
+  test("execute (apply) deletes via deleteUpdate with {id, incidentId}", async () => {
+    const deleteUpdate = mock(() => Promise.resolve({ success: true }));
+    const rpcClient = fakeRpcClient({ deleteUpdate });
+    const tool = createIncidentDeleteUpdateTool();
+    const result = await tool.execute({
+      input: { id: "upd1", incidentId: "inc1" },
+      principal,
+      rpcClient,
+    });
+    expect(deleteUpdate).toHaveBeenCalledWith({
+      id: "upd1",
+      incidentId: "inc1",
+    });
+    expect(result).toEqual({ id: "upd1", removed: true });
+  });
+});

package/src/ai/incident-delete-update.ts

@@ -0,0 +1,73 @@
+import { z } from "zod";
+import { qualifyAccessRuleId } from "@checkstack/common";
+import type { RpcClient, AuthUser } from "@checkstack/backend-api";
+import {
+  IncidentApi,
+  incidentAccess,
+  pluginMetadata,
+} from "@checkstack/incident-common";
+import type { AiProposalPreview } from "@checkstack/ai-common";
+import type { RegisteredAiTool } from "@checkstack/ai-backend";
+
+/** Input for `incident.deleteUpdate`: the update id + its owning incident. */
+export const IncidentDeleteUpdateInputSchema = z.object({
+  id: z.string(),
+  incidentId: z.string(),
+});
+export type IncidentDeleteUpdateInput = z.infer<
+  typeof IncidentDeleteUpdateInputSchema
+>;
+
+/** Output returned once a human applies the update removal. */
+export interface IncidentDeleteUpdateApplyResult {
+  id: string;
+  removed: true;
+}
+
+/**
+ * `incident.deleteUpdate` - delete a published status update by id.
+ *
+ * `effect: "destructive"` - deleting an update is irreversible, so it ALWAYS
+ * routes through the propose/apply confirm card in BOTH permission modes (it can
+ * never auto-apply). `dryRun` returns the captured payload for human review
+ * WITHOUT mutating; `execute` (reached only via `apply`) deletes the update. The
+ * underlying RPC uses the USER-SCOPED client passed at call time, so
+ * handler-side authorization is enforced exactly as a direct UI/RPC call.
+ */
+export function createIncidentDeleteUpdateTool(): RegisteredAiTool<
+  IncidentDeleteUpdateInput,
+  IncidentDeleteUpdateApplyResult
+> {
+  const dryRun = async ({
+    input,
+  }: {
+    input: IncidentDeleteUpdateInput;
+    principal: AuthUser;
+    rpcClient: RpcClient;
+  }): Promise<AiProposalPreview<IncidentDeleteUpdateInput>> => {
+    return {
+      summary: `Delete update ${input.id} from incident ${input.incidentId}. This is permanent.`,
+      payload: { id: input.id, incidentId: input.incidentId },
+    };
+  };
+
+  return {
+    name: "incident.deleteUpdate",
+    description:
+      "Delete a published status update from an incident by update id and its owning incidentId. DESTRUCTIVE and irreversible. Never deletes directly; a person must approve the confirmation. Find the update id and incidentId by reading the incident's details first.",
+    effect: "destructive",
+    input: IncidentDeleteUpdateInputSchema,
+    requiredAccessRules: [
+      qualifyAccessRuleId(pluginMetadata, incidentAccess.incident.manage),
+    ],
+    dryRun,
+    async execute({ input, rpcClient }) {
+      const incidentClient = rpcClient.forPlugin(IncidentApi);
+      await incidentClient.deleteUpdate({
+        id: input.id,
+        incidentId: input.incidentId,
+      });
+      return { id: input.id, removed: true };
+    },
+  };
+}

package/src/ai/register-ai-tools.ts

@@ -6,6 +6,7 @@ import { createIncidentAddUpdateTool } from "./incident-add-update";
 import { createIncidentResolveTool } from "./incident-resolve";
 import { createIncidentAddLinkTool } from "./incident-add-link";
 import { createIncidentRemoveLinkTool } from "./incident-remove-link";
+import { createIncidentDeleteUpdateTool } from "./incident-delete-update";
 
 /**
  * The incident plugin's AI tools, registered into the AI registry via
@@ -29,5 +30,6 @@ export function buildIncidentAiTools(): RegisteredAiTool[] {
     createIncidentResolveTool(),
     createIncidentAddLinkTool(),
     createIncidentRemoveLinkTool(),
+    createIncidentDeleteUpdateTool(),
   ];
 }

package/src/automations.test.ts

@@ -324,6 +324,76 @@ describe("incident automation actions", () => {
       expect(service.resolveIncident).toHaveBeenCalledWith("INC-1", "Fixed");
     });
 
+    // SLO-1 regression: an automation-driven resolve mutates the incident WITHOUT
+    // going through the RPC router, so it must emit `incident.lifecycle.changed`
+    // itself — otherwise an override-bearing incident resolved by an automation
+    // never triggers SLO downtime reconciliation and its incident-sourced event
+    // leaks open.
+    it("emits incident.lifecycle.changed on an automation resolve (SLO downtime reconcile)", async () => {
+      const resolved = {
+        id: "INC-1",
+        status: "resolved",
+        severity: "critical",
+        systemIds: ["sys-1", "sys-2"],
+      };
+      const service = makeServiceStub({
+        resolveIncident: mock(
+          async () => resolved,
+        ) as unknown as IncidentService["resolveIncident"],
+      });
+      const emit = mock(async () => {});
+      const eventBus = { emit } as unknown as Parameters<
+        typeof createIncidentActions
+      >[0]["eventBus"];
+      const resolveAction = createIncidentActions({ service, eventBus })[1];
+
+      await resolveAction.execute({
+        ...actionContext,
+        config: { incidentId: "INC-1", message: "Fixed" } as never,
+      });
+
+      expect(emit).toHaveBeenCalledTimes(1);
+      const emitArgs = emit.mock.calls[0] as unknown[] | undefined;
+      const hook = emitArgs?.[0] as { id?: string } | undefined;
+      const payload = emitArgs?.[1] as
+        | { systemIds?: string[]; action?: string }
+        | undefined;
+      expect(hook?.id).toBe("incident.lifecycle.changed");
+      expect(payload?.action).toBe("resolved");
+      expect(payload?.systemIds).toEqual(["sys-1", "sys-2"]);
+    });
+
+    it("emits incident.lifecycle.changed on an automation update_status → resolved", async () => {
+      const update = {
+        id: "upd-3",
+        incidentId: "INC-1",
+        message: "Status changed to resolved",
+        createdAt: new Date(),
+      };
+      const service = makeServiceStub({
+        addUpdate: mock(
+          async () => update,
+        ) as unknown as IncidentService["addUpdate"],
+      });
+      const emit = mock(async () => {});
+      const eventBus = { emit } as unknown as Parameters<
+        typeof createIncidentActions
+      >[0]["eventBus"];
+      const updateStatusAction = createIncidentActions({ service, eventBus })[3];
+
+      await updateStatusAction.execute({
+        ...actionContext,
+        config: { incidentId: "INC-1", status: "resolved" } as never,
+      });
+
+      expect(emit).toHaveBeenCalledTimes(1);
+      const payload = (emit.mock.calls[0] as unknown[] | undefined)?.[1] as
+        | { systemIds?: string[]; action?: string }
+        | undefined;
+      expect(payload?.action).toBe("resolved");
+      expect(payload?.systemIds).toEqual(["sys-1"]);
+    });
+
     // 6(b) regression: an action-driven resolve must route through the reactive
     // entity (like the RPC router) so it appends an `entity_transitions` row,
     // emits `ENTITY_CHANGED` (waking `wait_until`), and fires the