@fidelios/server 0.0.1

package/dist/services/secrets.js

@@ -0,0 +1,289 @@
+import { and, desc, eq } from "drizzle-orm";
+import { companySecrets, companySecretVersions } from "@fidelios/db";
+import { envBindingSchema } from "@fidelios/shared";
+import { conflict, notFound, unprocessable } from "../errors.js";
+import { getSecretProvider, listSecretProviders } from "../secrets/provider-registry.js";
+const ENV_KEY_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+const SENSITIVE_ENV_KEY_RE = /(api[-_]?key|access[-_]?token|auth(?:_?token)?|authorization|bearer|secret|passwd|password|credential|jwt|private[-_]?key|cookie|connectionstring)/i;
+const REDACTED_SENTINEL = "***REDACTED***";
+function asRecord(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return null;
+    return value;
+}
+function isSensitiveEnvKey(key) {
+    return SENSITIVE_ENV_KEY_RE.test(key);
+}
+function canonicalizeBinding(binding) {
+    if (typeof binding === "string") {
+        return { type: "plain", value: binding };
+    }
+    if (binding.type === "plain") {
+        return { type: "plain", value: String(binding.value) };
+    }
+    return {
+        type: "secret_ref",
+        secretId: binding.secretId,
+        version: binding.version ?? "latest",
+    };
+}
+export function secretService(db) {
+    async function getById(id) {
+        return db
+            .select()
+            .from(companySecrets)
+            .where(eq(companySecrets.id, id))
+            .then((rows) => rows[0] ?? null);
+    }
+    async function getByName(companyId, name) {
+        return db
+            .select()
+            .from(companySecrets)
+            .where(and(eq(companySecrets.companyId, companyId), eq(companySecrets.name, name)))
+            .then((rows) => rows[0] ?? null);
+    }
+    async function getSecretVersion(secretId, version) {
+        return db
+            .select()
+            .from(companySecretVersions)
+            .where(and(eq(companySecretVersions.secretId, secretId), eq(companySecretVersions.version, version)))
+            .then((rows) => rows[0] ?? null);
+    }
+    async function assertSecretInCompany(companyId, secretId) {
+        const secret = await getById(secretId);
+        if (!secret)
+            throw notFound("Secret not found");
+        if (secret.companyId !== companyId)
+            throw unprocessable("Secret must belong to same company");
+        return secret;
+    }
+    async function resolveSecretValue(companyId, secretId, version) {
+        const secret = await assertSecretInCompany(companyId, secretId);
+        const resolvedVersion = version === "latest" ? secret.latestVersion : version;
+        const versionRow = await getSecretVersion(secret.id, resolvedVersion);
+        if (!versionRow)
+            throw notFound("Secret version not found");
+        const provider = getSecretProvider(secret.provider);
+        return provider.resolveVersion({
+            material: versionRow.material,
+            externalRef: secret.externalRef,
+        });
+    }
+    async function normalizeEnvConfig(companyId, envValue, opts) {
+        const record = asRecord(envValue);
+        if (!record)
+            throw unprocessable("adapterConfig.env must be an object");
+        const normalized = {};
+        for (const [key, rawBinding] of Object.entries(record)) {
+            if (!ENV_KEY_RE.test(key)) {
+                throw unprocessable(`Invalid environment variable name: ${key}`);
+            }
+            const parsed = envBindingSchema.safeParse(rawBinding);
+            if (!parsed.success) {
+                throw unprocessable(`Invalid environment binding for key: ${key}`);
+            }
+            const binding = canonicalizeBinding(parsed.data);
+            if (binding.type === "plain") {
+                if (opts?.strictMode && isSensitiveEnvKey(key) && binding.value.trim().length > 0) {
+                    throw unprocessable(`Strict secret mode requires secret references for sensitive key: ${key}`);
+                }
+                if (binding.value === REDACTED_SENTINEL) {
+                    throw unprocessable(`Refusing to persist redacted placeholder for key: ${key}`);
+                }
+                normalized[key] = binding;
+                continue;
+            }
+            await assertSecretInCompany(companyId, binding.secretId);
+            normalized[key] = {
+                type: "secret_ref",
+                secretId: binding.secretId,
+                version: binding.version,
+            };
+        }
+        return normalized;
+    }
+    async function normalizeAdapterConfigForPersistenceInternal(companyId, adapterConfig, opts) {
+        const normalized = { ...adapterConfig };
+        if (!Object.prototype.hasOwnProperty.call(adapterConfig, "env")) {
+            return normalized;
+        }
+        normalized.env = await normalizeEnvConfig(companyId, adapterConfig.env, opts);
+        return normalized;
+    }
+    return {
+        listProviders: () => listSecretProviders(),
+        list: (companyId) => db
+            .select()
+            .from(companySecrets)
+            .where(eq(companySecrets.companyId, companyId))
+            .orderBy(desc(companySecrets.createdAt)),
+        getById,
+        getByName,
+        resolveSecretValue,
+        create: async (companyId, input, actor) => {
+            const existing = await getByName(companyId, input.name);
+            if (existing)
+                throw conflict(`Secret already exists: ${input.name}`);
+            const provider = getSecretProvider(input.provider);
+            const prepared = await provider.createVersion({
+                value: input.value,
+                externalRef: input.externalRef ?? null,
+            });
+            return db.transaction(async (tx) => {
+                const secret = await tx
+                    .insert(companySecrets)
+                    .values({
+                    companyId,
+                    name: input.name,
+                    provider: input.provider,
+                    externalRef: prepared.externalRef,
+                    latestVersion: 1,
+                    description: input.description ?? null,
+                    createdByAgentId: actor?.agentId ?? null,
+                    createdByUserId: actor?.userId ?? null,
+                })
+                    .returning()
+                    .then((rows) => rows[0]);
+                await tx.insert(companySecretVersions).values({
+                    secretId: secret.id,
+                    version: 1,
+                    material: prepared.material,
+                    valueSha256: prepared.valueSha256,
+                    createdByAgentId: actor?.agentId ?? null,
+                    createdByUserId: actor?.userId ?? null,
+                });
+                return secret;
+            });
+        },
+        rotate: async (secretId, input, actor) => {
+            const secret = await getById(secretId);
+            if (!secret)
+                throw notFound("Secret not found");
+            const provider = getSecretProvider(secret.provider);
+            const nextVersion = secret.latestVersion + 1;
+            const prepared = await provider.createVersion({
+                value: input.value,
+                externalRef: input.externalRef ?? secret.externalRef ?? null,
+            });
+            return db.transaction(async (tx) => {
+                await tx.insert(companySecretVersions).values({
+                    secretId: secret.id,
+                    version: nextVersion,
+                    material: prepared.material,
+                    valueSha256: prepared.valueSha256,
+                    createdByAgentId: actor?.agentId ?? null,
+                    createdByUserId: actor?.userId ?? null,
+                });
+                const updated = await tx
+                    .update(companySecrets)
+                    .set({
+                    latestVersion: nextVersion,
+                    externalRef: prepared.externalRef,
+                    updatedAt: new Date(),
+                })
+                    .where(eq(companySecrets.id, secret.id))
+                    .returning()
+                    .then((rows) => rows[0] ?? null);
+                if (!updated)
+                    throw notFound("Secret not found");
+                return updated;
+            });
+        },
+        update: async (secretId, patch) => {
+            const secret = await getById(secretId);
+            if (!secret)
+                throw notFound("Secret not found");
+            if (patch.name && patch.name !== secret.name) {
+                const duplicate = await getByName(secret.companyId, patch.name);
+                if (duplicate && duplicate.id !== secret.id) {
+                    throw conflict(`Secret already exists: ${patch.name}`);
+                }
+            }
+            return db
+                .update(companySecrets)
+                .set({
+                name: patch.name ?? secret.name,
+                description: patch.description === undefined ? secret.description : patch.description,
+                externalRef: patch.externalRef === undefined ? secret.externalRef : patch.externalRef,
+                updatedAt: new Date(),
+            })
+                .where(eq(companySecrets.id, secret.id))
+                .returning()
+                .then((rows) => rows[0] ?? null);
+        },
+        remove: async (secretId) => {
+            const secret = await getById(secretId);
+            if (!secret)
+                return null;
+            await db.delete(companySecrets).where(eq(companySecrets.id, secretId));
+            return secret;
+        },
+        normalizeAdapterConfigForPersistence: async (companyId, adapterConfig, opts) => normalizeAdapterConfigForPersistenceInternal(companyId, adapterConfig, opts),
+        normalizeHireApprovalPayloadForPersistence: async (companyId, payload, opts) => {
+            const normalized = { ...payload };
+            const adapterConfig = asRecord(payload.adapterConfig);
+            if (adapterConfig) {
+                normalized.adapterConfig = await normalizeAdapterConfigForPersistenceInternal(companyId, adapterConfig, opts);
+            }
+            return normalized;
+        },
+        resolveEnvBindings: async (companyId, envValue) => {
+            const record = asRecord(envValue);
+            if (!record)
+                return { env: {}, secretKeys: new Set() };
+            const resolved = {};
+            const secretKeys = new Set();
+            for (const [key, rawBinding] of Object.entries(record)) {
+                if (!ENV_KEY_RE.test(key)) {
+                    throw unprocessable(`Invalid environment variable name: ${key}`);
+                }
+                const parsed = envBindingSchema.safeParse(rawBinding);
+                if (!parsed.success) {
+                    throw unprocessable(`Invalid environment binding for key: ${key}`);
+                }
+                const binding = canonicalizeBinding(parsed.data);
+                if (binding.type === "plain") {
+                    resolved[key] = binding.value;
+                }
+                else {
+                    resolved[key] = await resolveSecretValue(companyId, binding.secretId, binding.version);
+                    secretKeys.add(key);
+                }
+            }
+            return { env: resolved, secretKeys };
+        },
+        resolveAdapterConfigForRuntime: async (companyId, adapterConfig) => {
+            const resolved = { ...adapterConfig };
+            const secretKeys = new Set();
+            if (!Object.prototype.hasOwnProperty.call(adapterConfig, "env")) {
+                return { config: resolved, secretKeys };
+            }
+            const record = asRecord(adapterConfig.env);
+            if (!record) {
+                resolved.env = {};
+                return { config: resolved, secretKeys };
+            }
+            const env = {};
+            for (const [key, rawBinding] of Object.entries(record)) {
+                if (!ENV_KEY_RE.test(key)) {
+                    throw unprocessable(`Invalid environment variable name: ${key}`);
+                }
+                const parsed = envBindingSchema.safeParse(rawBinding);
+                if (!parsed.success) {
+                    throw unprocessable(`Invalid environment binding for key: ${key}`);
+                }
+                const binding = canonicalizeBinding(parsed.data);
+                if (binding.type === "plain") {
+                    env[key] = binding.value;
+                }
+                else {
+                    env[key] = await resolveSecretValue(companyId, binding.secretId, binding.version);
+                    secretKeys.add(key);
+                }
+            }
+            resolved.env = env;
+            return { config: resolved, secretKeys };
+        },
+    };
+}
+//# sourceMappingURL=secrets.js.map

package/dist/services/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/services/secrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAErE,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAEzF,MAAM,UAAU,GAAG,0BAA0B,CAAC;AAC9C,MAAM,oBAAoB,GACxB,qJAAqJ,CAAC;AACxJ,MAAM,iBAAiB,GAAG,gBAAgB,CAAC;AAM3C,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrF,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAW;IACpC,OAAO,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAmB;IAC9C,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAC3C,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC7B,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;IACzD,CAAC;IACD,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,QAAQ;KACrC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,EAAM;IAClC,KAAK,UAAU,OAAO,CAAC,EAAU;QAC/B,OAAO,EAAE;aACN,MAAM,EAAE;aACR,IAAI,CAAC,cAAc,CAAC;aACpB,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;aAChC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,UAAU,SAAS,CAAC,SAAiB,EAAE,IAAY;QACtD,OAAO,EAAE;aACN,MAAM,EAAE;aACR,IAAI,CAAC,cAAc,CAAC;aACpB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;aAClF,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,UAAU,gBAAgB,CAAC,QAAgB,EAAE,OAAe;QAC/D,OAAO,EAAE;aACN,MAAM,EAAE;aACR,IAAI,CAAC,qBAAqB,CAAC;aAC3B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,qBAAqB,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAC5C,EAAE,CAAC,qBAAqB,CAAC,OAAO,EAAE,OAAO,CAAC,CAC3C,CACF;aACA,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,UAAU,qBAAqB,CAAC,SAAiB,EAAE,QAAgB;QACtE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM;YAAE,MAAM,QAAQ,CAAC,kBAAkB,CAAC,CAAC;QAChD,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS;YAAE,MAAM,aAAa,CAAC,oCAAoC,CAAC,CAAC;QAC9F,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,UAAU,kBAAkB,CAC/B,SAAiB,EACjB,QAAgB,EAChB,OAA0B;QAE1B,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAChE,MAAM,eAAe,GAAG,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC;QAC9E,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC;QACtE,IAAI,CAAC,UAAU;YAAE,MAAM,QAAQ,CAAC,0BAA0B,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,QAA0B,CAAC,CAAC;QACtE,OAAO,QAAQ,CAAC,cAAc,CAAC;YAC7B,QAAQ,EAAE,UAAU,CAAC,QAAmC;YACxD,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,UAAU,kBAAkB,CAC/B,SAAiB,EACjB,QAAiB,EACjB,IAA+B;QAE/B,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAClC,IAAI,CAAC,MAAM;YAAE,MAAM,aAAa,CAAC,qCAAqC,CAAC,CAAC;QAExE,MAAM,UAAU,GAAmB,EAAE,CAAC;QACtC,KAAK,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACvD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1B,MAAM,aAAa,CAAC,sCAAsC,GAAG,EAAE,CAAC,CAAC;YACnE,CAAC;YAED,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;YACtD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,MAAM,aAAa,CAAC,wCAAwC,GAAG,EAAE,CAAC,CAAC;YACrE,CAAC;YAED,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,CAAC,IAAkB,CAAC,CAAC;YAC/D,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC7B,IAAI,IAAI,EAAE,UAAU,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAClF,MAAM,aAAa,CACjB,oEAAoE,GAAG,EAAE,CAC1E,CAAC;gBACJ,CAAC;gBACD,IAAI,OAAO,CAAC,KAAK,KAAK,iBAAiB,EAAE,CAAC;oBACxC,MAAM,aAAa,CAAC,qDAAqD,GAAG,EAAE,CAAC,CAAC;gBAClF,CAAC;gBACD,UAAU,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC;gBAC1B,SAAS;YACX,CAAC;YAED,MAAM,qBAAqB,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;YACzD,UAAU,CAAC,GAAG,CAAC,GAAG;gBAChB,IAAI,EAAE,YAAY;gBAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;aACzB,CAAC;QACJ,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,KAAK,UAAU,4CAA4C,CACzD,SAAiB,EACjB,aAAsC,EACtC,IAA+B;QAE/B,MAAM,UAAU,GAAG,EAAE,GAAG,aAAa,EAAE,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,EAAE,CAAC;YAChE,OAAO,UAAU,CAAC;QACpB,CAAC;QACD,UAAU,CAAC,GAAG,GAAG,MAAM,kBAAkB,CAAC,SAAS,EAAE,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC9E,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,OAAO;QACL,aAAa,EAAE,GAAG,EAAE,CAAC,mBAAmB,EAAE;QAE1C,IAAI,EAAE,CAAC,SAAiB,EAAE,EAAE,CAC1B,EAAE;aACC,MAAM,EAAE;aACR,IAAI,CAAC,cAAc,CAAC;aACpB,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;aAC9C,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QAE5C,OAAO;QACP,SAAS;QACT,kBAAkB;QAElB,MAAM,EAAE,KAAK,EACX,SAAiB,EACjB,KAMC,EACD,KAA2D,EAC3D,EAAE;YACF,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACxD,IAAI,QAAQ;gBAAE,MAAM,QAAQ,CAAC,0BAA0B,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YAErE,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACnD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,aAAa,CAAC;gBAC5C,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;aACvC,CAAC,CAAC;YAEH,OAAO,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;gBACjC,MAAM,MAAM,GAAG,MAAM,EAAE;qBACpB,MAAM,CAAC,cAAc,CAAC;qBACtB,MAAM,CAAC;oBACN,SAAS;oBACT,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,WAAW,EAAE,QAAQ,CAAC,WAAW;oBACjC,aAAa,EAAE,CAAC;oBAChB,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;oBACtC,gBAAgB,EAAE,KAAK,EAAE,OAAO,IAAI,IAAI;oBACxC,eAAe,EAAE,KAAK,EAAE,MAAM,IAAI,IAAI;iBACvC,CAAC;qBACD,SAAS,EAAE;qBACX,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;gBAE3B,MAAM,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,MAAM,CAAC;oBAC5C,QAAQ,EAAE,MAAM,CAAC,EAAE;oBACnB,OAAO,EAAE,CAAC;oBACV,QAAQ,EAAE,QAAQ,CAAC,QAAQ;oBAC3B,WAAW,EAAE,QAAQ,CAAC,WAAW;oBACjC,gBAAgB,EAAE,KAAK,EAAE,OAAO,IAAI,IAAI;oBACxC,eAAe,EAAE,KAAK,EAAE,MAAM,IAAI,IAAI;iBACvC,CAAC,CAAC;gBAEH,OAAO,MAAM,CAAC;YAChB,CAAC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,EAAE,KAAK,EACX,QAAgB,EAChB,KAAqD,EACrD,KAA2D,EAC3D,EAAE;YACF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC;YACvC,IAAI,CAAC,MAAM;gBAAE,MAAM,QAAQ,CAAC,kBAAkB,CAAC,CAAC;YAChD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,QAA0B,CAAC,CAAC;YACtE,MAAM,WAAW,GAAG,MAAM,CAAC,aAAa,GAAG,CAAC,CAAC;YAC7C,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,aAAa,CAAC;gBAC5C,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,MAAM,CAAC,WAAW,IAAI,IAAI;aAC7D,CAAC,CAAC;YAEH,OAAO,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;gBACjC,MAAM,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,MAAM,CAAC;oBAC5C,QAAQ,EAAE,MAAM,CAAC,EAAE;oBACnB,OAAO,EAAE,WAAW;oBACpB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;oBAC3B,WAAW,EAAE,QAAQ,CAAC,WAAW;oBACjC,gBAAgB,EAAE,KAAK,EAAE,OAAO,IAAI,IAAI;oBACxC,eAAe,EAAE,KAAK,EAAE,MAAM,IAAI,IAAI;iBACvC,CAAC,CAAC;gBAEH,MAAM,OAAO,GAAG,MAAM,EAAE;qBACrB,MAAM,CAAC,cAAc,CAAC;qBACtB,GAAG,CAAC;oBACH,aAAa,EAAE,WAAW;oBAC1B,WAAW,EAAE,QAAQ,CAAC,WAAW;oBACjC,SAAS,EAAE,IAAI,IAAI,EAAE;iBACtB,CAAC;qBACD,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;qBACvC,SAAS,EAAE;qBACX,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;gBAEnC,IAAI,CAAC,OAAO;oBAAE,MAAM,QAAQ,CAAC,kBAAkB,CAAC,CAAC;gBACjD,OAAO,OAAO,CAAC;YACjB,CAAC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,EAAE,KAAK,EACX,QAAgB,EAChB,KAAkF,EAClF,EAAE;YACF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC;YACvC,IAAI,CAAC,MAAM;gBAAE,MAAM,QAAQ,CAAC,kBAAkB,CAAC,CAAC;YAEhD,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC7C,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;gBAChE,IAAI,SAAS,IAAI,SAAS,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC;oBAC5C,MAAM,QAAQ,CAAC,0BAA0B,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;gBACzD,CAAC;YACH,CAAC;YAED,OAAO,EAAE;iBACN,MAAM,CAAC,cAAc,CAAC;iBACtB,GAAG,CAAC;gBACH,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI;gBAC/B,WAAW,EACT,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW;gBAC1E,WAAW,EACT,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW;gBAC1E,SAAS,EAAE,IAAI,IAAI,EAAE;aACtB,CAAC;iBACD,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;iBACvC,SAAS,EAAE;iBACX,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;QACrC,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,QAAgB,EAAE,EAAE;YACjC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC;YACvC,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YACzB,MAAM,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;YACvE,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,oCAAoC,EAAE,KAAK,EACzC,SAAiB,EACjB,aAAsC,EACtC,IAA+B,EAC/B,EAAE,CAAC,4CAA4C,CAAC,SAAS,EAAE,aAAa,EAAE,IAAI,CAAC;QAEjF,0CAA0C,EAAE,KAAK,EAC/C,SAAiB,EACjB,OAAgC,EAChC,IAA+B,EAC/B,EAAE;YACF,MAAM,UAAU,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;YAClC,MAAM,aAAa,GAAG,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;YACtD,IAAI,aAAa,EAAE,CAAC;gBAClB,UAAU,CAAC,aAAa,GAAG,MAAM,4CAA4C,CAC3E,SAAS,EACT,aAAa,EACb,IAAI,CACL,CAAC;YACJ,CAAC;YACD,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,kBAAkB,EAAE,KAAK,EAAE,SAAiB,EAAE,QAAiB,EAAqE,EAAE;YACpI,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAClC,IAAI,CAAC,MAAM;gBAAE,OAAO,EAAE,GAAG,EAAE,EAA4B,EAAE,UAAU,EAAE,IAAI,GAAG,EAAU,EAAE,CAAC;YACzF,MAAM,QAAQ,GAA2B,EAAE,CAAC;YAC5C,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;YAErC,KAAK,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBACvD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC1B,MAAM,aAAa,CAAC,sCAAsC,GAAG,EAAE,CAAC,CAAC;gBACnE,CAAC;gBACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;gBACtD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBACpB,MAAM,aAAa,CAAC,wCAAwC,GAAG,EAAE,CAAC,CAAC;gBACrE,CAAC;gBACD,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,CAAC,IAAkB,CAAC,CAAC;gBAC/D,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;oBAC7B,QAAQ,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC;gBAChC,CAAC;qBAAM,CAAC;oBACN,QAAQ,CAAC,GAAG,CAAC,GAAG,MAAM,kBAAkB,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;oBACvF,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACtB,CAAC;YACH,CAAC;YACD,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;QACvC,CAAC;QAED,8BAA8B,EAAE,KAAK,EAAE,SAAiB,EAAE,aAAsC,EAAyE,EAAE;YACzK,MAAM,QAAQ,GAAG,EAAE,GAAG,aAAa,EAAE,CAAC;YACtC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;YACrC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,EAAE,CAAC;gBAChE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;YAC1C,CAAC;YACD,MAAM,MAAM,GAAG,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;YAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,QAAQ,CAAC,GAAG,GAAG,EAAE,CAAC;gBAClB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;YAC1C,CAAC;YACD,MAAM,GAAG,GAA2B,EAAE,CAAC;YACvC,KAAK,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBACvD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC1B,MAAM,aAAa,CAAC,sCAAsC,GAAG,EAAE,CAAC,CAAC;gBACnE,CAAC;gBACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;gBACtD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBACpB,MAAM,aAAa,CAAC,wCAAwC,GAAG,EAAE,CAAC,CAAC;gBACrE,CAAC;gBACD,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,CAAC,IAAkB,CAAC,CAAC;gBAC/D,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;oBAC7B,GAAG,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC;gBAC3B,CAAC;qBAAM,CAAC;oBACN,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,kBAAkB,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;oBAClF,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACtB,CAAC;YACH,CAAC;YACD,QAAQ,CAAC,GAAG,GAAG,GAAG,CAAC;YACnB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;QAC1C,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/services/sidebar-badges.d.ts

@@ -0,0 +1,9 @@
+import type { Db } from "@fidelios/db";
+import type { SidebarBadges } from "@fidelios/shared";
+export declare function sidebarBadgeService(db: Db): {
+    get: (companyId: string, extra?: {
+        joinRequests?: number;
+        unreadTouchedIssues?: number;
+    }) => Promise<SidebarBadges>;
+};
+//# sourceMappingURL=sidebar-badges.d.ts.map

package/dist/services/sidebar-badges.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sidebar-badges.d.ts","sourceRoot":"","sources":["../../src/services/sidebar-badges.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,cAAc,CAAC;AAEvC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAKtD,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,EAAE;qBAGzB,MAAM,UACT;QAAE,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;KAAE,KAC9D,OAAO,CAAC,aAAa,CAAC;EAyC5B"}

package/dist/services/sidebar-badges.js

@@ -0,0 +1,33 @@
+import { and, desc, eq, inArray, not, sql } from "drizzle-orm";
+import { agents, approvals, heartbeatRuns } from "@fidelios/db";
+const ACTIONABLE_APPROVAL_STATUSES = ["pending", "revision_requested"];
+const FAILED_HEARTBEAT_STATUSES = ["failed", "timed_out"];
+export function sidebarBadgeService(db) {
+    return {
+        get: async (companyId, extra) => {
+            const actionableApprovals = await db
+                .select({ count: sql `count(*)` })
+                .from(approvals)
+                .where(and(eq(approvals.companyId, companyId), inArray(approvals.status, ACTIONABLE_APPROVAL_STATUSES)))
+                .then((rows) => Number(rows[0]?.count ?? 0));
+            const latestRunByAgent = await db
+                .selectDistinctOn([heartbeatRuns.agentId], {
+                runStatus: heartbeatRuns.status,
+            })
+                .from(heartbeatRuns)
+                .innerJoin(agents, eq(heartbeatRuns.agentId, agents.id))
+                .where(and(eq(heartbeatRuns.companyId, companyId), eq(agents.companyId, companyId), not(eq(agents.status, "terminated"))))
+                .orderBy(heartbeatRuns.agentId, desc(heartbeatRuns.createdAt));
+            const failedRuns = latestRunByAgent.filter((row) => FAILED_HEARTBEAT_STATUSES.includes(row.runStatus)).length;
+            const joinRequests = extra?.joinRequests ?? 0;
+            const unreadTouchedIssues = extra?.unreadTouchedIssues ?? 0;
+            return {
+                inbox: actionableApprovals + failedRuns + joinRequests + unreadTouchedIssues,
+                approvals: actionableApprovals,
+                failedRuns,
+                joinRequests,
+            };
+        },
+    };
+}
+//# sourceMappingURL=sidebar-badges.js.map

package/dist/services/sidebar-badges.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sidebar-badges.js","sourceRoot":"","sources":["../../src/services/sidebar-badges.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAE/D,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAGhE,MAAM,4BAA4B,GAAG,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;AACvE,MAAM,yBAAyB,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;AAE1D,MAAM,UAAU,mBAAmB,CAAC,EAAM;IACxC,OAAO;QACL,GAAG,EAAE,KAAK,EACR,SAAiB,EACjB,KAA+D,EACvC,EAAE;YAC1B,MAAM,mBAAmB,GAAG,MAAM,EAAE;iBACjC,MAAM,CAAC,EAAE,KAAK,EAAE,GAAG,CAAQ,UAAU,EAAE,CAAC;iBACxC,IAAI,CAAC,SAAS,CAAC;iBACf,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,EAClC,OAAO,CAAC,SAAS,CAAC,MAAM,EAAE,4BAA4B,CAAC,CACxD,CACF;iBACA,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC;YAE/C,MAAM,gBAAgB,GAAG,MAAM,EAAE;iBAC9B,gBAAgB,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE;gBACzC,SAAS,EAAE,aAAa,CAAC,MAAM;aAChC,CAAC;iBACD,IAAI,CAAC,aAAa,CAAC;iBACnB,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;iBACvD,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,SAAS,CAAC,EACtC,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,EAC/B,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CACrC,CACF;iBACA,OAAO,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;YAEjE,MAAM,UAAU,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CACjD,yBAAyB,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAClD,CAAC,MAAM,CAAC;YAET,MAAM,YAAY,GAAG,KAAK,EAAE,YAAY,IAAI,CAAC,CAAC;YAC9C,MAAM,mBAAmB,GAAG,KAAK,EAAE,mBAAmB,IAAI,CAAC,CAAC;YAC5D,OAAO;gBACL,KAAK,EAAE,mBAAmB,GAAG,UAAU,GAAG,YAAY,GAAG,mBAAmB;gBAC5E,SAAS,EAAE,mBAAmB;gBAC9B,UAAU;gBACV,YAAY;aACb,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/services/work-products.d.ts

@@ -0,0 +1,14 @@
+import type { Db } from "@fidelios/db";
+import { issueWorkProducts } from "@fidelios/db";
+import type { IssueWorkProduct } from "@fidelios/shared";
+type IssueWorkProductRow = typeof issueWorkProducts.$inferSelect;
+declare function toIssueWorkProduct(row: IssueWorkProductRow): IssueWorkProduct;
+export declare function workProductService(db: Db): {
+    listForIssue: (issueId: string) => Promise<IssueWorkProduct[]>;
+    getById: (id: string) => Promise<IssueWorkProduct | null>;
+    createForIssue: (issueId: string, companyId: string, data: Omit<typeof issueWorkProducts.$inferInsert, "issueId" | "companyId">) => Promise<IssueWorkProduct | null>;
+    update: (id: string, patch: Partial<typeof issueWorkProducts.$inferInsert>) => Promise<IssueWorkProduct | null>;
+    remove: (id: string) => Promise<IssueWorkProduct | null>;
+};
+export { toIssueWorkProduct };
+//# sourceMappingURL=work-products.d.ts.map

package/dist/services/work-products.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"work-products.d.ts","sourceRoot":"","sources":["../../src/services/work-products.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEzD,KAAK,mBAAmB,GAAG,OAAO,iBAAiB,CAAC,YAAY,CAAC;AAEjE,iBAAS,kBAAkB,CAAC,GAAG,EAAE,mBAAmB,GAAG,gBAAgB,CAuBtE;AAED,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,EAAE;4BAEP,MAAM;kBAShB,MAAM;8BASM,MAAM,aAAa,MAAM,QAAQ,IAAI,CAAC,OAAO,iBAAiB,CAAC,YAAY,EAAE,SAAS,GAAG,WAAW,CAAC;iBA2BlH,MAAM,SAAS,OAAO,CAAC,OAAO,iBAAiB,CAAC,YAAY,CAAC;iBAgC7D,MAAM;EAS5B;AAED,OAAO,EAAE,kBAAkB,EAAE,CAAC"}

package/dist/services/work-products.js

@@ -0,0 +1,100 @@
+import { and, desc, eq } from "drizzle-orm";
+import { issueWorkProducts } from "@fidelios/db";
+function toIssueWorkProduct(row) {
+    return {
+        id: row.id,
+        companyId: row.companyId,
+        projectId: row.projectId ?? null,
+        issueId: row.issueId,
+        executionWorkspaceId: row.executionWorkspaceId ?? null,
+        runtimeServiceId: row.runtimeServiceId ?? null,
+        type: row.type,
+        provider: row.provider,
+        externalId: row.externalId ?? null,
+        title: row.title,
+        url: row.url ?? null,
+        status: row.status,
+        reviewState: row.reviewState,
+        isPrimary: row.isPrimary,
+        healthStatus: row.healthStatus,
+        summary: row.summary ?? null,
+        metadata: row.metadata ?? null,
+        createdByRunId: row.createdByRunId ?? null,
+        createdAt: row.createdAt,
+        updatedAt: row.updatedAt,
+    };
+}
+export function workProductService(db) {
+    return {
+        listForIssue: async (issueId) => {
+            const rows = await db
+                .select()
+                .from(issueWorkProducts)
+                .where(eq(issueWorkProducts.issueId, issueId))
+                .orderBy(desc(issueWorkProducts.isPrimary), desc(issueWorkProducts.updatedAt));
+            return rows.map(toIssueWorkProduct);
+        },
+        getById: async (id) => {
+            const row = await db
+                .select()
+                .from(issueWorkProducts)
+                .where(eq(issueWorkProducts.id, id))
+                .then((rows) => rows[0] ?? null);
+            return row ? toIssueWorkProduct(row) : null;
+        },
+        createForIssue: async (issueId, companyId, data) => {
+            const row = await db.transaction(async (tx) => {
+                if (data.isPrimary) {
+                    await tx
+                        .update(issueWorkProducts)
+                        .set({ isPrimary: false, updatedAt: new Date() })
+                        .where(and(eq(issueWorkProducts.companyId, companyId), eq(issueWorkProducts.issueId, issueId), eq(issueWorkProducts.type, data.type)));
+                }
+                return await tx
+                    .insert(issueWorkProducts)
+                    .values({
+                    ...data,
+                    companyId,
+                    issueId,
+                })
+                    .returning()
+                    .then((rows) => rows[0] ?? null);
+            });
+            return row ? toIssueWorkProduct(row) : null;
+        },
+        update: async (id, patch) => {
+            const row = await db.transaction(async (tx) => {
+                const existing = await tx
+                    .select()
+                    .from(issueWorkProducts)
+                    .where(eq(issueWorkProducts.id, id))
+                    .then((rows) => rows[0] ?? null);
+                if (!existing)
+                    return null;
+                if (patch.isPrimary === true) {
+                    await tx
+                        .update(issueWorkProducts)
+                        .set({ isPrimary: false, updatedAt: new Date() })
+                        .where(and(eq(issueWorkProducts.companyId, existing.companyId), eq(issueWorkProducts.issueId, existing.issueId), eq(issueWorkProducts.type, existing.type)));
+                }
+                return await tx
+                    .update(issueWorkProducts)
+                    .set({ ...patch, updatedAt: new Date() })
+                    .where(eq(issueWorkProducts.id, id))
+                    .returning()
+                    .then((rows) => rows[0] ?? null);
+            });
+            return row ? toIssueWorkProduct(row) : null;
+        },
+        remove: async (id) => {
+            const row = await db
+                .delete(issueWorkProducts)
+                .where(eq(issueWorkProducts.id, id))
+                .returning()
+                .then((rows) => rows[0] ?? null);
+            return row ? toIssueWorkProduct(row) : null;
+        },
+    };
+}
+export { toIssueWorkProduct };
+//# sourceMappingURL=work-products.js.map

package/dist/services/work-products.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"work-products.js","sourceRoot":"","sources":["../../src/services/work-products.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAKjD,SAAS,kBAAkB,CAAC,GAAwB;IAClD,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI;QAChC,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,oBAAoB,EAAE,GAAG,CAAC,oBAAoB,IAAI,IAAI;QACtD,gBAAgB,EAAE,GAAG,CAAC,gBAAgB,IAAI,IAAI;QAC9C,IAAI,EAAE,GAAG,CAAC,IAAgC;QAC1C,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,IAAI;QAClC,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,IAAI;QACpB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,WAAW,EAAE,GAAG,CAAC,WAA8C;QAC/D,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,YAAY,EAAE,GAAG,CAAC,YAAgD;QAClE,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,IAAI;QAC5B,QAAQ,EAAG,GAAG,CAAC,QAA2C,IAAI,IAAI;QAClE,cAAc,EAAE,GAAG,CAAC,cAAc,IAAI,IAAI;QAC1C,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,SAAS,EAAE,GAAG,CAAC,SAAS;KACzB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,EAAM;IACvC,OAAO;QACL,YAAY,EAAE,KAAK,EAAE,OAAe,EAAE,EAAE;YACtC,MAAM,IAAI,GAAG,MAAM,EAAE;iBAClB,MAAM,EAAE;iBACR,IAAI,CAAC,iBAAiB,CAAC;iBACvB,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;iBAC7C,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC;YACjF,OAAO,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QACtC,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,EAAU,EAAE,EAAE;YAC5B,MAAM,GAAG,GAAG,MAAM,EAAE;iBACjB,MAAM,EAAE;iBACR,IAAI,CAAC,iBAAiB,CAAC;iBACvB,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;iBACnC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;YACnC,OAAO,GAAG,CAAC,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9C,CAAC;QAED,cAAc,EAAE,KAAK,EAAE,OAAe,EAAE,SAAiB,EAAE,IAA0E,EAAE,EAAE;YACvI,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;gBAC5C,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;oBACnB,MAAM,EAAE;yBACL,MAAM,CAAC,iBAAiB,CAAC;yBACzB,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;yBAChD,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,iBAAiB,CAAC,SAAS,EAAE,SAAS,CAAC,EAC1C,EAAE,CAAC,iBAAiB,CAAC,OAAO,EAAE,OAAO,CAAC,EACtC,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CACtC,CACF,CAAC;gBACN,CAAC;gBACD,OAAO,MAAM,EAAE;qBACZ,MAAM,CAAC,iBAAiB,CAAC;qBACzB,MAAM,CAAC;oBACN,GAAG,IAAI;oBACP,SAAS;oBACT,OAAO;iBACR,CAAC;qBACD,SAAS,EAAE;qBACX,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;YACrC,CAAC,CAAC,CAAC;YACH,OAAO,GAAG,CAAC,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9C,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,EAAU,EAAE,KAAqD,EAAE,EAAE;YAClF,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;gBAC5C,MAAM,QAAQ,GAAG,MAAM,EAAE;qBACtB,MAAM,EAAE;qBACR,IAAI,CAAC,iBAAiB,CAAC;qBACvB,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;qBACnC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;gBACnC,IAAI,CAAC,QAAQ;oBAAE,OAAO,IAAI,CAAC;gBAE3B,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;oBAC7B,MAAM,EAAE;yBACL,MAAM,CAAC,iBAAiB,CAAC;yBACzB,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;yBAChD,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,iBAAiB,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,EACnD,EAAE,CAAC,iBAAiB,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,EAC/C,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,CAC1C,CACF,CAAC;gBACN,CAAC;gBAED,OAAO,MAAM,EAAE;qBACZ,MAAM,CAAC,iBAAiB,CAAC;qBACzB,GAAG,CAAC,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;qBACxC,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;qBACnC,SAAS,EAAE;qBACX,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;YACrC,CAAC,CAAC,CAAC;YACH,OAAO,GAAG,CAAC,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9C,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,EAAU,EAAE,EAAE;YAC3B,MAAM,GAAG,GAAG,MAAM,EAAE;iBACjB,MAAM,CAAC,iBAAiB,CAAC;iBACzB,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;iBACnC,SAAS,EAAE;iBACX,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;YACnC,OAAO,GAAG,CAAC,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9C,CAAC;KACF,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,kBAAkB,EAAE,CAAC"}

package/dist/services/workspace-operation-log-store.d.ts

@@ -0,0 +1,33 @@
+export type WorkspaceOperationLogStoreType = "local_file";
+export interface WorkspaceOperationLogHandle {
+    store: WorkspaceOperationLogStoreType;
+    logRef: string;
+}
+export interface WorkspaceOperationLogReadOptions {
+    offset?: number;
+    limitBytes?: number;
+}
+export interface WorkspaceOperationLogReadResult {
+    content: string;
+    nextOffset?: number;
+}
+export interface WorkspaceOperationLogFinalizeSummary {
+    bytes: number;
+    sha256?: string;
+    compressed: boolean;
+}
+export interface WorkspaceOperationLogStore {
+    begin(input: {
+        companyId: string;
+        operationId: string;
+    }): Promise<WorkspaceOperationLogHandle>;
+    append(handle: WorkspaceOperationLogHandle, event: {
+        stream: "stdout" | "stderr" | "system";
+        chunk: string;
+        ts: string;
+    }): Promise<void>;
+    finalize(handle: WorkspaceOperationLogHandle): Promise<WorkspaceOperationLogFinalizeSummary>;
+    read(handle: WorkspaceOperationLogHandle, opts?: WorkspaceOperationLogReadOptions): Promise<WorkspaceOperationLogReadResult>;
+}
+export declare function getWorkspaceOperationLogStore(): WorkspaceOperationLogStore;
+//# sourceMappingURL=workspace-operation-log-store.d.ts.map

package/dist/services/workspace-operation-log-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-operation-log-store.d.ts","sourceRoot":"","sources":["../../src/services/workspace-operation-log-store.ts"],"names":[],"mappings":"AAMA,MAAM,MAAM,8BAA8B,GAAG,YAAY,CAAC;AAE1D,MAAM,WAAW,2BAA2B;IAC1C,KAAK,EAAE,8BAA8B,CAAC;IACtC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,gCAAgC;IAC/C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,+BAA+B;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,oCAAoC;IACnD,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,0BAA0B;IACzC,KAAK,CAAC,KAAK,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAC/F,MAAM,CACJ,MAAM,EAAE,2BAA2B,EACnC,KAAK,EAAE;QAAE,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAC3E,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,QAAQ,CAAC,MAAM,EAAE,2BAA2B,GAAG,OAAO,CAAC,oCAAoC,CAAC,CAAC;IAC7F,IAAI,CAAC,MAAM,EAAE,2BAA2B,EAAE,IAAI,CAAC,EAAE,gCAAgC,GAAG,OAAO,CAAC,+BAA+B,CAAC,CAAC;CAC9H;AAgHD,wBAAgB,6BAA6B,+BAM5C"}

package/dist/services/workspace-operation-log-store.js

@@ -0,0 +1,110 @@
+import { createReadStream, promises as fs } from "node:fs";
+import path from "node:path";
+import { createHash } from "node:crypto";
+import { notFound } from "../errors.js";
+import { resolveFideliOSInstanceRoot } from "../home-paths.js";
+function safeSegments(...segments) {
+    return segments.map((segment) => segment.replace(/[^a-zA-Z0-9._-]/g, "_"));
+}
+function resolveWithin(basePath, relativePath) {
+    const resolved = path.resolve(basePath, relativePath);
+    const base = path.resolve(basePath) + path.sep;
+    if (!resolved.startsWith(base) && resolved !== path.resolve(basePath)) {
+        throw new Error("Invalid log path");
+    }
+    return resolved;
+}
+function createLocalFileWorkspaceOperationLogStore(basePath) {
+    async function ensureDir(relativeDir) {
+        const dir = resolveWithin(basePath, relativeDir);
+        await fs.mkdir(dir, { recursive: true });
+    }
+    async function readFileRange(filePath, offset, limitBytes) {
+        const stat = await fs.stat(filePath).catch(() => null);
+        if (!stat)
+            throw notFound("Workspace operation log not found");
+        const start = Math.max(0, Math.min(offset, stat.size));
+        const end = Math.max(start, Math.min(start + limitBytes - 1, stat.size - 1));
+        if (start > end) {
+            return { content: "", nextOffset: start };
+        }
+        const chunks = [];
+        await new Promise((resolve, reject) => {
+            const stream = createReadStream(filePath, { start, end });
+            stream.on("data", (chunk) => {
+                chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+            });
+            stream.on("error", reject);
+            stream.on("end", () => resolve());
+        });
+        const content = Buffer.concat(chunks).toString("utf8");
+        const nextOffset = end + 1 < stat.size ? end + 1 : undefined;
+        return { content, nextOffset };
+    }
+    async function sha256File(filePath) {
+        return new Promise((resolve, reject) => {
+            const hash = createHash("sha256");
+            const stream = createReadStream(filePath);
+            stream.on("data", (chunk) => hash.update(chunk));
+            stream.on("error", reject);
+            stream.on("end", () => resolve(hash.digest("hex")));
+        });
+    }
+    return {
+        async begin(input) {
+            const [companyId] = safeSegments(input.companyId);
+            const operationId = safeSegments(input.operationId)[0];
+            const relDir = companyId;
+            const relPath = path.join(relDir, `${operationId}.ndjson`);
+            await ensureDir(relDir);
+            const absPath = resolveWithin(basePath, relPath);
+            await fs.writeFile(absPath, "", "utf8");
+            return { store: "local_file", logRef: relPath };
+        },
+        async append(handle, event) {
+            if (handle.store !== "local_file")
+                return;
+            const absPath = resolveWithin(basePath, handle.logRef);
+            const line = JSON.stringify({
+                ts: event.ts,
+                stream: event.stream,
+                chunk: event.chunk,
+            });
+            await fs.appendFile(absPath, `${line}\n`, "utf8");
+        },
+        async finalize(handle) {
+            if (handle.store !== "local_file") {
+                return { bytes: 0, compressed: false };
+            }
+            const absPath = resolveWithin(basePath, handle.logRef);
+            const stat = await fs.stat(absPath).catch(() => null);
+            if (!stat)
+                throw notFound("Workspace operation log not found");
+            const hash = await sha256File(absPath);
+            return {
+                bytes: stat.size,
+                sha256: hash,
+                compressed: false,
+            };
+        },
+        async read(handle, opts) {
+            if (handle.store !== "local_file") {
+                throw notFound("Workspace operation log not found");
+            }
+            const absPath = resolveWithin(basePath, handle.logRef);
+            const offset = opts?.offset ?? 0;
+            const limitBytes = opts?.limitBytes ?? 256_000;
+            return readFileRange(absPath, offset, limitBytes);
+        },
+    };
+}
+let cachedStore = null;
+export function getWorkspaceOperationLogStore() {
+    if (cachedStore)
+        return cachedStore;
+    const basePath = process.env.WORKSPACE_OPERATION_LOG_BASE_PATH
+        ?? path.resolve(resolveFideliOSInstanceRoot(), "data", "workspace-operation-logs");
+    cachedStore = createLocalFileWorkspaceOperationLogStore(basePath);
+    return cachedStore;
+}
+//# sourceMappingURL=workspace-operation-log-store.js.map