@crowdsource.you/core 1.2.0

package/dist/esm/outbox/postgres/reportColumns.js

@@ -0,0 +1,191 @@
+import { getTableName, sql } from 'drizzle-orm';
+import { boolean, check, index, integer, text, varchar, } from 'drizzle-orm/pg-core';
+import { createdAt, generatedId, inList, textArrayLiteral, timestamptz, updatedAt, } from '@oxy.so/db';
+/**
+ * The moderation half of an application's report table.
+ *
+ * The Postgres twin of `moderationReportSchemaFields`, and the split is the same
+ * one: the application owns the table — its name, its own extra columns, whatever
+ * verdict field it already had — and this package owns the SHAPE of the columns
+ * it queries, plus the indexes those queries depend on.
+ *
+ * ```ts
+ * const REPORT_MODERATION = {
+ *   reportedTypes: ['listing', 'review'],
+ *   categories: ['spam', 'harassment'],
+ * } as const;
+ *
+ * export const reports = pgTable(
+ *   'reports',
+ *   {
+ *     ...moderationReportColumns(REPORT_MODERATION),
+ *     // …the application's own columns
+ *   },
+ *   moderationReportTableExtras(REPORT_MODERATION),
+ * );
+ * ```
+ *
+ * **`moderationReportTableExtras` takes the OPTIONS and returns the callback**,
+ * rather than taking the built columns directly. It has to: the CHECK on
+ * `reported_type` and the containment CHECK on `categories` are built from the
+ * same tuples that constrain the columns, and drizzle does not carry those
+ * tuples onto the built column (`enumValues` is `undefined` there — measured).
+ * Passing one options object to both calls is what keeps the column and its
+ * constraint from drifting apart.
+ */
+/**
+ * The local statuses, as the CHECK renders them.
+ *
+ * Spelled out beside the DDL so it cannot acquire an ORM dependency. `satisfies`
+ * refuses a value outside the union; `postgresSchema.test.ts` asserts this tuple
+ * and `MODERATION_LOCAL_STATUSES` still agree, which is what catches an OMISSION
+ * — the direction a type cannot see.
+ */
+const LOCAL_STATUSES = [
+    'received',
+    'queued',
+    'submitted',
+    'delivery_failed',
+    'closed',
+];
+/** Mongo's `detailsMaxLength ?? 2_000`, for the same reason: it bounds free text. */
+const DEFAULT_DETAILS_MAX_LENGTH = 2000;
+/**
+ * The columns this package reads and writes, to spread into the application's
+ * own `pgTable`.
+ *
+ * Every SQL name is written out. Drizzle would derive one from the property, and
+ * its derivation mangles digit- and capital-adjacent names — `crowdSourceReportId`
+ * becomes `crowd_source_report_id`, which is a working column with a name nobody
+ * chose and which no gate would notice.
+ */
+export function moderationReportColumns(options = {}) {
+    return {
+        /**
+         * `text`, not `uuid`, and generated in the application.
+         *
+         * `generatedId()` holds a uuid v7 for a row created here and a 24-character
+         * ObjectId hex for every row that existed before a Mongo cutover, so one id
+         * space serves both. The consequence that matters downstream: a malformed id
+         * matches no rows instead of raising `22P02`, which is exactly the Mongo
+         * behaviour the delivery path already handles.
+         */
+        id: generatedId(),
+        reportedType: text('reported_type').notNull(),
+        reportedId: text('reported_id').notNull(),
+        /**
+         * The reporting Oxy user id.
+         *
+         * The Oxy subject IS the identity binding proof, so there is no separate
+         * binding step for an application to implement — but it does mean this
+         * column must hold an Oxy user id and not an application-local one.
+         */
+        reporter: text('reporter').notNull(),
+        /**
+         * `text[]`, written and read WHOLE.
+         *
+         * This package sets it at intake and reads it at delivery; it never queries
+         * by element, so an array column is the port rather than a join table. A
+         * containment CHECK constrains the values when the application declares them.
+         */
+        categories: text('categories').array().notNull(),
+        details: varchar('details', {
+            length: options.detailsMaxLength ?? DEFAULT_DETAILS_MAX_LENGTH,
+        }),
+        localStatus: text('local_status').notNull().default('received'),
+        /**
+         * Why a report is not going anywhere, in words an operator can read.
+         *
+         * Stored rather than inferred from a missing outbox row. A missing row is
+         * also what a lost write looks like, and the two need to be distinguishable
+         * months later without re-deriving which types had providers at the time.
+         */
+        localStatusReason: varchar('local_status_reason', { length: 300 }),
+        crowdSourceReportId: text('crowdsource_report_id'),
+        crowdSourceCaseId: text('crowdsource_case_id'),
+        crowdSourceMerged: boolean('crowdsource_merged'),
+        /** SHA-256 of the exact representation that was reviewed. */
+        contentSnapshotHash: text('content_snapshot_hash'),
+        submittedAt: timestamptz(),
+        lastDeliveryError: varchar('last_delivery_error', { length: 2000 }),
+        decisionId: text('decision_id'),
+        /**
+         * The revision guard.
+         *
+         * Compared in the update's WHERE clause, so it is the database that refuses a
+         * stale write rather than a read-then-write in the application process.
+         */
+        decisionRevision: integer('decision_revision'),
+        decisionOutcome: text('decision_outcome'),
+        decisionStatus: text('decision_status'),
+        decidedAt: timestamptz(),
+        enforcedAction: text('enforced_action'),
+        enforcedAt: timestamptz(),
+        createdAt: createdAt(),
+        updatedAt: updatedAt(),
+    };
+}
+/** Postgres truncates an identifier at 63 bytes, silently, and then names collide. */
+const MAX_IDENTIFIER_BYTES = 63;
+function identifier(parts) {
+    const name = parts.join('_');
+    if (Buffer.byteLength(name, 'utf8') > MAX_IDENTIFIER_BYTES) {
+        throw new Error(`The moderation report index name '${name}' is ${Buffer.byteLength(name, 'utf8')} bytes; ` +
+            `Postgres truncates identifiers at ${MAX_IDENTIFIER_BYTES} and two names that differ ` +
+            'only past the cut then collide. Give the report table a shorter name.');
+    }
+    return name;
+}
+/**
+ * The CHECKs and indexes the report table needs, as `pgTable`'s third argument.
+ *
+ * The three indexes are the same three `applyModerationReportIndexes` creates,
+ * and not optional: reconciliation scans `(local_status, created_at)` oldest-first
+ * on every sweep, and the decision worker looks a case up by
+ * `crowdsource_case_id` on every inbound decision. Without them both become
+ * sequential scans that grow with the table.
+ *
+ * The compound uniqueness of "one report per reporter per object" is the
+ * APPLICATION's to declare — some applications allow a reporter to file twice
+ * under different categories — so it is not created here. Intake's duplicate
+ * check reads `(reporter, reported_id, reported_type)`, so that one is indexed
+ * for it either way.
+ *
+ * Index names are derived from the adopter's own table name and length-checked,
+ * because two names that differ only past the 63rd byte are the same name to
+ * Postgres.
+ */
+export function moderationReportTableExtras(options = {}) {
+    return (columns) => {
+        /**
+         * The adopter's table name, read off one of its own columns — `pgTable`
+         * calls this with the BUILT columns, each of which carries its table. That
+         * is what lets the index names belong to the adopter's table without being
+         * passed in a second time and drifting.
+         */
+        const prefix = getTableName(columns.localStatus.table);
+        return [
+            check(identifier([prefix, 'local_status_check']), sql `${columns.localStatus} in (${sql.raw(inList(LOCAL_STATUSES))})`),
+            ...(options.reportedTypes === undefined
+                ? []
+                : [
+                    check(identifier([prefix, 'reported_type_check']), sql `${columns.reportedType} in (${sql.raw(inList(options.reportedTypes))})`),
+                ]),
+            ...(options.categories === undefined
+                ? []
+                : [
+                    /**
+                     * Containment, not equality: a report carries a SUBSET of the
+                     * declared categories, and `<@` is trivially satisfied by an empty
+                     * array — which the application's own validation refuses before this
+                     * is ever reached.
+                     */
+                    check(identifier([prefix, 'categories_check']), sql `${columns.categories} <@ ${sql.raw(textArrayLiteral(options.categories))}`),
+                ]),
+            index(identifier([prefix, 'local_status_created_at_idx'])).on(columns.localStatus, columns.createdAt),
+            index(identifier([prefix, 'crowdsource_case_id_idx'])).on(columns.crowdSourceCaseId),
+            index(identifier([prefix, 'reporter_object_idx'])).on(columns.reporter, columns.reportedId, columns.reportedType),
+        ];
+    };
+}
+//# sourceMappingURL=reportColumns.js.map

package/dist/esm/outbox/postgres/reportColumns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reportColumns.js","sourceRoot":"","sources":["../../../../src/outbox/postgres/reportColumns.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EACL,OAAO,EACP,KAAK,EACL,KAAK,EACL,OAAO,EACP,IAAI,EACJ,OAAO,GAGR,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,SAAS,EACT,WAAW,EACX,MAAM,EACN,gBAAgB,EAChB,WAAW,EACX,SAAS,GACV,MAAM,YAAY,CAAC;AAGpB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH;;;;;;;GAOG;AACH,MAAM,cAAc,GAAG;IACrB,UAAU;IACV,QAAQ;IACR,WAAW;IACX,iBAAiB;IACjB,QAAQ;CAC2C,CAAC;AAEtD,qFAAqF;AACrF,MAAM,0BAA0B,GAAG,IAAK,CAAC;AAoBzC;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CAAC,UAAyC,EAAE;IACjF,OAAO;QACL;;;;;;;;WAQG;QACH,EAAE,EAAE,WAAW,EAAE;QAEjB,YAAY,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE;QAC7C,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;QACzC;;;;;;WAMG;QACH,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;QACpC;;;;;;WAMG;QACH,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE;QAChD,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE;YAC1B,MAAM,EAAE,OAAO,CAAC,gBAAgB,IAAI,0BAA0B;SAC/D,CAAC;QAEF,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC;QAC/D;;;;;;WAMG;QACH,iBAAiB,EAAE,OAAO,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QAElE,mBAAmB,EAAE,IAAI,CAAC,uBAAuB,CAAC;QAClD,iBAAiB,EAAE,IAAI,CAAC,qBAAqB,CAAC;QAC9C,iBAAiB,EAAE,OAAO,CAAC,oBAAoB,CAAC;QAChD,6DAA6D;QAC7D,mBAAmB,EAAE,IAAI,CAAC,uBAAuB,CAAC;QAClD,WAAW,EAAE,WAAW,EAAE;QAC1B,iBAAiB,EAAE,OAAO,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,IAAK,EAAE,CAAC;QAEpE,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC;QAC/B;;;;;WAKG;QACH,gBAAgB,EAAE,OAAO,CAAC,mBAAmB,CAAC;QAC9C,eAAe,EAAE,IAAI,CAAC,kBAAkB,CAAC;QACzC,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC;QACvC,SAAS,EAAE,WAAW,EAAE;QACxB,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC;QACvC,UAAU,EAAE,WAAW,EAAE;QAEzB,SAAS,EAAE,SAAS,EAAE;QACtB,SAAS,EAAE,SAAS,EAAE;KACvB,CAAC;AACJ,CAAC;AA2BD,sFAAsF;AACtF,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAEhC,SAAS,UAAU,CAAC,KAAwB;IAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,oBAAoB,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CACb,qCAAqC,IAAI,QAAQ,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU;YACxF,qCAAqC,oBAAoB,6BAA6B;YACtF,uEAAuE,CAC1E,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,2BAA2B,CAAC,UAAyC,EAAE;IACrF,OAAO,CAAC,OAAqC,EAAE,EAAE;QAC/C;;;;;WAKG;QACH,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAEvD,OAAO;YACL,KAAK,CACH,UAAU,CAAC,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,EAC1C,GAAG,CAAA,GAAG,OAAO,CAAC,WAAW,QAAQ,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,GAAG,CACpE;YACD,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS;gBACrC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC;oBACE,KAAK,CACH,UAAU,CAAC,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC,EAC3C,GAAG,CAAA,GAAG,OAAO,CAAC,YAAY,QAAQ,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,GAAG,CAC5E;iBACF,CAAC;YACN,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS;gBAClC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC;oBACE;;;;;uBAKG;oBACH,KAAK,CACH,UAAU,CAAC,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,EACxC,GAAG,CAAA,GAAG,OAAO,CAAC,UAAU,OAAO,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,EAAE,CAC/E;iBACF,CAAC;YACN,KAAK,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,6BAA6B,CAAC,CAAC,CAAC,CAAC,EAAE,CAC3D,OAAO,CAAC,WAAW,EACnB,OAAO,CAAC,SAAS,CAClB;YACD,KAAK,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC;YACpF,KAAK,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC,CAAC,CAAC,EAAE,CACnD,OAAO,CAAC,QAAQ,EAChB,OAAO,CAAC,UAAU,EAClB,OAAO,CAAC,YAAY,CACrB;SACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}

package/dist/esm/outbox/postgres/store/enforcement.js

@@ -0,0 +1,158 @@
+import { and, eq, inArray, sql } from 'drizzle-orm';
+/**
+ * The enforcement ledger, in Postgres.
+ *
+ * Two operations carry everything: the CLAIM that makes an action happen at most
+ * once, and the reversal LOOKUP that decides what a correction puts back. Two of
+ * this package's eleven proven mutations attack the second one, which makes its
+ * predicate the most load-bearing SQL in the Postgres half.
+ *
+ * ## The idempotency key IS the primary key
+ *
+ * `decision_id + decision_revision + action`. Mongo needed a surrogate `_id` plus
+ * a unique index on that triple; here the triple is the key, so
+ * `onConflictDoNothing()` needs no explicit `target` — there is only one
+ * constraint it could mean — and there is no second object to keep in step.
+ *
+ * `decision_revision` being IN the key is what lets a correction act: a new
+ * revision is a different row, so the restore it asks for is allowed to happen
+ * while still being impossible to apply twice itself.
+ *
+ * ## Addressed by the key, never by a record id
+ *
+ * Every write after the claim addresses the row by the same three values the
+ * claim used. PostgreSQL reaches it through the composite primary key, so no
+ * opaque record id crosses the port.
+ */
+export function postgresEnforcementStore(input) {
+    const { db } = input;
+    const enforcements = input.tables.enforcements;
+    /** The primary key, as a predicate. Addresses at most one row, by construction. */
+    const keyFilter = (key) => and(eq(enforcements.decisionId, key.decisionId), eq(enforcements.decisionRevision, key.decisionRevision), eq(enforcements.action, key.action));
+    return {
+        async claim(row) {
+            /**
+             * The insert IS the check, and a lost race is zero rows rather than an
+             * error — the same shape as the event store's claim, and for the same
+             * reason: there is no catch block whose predicate could be widened into
+             * swallowing a real fault as "another delivery already handled it".
+             *
+             * `created_at` and `updated_at` are written from the caller's `now`. The
+             * Mongo store lets Mongoose own them; here nothing does, and the reversal
+             * lookup ORDERS BY `created_at`, so the clock that decides which row is
+             * "most recent" is the caller's rather than two different defaults'.
+             */
+            const rows = await db
+                .insert(enforcements)
+                .values({
+                decisionId: row.decisionId,
+                decisionRevision: row.decisionRevision,
+                action: row.action,
+                caseId: row.caseId,
+                subjectType: row.subjectType,
+                subjectId: row.subjectId,
+                outcome: row.outcome,
+                ...(row.recommendedAction === undefined
+                    ? {}
+                    : { recommendedAction: row.recommendedAction }),
+                reason: row.reason,
+                mode: row.mode,
+                applied: false,
+                createdAt: row.now,
+                updatedAt: row.now,
+            })
+                .onConflictDoNothing()
+                .returning({ decisionId: enforcements.decisionId });
+            return rows.length === 1;
+        },
+        async markSkipped(key, { skippedReason, recordedAs, now }) {
+            await db
+                .update(enforcements)
+                .set({
+                skippedReason,
+                // Absent means leave it: `recorded_as` only carries a value when the
+                // effect said the planned action amounted to something else.
+                ...(recordedAs === undefined ? {} : { recordedAs }),
+                updatedAt: now,
+            })
+                .where(keyFilter(key));
+        },
+        async markApplied(key, { appliedAt, previousState, now }) {
+            await db
+                .update(enforcements)
+                .set({
+                applied: true,
+                appliedAt,
+                /**
+                 * Written as `jsonb`, so it round-trips as the object it was rather
+                 * than as its `JSON.stringify` — a `text` column would hand a reversal
+                 * a string, and `previousState?.status` on a string is `undefined`,
+                 * which reads as "moderation displaced nothing" and restores a guess.
+                 *
+                 * Absent means leave it NULL: an action that changed state records what
+                 * it displaced, and one that did not must not claim it displaced
+                 * nothing-in-particular.
+                 */
+                ...(previousState === undefined ? {} : { previousState }),
+                updatedAt: now,
+            })
+                .where(keyFilter(key));
+        },
+        async releaseClaim(key) {
+            await db.delete(enforcements).where(keyFilter(key));
+        },
+        async latestApplied({ subjectType, subjectId, actions }) {
+            /**
+             * The reversal lookup, and every clause in it is load-bearing.
+             *
+             * `eq(applied, true)` — a row that was RECORDED and never carried out
+             * describes a state change that never happened, and it carries no
+             * `previous_state` at all. Reading it hands a reversal nothing and the
+             * application's fallback publishes a draft moderation only ever hid.
+             *
+             * `inArray(action, actions)` — one action may reverse several. The most
+             * recent APPLIED row across the whole declared set wins, so `apply`
+             * receives whatever actually happened last rather than whichever action
+             * happens to be first in the array. Note the membership is POSITIVE: a
+             * negated set (`not in (…)`) would render as `<> ALL (…)`, which no btree
+             * can serve, and the supporting index would quietly stop being used.
+             *
+             * `created_at desc NULLS LAST` with `limit(1)` — newest first, and the
+             * NULLS placement is written out because drizzle's two spellings of "desc"
+             * DISAGREE and the difference is a blocking sort.
+             *
+             * Measured on Postgres 17. `.desc()` inside a drizzle INDEX emits
+             * `DESC NULLS LAST`; `desc(column)` in an ORDER BY emits plain `DESC`,
+             * which in Postgres means NULLS FIRST. Those two orderings do not match, so
+             * no index can satisfy the sort and the plan gains a `Sort` node — even
+             * though `created_at` is NOT NULL and the two orderings can differ by
+             * nothing at all. With `nulls last` the plan is a plain index scan under
+             * the Limit:
+             *
+             *     desc            -> Limit → Sort (created_at DESC) → Index Scan …
+             *     desc nulls last -> Limit → Index Scan …
+             *
+             * Correct results either way, and a sort that grows with the number of
+             * enforcement rows for one subject. `postgresEnforcementStore.test.ts`
+             * asserts the absence of that `Sort` against the real planner.
+             */
+            const rows = await db
+                .select({
+                action: enforcements.action,
+                previousState: enforcements.previousState,
+            })
+                .from(enforcements)
+                .where(and(eq(enforcements.subjectType, subjectType), eq(enforcements.subjectId, subjectId), inArray(enforcements.action, [...actions]), eq(enforcements.applied, true)))
+                .orderBy(sql `${enforcements.createdAt} desc nulls last`)
+                .limit(1);
+            const [row] = rows;
+            if (row === undefined)
+                return null;
+            return {
+                action: row.action,
+                ...(row.previousState === null ? {} : { previousState: row.previousState }),
+            };
+        },
+    };
+}
+//# sourceMappingURL=enforcement.js.map

package/dist/esm/outbox/postgres/store/enforcement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enforcement.js","sourceRoot":"","sources":["../../../../../src/outbox/postgres/store/enforcement.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAQpD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAGxC;IACC,MAAM,EAAE,EAAE,EAAE,GAAG,KAAK,CAAC;IACrB,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC;IAE/C,mFAAmF;IACnF,MAAM,SAAS,GAAG,CAAC,GAA6B,EAAE,EAAE,CAClD,GAAG,CACD,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,EAC3C,EAAE,CAAC,YAAY,CAAC,gBAAgB,EAAE,GAAG,CAAC,gBAAgB,CAAC,EACvD,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CACpC,CAAC;IAEJ,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,GAAG;YACb;;;;;;;;;;eAUG;YACH,MAAM,IAAI,GAAG,MAAM,EAAE;iBAClB,MAAM,CAAC,YAAY,CAAC;iBACpB,MAAM,CAAC;gBACN,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;gBACtC,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,GAAG,CAAC,GAAG,CAAC,iBAAiB,KAAK,SAAS;oBACrC,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,iBAAiB,EAAE,GAAG,CAAC,iBAAiB,EAAE,CAAC;gBACjD,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,OAAO,EAAE,KAAK;gBACd,SAAS,EAAE,GAAG,CAAC,GAAG;gBAClB,SAAS,EAAE,GAAG,CAAC,GAAG;aACnB,CAAC;iBACD,mBAAmB,EAAE;iBACrB,SAAS,CAAC,EAAE,UAAU,EAAE,YAAY,CAAC,UAAU,EAAE,CAAC,CAAC;YAEtD,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC;QAC3B,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,UAAU,EAAE,GAAG,EAAE;YACvD,MAAM,EAAE;iBACL,MAAM,CAAC,YAAY,CAAC;iBACpB,GAAG,CAAC;gBACH,aAAa;gBACb,qEAAqE;gBACrE,6DAA6D;gBAC7D,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;gBACnD,SAAS,EAAE,GAAG;aACf,CAAC;iBACD,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,EAAE;YACtD,MAAM,EAAE;iBACL,MAAM,CAAC,YAAY,CAAC;iBACpB,GAAG,CAAC;gBACH,OAAO,EAAE,IAAI;gBACb,SAAS;gBACT;;;;;;;;;mBASG;gBACH,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC;gBACzD,SAAS,EAAE,GAAG;aACf,CAAC;iBACD,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,GAAG;YACpB,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;QACtD,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE;YACrD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eAiCG;YACH,MAAM,IAAI,GAAG,MAAM,EAAE;iBAClB,MAAM,CAAC;gBACN,MAAM,EAAE,YAAY,CAAC,MAAM;gBAC3B,aAAa,EAAE,YAAY,CAAC,aAAa;aAC1C,CAAC;iBACD,IAAI,CAAC,YAAY,CAAC;iBAClB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,WAAW,CAAC,EACzC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,SAAS,CAAC,EACrC,OAAO,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,EAC1C,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAC/B,CACF;iBACA,OAAO,CAAC,GAAG,CAAA,GAAG,YAAY,CAAC,SAAS,kBAAkB,CAAC;iBACvD,KAAK,CAAC,CAAC,CAAC,CAAC;YAEZ,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;YACnB,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC;YACnC,OAAO;gBACL,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,GAAG,CAAC,GAAG,CAAC,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,GAAG,CAAC,aAAa,EAAE,CAAC;aAC5E,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/esm/outbox/postgres/store/events.js

@@ -0,0 +1,101 @@
+import { eq } from 'drizzle-orm';
+/**
+ * The inbound webhook event log, in Postgres.
+ *
+ * ## The one place this backend is structurally better rather than equivalent
+ *
+ * Everything else in this port aims for parity. This claim does not: it removes a
+ * failure mode instead of handling it, and the difference is worth being precise
+ * about, because "better" is otherwise just an adjective.
+ *
+ * **Mongo's claim throws and catches.** It inserts, and reads `code === 11000` to
+ * tell "somebody else has this event" from a real fault; everything that is not
+ * 11000 is rethrown, so a lost connection or a failover answers non-2xx and the
+ * event stays on the sender's retry schedule. That property is correct — and it
+ * lives in a PREDICATE. `catch { return false }` is one keystroke away, it
+ * type-checks, and it turns a connection failure into "already processed": the
+ * receiver answers 200 and a decision is retired that nobody ever handled. The
+ * only thing standing between those two behaviours is a conditional somebody
+ * could widen, and a test can only catch that by injecting a driver failure.
+ *
+ * **Postgres's claim does not throw at all.** `ON CONFLICT DO NOTHING` plus
+ * `RETURNING` makes a duplicate a ROW COUNT rather than an error: one row means
+ * this call took the claim, zero means somebody else holds it. So there is no
+ * catch block here — and therefore
+ *
+ *   - no predicate to widen,
+ *   - no code path that can convert a fault into a negative answer,
+ *   - and the "rethrow everything else" guarantee holds by the ABSENCE of code
+ *     rather than by the presence of correct code.
+ *
+ * That is the mechanism: the Mongo version is a property of code that exists and
+ * can be edited wrongly; this one is a property of code that does not exist. Only
+ * the second cannot be broken by a well-meaning change.
+ *
+ * The consequence for the mutation suite, stated because its absence would
+ * otherwise look like a gap: there is nothing to DELETE on the insert side, so no
+ * mutation can attack it. The one that exists attacks the READ — `rows.length === 1`
+ * collapsing to `true`, which would hand the same event to two handlers.
+ */
+export function postgresEventStore(input) {
+    const { db } = input;
+    const events = input.tables.events;
+    return {
+        async claim({ eventId, receivedAt, expiresAt }) {
+            /**
+             * The insert IS the claim, and a lost race is zero rows rather than an
+             * exception. `created_at`/`updated_at` are left to their column defaults:
+             * unlike the outbox, nothing here needs a repeated write to be provably a
+             * no-op, so the database's clock is the simpler authority.
+             */
+            const rows = await db
+                .insert(events)
+                .values({ id: eventId, state: 'claimed', receivedAt, expiresAt })
+                .onConflictDoNothing({ target: events.id })
+                .returning({ id: events.id });
+            return rows.length === 1;
+        },
+        /** Give the claim back so a redelivery can be processed. */
+        async release(eventId) {
+            await db.delete(events).where(eq(events.id, eventId));
+        },
+        async markQueued({ eventId, type, caseId, payload, now }, tx) {
+            /**
+             * On the CALLER's transaction, which is the whole point: this row's
+             * completion and the outbox row that carries the work commit together, or a
+             * crash between them leaves an event permanently deduplicated with no work
+             * queued — a decision silently lost, with a row saying it arrived.
+             */
+            await tx
+                .update(events)
+                .set({
+                type,
+                caseId,
+                payload,
+                state: 'queued',
+                queuedAt: now,
+                updatedAt: now,
+            })
+                .where(eq(events.id, eventId));
+        },
+        async markIgnored({ eventId, type, caseId, now }) {
+            await db
+                .update(events)
+                .set({
+                type,
+                /**
+                 * Absent means LEAVE IT, not write something. An event type carrying no
+                 * case id is ordinary — `case.created` before a case is linked — and
+                 * `caseId: String(caseId)` would store the four characters `null` or
+                 * the nine characters `undefined`, which then reads as a case id
+                 * everywhere downstream. Postgres keeps the column NULL.
+                 */
+                ...(caseId === undefined ? {} : { caseId }),
+                state: 'ignored',
+                updatedAt: now,
+            })
+                .where(eq(events.id, eventId));
+        },
+    };
+}
+//# sourceMappingURL=events.js.map

package/dist/esm/outbox/postgres/store/events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.js","sourceRoot":"","sources":["../../../../../src/outbox/postgres/store/events.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAKjC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAGlC;IACC,MAAM,EAAE,EAAE,EAAE,GAAG,KAAK,CAAC;IACrB,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC;IAEnC,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE;YAC5C;;;;;eAKG;YACH,MAAM,IAAI,GAAG,MAAM,EAAE;iBAClB,MAAM,CAAC,MAAM,CAAC;iBACd,MAAM,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;iBAChE,mBAAmB,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;iBAC1C,SAAS,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;YAEhC,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC;QAC3B,CAAC;QAED,4DAA4D;QAC5D,KAAK,CAAC,OAAO,CAAC,OAAO;YACnB,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;QACxD,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE;YAC1D;;;;;eAKG;YACH,MAAM,EAAE;iBACL,MAAM,CAAC,MAAM,CAAC;iBACd,GAAG,CAAC;gBACH,IAAI;gBACJ,MAAM;gBACN,OAAO;gBACP,KAAK,EAAE,QAAQ;gBACf,QAAQ,EAAE,GAAG;gBACb,SAAS,EAAE,GAAG;aACf,CAAC;iBACD,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;QACnC,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE;YAC9C,MAAM,EAAE;iBACL,MAAM,CAAC,MAAM,CAAC;iBACd,GAAG,CAAC;gBACH,IAAI;gBACJ;;;;;;mBAMG;gBACH,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;gBAC3C,KAAK,EAAE,SAAS;gBAChB,SAAS,EAAE,GAAG;aACf,CAAC;iBACD,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;QACnC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/esm/outbox/postgres/store/index.js

@@ -0,0 +1,59 @@
+import { sql } from 'drizzle-orm';
+import { postgresEnforcementStore } from './enforcement.js';
+import { postgresEventStore } from './events.js';
+import { postgresOutboxStore } from './outbox.js';
+import { postgresReportStore } from './reports.js';
+import { postgresTransactionRunner } from './transaction.js';
+/**
+ * Everything this package writes, in Postgres.
+ *
+ * One factory rather than five, because the five members must share one handle: a
+ * report and its outbox row commit in the SAME transaction, and a store assembled
+ * from two handles would type-check perfectly and quietly lose that.
+ *
+ * Unlike the Mongo factory, this one CREATES NOTHING. There is no schema to
+ * register: the adopter's own migration created the tables, generated from the
+ * definitions this package exports, in the adopter's own journal. That asymmetry
+ * is deliberate and is the reason no migrations folder ships here — two journals
+ * against one `drizzle.__drizzle_migrations` table interleave, and the loser is
+ * skipped in silence with exit 0.
+ */
+export function postgresModerationStore(input) {
+    const { db, reportTable, tables } = input;
+    return {
+        transaction: postgresTransactionRunner(db),
+        outbox: postgresOutboxStore({ db, tables }),
+        events: postgresEventStore({ db, tables }),
+        enforcement: postgresEnforcementStore({ db, tables }),
+        reports: postgresReportStore({ db, reportTable }),
+        /**
+         * ASSERTS the schema, rather than creating it.
+         *
+         * The Mongo half calls `init()` and builds indexes; there is nothing here to
+         * build, so what remains is worth doing for its own sake: confirming the four
+         * tables this package queries exist BEFORE the first report is filed rather
+         * than at the first delivery.
+         *
+         * A missing table raises `42P01 undefined_table` and names it. `limit(0)`
+         * means Postgres parses and plans each statement — which is what proves the
+         * relation resolves — without reading a row.
+         *
+         * It cannot check COLUMNS. An adopter whose migration is a version behind
+         * gets a compile error from `ModerationReportTable` for a missing column and
+         * a `42703` from the query for a stale migration; both are loud, and neither
+         * is this function's job.
+         */
+        async ensureSchema() {
+            const present = [
+                tables.outbox,
+                tables.events,
+                tables.enforcements,
+                reportTable,
+            ];
+            for (const table of present) {
+                await db.select({ resolves: sql `1` }).from(table).limit(0);
+            }
+        },
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/esm/outbox/postgres/store/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/outbox/postgres/store/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAMlC,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,yBAAyB,EAA2B,MAAM,kBAAkB,CAAC;AAEtF;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,uBAAuB,CAAyC,KAM/E;IACC,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAE1C,OAAO;QACL,WAAW,EAAE,yBAAyB,CAAC,EAAE,CAAC;QAC1C,MAAM,EAAE,mBAAmB,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;QAC3C,MAAM,EAAE,kBAAkB,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;QAC1C,WAAW,EAAE,wBAAwB,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;QACrD,OAAO,EAAE,mBAAmB,CAAU,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC;QAE1D;;;;;;;;;;;;;;;;WAgBG;QACH,KAAK,CAAC,YAAY;YAChB,MAAM,OAAO,GAAuB;gBAClC,MAAM,CAAC,MAAM;gBACb,MAAM,CAAC,MAAM;gBACb,MAAM,CAAC,YAAY;gBACnB,WAAW;aACZ,CAAC;YACF,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC5B,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAA,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}