@crowdsource.you/core 1.2.0

package/dist/outbox/postgres/reportColumns.d.ts

@@ -0,0 +1,154 @@
+import { type PgColumn, type PgTable } from 'drizzle-orm/pg-core';
+export interface ModerationReportColumnOptions {
+    /**
+     * The application's reportable types. Constrains the stored value.
+     *
+     * This is NOT the set of DELIVERABLE types — a type with no subject provider is
+     * still reportable and still stored, it simply never leaves. Registering a
+     * provider is what makes a type deliverable, and the two lists are allowed to
+     * differ.
+     *
+     * Omitted, no CHECK is created. Supplying it later is a migration.
+     */
+    readonly reportedTypes?: readonly string[];
+    /** The application's report categories. Omitted, no CHECK is created. */
+    readonly categories?: readonly string[];
+    /** Maximum length of the reporter's free text. */
+    readonly detailsMaxLength?: number;
+}
+/**
+ * The columns this package reads and writes, to spread into the application's
+ * own `pgTable`.
+ *
+ * Every SQL name is written out. Drizzle would derive one from the property, and
+ * its derivation mangles digit- and capital-adjacent names — `crowdSourceReportId`
+ * becomes `crowd_source_report_id`, which is a working column with a name nobody
+ * chose and which no gate would notice.
+ */
+export declare function moderationReportColumns(options?: ModerationReportColumnOptions): {
+    /**
+     * `text`, not `uuid`, and generated in the application.
+     *
+     * `generatedId()` holds a uuid v7 for a row created here and a 24-character
+     * ObjectId hex for every row that existed before a Mongo cutover, so one id
+     * space serves both. The consequence that matters downstream: a malformed id
+     * matches no rows instead of raising `22P02`, which is exactly the Mongo
+     * behaviour the delivery path already handles.
+     */
+    id: import("drizzle-orm").HasRuntimeDefault<import("drizzle-orm").HasDefault<import("drizzle-orm").IsPrimaryKey<import("drizzle-orm").NotNull<import("drizzle-orm/pg-core").PgTextBuilderInitial<"", [string, ...string[]]>>>>>;
+    reportedType: import("drizzle-orm").NotNull<import("drizzle-orm/pg-core").PgTextBuilderInitial<"reported_type", [string, ...string[]]>>;
+    reportedId: import("drizzle-orm").NotNull<import("drizzle-orm/pg-core").PgTextBuilderInitial<"reported_id", [string, ...string[]]>>;
+    /**
+     * The reporting Oxy user id.
+     *
+     * The Oxy subject IS the identity binding proof, so there is no separate
+     * binding step for an application to implement — but it does mean this
+     * column must hold an Oxy user id and not an application-local one.
+     */
+    reporter: import("drizzle-orm").NotNull<import("drizzle-orm/pg-core").PgTextBuilderInitial<"reporter", [string, ...string[]]>>;
+    /**
+     * `text[]`, written and read WHOLE.
+     *
+     * This package sets it at intake and reads it at delivery; it never queries
+     * by element, so an array column is the port rather than a join table. A
+     * containment CHECK constrains the values when the application declares them.
+     */
+    categories: import("drizzle-orm").NotNull<import("drizzle-orm/pg-core").PgArrayBuilder<{
+        name: "categories";
+        dataType: "array";
+        columnType: "PgArray";
+        data: string[];
+        driverParam: string | string[];
+        enumValues: [string, ...string[]];
+        size: undefined;
+        baseBuilder: {
+            name: "categories";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            enumValues: [string, ...string[]];
+            driverParam: string;
+        };
+    }, {
+        name: "categories";
+        dataType: "string";
+        columnType: "PgText";
+        data: string;
+        enumValues: [string, ...string[]];
+        driverParam: string;
+    }>>;
+    details: import("drizzle-orm/pg-core").PgVarcharBuilderInitial<"details", [string, ...string[]], number>;
+    localStatus: import("drizzle-orm").HasDefault<import("drizzle-orm").NotNull<import("drizzle-orm/pg-core").PgTextBuilderInitial<"local_status", [string, ...string[]]>>>;
+    /**
+     * Why a report is not going anywhere, in words an operator can read.
+     *
+     * Stored rather than inferred from a missing outbox row. A missing row is
+     * also what a lost write looks like, and the two need to be distinguishable
+     * months later without re-deriving which types had providers at the time.
+     */
+    localStatusReason: import("drizzle-orm/pg-core").PgVarcharBuilderInitial<"local_status_reason", [string, ...string[]], 300>;
+    crowdSourceReportId: import("drizzle-orm/pg-core").PgTextBuilderInitial<"crowdsource_report_id", [string, ...string[]]>;
+    crowdSourceCaseId: import("drizzle-orm/pg-core").PgTextBuilderInitial<"crowdsource_case_id", [string, ...string[]]>;
+    crowdSourceMerged: import("drizzle-orm/pg-core").PgBooleanBuilderInitial<"crowdsource_merged">;
+    /** SHA-256 of the exact representation that was reviewed. */
+    contentSnapshotHash: import("drizzle-orm/pg-core").PgTextBuilderInitial<"content_snapshot_hash", [string, ...string[]]>;
+    submittedAt: import("drizzle-orm/pg-core").PgTimestampBuilderInitial<"">;
+    lastDeliveryError: import("drizzle-orm/pg-core").PgVarcharBuilderInitial<"last_delivery_error", [string, ...string[]], 2000>;
+    decisionId: import("drizzle-orm/pg-core").PgTextBuilderInitial<"decision_id", [string, ...string[]]>;
+    /**
+     * The revision guard.
+     *
+     * Compared in the update's WHERE clause, so it is the database that refuses a
+     * stale write rather than a read-then-write in the application process.
+     */
+    decisionRevision: import("drizzle-orm/pg-core").PgIntegerBuilderInitial<"decision_revision">;
+    decisionOutcome: import("drizzle-orm/pg-core").PgTextBuilderInitial<"decision_outcome", [string, ...string[]]>;
+    decisionStatus: import("drizzle-orm/pg-core").PgTextBuilderInitial<"decision_status", [string, ...string[]]>;
+    decidedAt: import("drizzle-orm/pg-core").PgTimestampBuilderInitial<"">;
+    enforcedAction: import("drizzle-orm/pg-core").PgTextBuilderInitial<"enforced_action", [string, ...string[]]>;
+    enforcedAt: import("drizzle-orm/pg-core").PgTimestampBuilderInitial<"">;
+    createdAt: import("drizzle-orm").HasDefault<import("drizzle-orm").NotNull<import("drizzle-orm/pg-core").PgTimestampBuilderInitial<"">>>;
+    updatedAt: import("drizzle-orm").HasDefault<import("drizzle-orm").HasDefault<import("drizzle-orm").NotNull<import("drizzle-orm/pg-core").PgTimestampBuilderInitial<"">>>>;
+};
+/** The column map, as the adopter's table carries it once built. */
+export type ModerationReportColumns = ReturnType<typeof moderationReportColumns>;
+/** Every column name the report store queries by. */
+export type ModerationReportColumnName = keyof ModerationReportColumns;
+/**
+ * The built columns, as `pgTable`'s third argument receives them.
+ *
+ * Deliberately NOT `ModerationReportTable`: drizzle calls that callback with the
+ * column map alone, which is not a table, so a parameter typed as one would
+ * refuse to be a `pgTable` callback at all.
+ */
+export type ModerationReportBuiltColumns = Record<ModerationReportColumnName, PgColumn>;
+/**
+ * A table carrying at least the moderation report columns.
+ *
+ * Structural on purpose: the adopter's table has its own name and its own extra
+ * columns, and a type derived from a concrete `pgTable` would name one table and
+ * therefore accept no other. What this asserts is the part that matters — that
+ * every column the report store reaches for is present.
+ */
+export type ModerationReportTable = PgTable & Record<ModerationReportColumnName, PgColumn>;
+/**
+ * The CHECKs and indexes the report table needs, as `pgTable`'s third argument.
+ *
+ * The three indexes are the same three `applyModerationReportIndexes` creates,
+ * and not optional: reconciliation scans `(local_status, created_at)` oldest-first
+ * on every sweep, and the decision worker looks a case up by
+ * `crowdsource_case_id` on every inbound decision. Without them both become
+ * sequential scans that grow with the table.
+ *
+ * The compound uniqueness of "one report per reporter per object" is the
+ * APPLICATION's to declare — some applications allow a reporter to file twice
+ * under different categories — so it is not created here. Intake's duplicate
+ * check reads `(reporter, reported_id, reported_type)`, so that one is indexed
+ * for it either way.
+ *
+ * Index names are derived from the adopter's own table name and length-checked,
+ * because two names that differ only past the 63rd byte are the same name to
+ * Postgres.
+ */
+export declare function moderationReportTableExtras(options?: ModerationReportColumnOptions): (columns: ModerationReportBuiltColumns) => (import("drizzle-orm/pg-core").CheckBuilder | import("drizzle-orm/pg-core").IndexBuilder)[];
+//# sourceMappingURL=reportColumns.d.ts.map

package/dist/outbox/postgres/reportColumns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reportColumns.d.ts","sourceRoot":"","sources":["../../../src/outbox/postgres/reportColumns.ts"],"names":[],"mappings":"AACA,OAAO,EAOL,KAAK,QAAQ,EACb,KAAK,OAAO,EACb,MAAM,qBAAqB,CAAC;AA+D7B,MAAM,WAAW,6BAA6B;IAC5C;;;;;;;;;OASG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,yEAAyE;IACzE,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,kDAAkD;IAClD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,GAAE,6BAAkC;IAE/E;;;;;;;;OAQG;;;;IAKH;;;;;;OAMG;;IAEH;;;;;;OAMG;;;;;;;;;;;;;;;;;;;;;;;;;;;IAOH;;;;;;OAMG;;;;;IAMH,6DAA6D;;;;;IAM7D;;;;;OAKG;;;;;;;;;EAWN;AAED,oEAAoE;AACpE,MAAM,MAAM,uBAAuB,GAAG,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAEjF,qDAAqD;AACrD,MAAM,MAAM,0BAA0B,GAAG,MAAM,uBAAuB,CAAC;AAEvE;;;;;;GAMG;AACH,MAAM,MAAM,4BAA4B,GAAG,MAAM,CAAC,0BAA0B,EAAE,QAAQ,CAAC,CAAC;AAExF;;;;;;;GAOG;AACH,MAAM,MAAM,qBAAqB,GAAG,OAAO,GAAG,MAAM,CAAC,0BAA0B,EAAE,QAAQ,CAAC,CAAC;AAiB3F;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,GAAE,6BAAkC,IAC7E,SAAS,4BAA4B,iGAgD9C"}

package/dist/outbox/postgres/reportColumns.js

@@ -0,0 +1,195 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.moderationReportColumns = moderationReportColumns;
+exports.moderationReportTableExtras = moderationReportTableExtras;
+const drizzle_orm_1 = require("drizzle-orm");
+const pg_core_1 = require("drizzle-orm/pg-core");
+const db_1 = require("@oxy.so/db");
+/**
+ * The moderation half of an application's report table.
+ *
+ * The Postgres twin of `moderationReportSchemaFields`, and the split is the same
+ * one: the application owns the table — its name, its own extra columns, whatever
+ * verdict field it already had — and this package owns the SHAPE of the columns
+ * it queries, plus the indexes those queries depend on.
+ *
+ * ```ts
+ * const REPORT_MODERATION = {
+ *   reportedTypes: ['listing', 'review'],
+ *   categories: ['spam', 'harassment'],
+ * } as const;
+ *
+ * export const reports = pgTable(
+ *   'reports',
+ *   {
+ *     ...moderationReportColumns(REPORT_MODERATION),
+ *     // …the application's own columns
+ *   },
+ *   moderationReportTableExtras(REPORT_MODERATION),
+ * );
+ * ```
+ *
+ * **`moderationReportTableExtras` takes the OPTIONS and returns the callback**,
+ * rather than taking the built columns directly. It has to: the CHECK on
+ * `reported_type` and the containment CHECK on `categories` are built from the
+ * same tuples that constrain the columns, and drizzle does not carry those
+ * tuples onto the built column (`enumValues` is `undefined` there — measured).
+ * Passing one options object to both calls is what keeps the column and its
+ * constraint from drifting apart.
+ */
+/**
+ * The local statuses, as the CHECK renders them.
+ *
+ * Spelled out beside the DDL so it cannot acquire an ORM dependency. `satisfies`
+ * refuses a value outside the union; `postgresSchema.test.ts` asserts this tuple
+ * and `MODERATION_LOCAL_STATUSES` still agree, which is what catches an OMISSION
+ * — the direction a type cannot see.
+ */
+const LOCAL_STATUSES = [
+    'received',
+    'queued',
+    'submitted',
+    'delivery_failed',
+    'closed',
+];
+/** Mongo's `detailsMaxLength ?? 2_000`, for the same reason: it bounds free text. */
+const DEFAULT_DETAILS_MAX_LENGTH = 2000;
+/**
+ * The columns this package reads and writes, to spread into the application's
+ * own `pgTable`.
+ *
+ * Every SQL name is written out. Drizzle would derive one from the property, and
+ * its derivation mangles digit- and capital-adjacent names — `crowdSourceReportId`
+ * becomes `crowd_source_report_id`, which is a working column with a name nobody
+ * chose and which no gate would notice.
+ */
+function moderationReportColumns(options = {}) {
+    return {
+        /**
+         * `text`, not `uuid`, and generated in the application.
+         *
+         * `generatedId()` holds a uuid v7 for a row created here and a 24-character
+         * ObjectId hex for every row that existed before a Mongo cutover, so one id
+         * space serves both. The consequence that matters downstream: a malformed id
+         * matches no rows instead of raising `22P02`, which is exactly the Mongo
+         * behaviour the delivery path already handles.
+         */
+        id: (0, db_1.generatedId)(),
+        reportedType: (0, pg_core_1.text)('reported_type').notNull(),
+        reportedId: (0, pg_core_1.text)('reported_id').notNull(),
+        /**
+         * The reporting Oxy user id.
+         *
+         * The Oxy subject IS the identity binding proof, so there is no separate
+         * binding step for an application to implement — but it does mean this
+         * column must hold an Oxy user id and not an application-local one.
+         */
+        reporter: (0, pg_core_1.text)('reporter').notNull(),
+        /**
+         * `text[]`, written and read WHOLE.
+         *
+         * This package sets it at intake and reads it at delivery; it never queries
+         * by element, so an array column is the port rather than a join table. A
+         * containment CHECK constrains the values when the application declares them.
+         */
+        categories: (0, pg_core_1.text)('categories').array().notNull(),
+        details: (0, pg_core_1.varchar)('details', {
+            length: options.detailsMaxLength ?? DEFAULT_DETAILS_MAX_LENGTH,
+        }),
+        localStatus: (0, pg_core_1.text)('local_status').notNull().default('received'),
+        /**
+         * Why a report is not going anywhere, in words an operator can read.
+         *
+         * Stored rather than inferred from a missing outbox row. A missing row is
+         * also what a lost write looks like, and the two need to be distinguishable
+         * months later without re-deriving which types had providers at the time.
+         */
+        localStatusReason: (0, pg_core_1.varchar)('local_status_reason', { length: 300 }),
+        crowdSourceReportId: (0, pg_core_1.text)('crowdsource_report_id'),
+        crowdSourceCaseId: (0, pg_core_1.text)('crowdsource_case_id'),
+        crowdSourceMerged: (0, pg_core_1.boolean)('crowdsource_merged'),
+        /** SHA-256 of the exact representation that was reviewed. */
+        contentSnapshotHash: (0, pg_core_1.text)('content_snapshot_hash'),
+        submittedAt: (0, db_1.timestamptz)(),
+        lastDeliveryError: (0, pg_core_1.varchar)('last_delivery_error', { length: 2000 }),
+        decisionId: (0, pg_core_1.text)('decision_id'),
+        /**
+         * The revision guard.
+         *
+         * Compared in the update's WHERE clause, so it is the database that refuses a
+         * stale write rather than a read-then-write in the application process.
+         */
+        decisionRevision: (0, pg_core_1.integer)('decision_revision'),
+        decisionOutcome: (0, pg_core_1.text)('decision_outcome'),
+        decisionStatus: (0, pg_core_1.text)('decision_status'),
+        decidedAt: (0, db_1.timestamptz)(),
+        enforcedAction: (0, pg_core_1.text)('enforced_action'),
+        enforcedAt: (0, db_1.timestamptz)(),
+        createdAt: (0, db_1.createdAt)(),
+        updatedAt: (0, db_1.updatedAt)(),
+    };
+}
+/** Postgres truncates an identifier at 63 bytes, silently, and then names collide. */
+const MAX_IDENTIFIER_BYTES = 63;
+function identifier(parts) {
+    const name = parts.join('_');
+    if (Buffer.byteLength(name, 'utf8') > MAX_IDENTIFIER_BYTES) {
+        throw new Error(`The moderation report index name '${name}' is ${Buffer.byteLength(name, 'utf8')} bytes; ` +
+            `Postgres truncates identifiers at ${MAX_IDENTIFIER_BYTES} and two names that differ ` +
+            'only past the cut then collide. Give the report table a shorter name.');
+    }
+    return name;
+}
+/**
+ * The CHECKs and indexes the report table needs, as `pgTable`'s third argument.
+ *
+ * The three indexes are the same three `applyModerationReportIndexes` creates,
+ * and not optional: reconciliation scans `(local_status, created_at)` oldest-first
+ * on every sweep, and the decision worker looks a case up by
+ * `crowdsource_case_id` on every inbound decision. Without them both become
+ * sequential scans that grow with the table.
+ *
+ * The compound uniqueness of "one report per reporter per object" is the
+ * APPLICATION's to declare — some applications allow a reporter to file twice
+ * under different categories — so it is not created here. Intake's duplicate
+ * check reads `(reporter, reported_id, reported_type)`, so that one is indexed
+ * for it either way.
+ *
+ * Index names are derived from the adopter's own table name and length-checked,
+ * because two names that differ only past the 63rd byte are the same name to
+ * Postgres.
+ */
+function moderationReportTableExtras(options = {}) {
+    return (columns) => {
+        /**
+         * The adopter's table name, read off one of its own columns — `pgTable`
+         * calls this with the BUILT columns, each of which carries its table. That
+         * is what lets the index names belong to the adopter's table without being
+         * passed in a second time and drifting.
+         */
+        const prefix = (0, drizzle_orm_1.getTableName)(columns.localStatus.table);
+        return [
+            (0, pg_core_1.check)(identifier([prefix, 'local_status_check']), (0, drizzle_orm_1.sql) `${columns.localStatus} in (${drizzle_orm_1.sql.raw((0, db_1.inList)(LOCAL_STATUSES))})`),
+            ...(options.reportedTypes === undefined
+                ? []
+                : [
+                    (0, pg_core_1.check)(identifier([prefix, 'reported_type_check']), (0, drizzle_orm_1.sql) `${columns.reportedType} in (${drizzle_orm_1.sql.raw((0, db_1.inList)(options.reportedTypes))})`),
+                ]),
+            ...(options.categories === undefined
+                ? []
+                : [
+                    /**
+                     * Containment, not equality: a report carries a SUBSET of the
+                     * declared categories, and `<@` is trivially satisfied by an empty
+                     * array — which the application's own validation refuses before this
+                     * is ever reached.
+                     */
+                    (0, pg_core_1.check)(identifier([prefix, 'categories_check']), (0, drizzle_orm_1.sql) `${columns.categories} <@ ${drizzle_orm_1.sql.raw((0, db_1.textArrayLiteral)(options.categories))}`),
+                ]),
+            (0, pg_core_1.index)(identifier([prefix, 'local_status_created_at_idx'])).on(columns.localStatus, columns.createdAt),
+            (0, pg_core_1.index)(identifier([prefix, 'crowdsource_case_id_idx'])).on(columns.crowdSourceCaseId),
+            (0, pg_core_1.index)(identifier([prefix, 'reporter_object_idx'])).on(columns.reporter, columns.reportedId, columns.reportedType),
+        ];
+    };
+}
+//# sourceMappingURL=reportColumns.js.map

package/dist/outbox/postgres/reportColumns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reportColumns.js","sourceRoot":"","sources":["../../../src/outbox/postgres/reportColumns.ts"],"names":[],"mappings":";;AAoGA,0DAsEC;AA6DD,kEAiDC;AAxRD,6CAAgD;AAChD,iDAS6B;AAC7B,mCAOoB;AAGpB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH;;;;;;;GAOG;AACH,MAAM,cAAc,GAAG;IACrB,UAAU;IACV,QAAQ;IACR,WAAW;IACX,iBAAiB;IACjB,QAAQ;CAC2C,CAAC;AAEtD,qFAAqF;AACrF,MAAM,0BAA0B,GAAG,IAAK,CAAC;AAoBzC;;;;;;;;GAQG;AACH,SAAgB,uBAAuB,CAAC,UAAyC,EAAE;IACjF,OAAO;QACL;;;;;;;;WAQG;QACH,EAAE,EAAE,IAAA,gBAAW,GAAE;QAEjB,YAAY,EAAE,IAAA,cAAI,EAAC,eAAe,CAAC,CAAC,OAAO,EAAE;QAC7C,UAAU,EAAE,IAAA,cAAI,EAAC,aAAa,CAAC,CAAC,OAAO,EAAE;QACzC;;;;;;WAMG;QACH,QAAQ,EAAE,IAAA,cAAI,EAAC,UAAU,CAAC,CAAC,OAAO,EAAE;QACpC;;;;;;WAMG;QACH,UAAU,EAAE,IAAA,cAAI,EAAC,YAAY,CAAC,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE;QAChD,OAAO,EAAE,IAAA,iBAAO,EAAC,SAAS,EAAE;YAC1B,MAAM,EAAE,OAAO,CAAC,gBAAgB,IAAI,0BAA0B;SAC/D,CAAC;QAEF,WAAW,EAAE,IAAA,cAAI,EAAC,cAAc,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC;QAC/D;;;;;;WAMG;QACH,iBAAiB,EAAE,IAAA,iBAAO,EAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QAElE,mBAAmB,EAAE,IAAA,cAAI,EAAC,uBAAuB,CAAC;QAClD,iBAAiB,EAAE,IAAA,cAAI,EAAC,qBAAqB,CAAC;QAC9C,iBAAiB,EAAE,IAAA,iBAAO,EAAC,oBAAoB,CAAC;QAChD,6DAA6D;QAC7D,mBAAmB,EAAE,IAAA,cAAI,EAAC,uBAAuB,CAAC;QAClD,WAAW,EAAE,IAAA,gBAAW,GAAE;QAC1B,iBAAiB,EAAE,IAAA,iBAAO,EAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,IAAK,EAAE,CAAC;QAEpE,UAAU,EAAE,IAAA,cAAI,EAAC,aAAa,CAAC;QAC/B;;;;;WAKG;QACH,gBAAgB,EAAE,IAAA,iBAAO,EAAC,mBAAmB,CAAC;QAC9C,eAAe,EAAE,IAAA,cAAI,EAAC,kBAAkB,CAAC;QACzC,cAAc,EAAE,IAAA,cAAI,EAAC,iBAAiB,CAAC;QACvC,SAAS,EAAE,IAAA,gBAAW,GAAE;QACxB,cAAc,EAAE,IAAA,cAAI,EAAC,iBAAiB,CAAC;QACvC,UAAU,EAAE,IAAA,gBAAW,GAAE;QAEzB,SAAS,EAAE,IAAA,cAAS,GAAE;QACtB,SAAS,EAAE,IAAA,cAAS,GAAE;KACvB,CAAC;AACJ,CAAC;AA2BD,sFAAsF;AACtF,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAEhC,SAAS,UAAU,CAAC,KAAwB;IAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,oBAAoB,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CACb,qCAAqC,IAAI,QAAQ,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU;YACxF,qCAAqC,oBAAoB,6BAA6B;YACtF,uEAAuE,CAC1E,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAgB,2BAA2B,CAAC,UAAyC,EAAE;IACrF,OAAO,CAAC,OAAqC,EAAE,EAAE;QAC/C;;;;;WAKG;QACH,MAAM,MAAM,GAAG,IAAA,0BAAY,EAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAEvD,OAAO;YACL,IAAA,eAAK,EACH,UAAU,CAAC,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,EAC1C,IAAA,iBAAG,EAAA,GAAG,OAAO,CAAC,WAAW,QAAQ,iBAAG,CAAC,GAAG,CAAC,IAAA,WAAM,EAAC,cAAc,CAAC,CAAC,GAAG,CACpE;YACD,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS;gBACrC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC;oBACE,IAAA,eAAK,EACH,UAAU,CAAC,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC,EAC3C,IAAA,iBAAG,EAAA,GAAG,OAAO,CAAC,YAAY,QAAQ,iBAAG,CAAC,GAAG,CAAC,IAAA,WAAM,EAAC,OAAO,CAAC,aAAa,CAAC,CAAC,GAAG,CAC5E;iBACF,CAAC;YACN,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS;gBAClC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC;oBACE;;;;;uBAKG;oBACH,IAAA,eAAK,EACH,UAAU,CAAC,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,EACxC,IAAA,iBAAG,EAAA,GAAG,OAAO,CAAC,UAAU,OAAO,iBAAG,CAAC,GAAG,CAAC,IAAA,qBAAgB,EAAC,OAAO,CAAC,UAAU,CAAC,CAAC,EAAE,CAC/E;iBACF,CAAC;YACN,IAAA,eAAK,EAAC,UAAU,CAAC,CAAC,MAAM,EAAE,6BAA6B,CAAC,CAAC,CAAC,CAAC,EAAE,CAC3D,OAAO,CAAC,WAAW,EACnB,OAAO,CAAC,SAAS,CAClB;YACD,IAAA,eAAK,EAAC,UAAU,CAAC,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC;YACpF,IAAA,eAAK,EAAC,UAAU,CAAC,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC,CAAC,CAAC,EAAE,CACnD,OAAO,CAAC,QAAQ,EAChB,OAAO,CAAC,UAAU,EAClB,OAAO,CAAC,YAAY,CACrB;SACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}

package/dist/outbox/postgres/store/enforcement.d.ts

@@ -0,0 +1,33 @@
+import type { ModerationEnforcementStore } from '../../store/types.js';
+import type { ModerationTables } from '../tables.js';
+import type { ModerationPgHandle } from './transaction.js';
+/**
+ * The enforcement ledger, in Postgres.
+ *
+ * Two operations carry everything: the CLAIM that makes an action happen at most
+ * once, and the reversal LOOKUP that decides what a correction puts back. Two of
+ * this package's eleven proven mutations attack the second one, which makes its
+ * predicate the most load-bearing SQL in the Postgres half.
+ *
+ * ## The idempotency key IS the primary key
+ *
+ * `decision_id + decision_revision + action`. Mongo needed a surrogate `_id` plus
+ * a unique index on that triple; here the triple is the key, so
+ * `onConflictDoNothing()` needs no explicit `target` — there is only one
+ * constraint it could mean — and there is no second object to keep in step.
+ *
+ * `decision_revision` being IN the key is what lets a correction act: a new
+ * revision is a different row, so the restore it asks for is allowed to happen
+ * while still being impossible to apply twice itself.
+ *
+ * ## Addressed by the key, never by a record id
+ *
+ * Every write after the claim addresses the row by the same three values the
+ * claim used. PostgreSQL reaches it through the composite primary key, so no
+ * opaque record id crosses the port.
+ */
+export declare function postgresEnforcementStore(input: {
+    db: ModerationPgHandle;
+    tables: ModerationTables;
+}): ModerationEnforcementStore;
+//# sourceMappingURL=enforcement.d.ts.map

package/dist/outbox/postgres/store/enforcement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"enforcement.d.ts","sourceRoot":"","sources":["../../../../src/outbox/postgres/store/enforcement.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAEV,0BAA0B,EAC3B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAE3D;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE;IAC9C,EAAE,EAAE,kBAAkB,CAAC;IACvB,MAAM,EAAE,gBAAgB,CAAC;CAC1B,GAAG,0BAA0B,CAqJ7B"}

package/dist/outbox/postgres/store/enforcement.js

@@ -0,0 +1,161 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.postgresEnforcementStore = postgresEnforcementStore;
+const drizzle_orm_1 = require("drizzle-orm");
+/**
+ * The enforcement ledger, in Postgres.
+ *
+ * Two operations carry everything: the CLAIM that makes an action happen at most
+ * once, and the reversal LOOKUP that decides what a correction puts back. Two of
+ * this package's eleven proven mutations attack the second one, which makes its
+ * predicate the most load-bearing SQL in the Postgres half.
+ *
+ * ## The idempotency key IS the primary key
+ *
+ * `decision_id + decision_revision + action`. Mongo needed a surrogate `_id` plus
+ * a unique index on that triple; here the triple is the key, so
+ * `onConflictDoNothing()` needs no explicit `target` — there is only one
+ * constraint it could mean — and there is no second object to keep in step.
+ *
+ * `decision_revision` being IN the key is what lets a correction act: a new
+ * revision is a different row, so the restore it asks for is allowed to happen
+ * while still being impossible to apply twice itself.
+ *
+ * ## Addressed by the key, never by a record id
+ *
+ * Every write after the claim addresses the row by the same three values the
+ * claim used. PostgreSQL reaches it through the composite primary key, so no
+ * opaque record id crosses the port.
+ */
+function postgresEnforcementStore(input) {
+    const { db } = input;
+    const enforcements = input.tables.enforcements;
+    /** The primary key, as a predicate. Addresses at most one row, by construction. */
+    const keyFilter = (key) => (0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(enforcements.decisionId, key.decisionId), (0, drizzle_orm_1.eq)(enforcements.decisionRevision, key.decisionRevision), (0, drizzle_orm_1.eq)(enforcements.action, key.action));
+    return {
+        async claim(row) {
+            /**
+             * The insert IS the check, and a lost race is zero rows rather than an
+             * error — the same shape as the event store's claim, and for the same
+             * reason: there is no catch block whose predicate could be widened into
+             * swallowing a real fault as "another delivery already handled it".
+             *
+             * `created_at` and `updated_at` are written from the caller's `now`. The
+             * Mongo store lets Mongoose own them; here nothing does, and the reversal
+             * lookup ORDERS BY `created_at`, so the clock that decides which row is
+             * "most recent" is the caller's rather than two different defaults'.
+             */
+            const rows = await db
+                .insert(enforcements)
+                .values({
+                decisionId: row.decisionId,
+                decisionRevision: row.decisionRevision,
+                action: row.action,
+                caseId: row.caseId,
+                subjectType: row.subjectType,
+                subjectId: row.subjectId,
+                outcome: row.outcome,
+                ...(row.recommendedAction === undefined
+                    ? {}
+                    : { recommendedAction: row.recommendedAction }),
+                reason: row.reason,
+                mode: row.mode,
+                applied: false,
+                createdAt: row.now,
+                updatedAt: row.now,
+            })
+                .onConflictDoNothing()
+                .returning({ decisionId: enforcements.decisionId });
+            return rows.length === 1;
+        },
+        async markSkipped(key, { skippedReason, recordedAs, now }) {
+            await db
+                .update(enforcements)
+                .set({
+                skippedReason,
+                // Absent means leave it: `recorded_as` only carries a value when the
+                // effect said the planned action amounted to something else.
+                ...(recordedAs === undefined ? {} : { recordedAs }),
+                updatedAt: now,
+            })
+                .where(keyFilter(key));
+        },
+        async markApplied(key, { appliedAt, previousState, now }) {
+            await db
+                .update(enforcements)
+                .set({
+                applied: true,
+                appliedAt,
+                /**
+                 * Written as `jsonb`, so it round-trips as the object it was rather
+                 * than as its `JSON.stringify` — a `text` column would hand a reversal
+                 * a string, and `previousState?.status` on a string is `undefined`,
+                 * which reads as "moderation displaced nothing" and restores a guess.
+                 *
+                 * Absent means leave it NULL: an action that changed state records what
+                 * it displaced, and one that did not must not claim it displaced
+                 * nothing-in-particular.
+                 */
+                ...(previousState === undefined ? {} : { previousState }),
+                updatedAt: now,
+            })
+                .where(keyFilter(key));
+        },
+        async releaseClaim(key) {
+            await db.delete(enforcements).where(keyFilter(key));
+        },
+        async latestApplied({ subjectType, subjectId, actions }) {
+            /**
+             * The reversal lookup, and every clause in it is load-bearing.
+             *
+             * `eq(applied, true)` — a row that was RECORDED and never carried out
+             * describes a state change that never happened, and it carries no
+             * `previous_state` at all. Reading it hands a reversal nothing and the
+             * application's fallback publishes a draft moderation only ever hid.
+             *
+             * `inArray(action, actions)` — one action may reverse several. The most
+             * recent APPLIED row across the whole declared set wins, so `apply`
+             * receives whatever actually happened last rather than whichever action
+             * happens to be first in the array. Note the membership is POSITIVE: a
+             * negated set (`not in (…)`) would render as `<> ALL (…)`, which no btree
+             * can serve, and the supporting index would quietly stop being used.
+             *
+             * `created_at desc NULLS LAST` with `limit(1)` — newest first, and the
+             * NULLS placement is written out because drizzle's two spellings of "desc"
+             * DISAGREE and the difference is a blocking sort.
+             *
+             * Measured on Postgres 17. `.desc()` inside a drizzle INDEX emits
+             * `DESC NULLS LAST`; `desc(column)` in an ORDER BY emits plain `DESC`,
+             * which in Postgres means NULLS FIRST. Those two orderings do not match, so
+             * no index can satisfy the sort and the plan gains a `Sort` node — even
+             * though `created_at` is NOT NULL and the two orderings can differ by
+             * nothing at all. With `nulls last` the plan is a plain index scan under
+             * the Limit:
+             *
+             *     desc            -> Limit → Sort (created_at DESC) → Index Scan …
+             *     desc nulls last -> Limit → Index Scan …
+             *
+             * Correct results either way, and a sort that grows with the number of
+             * enforcement rows for one subject. `postgresEnforcementStore.test.ts`
+             * asserts the absence of that `Sort` against the real planner.
+             */
+            const rows = await db
+                .select({
+                action: enforcements.action,
+                previousState: enforcements.previousState,
+            })
+                .from(enforcements)
+                .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(enforcements.subjectType, subjectType), (0, drizzle_orm_1.eq)(enforcements.subjectId, subjectId), (0, drizzle_orm_1.inArray)(enforcements.action, [...actions]), (0, drizzle_orm_1.eq)(enforcements.applied, true)))
+                .orderBy((0, drizzle_orm_1.sql) `${enforcements.createdAt} desc nulls last`)
+                .limit(1);
+            const [row] = rows;
+            if (row === undefined)
+                return null;
+            return {
+                action: row.action,
+                ...(row.previousState === null ? {} : { previousState: row.previousState }),
+            };
+        },
+    };
+}
+//# sourceMappingURL=enforcement.js.map

package/dist/outbox/postgres/store/enforcement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enforcement.js","sourceRoot":"","sources":["../../../../src/outbox/postgres/store/enforcement.ts"],"names":[],"mappings":";;AAiCA,4DAwJC;AAzLD,6CAAoD;AAQpD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,SAAgB,wBAAwB,CAAC,KAGxC;IACC,MAAM,EAAE,EAAE,EAAE,GAAG,KAAK,CAAC;IACrB,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC;IAE/C,mFAAmF;IACnF,MAAM,SAAS,GAAG,CAAC,GAA6B,EAAE,EAAE,CAClD,IAAA,iBAAG,EACD,IAAA,gBAAE,EAAC,YAAY,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,EAC3C,IAAA,gBAAE,EAAC,YAAY,CAAC,gBAAgB,EAAE,GAAG,CAAC,gBAAgB,CAAC,EACvD,IAAA,gBAAE,EAAC,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CACpC,CAAC;IAEJ,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,GAAG;YACb;;;;;;;;;;eAUG;YACH,MAAM,IAAI,GAAG,MAAM,EAAE;iBAClB,MAAM,CAAC,YAAY,CAAC;iBACpB,MAAM,CAAC;gBACN,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;gBACtC,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,GAAG,CAAC,GAAG,CAAC,iBAAiB,KAAK,SAAS;oBACrC,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,iBAAiB,EAAE,GAAG,CAAC,iBAAiB,EAAE,CAAC;gBACjD,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,OAAO,EAAE,KAAK;gBACd,SAAS,EAAE,GAAG,CAAC,GAAG;gBAClB,SAAS,EAAE,GAAG,CAAC,GAAG;aACnB,CAAC;iBACD,mBAAmB,EAAE;iBACrB,SAAS,CAAC,EAAE,UAAU,EAAE,YAAY,CAAC,UAAU,EAAE,CAAC,CAAC;YAEtD,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC;QAC3B,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,UAAU,EAAE,GAAG,EAAE;YACvD,MAAM,EAAE;iBACL,MAAM,CAAC,YAAY,CAAC;iBACpB,GAAG,CAAC;gBACH,aAAa;gBACb,qEAAqE;gBACrE,6DAA6D;gBAC7D,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;gBACnD,SAAS,EAAE,GAAG;aACf,CAAC;iBACD,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,EAAE;YACtD,MAAM,EAAE;iBACL,MAAM,CAAC,YAAY,CAAC;iBACpB,GAAG,CAAC;gBACH,OAAO,EAAE,IAAI;gBACb,SAAS;gBACT;;;;;;;;;mBASG;gBACH,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC;gBACzD,SAAS,EAAE,GAAG;aACf,CAAC;iBACD,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,GAAG;YACpB,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;QACtD,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE;YACrD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eAiCG;YACH,MAAM,IAAI,GAAG,MAAM,EAAE;iBAClB,MAAM,CAAC;gBACN,MAAM,EAAE,YAAY,CAAC,MAAM;gBAC3B,aAAa,EAAE,YAAY,CAAC,aAAa;aAC1C,CAAC;iBACD,IAAI,CAAC,YAAY,CAAC;iBAClB,KAAK,CACJ,IAAA,iBAAG,EACD,IAAA,gBAAE,EAAC,YAAY,CAAC,WAAW,EAAE,WAAW,CAAC,EACzC,IAAA,gBAAE,EAAC,YAAY,CAAC,SAAS,EAAE,SAAS,CAAC,EACrC,IAAA,qBAAO,EAAC,YAAY,CAAC,MAAM,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,EAC1C,IAAA,gBAAE,EAAC,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAC/B,CACF;iBACA,OAAO,CAAC,IAAA,iBAAG,EAAA,GAAG,YAAY,CAAC,SAAS,kBAAkB,CAAC;iBACvD,KAAK,CAAC,CAAC,CAAC,CAAC;YAEZ,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;YACnB,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC;YACnC,OAAO;gBACL,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,GAAG,CAAC,GAAG,CAAC,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,GAAG,CAAC,aAAa,EAAE,CAAC;aAC5E,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/outbox/postgres/store/events.d.ts

@@ -0,0 +1,46 @@
+import type { ModerationEventStore } from '../../store/types.js';
+import type { ModerationTables } from '../tables.js';
+import type { ModerationPgHandle } from './transaction.js';
+/**
+ * The inbound webhook event log, in Postgres.
+ *
+ * ## The one place this backend is structurally better rather than equivalent
+ *
+ * Everything else in this port aims for parity. This claim does not: it removes a
+ * failure mode instead of handling it, and the difference is worth being precise
+ * about, because "better" is otherwise just an adjective.
+ *
+ * **Mongo's claim throws and catches.** It inserts, and reads `code === 11000` to
+ * tell "somebody else has this event" from a real fault; everything that is not
+ * 11000 is rethrown, so a lost connection or a failover answers non-2xx and the
+ * event stays on the sender's retry schedule. That property is correct — and it
+ * lives in a PREDICATE. `catch { return false }` is one keystroke away, it
+ * type-checks, and it turns a connection failure into "already processed": the
+ * receiver answers 200 and a decision is retired that nobody ever handled. The
+ * only thing standing between those two behaviours is a conditional somebody
+ * could widen, and a test can only catch that by injecting a driver failure.
+ *
+ * **Postgres's claim does not throw at all.** `ON CONFLICT DO NOTHING` plus
+ * `RETURNING` makes a duplicate a ROW COUNT rather than an error: one row means
+ * this call took the claim, zero means somebody else holds it. So there is no
+ * catch block here — and therefore
+ *
+ *   - no predicate to widen,
+ *   - no code path that can convert a fault into a negative answer,
+ *   - and the "rethrow everything else" guarantee holds by the ABSENCE of code
+ *     rather than by the presence of correct code.
+ *
+ * That is the mechanism: the Mongo version is a property of code that exists and
+ * can be edited wrongly; this one is a property of code that does not exist. Only
+ * the second cannot be broken by a well-meaning change.
+ *
+ * The consequence for the mutation suite, stated because its absence would
+ * otherwise look like a gap: there is nothing to DELETE on the insert side, so no
+ * mutation can attack it. The one that exists attacks the READ — `rows.length === 1`
+ * collapsing to `true`, which would hand the same event to two handlers.
+ */
+export declare function postgresEventStore(input: {
+    db: ModerationPgHandle;
+    tables: ModerationTables;
+}): ModerationEventStore<ModerationPgHandle>;
+//# sourceMappingURL=events.d.ts.map

package/dist/outbox/postgres/store/events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../../../../src/outbox/postgres/store/events.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAE3D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE;IACxC,EAAE,EAAE,kBAAkB,CAAC;IACvB,MAAM,EAAE,gBAAgB,CAAC;CAC1B,GAAG,oBAAoB,CAAC,kBAAkB,CAAC,CAiE3C"}