@checkstack/incident-backend 1.6.7 → 1.7.0

package/CHANGELOG.md

@@ -1,5 +1,42 @@
 # @checkstack/incident-backend
 
+## 1.7.0
+
+### Minor Changes
+
+- 0b6f01b: feat(incident): contribute incident signals to the backend system.issues aggregator
+
+  The incident plugin now registers a `system.issues` contributor (sourceId
+  `incident`) from its backend `init`, so the AI assistant surfaces open incidents
+  alongside SLOs, health checks, anomalies, and dependency problems.
+
+  The contributor enforces its own `incident.read` access gate (returning an empty
+  map - never throwing - when the principal lacks access; service users carry no
+  access rules and so get no signals), then reads every OPEN (not-resolved)
+  incident for all systems from the shared, durable `incidents` +
+  `incident_systems` tables via a new global `listOpenIncidentsBySystem` service
+  method. The answer is therefore identical on every pod, and only systems with an
+  open incident appear in the result.
+
+  The row->signal mapping (source/tone/label/detail/href/accessRule/since/iconName)
+  is extracted into a new pure `deriveIncidentSignals` deriver in
+  `@checkstack/incident-common`, shared by both the backend contributor and the
+  frontend `IncidentSignalsFiller` so the two surfaces stay in lockstep. The
+  frontend filler now delegates to that deriver with unchanged behavior.
+
+### Patch Changes
+
+- Updated dependencies [dbb76a2]
+- Updated dependencies [0b6f01b]
+- Updated dependencies [0b6f01b]
+  - @checkstack/ai-backend@0.3.0
+  - @checkstack/incident-common@1.5.0
+  - @checkstack/automation-backend@0.5.8
+  - @checkstack/catalog-backend@1.4.8
+  - @checkstack/backend-api@0.21.6
+  - @checkstack/command-backend@0.2.6
+  - @checkstack/integration-backend@0.4.6
+
 ## 1.6.7
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/incident-backend",
-  "version": "1.6.7",
+  "version": "1.7.0",
   "license": "Elastic-2.0",
   "type": "module",
   "main": "src/index.ts",
@@ -14,21 +14,21 @@
     "lint:code": "eslint . --max-warnings 0"
   },
   "dependencies": {
-    "@checkstack/ai-backend": "0.2.0",
+    "@checkstack/ai-backend": "0.3.0",
     "@checkstack/ai-common": "0.1.3",
-    "@checkstack/backend-api": "0.21.5",
+    "@checkstack/backend-api": "0.21.6",
     "@checkstack/cache-api": "0.3.12",
     "@checkstack/cache-utils": "0.2.17",
-    "@checkstack/incident-common": "1.4.4",
+    "@checkstack/incident-common": "1.5.0",
     "@checkstack/catalog-common": "2.3.4",
-    "@checkstack/catalog-backend": "1.4.7",
+    "@checkstack/catalog-backend": "1.4.8",
     "@checkstack/notification-common": "1.3.3",
     "@checkstack/auth-common": "0.8.3",
-    "@checkstack/command-backend": "0.2.5",
+    "@checkstack/command-backend": "0.2.6",
     "@checkstack/signal-common": "0.2.9",
-    "@checkstack/integration-backend": "0.4.5",
+    "@checkstack/integration-backend": "0.4.6",
     "@checkstack/integration-common": "0.7.3",
-    "@checkstack/automation-backend": "0.5.7",
+    "@checkstack/automation-backend": "0.5.8",
     "@checkstack/automation-common": "0.4.3",
     "@checkstack/common": "0.15.0",
     "drizzle-orm": "^0.45.0",
@@ -39,7 +39,7 @@
   "devDependencies": {
     "@checkstack/drizzle-helper": "0.0.5",
     "@checkstack/scripts": "0.6.1",
-    "@checkstack/test-utils-backend": "0.1.39",
+    "@checkstack/test-utils-backend": "0.1.40",
     "@checkstack/tsconfig": "0.0.7",
     "@types/bun": "^1.0.0",
     "drizzle-kit": "^0.31.10",

package/src/index.ts

@@ -3,6 +3,8 @@ import type { SafeDatabase } from "@checkstack/backend-api";
 import {
   aiToolExtensionPoint,
   aiToolProjectionExtensionPoint,
+  systemSignalsExtensionPoint,
+  createSystemAccessResolver,
   deferredProjectionExecute,
 } from "@checkstack/ai-backend";
 import {
@@ -48,6 +50,7 @@ import {
   incidentTriggers,
 } from "./automations";
 import { buildIncidentAiTools } from "./ai/register-ai-tools";
+import { createIncidentSignalsContributor } from "./system-signals";
 
 // =============================================================================
 // Plugin Definition
@@ -224,6 +227,19 @@ export default createBackendPlugin({
           execute: deferredProjectionExecute,
         });
 
+        // Contribute incident problem state to the `system.issues` AI tool.
+        // Mirrors the frontend `SystemSignalsSlot` filler: returns one signal
+        // per OPEN incident for EVERY system globally (keyed by systemId),
+        // using the SAME shared deriver so frontend and backend agree. The
+        // per-source access gate + global read live in the contributor factory.
+        const signalsExt = env.getExtensionPoint(systemSignalsExtensionPoint);
+        signalsExt.contribute(
+          createIncidentSignalsContributor({
+            service,
+            resolver: createSystemAccessResolver(rpcClient),
+          }),
+        );
+
         // Register "Create Incident" command in the command palette
         registerSearchProvider({
           pluginMetadata,

package/src/service.test.ts

@@ -227,6 +227,99 @@ describe("IncidentService.getManyEntityStates (plugin-backed entity read)", () =
   });
 });
 
+describe("IncidentService.listOpenIncidentsBySystem (global signals read)", () => {
+  it("returns {} without a junction query when no open incidents exist", async () => {
+    const dbHelper = createProgrammableSelectDb([
+      // 1st query: open incidents -> none, so the junction query is skipped.
+      [],
+    ]);
+    const service = new IncidentService(
+      dbHelper.db as never,
+      makeFakeAdvisoryLock(),
+    );
+    expect(await service.listOpenIncidentsBySystem()).toEqual({});
+    expect(dbHelper.getCallCount()).toBe(1);
+  });
+
+  it("groups open incidents under each affected system, full systemIds per entry", async () => {
+    const createdAt = new Date("2026-06-01T10:00:00.000Z");
+    const updatedAt = new Date("2026-06-01T10:05:00.000Z");
+    const dbHelper = createProgrammableSelectDb([
+      // 1st query: open incident rows (resolved excluded by the WHERE clause).
+      [
+        {
+          id: "inc-1",
+          title: "DB down",
+          description: null,
+          status: "investigating",
+          severity: "critical",
+          suppressNotifications: false,
+          createdAt,
+          updatedAt,
+        },
+        {
+          id: "inc-2",
+          title: "Slow",
+          description: "elevated latency",
+          status: "monitoring",
+          severity: "major",
+          suppressNotifications: false,
+          createdAt,
+          updatedAt,
+        },
+      ],
+      // 2nd query: junction rows. inc-1 spans two systems; inc-2 one.
+      [
+        { incidentId: "inc-1", systemId: "sys-a" },
+        { incidentId: "inc-1", systemId: "sys-b" },
+        { incidentId: "inc-2", systemId: "sys-a" },
+      ],
+    ]);
+    const service = new IncidentService(
+      dbHelper.db as never,
+      makeFakeAdvisoryLock(),
+    );
+
+    const out = await service.listOpenIncidentsBySystem();
+
+    expect(Object.keys(out).sort()).toEqual(["sys-a", "sys-b"]);
+    // sys-a sees both incidents; sys-b only inc-1.
+    expect(out["sys-a"].map((i) => i.id)).toEqual(["inc-1", "inc-2"]);
+    expect(out["sys-b"].map((i) => i.id)).toEqual(["inc-1"]);
+    // Multi-system incident carries its FULL systemIds under each key.
+    expect(out["sys-a"][0].systemIds).toEqual(["sys-a", "sys-b"]);
+    expect(out["sys-b"][0].systemIds).toEqual(["sys-a", "sys-b"]);
+    // null description is normalized to undefined (IncidentWithSystems shape).
+    expect(out["sys-a"][0].description).toBeUndefined();
+    expect(out["sys-a"][1].description).toBe("elevated latency");
+    expect(dbHelper.getCallCount()).toBe(2);
+  });
+
+  it("yields no entry for an open incident with no system associations", async () => {
+    const dbHelper = createProgrammableSelectDb([
+      [
+        {
+          id: "inc-orphan",
+          title: "Orphan",
+          description: null,
+          status: "identified",
+          severity: "minor",
+          suppressNotifications: false,
+          createdAt: new Date("2026-06-01T10:00:00.000Z"),
+          updatedAt: new Date("2026-06-01T10:00:00.000Z"),
+        },
+      ],
+      [], // no junction rows
+    ]);
+    const service = new IncidentService(
+      dbHelper.db as never,
+      makeFakeAdvisoryLock(),
+    );
+    expect(await service.listOpenIncidentsBySystem()).toEqual({});
+    expect(dbHelper.getCallCount()).toBe(2);
+  });
+});
+
 /**
  * Table-backed fake `db` for the dedup-create path. Models just enough of
  * the Drizzle surface the service touches (select/insert by TABLE IDENTITY,

package/src/service.ts

@@ -224,6 +224,59 @@ export class IncidentService {
     return result;
   }
 
+  /**
+   * Global read of every OPEN (not-resolved) incident across ALL systems,
+   * grouped by systemId. Powers the backend `system.issues` contributor, which
+   * needs problem state for every system on every pod (not a caller-supplied
+   * systemId list). Reads the authoritative `incidents` + `incident_systems`
+   * tables, so the answer is identical on every pod (state-and-scale rule).
+   *
+   * An incident affecting multiple systems appears under each of its systemIds,
+   * each entry carrying the incident's full `systemIds` list (mirrors the bulk
+   * RPC shape `getBulkIncidentsForSystems` returns). Systems with no open
+   * incident are simply absent from the returned record.
+   */
+  async listOpenIncidentsBySystem(): Promise<
+    Record<string, IncidentWithSystems[]>
+  > {
+    const openRows = await this.db
+      .select()
+      .from(incidents)
+      .where(ne(incidents.status, "resolved"));
+    if (openRows.length === 0) return {};
+
+    const openIds = openRows.map((i) => i.id);
+    const systemRows = await this.db
+      .select({
+        incidentId: incidentSystems.incidentId,
+        systemId: incidentSystems.systemId,
+      })
+      .from(incidentSystems)
+      .where(inArray(incidentSystems.incidentId, openIds));
+
+    const systemsByIncident = new Map<string, string[]>();
+    for (const r of systemRows) {
+      const list = systemsByIncident.get(r.incidentId);
+      if (list) list.push(r.systemId);
+      else systemsByIncident.set(r.incidentId, [r.systemId]);
+    }
+
+    const result: Record<string, IncidentWithSystems[]> = {};
+    for (const i of openRows) {
+      const systemIds = systemsByIncident.get(i.id) ?? [];
+      const incident: IncidentWithSystems = {
+        ...i,
+        description: i.description ?? undefined,
+        systemIds,
+      };
+      for (const systemId of systemIds) {
+        (result[systemId] ??= []).push(incident);
+      }
+    }
+
+    return result;
+  }
+
   /**
    * Create a new incident.
    *

package/src/system-signals.test.ts

@@ -0,0 +1,100 @@
+import { describe, test, expect, mock } from "bun:test";
+import type { AuthUser } from "@checkstack/backend-api";
+import type { SystemAccessResolver } from "@checkstack/ai-backend";
+import type { IncidentWithSystems } from "@checkstack/incident-common";
+import { createIncidentSignalsContributor } from "./system-signals";
+import type { IncidentService } from "./service";
+
+const openIncident: IncidentWithSystems = {
+  id: "inc-1",
+  title: "Database down",
+  description: undefined,
+  status: "investigating",
+  severity: "critical",
+  suppressNotifications: false,
+  createdAt: new Date("2026-06-01T10:00:00.000Z"),
+  updatedAt: new Date("2026-06-01T10:00:00.000Z"),
+  systemIds: ["sys-1"],
+};
+
+function makeService(
+  bySystem: Record<string, IncidentWithSystems[]>,
+): Pick<IncidentService, "listOpenIncidentsBySystem"> {
+  return {
+    listOpenIncidentsBySystem: mock(async () => bySystem),
+  };
+}
+
+// The per-source gate (global rule, team grants, service trust) is owned and
+// tested by `createGatedSystemSignalsContributor`; here we use simple resolver
+// stubs and focus on this plugin's wiring (source id, service, shared deriver).
+const allowAll: SystemAccessResolver = {
+  accessibleSystemIds: async ({ systemIds }) => systemIds,
+};
+const denyAll: SystemAccessResolver = { accessibleSystemIds: async () => [] };
+
+const userWithRead: AuthUser = {
+  type: "user",
+  id: "u1",
+  accessRules: ["incident.incident.read"],
+};
+const userWithoutRead: AuthUser = { type: "user", id: "u2", accessRules: [] };
+
+describe("incident system-signals contributor", () => {
+  test("uses the shared incident source id", () => {
+    const contributor = createIncidentSignalsContributor({
+      service: makeService({}),
+      resolver: allowAll,
+    });
+    expect(contributor.sourceId).toBe("incident");
+  });
+
+  test("wires the service + shared deriver for an authorized principal", async () => {
+    const service = makeService({ "sys-1": [openIncident] });
+    const contributor = createIncidentSignalsContributor({
+      service,
+      resolver: allowAll,
+    });
+
+    const result = await contributor.read({ principal: userWithRead });
+
+    expect(result.accessible).toBe(true);
+    expect(Object.keys(result.signals)).toEqual(["sys-1"]);
+    expect(result.signals["sys-1"][0]).toMatchObject({
+      source: "incident",
+      tone: "error",
+      label: "Critical incident",
+      detail: "Database down",
+      since: "2026-06-01T10:00:00.000Z",
+    });
+  });
+
+  test("filters to team-granted systems for a non-global user", async () => {
+    const service = makeService({
+      "sys-1": [openIncident],
+      "sys-2": [{ ...openIncident, id: "inc-2", systemIds: ["sys-2"] }],
+    });
+    const recorded: string[] = [];
+    const resolver: SystemAccessResolver = {
+      accessibleSystemIds: async ({ resourceType, systemIds }) => {
+        recorded.push(resourceType);
+        return systemIds.filter((id) => id === "sys-2");
+      },
+    };
+    const contributor = createIncidentSignalsContributor({ service, resolver });
+
+    const result = await contributor.read({ principal: userWithoutRead });
+
+    expect(Object.keys(result.signals)).toEqual(["sys-2"]);
+    expect(recorded).toEqual(["incident.incident"]);
+  });
+
+  test("a non-global user with no team grants gets nothing", async () => {
+    const contributor = createIncidentSignalsContributor({
+      service: makeService({ "sys-1": [openIncident] }),
+      resolver: denyAll,
+    });
+    const result = await contributor.read({ principal: userWithoutRead });
+    expect(result).toEqual({ accessible: false, signals: {} });
+  });
+});

package/src/system-signals.ts

@@ -0,0 +1,44 @@
+import {
+  createGatedSystemSignalsContributor,
+  type SystemAccessResolver,
+  type SystemSignalsContributor,
+} from "@checkstack/ai-backend";
+import {
+  incidentAccess,
+  INCIDENT_SIGNAL_SOURCE_ID,
+  deriveIncidentSignals,
+} from "@checkstack/incident-common";
+import type { IncidentService } from "./service";
+
+/** The slice of `IncidentService` the contributor needs - eases testing. */
+type SignalsService = Pick<IncidentService, "listOpenIncidentsBySystem">;
+
+/**
+ * Build the incident `SystemSignalsContributor` for the backend `system.issues`
+ * AI tool. Reads OPEN incidents for every system globally and runs the SAME
+ * shared `deriveIncidentSignals` deriver the dashboard filler uses, so frontend
+ * and backend signals match. The per-source access gate (global rule plus
+ * per-system team grants) is applied by
+ * {@link createGatedSystemSignalsContributor}; the global read resolves from the
+ * authoritative incident tables, so the answer is identical on every pod.
+ */
+export function createIncidentSignalsContributor({
+  service,
+  resolver,
+}: {
+  service: SignalsService;
+  resolver: SystemAccessResolver;
+}): SystemSignalsContributor {
+  return createGatedSystemSignalsContributor({
+    sourceId: INCIDENT_SIGNAL_SOURCE_ID,
+    accessRule: incidentAccess.incident.read,
+    resolver,
+    readSignals: async () => {
+      const incidentsBySystem = await service.listOpenIncidentsBySystem();
+      return deriveIncidentSignals({
+        incidentsBySystem,
+        systemIds: Object.keys(incidentsBySystem),
+      });
+    },
+  });
+}