@gmickel/gno 1.28.0 → 1.29.0

package/src/store/sqlite/retrieval-trace-store.ts

@@ -2,6 +2,7 @@
 
 import type { Database } from "bun:sqlite";
 
+import type { EgressLineage } from "../../core/egress-provenance";
 import type {
   RetrievalTraceAppendResult,
   RetrievalTraceBundle,
@@ -16,8 +17,13 @@ import type {
   StoreResult,
 } from "../types";
 
+import {
+  egressLineageSchema,
+  mergeEgressLineages,
+} from "../../core/egress-provenance";
 import {
   canonicalTraceJson,
+  hashLegacyRetrievalTraceCreation,
   hashRetrievalTraceCreation,
   hashTraceCanonical,
   parseRetrievalTraceEventInput,
@@ -113,6 +119,7 @@ export const createTrace = (
     const queryShapeJson = canonicalTraceJson(trace.queryShape);
     const goalShapeJson = canonicalTraceJson(trace.goalShape);
     const filtersJson = canonicalTraceJson(trace.filters);
+    const egressLineageJson = canonicalTraceJson(trace.egressLineage);
     const queryBytes = enforceByteLimit(
       trace.queryText ?? "",
       8192,
@@ -138,16 +145,23 @@ export const createTrace = (
       16_384,
       "Retrieval trace filters"
     );
+    const egressLineageBytes = enforceByteLimit(
+      egressLineageJson,
+      32_768,
+      "Retrieval trace egress lineage"
+    );
     const creationDigest = hashRetrievalTraceCreation(trace);
     const insert = db.run(
       `INSERT OR IGNORE INTO retrieval_traces (
          trace_id, schema_version, redaction_mode, replay_capable,
          query_text, query_digest, query_shape_json,
          goal_text, goal_digest, goal_shape_json, filters_json,
+         effective_egress_policy, egress_lineage_digest,
+         egress_lineage_json, egress_lineage_bytes,
          pipeline_fingerprint, model_fingerprint, config_fingerprint,
          index_fingerprint, status, created_at_ms, updated_at_ms,
-         expires_at_ms, byte_size, creation_digest
-       ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+         expires_at_ms, byte_size, creation_digest, creation_digest_version
+       ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
       [
         trace.traceId,
         trace.schemaVersion,
@@ -160,6 +174,10 @@ export const createTrace = (
         trace.goalDigest,
         goalShapeJson,
         filtersJson,
+        trace.egressLineage.effectivePolicy,
+        trace.egressLineage.digest,
+        egressLineageJson,
+        egressLineageBytes,
         trace.fingerprints.pipeline,
         trace.fingerprints.model,
         trace.fingerprints.config,
@@ -170,15 +188,51 @@ export const createTrace = (
         trace.expiresAtMs,
         queryBytes + shapeBytes + goalBytes + goalShapeBytes + filterBytes,
         creationDigest,
+        1,
       ]
     );
     if (insert.changes > 0) return ok("inserted");
     const stored = db
-      .query<{ creation_digest: string }, [string]>(
-        "SELECT creation_digest FROM retrieval_traces WHERE trace_id = ?"
+      .query<
+        {
+          creation_digest: string;
+          creation_digest_version: 0 | 1;
+          egress_lineage_digest: string;
+          egress_lineage_json: string;
+        },
+        [string]
+      >(
+        `SELECT creation_digest, creation_digest_version,
+                egress_lineage_digest, egress_lineage_json
+         FROM retrieval_traces WHERE trace_id = ?`
       )
       .get(trace.traceId);
-    if (stored?.creation_digest === creationDigest) return ok("duplicate");
+    if (stored?.creation_digest === creationDigest) {
+      if (stored.creation_digest_version === 0) {
+        db.run(
+          `UPDATE retrieval_traces SET creation_digest_version = 1
+           WHERE trace_id = ? AND creation_digest_version = 0`,
+          [trace.traceId]
+        );
+      }
+      return ok("duplicate");
+    }
+    const legacyLineage =
+      '{"digest":"87b249b76459c91c172da6be6cbe3f93b61c44869eb196f3470ec36ebb50b8b0","effectivePolicy":"local_only","sources":[{"collection":"legacy","policy":"local_only","source":"legacy_default"}]}';
+    if (
+      stored?.creation_digest_version === 0 &&
+      stored.egress_lineage_digest === trace.egressLineage.digest &&
+      stored.egress_lineage_json === legacyLineage &&
+      stored.creation_digest === hashLegacyRetrievalTraceCreation(trace)
+    ) {
+      db.run(
+        `UPDATE retrieval_traces
+         SET creation_digest = ?, creation_digest_version = 1
+         WHERE trace_id = ? AND creation_digest_version = 0`,
+        [creationDigest, trace.traceId]
+      );
+      return ok("duplicate");
+    }
     return err(
       "CONSTRAINT_VIOLATION",
       `trace_id ${trace.traceId} already exists with different content`
@@ -188,6 +242,51 @@ export const createTrace = (
   }
 };
 
+export const mergeTraceEgressLineage = (
+  db: Database,
+  traceId: string,
+  input: EgressLineage
+): StoreResult<RetrievalTraceAppendResult> => {
+  try {
+    validateTraceId(traceId, "traceId");
+    const incoming = egressLineageSchema.parse(input);
+    const stored = db
+      .query<{ egress_lineage_json: string }, [string]>(
+        "SELECT egress_lineage_json FROM retrieval_traces WHERE trace_id = ?"
+      )
+      .get(traceId);
+    if (!stored)
+      return err("NOT_FOUND", `Retrieval trace ${traceId} not found`);
+    const current = egressLineageSchema.parse(
+      JSON.parse(stored.egress_lineage_json)
+    );
+    const merged = mergeEgressLineages([current, incoming]);
+    if (merged.digest === current.digest) return ok("duplicate");
+    const lineageJson = canonicalTraceJson(merged);
+    const lineageBytes = enforceByteLimit(
+      lineageJson,
+      32_768,
+      "Retrieval trace egress lineage"
+    );
+    db.run(
+      `UPDATE retrieval_traces
+       SET effective_egress_policy = ?, egress_lineage_digest = ?,
+           egress_lineage_json = ?, egress_lineage_bytes = ?
+       WHERE trace_id = ?`,
+      [
+        merged.effectivePolicy,
+        merged.digest,
+        lineageJson,
+        lineageBytes,
+        traceId,
+      ]
+    );
+    return ok("inserted");
+  } catch (cause) {
+    return traceWriteError(cause, "Failed to merge retrieval trace lineage");
+  }
+};
+
 export const getTrace = (
   db: Database,
   traceId: string

package/src/store/types.ts

@@ -5,8 +5,15 @@
  * @module src/store/types
  */
 
-import type { Collection, Context, FtsTokenizer } from "../config/types";
+import type {
+  Collection,
+  Context,
+  EgressPolicy,
+  EgressPolicySource,
+  FtsTokenizer,
+} from "../config/types";
 import type { RecordAnchor, RecordMetadata } from "../converters/types";
+import type { EgressLineage } from "../core/egress-provenance";
 
 // ─────────────────────────────────────────────────────────────────────────────
 // Error Types
@@ -25,6 +32,7 @@ export type StoreErrorCode =
   | "INVALID_INPUT"
   | "IO_ERROR"
   | "INTERNAL"
+  | "EGRESS_DENIED"
   // Vector-specific error codes (EPIC 7)
   | "VECTOR_WRITE_FAILED"
   | "VECTOR_DELETE_FAILED"
@@ -73,6 +81,10 @@ export interface CollectionRow {
   exclude: string[] | null;
   updateCmd: string | null;
   languageHint: string | null;
+  /** Effective fail-closed content transfer boundary. */
+  egressPolicy: EgressPolicy;
+  /** Whether policy was explicit or supplied by a safe default. */
+  egressPolicySource: EgressPolicySource;
   syncedAt: string;
 }
 
@@ -397,6 +409,7 @@ export interface DocumentChangeRow {
   oldActive: boolean | null;
   newActive: boolean | null;
   structureDelta: DocumentChangeStructureDelta;
+  egressLineage: EgressLineage;
   observedAtMs: number;
   byteSize: number;
 }
@@ -612,6 +625,10 @@ export interface FtsResult {
 export interface CollectionStatus {
   name: string;
   path: string;
+  /** Effective fail-closed content transfer boundary. */
+  egressPolicy: EgressPolicy;
+  /** Whether policy was explicit or supplied by a safe default. */
+  egressPolicySource: EgressPolicySource;
   totalDocuments: number;
   activeDocuments: number;
   errorDocuments: number;
@@ -1089,6 +1106,8 @@ export interface RetrievalTraceInput {
     terms: number;
   };
   filters: Record<string, unknown>;
+  /** Trusted collection ownership, independent from privacy-redacted filters. */
+  egressLineage: EgressLineage;
   fingerprints: RetrievalTraceFingerprints;
   status: "open";
   createdAtMs: number;
@@ -1173,6 +1192,7 @@ export interface RetrievalTraceExportManifestInput {
   traceIds: string[];
   format: RetrievalTraceExportFormat;
   artifactHash: string;
+  egressLineage: EgressLineage;
   createdAtMs: number;
 }
 
@@ -1183,6 +1203,65 @@ export interface RetrievalTraceExportManifestRow extends Omit<
   traceIds: string[];
 }
 
+export type EgressAuditDecision = "allow" | "deny";
+
+export interface EgressAuditReceiptInput {
+  auditId: string;
+  decision: EgressAuditDecision;
+  action: import("../core/egress-policy").EgressAction;
+  destinationZone: import("../core/egress-policy").EgressDestinationZone;
+  contentClass: import("../core/egress-policy").EgressContentClass;
+  effectivePolicy: EgressPolicy;
+  reasonCode: import("../core/egress-policy").EgressReasonCode;
+  lineageDigest: string;
+  createdAtMs: number;
+  expiresAtMs: number;
+}
+
+export interface EgressAuditReceiptRow extends EgressAuditReceiptInput {
+  byteSize: number;
+}
+
+export interface EgressAuditCursor {
+  createdAtMs: number;
+  auditId: string;
+}
+
+export interface EgressAuditPage {
+  receipts: EgressAuditReceiptRow[];
+  nextCursor: EgressAuditCursor | null;
+}
+
+export interface EgressAuditRetentionPolicy {
+  maxAgeDays: number;
+  maxReceipts: number;
+  maxBytes: number;
+}
+
+export interface EgressAuditRetentionResult {
+  deleted: number;
+  remainingReceipts: number;
+  remainingBytes: number;
+}
+
+export interface EgressAuditPurgeResult {
+  deleted: number;
+  physicalCleanup: RetrievalTracePhysicalCleanupStatus;
+  checkpointedFrames: number;
+  remainingWalFrames: number;
+}
+
+export interface EgressAuditDeleteResult extends EgressAuditPurgeResult {
+  auditId: string;
+}
+
+export interface EgressAuditStatusResult {
+  receipts: number;
+  bytes: number;
+  oldestCreatedAtMs: number | null;
+  newestCreatedAtMs: number | null;
+}
+
 export interface RetrievalTraceBundle {
   trace: RetrievalTraceRow;
   runs: RetrievalTraceRunRow[];
@@ -1357,6 +1436,12 @@ export interface StorePort {
     trace: RetrievalTraceInput
   ): Promise<StoreResult<RetrievalTraceAppendResult>>;
 
+  /** Widen one trace to the canonical union of observed policy ownership. */
+  mergeRetrievalTraceEgressLineage?(
+    traceId: string,
+    lineage: EgressLineage
+  ): Promise<StoreResult<RetrievalTraceAppendResult>>;
+
   /** Return a trace and all of its locally stored subordinate records. */
   getRetrievalTrace(
     traceId: string
@@ -1433,6 +1518,46 @@ export interface StorePort {
     nowMs: number
   ): Promise<StoreResult<RetrievalTraceRetentionResult>>;
 
+  /** Append one content-free egress decision receipt. */
+  appendEgressAuditReceipt(
+    receipt: EgressAuditReceiptInput
+  ): Promise<StoreResult<RetrievalTraceAppendResult>>;
+
+  /** Append one receipt and enforce bounds in one atomic store transaction. */
+  appendEgressAuditReceiptWithRetention?(
+    receipt: EgressAuditReceiptInput,
+    policy: EgressAuditRetentionPolicy,
+    nowMs: number
+  ): Promise<StoreResult<RetrievalTraceAppendResult>>;
+
+  /** Inspect bounded receipts newest-first through an opaque cursor. */
+  listEgressAuditReceipts(
+    limit: number,
+    cursor?: EgressAuditCursor
+  ): Promise<StoreResult<EgressAuditPage>>;
+
+  /** Inspect one content-free receipt by stable local identifier. */
+  getEgressAuditReceipt(
+    auditId: string
+  ): Promise<StoreResult<EgressAuditReceiptRow | null>>;
+
+  /** Delete exactly one audit receipt with truthful physical cleanup status. */
+  deleteEgressAuditReceipt(
+    auditId: string
+  ): Promise<StoreResult<EgressAuditDeleteResult>>;
+
+  /** Return content-free local audit storage and retention facts. */
+  getEgressAuditStatus(): Promise<StoreResult<EgressAuditStatusResult>>;
+
+  /** Enforce the audit domain's independent age/count/byte policy. */
+  enforceEgressAuditRetention(
+    policy: EgressAuditRetentionPolicy,
+    nowMs: number
+  ): Promise<StoreResult<EgressAuditRetentionResult>>;
+
+  /** Purge only audit receipts with truthful SQLite physical cleanup status. */
+  purgeEgressAuditReceipts(): Promise<StoreResult<EgressAuditPurgeResult>>;
+
   // ─────────────────────────────────────────────────────────────────────────
   // Documents
   // ─────────────────────────────────────────────────────────────────────────

package/browser-extension/artifacts/gno-browser-clipper-v1.28.0.zip.sha256

@@ -1 +0,0 @@
-5cdb85ddd0e73801a566527b7a908c8e0854a83c56cae281bab5f1285dae6734  gno-browser-clipper-v1.28.0.zip