@iislee/opencodex 2.11.0 → 2.35.0

package/src/lab/query/connection.ts

@@ -0,0 +1,107 @@
+import { Database } from "bun:sqlite";
+import { existsSync } from "node:fs";
+import { LAB_PROJECTION_SPEC_VERSION } from "../constants";
+import { labSqlitePath } from "../paths";
+import { LAB_SQLITE_SCHEMA_VERSION } from "../projection/schema";
+import { LabProjectionIncompatibleError, LabProjectionUnavailableError } from "./errors";
+
+export interface LabReadConnection {
+  db: Database;
+  sqlitePath: string;
+  schemaVersion: number;
+  projectionSpecVersion: string;
+  builtAtMs: number;
+}
+
+const COUNTABLE_TABLES = [
+  "events",
+  "subjects",
+  "observations",
+  "claims",
+  "verdicts",
+  "artifacts",
+  "corruption",
+] as const;
+
+export type CountableTable = (typeof COUNTABLE_TABLES)[number];
+
+const COUNT_TABLE_SQL: Record<CountableTable, string> = {
+  events: "SELECT COUNT(*) AS c FROM events",
+  subjects: "SELECT COUNT(*) AS c FROM subjects",
+  observations: "SELECT COUNT(*) AS c FROM observations",
+  claims: "SELECT COUNT(*) AS c FROM claims",
+  verdicts: "SELECT COUNT(*) AS c FROM verdicts",
+  artifacts: "SELECT COUNT(*) AS c FROM artifacts",
+  corruption: "SELECT COUNT(*) AS c FROM corruption",
+};
+
+export function resolveLabSqlitePath(configDir?: string): string {
+  return labSqlitePath(configDir);
+}
+
+export function openLabReadConnection(configDir?: string): LabReadConnection {
+  const sqlitePath = resolveLabSqlitePath(configDir);
+  if (!existsSync(sqlitePath)) {
+    throw new LabProjectionUnavailableError();
+  }
+  let db: Database;
+  try {
+    db = new Database(sqlitePath, { readonly: true });
+  } catch {
+    throw new LabProjectionUnavailableError();
+  }
+  try {
+    const metaRows = db
+      .query("SELECT key, value FROM schema_meta")
+      .all() as Array<{ key: string; value: string }>;
+    const meta = new Map(metaRows.map((r) => [r.key, r.value]));
+    const schemaRaw = meta.get("schema_version");
+    const specRaw = meta.get("projection_spec_version");
+    const builtRaw = meta.get("built_at_ms");
+    if (!schemaRaw || !specRaw || !builtRaw) {
+      db.close();
+      throw new LabProjectionUnavailableError();
+    }
+    const schemaVersion = Number(schemaRaw);
+    const projectionSpecVersion = specRaw;
+    const builtAtMs = Number(builtRaw);
+    if (
+      !Number.isInteger(schemaVersion) ||
+      schemaVersion !== LAB_SQLITE_SCHEMA_VERSION ||
+      projectionSpecVersion !== LAB_PROJECTION_SPEC_VERSION ||
+      !Number.isFinite(builtAtMs)
+    ) {
+      db.close();
+      throw new LabProjectionIncompatibleError();
+    }
+    return {
+      db,
+      sqlitePath,
+      schemaVersion,
+      projectionSpecVersion,
+      builtAtMs,
+    };
+  } catch (err) {
+    try {
+      db.close();
+    } catch {
+      /* ignore */
+    }
+    if (err instanceof LabProjectionUnavailableError || err instanceof LabProjectionIncompatibleError) {
+      throw err;
+    }
+    throw new LabProjectionUnavailableError();
+  }
+}
+
+export function closeLabReadConnection(conn: LabReadConnection): void {
+  conn.db.close();
+}
+
+export function countTable(conn: LabReadConnection, table: CountableTable): number {
+  if (!(COUNTABLE_TABLES as readonly string[]).includes(table)) {
+    throw new LabProjectionUnavailableError();
+  }
+  const row = conn.db.query(COUNT_TABLE_SQL[table]).get() as { c: number };
+  return Number(row.c);
+}

package/src/lab/query/constants.ts

@@ -0,0 +1,4 @@
+export const LAB_QUERY_DEFAULT_PAGE_SIZE = 50;
+export const LAB_QUERY_MAX_PAGE_SIZE = 100;
+export const LAB_QUERY_CURSOR_VERSION = 1;
+export const LAB_QUERY_MAX_CURSOR_BYTES = 4096;

package/src/lab/query/cursor.ts

@@ -0,0 +1,132 @@
+import { LAB_QUERY_CURSOR_VERSION, LAB_QUERY_MAX_CURSOR_BYTES } from "./constants";
+import { InvalidCursorError } from "./errors";
+
+export type VerdictCursorPayload = {
+  v: typeof LAB_QUERY_CURSOR_VERSION;
+  k: "verdicts";
+  a: number;
+  p: string;
+  f: string;
+};
+
+export type ObservationCursorPayload = {
+  v: typeof LAB_QUERY_CURSOR_VERSION;
+  k: "observations";
+  c: number;
+  e: string;
+  f: string;
+};
+
+export type EventCursorPayload = {
+  v: typeof LAB_QUERY_CURSOR_VERSION;
+  k: "events";
+  r: number;
+  e: string;
+  f: string;
+};
+
+export type SubjectCursorPayload = {
+  v: typeof LAB_QUERY_CURSOR_VERSION;
+  k: "subjects";
+  s: string;
+  f: string;
+};
+
+export type ArtifactCursorPayload = {
+  v: typeof LAB_QUERY_CURSOR_VERSION;
+  k: "artifacts";
+  d: string;
+  f: string;
+};
+
+export type LabCursorPayload =
+  | VerdictCursorPayload
+  | ObservationCursorPayload
+  | EventCursorPayload
+  | SubjectCursorPayload
+  | ArtifactCursorPayload;
+
+function stableFilterKey(filters: Record<string, unknown>): string {
+  const entries = Object.entries(filters)
+    .filter(([, v]) => v !== undefined && v !== null)
+    .sort(([a], [b]) => a.localeCompare(b));
+  return JSON.stringify(entries);
+}
+
+export function encodeLabCursor(payload: LabCursorPayload): string {
+  return Buffer.from(JSON.stringify(payload)).toString("base64url");
+}
+
+export function decodeLabCursor(raw: string | null | undefined): LabCursorPayload | null {
+  if (typeof raw !== "string" || raw.length === 0 || raw.length > LAB_QUERY_MAX_CURSOR_BYTES) return null;
+  try {
+    const parsed = JSON.parse(Buffer.from(raw, "base64url").toString("utf8")) as Record<string, unknown>;
+    if (parsed.v !== LAB_QUERY_CURSOR_VERSION || typeof parsed.k !== "string") return null;
+    if (parsed.k === "verdicts") {
+      if (typeof parsed.a !== "number" || !Number.isFinite(parsed.a)) return null;
+      if (typeof parsed.p !== "string" || parsed.p.length === 0 || parsed.p.length > 256) return null;
+      if (typeof parsed.f !== "string") return null;
+      return parsed as VerdictCursorPayload;
+    }
+    if (parsed.k === "observations") {
+      if (typeof parsed.c !== "number" || !Number.isFinite(parsed.c)) return null;
+      if (typeof parsed.e !== "string" || parsed.e.length === 0 || parsed.e.length > 256) return null;
+      if (typeof parsed.f !== "string") return null;
+      return parsed as ObservationCursorPayload;
+    }
+    if (parsed.k === "events") {
+      if (typeof parsed.r !== "number" || !Number.isFinite(parsed.r)) return null;
+      if (typeof parsed.e !== "string" || parsed.e.length === 0 || parsed.e.length > 256) return null;
+      if (typeof parsed.f !== "string") return null;
+      return parsed as EventCursorPayload;
+    }
+    if (parsed.k === "subjects") {
+      if (typeof parsed.s !== "string" || parsed.s.length === 0 || parsed.s.length > 256) return null;
+      if (typeof parsed.f !== "string") return null;
+      return parsed as SubjectCursorPayload;
+    }
+    if (parsed.k === "artifacts") {
+      if (typeof parsed.d !== "string" || parsed.d.length === 0 || parsed.d.length > 128) return null;
+      if (typeof parsed.f !== "string") return null;
+      return parsed as ArtifactCursorPayload;
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+
+export function assertCursorFilters(
+  cursor: LabCursorPayload,
+  filters: Record<string, unknown>,
+  kind: LabCursorPayload["k"],
+): void {
+  if (cursor.k !== kind) throw new InvalidCursorError();
+  const expected = stableFilterKey(filters);
+  const actual = (cursor as { f: string }).f;
+  if (actual !== expected) throw new InvalidCursorError();
+}
+
+export function filterKeyFor(filters: Record<string, unknown>): string {
+  return stableFilterKey(filters);
+}
+
+export function verdictCursor(asOf: number, projectionKey: string, filters: Record<string, unknown>): VerdictCursorPayload {
+  return { v: LAB_QUERY_CURSOR_VERSION, k: "verdicts", a: asOf, p: projectionKey, f: stableFilterKey(filters) };
+}
+
+export function observationCursor(completedAt: number, eventId: string, filters: Record<string, unknown>): ObservationCursorPayload {
+  return { v: LAB_QUERY_CURSOR_VERSION, k: "observations", c: completedAt, e: eventId, f: stableFilterKey(filters) };
+}
+
+export function eventCursor(recordedAt: number, eventId: string, filters: Record<string, unknown>): EventCursorPayload {
+  return { v: LAB_QUERY_CURSOR_VERSION, k: "events", r: recordedAt, e: eventId, f: stableFilterKey(filters) };
+}
+
+export function subjectCursor(subjectId: string, filters: Record<string, unknown>): SubjectCursorPayload {
+  return { v: LAB_QUERY_CURSOR_VERSION, k: "subjects", s: subjectId, f: stableFilterKey(filters) };
+}
+
+export function artifactCursor(digest: string, filters: Record<string, unknown>): ArtifactCursorPayload {
+  return { v: LAB_QUERY_CURSOR_VERSION, k: "artifacts", d: digest, f: stableFilterKey(filters) };
+}

package/src/lab/query/dto-map.ts

@@ -0,0 +1,277 @@
+import { sanitizeDiagnostic } from "../artifacts/sanitize";
+import type {
+  ClaimSnapshotEvent,
+  InvalidationEvent,
+  LabEvent,
+  ObservationEvent,
+  PurgeTombstoneEvent,
+  RouteDependencyV1,
+  RouteSubjectV1,
+  TaskSubjectV1,
+} from "../events/types";
+import { validateLabEvent } from "../events/validate";
+import type {
+  ArtifactMetadataDto,
+  ClaimSnapshotEventDto,
+  EventListItemDto,
+  InvalidationEventDto,
+  LabEventDto,
+  ObservationDto,
+  ObservationEventDto,
+  ProtocolSubjectDto,
+  PurgeTombstoneEventDto,
+  RouteDependencyDto,
+  RouteSubjectDto,
+  SubjectDto,
+  SubjectListItemDto,
+  TaskSubjectDto,
+  VerdictDto,
+} from "./types";
+
+const SECRETISH = /sk-[a-z0-9]{10,}|Bearer\s+[A-Za-z0-9._\-]+|ghp_[A-Za-z0-9]{20,}|xox[baprs]-[A-Za-z0-9-]{10,}/gi;
+const URL_USERINFO = /https?:\/\/[^/\s:@]+:[^/\s@]+@/gi;
+const WINDOWS_PATH = /[A-Za-z]:\\(?:[^\\:*?"<>|\r\n]+\\)*[^\\:*?"<>|\r\n]*/g;
+const POSIX_HOME = /(?:^|[^A-Za-z0-9_])(?:\/home\/|\/Users\/|~\/)[^\s"'<>|]+/g;
+
+export function sanitizePublicText(value: string | null | undefined, max = 256): string | null {
+  if (value === null || value === undefined) return null;
+  let out = sanitizeDiagnostic(value);
+  out = out.replace(SECRETISH, "[redacted]");
+  out = out.replace(URL_USERINFO, "[redacted-url]@");
+  out = out.replace(WINDOWS_PATH, "[redacted-path]");
+  out = out.replace(POSIX_HOME, "[redacted-path]");
+  if (out.length > max) out = out.slice(0, max);
+  return out;
+}
+
+function parseJsonArray(raw: string): string[] {
+  try {
+    const parsed = JSON.parse(raw);
+    return Array.isArray(parsed) ? parsed.filter((v): v is string => typeof v === "string") : [];
+  } catch {
+    return [];
+  }
+}
+
+export function mapVerdictRow(row: Record<string, unknown>): VerdictDto {
+  return {
+    projectionKey: String(row.projection_key),
+    subjectId: String(row.subject_id),
+    evidenceLayer: row.evidence_layer as VerdictDto["evidenceLayer"],
+    suiteId: String(row.suite_id),
+    suiteVersion: String(row.suite_version),
+    suiteManifestDigest: String(row.suite_manifest_digest),
+    projectionSpecVersion: String(row.projection_spec_version),
+    verdict: row.verdict as VerdictDto["verdict"],
+    asOf: Number(row.as_of),
+    scenarioManifestDigests: parseJsonArray(String(row.scenario_manifest_digests_json)),
+    claimSourceDigest: row.claim_source_digest ? String(row.claim_source_digest) : null,
+    contributingEventIds: parseJsonArray(String(row.contributing_event_ids_json)),
+    contradictingEventIds: parseJsonArray(String(row.contradicting_event_ids_json)),
+    notes: parseJsonArray(String(row.notes_json)).map((n) => sanitizePublicText(n, 512) ?? ""),
+  };
+}
+
+function mapRouteDependency(dep: RouteDependencyV1): RouteDependencyDto {
+  return {
+    role: dep.role,
+    providerId: dep.providerId,
+    providerInstanceFingerprint: dep.providerInstanceFingerprint,
+    clientModelId: dep.clientModelId,
+    upstreamModelId: dep.upstreamModelId,
+    effectiveAdapter: dep.effectiveAdapter,
+    upstreamProtocol: dep.upstreamProtocol,
+    endpointFingerprint: dep.endpointFingerprint,
+    behaviorFingerprint: dep.behaviorFingerprint,
+  };
+}
+
+function mapRouteSubject(subject: RouteSubjectV1): RouteSubjectDto {
+  return {
+    subjectKind: "route",
+    subjectSchemaVersion: 1,
+    providerId: subject.providerId,
+    providerInstanceFingerprint: subject.providerInstanceFingerprint,
+    clientModelId: subject.clientModelId,
+    upstreamModelId: subject.upstreamModelId,
+    effectiveAdapter: subject.effectiveAdapter,
+    inboundProtocol: subject.inboundProtocol,
+    upstreamProtocol: subject.upstreamProtocol,
+    surface: subject.surface,
+    opencodexCompatibilityVersion: subject.opencodexCompatibilityVersion,
+    behaviorFingerprint: subject.behaviorFingerprint,
+    endpointFingerprint: subject.endpointFingerprint,
+    dependencies: subject.dependencies.map(mapRouteDependency),
+  };
+}
+
+export function mapSubjectJson(subjectJson: string): SubjectDto | null {
+  try {
+    const parsed = JSON.parse(subjectJson) as Record<string, unknown>;
+    const kind = parsed.subjectKind;
+    if (kind === "protocol") {
+      return {
+        subjectKind: "protocol",
+        subjectSchemaVersion: 1,
+        opencodexCompatibilityVersion: String(parsed.opencodexCompatibilityVersion),
+        effectiveAdapter: String(parsed.effectiveAdapter),
+        inboundProtocol: String(parsed.inboundProtocol),
+        upstreamProtocol: String(parsed.upstreamProtocol),
+        surface: String(parsed.surface),
+        behaviorFingerprint: String(parsed.behaviorFingerprint),
+      };
+    }
+    if (kind === "route") {
+      return mapRouteSubject(parsed as unknown as RouteSubjectV1);
+    }
+    if (kind === "task") {
+      const task = parsed as unknown as TaskSubjectV1;
+      return {
+        subjectKind: "task",
+        subjectSchemaVersion: 1,
+        routeSubject: mapRouteSubject(task.routeSubject),
+        taskClassId: task.taskClassId,
+        taskClassVersion: task.taskClassVersion,
+        taskFixtureDigest: task.taskFixtureDigest,
+        verifierManifestDigest: task.verifierManifestDigest,
+        fabricCompatibilityVersion: task.fabricCompatibilityVersion,
+        sandboxProfileDigest: task.sandboxProfileDigest,
+      };
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+
+export function mapSubjectListRow(row: Record<string, unknown>): SubjectListItemDto {
+  return {
+    subjectId: String(row.subject_id),
+    subjectKind: String(row.subject_kind),
+  };
+}
+
+export function mapObservationRow(
+  row: Record<string, unknown>,
+  excluded: boolean,
+  exclusionReason: string | null,
+): ObservationDto {
+  return {
+    eventId: String(row.event_id),
+    subjectId: String(row.subject_id),
+    evidenceLayer: row.evidence_layer as ObservationDto["evidenceLayer"],
+    suiteId: String(row.suite_id),
+    suiteVersion: String(row.suite_version),
+    suiteManifestDigest: String(row.suite_manifest_digest),
+    scenarioId: String(row.scenario_id),
+    scenarioVersion: String(row.scenario_version),
+    scenarioManifestDigest: String(row.scenario_manifest_digest),
+    outcome: row.outcome as ObservationDto["outcome"],
+    completedAt: Number(row.completed_at),
+    executionMode: row.execution_mode as ObservationDto["executionMode"],
+    excluded,
+    exclusionReason: sanitizePublicText(exclusionReason),
+  };
+}
+
+export function mapEventListRow(row: Record<string, unknown>): EventListItemDto {
+  return {
+    eventId: String(row.event_id),
+    eventKind: row.event_kind as EventListItemDto["eventKind"],
+    recordedAt: Number(row.recorded_at),
+    excluded: Number(row.excluded) === 1,
+    exclusionReason: sanitizePublicText(row.exclusion_reason ? String(row.exclusion_reason) : null),
+  };
+}
+
+export function mapArtifactRow(row: Record<string, unknown>): ArtifactMetadataDto {
+  return {
+    digest: String(row.digest),
+    artifactClass: row.artifact_class ? row.artifact_class as ArtifactMetadataDto["artifactClass"] : null,
+    mediaType: row.media_type ? String(row.media_type) : null,
+    byteCount: row.byte_count === null || row.byte_count === undefined ? null : Number(row.byte_count),
+    status: row.status as ArtifactMetadataDto["status"],
+    lastError: sanitizePublicText(row.last_error ? String(row.last_error) : null),
+  };
+}
+
+function exclusionFromRow(row: Record<string, unknown>): { excluded: boolean; exclusionReason: string | null } {
+  return {
+    excluded: Number(row.excluded) === 1,
+    exclusionReason: sanitizePublicText(row.exclusion_reason ? String(row.exclusion_reason) : null),
+  };
+}
+
+export function mapValidatedEventToDto(event: LabEvent, excluded: boolean, exclusionReason: string | null): LabEventDto {
+  const base = {
+    eventId: event.eventId,
+    recordedAt: event.recordedAt,
+    producer: event.producer,
+    producerVersion: event.producerVersion,
+    excluded,
+    exclusionReason: sanitizePublicText(exclusionReason),
+  };
+  if (event.eventKind === "observation") {
+    const obs = event as ObservationEvent;
+    return {
+      eventKind: "observation",
+      ...base,
+      evidenceLayer: obs.evidenceLayer,
+      scenarioId: obs.scenarioId,
+      scenarioVersion: obs.scenarioVersion,
+      scenarioManifestDigest: obs.scenarioManifestDigest,
+      suiteId: obs.suiteId,
+      suiteVersion: obs.suiteVersion,
+      suiteManifestDigest: obs.suiteManifestDigest,
+      subjectId: obs.subjectId,
+      startedAt: obs.startedAt,
+      completedAt: obs.completedAt,
+      executionMode: obs.executionMode,
+      attempt: obs.attempt,
+      outcome: obs.outcome,
+    } satisfies ObservationEventDto;
+  }
+  if (event.eventKind === "claim_snapshot") {
+    const claim = event as ClaimSnapshotEvent;
+    return {
+      eventKind: "claim_snapshot",
+      ...base,
+      subjectId: claim.subjectId,
+      capability: claim.capability,
+      polarity: claim.polarity,
+      sourceManifestDigest: claim.sourceManifestDigest,
+      effectiveAt: claim.effectiveAt,
+    } satisfies ClaimSnapshotEventDto;
+  }
+  if (event.eventKind === "invalidation") {
+    const inv = event as InvalidationEvent;
+    return {
+      eventKind: "invalidation",
+      ...base,
+      reason: inv.reason,
+      targetEventIds: [...inv.targetEventIds],
+    } satisfies InvalidationEventDto;
+  }
+  const purge = event as PurgeTombstoneEvent;
+  return {
+    eventKind: "purge_tombstone",
+    ...base,
+    targetEventIds: [...purge.targetEventIds],
+    targetArtifactDigests: [...purge.targetArtifactDigests],
+    purgeActions: [...purge.purgeActions],
+  } satisfies PurgeTombstoneEventDto;
+}
+
+export function parseEventPayloadToDto(
+  payloadJson: string,
+  excluded: boolean,
+  exclusionReason: string | null,
+): LabEventDto | null {
+  try {
+    const parsed = JSON.parse(payloadJson);
+    const event = validateLabEvent(parsed);
+    return mapValidatedEventToDto(event, excluded, exclusionReason);
+  } catch {
+    return null;
+  }
+}

package/src/lab/query/errors.ts

@@ -0,0 +1,22 @@
+/** CL-04 read-surface errors — safe codes only, no SQLite/path leakage. */
+
+export class LabProjectionUnavailableError extends Error {
+  readonly code = "lab_projection_unavailable" as const;
+  constructor() {
+    super("lab projection is not available");
+  }
+}
+
+export class LabProjectionIncompatibleError extends Error {
+  readonly code = "lab_projection_incompatible" as const;
+  constructor() {
+    super("lab projection schema or spec version is incompatible");
+  }
+}
+
+export class InvalidCursorError extends Error {
+  readonly code = "invalid_cursor" as const;
+  constructor() {
+    super("invalid cursor");
+  }
+}

package/src/lab/query/freshness.ts

@@ -0,0 +1,53 @@
+import type { EvidenceLayer } from "../constants";
+import { closeLabReadConnection, openLabReadConnection } from "./connection";
+
+export interface ExactObservationIdentity {
+  subjectId: string;
+  layer: EvidenceLayer;
+  suiteId: string;
+  suiteVersion: string;
+  suiteManifestDigest: string;
+  scenarioId: string;
+  scenarioVersion: string;
+  scenarioManifestDigest: string;
+}
+
+/** Return the newest non-excluded observation for one exact evidence identity. */
+export function queryLatestExactObservationCompletedAt(
+  identity: ExactObservationIdentity,
+  configDir?: string,
+): number | undefined {
+  const conn = openLabReadConnection(configDir);
+  try {
+    const row = conn.db
+      .query(
+        `SELECT o.completed_at
+         FROM observations o
+         JOIN events e ON e.event_id = o.event_id
+         WHERE o.subject_id = ?
+           AND o.evidence_layer = ?
+           AND o.suite_id = ?
+           AND o.suite_version = ?
+           AND o.suite_manifest_digest = ?
+           AND o.scenario_id = ?
+           AND o.scenario_version = ?
+           AND o.scenario_manifest_digest = ?
+           AND e.excluded = 0
+         ORDER BY o.completed_at DESC, o.event_id DESC
+         LIMIT 1`,
+      )
+      .get(
+        identity.subjectId,
+        identity.layer,
+        identity.suiteId,
+        identity.suiteVersion,
+        identity.suiteManifestDigest,
+        identity.scenarioId,
+        identity.scenarioVersion,
+        identity.scenarioManifestDigest,
+      ) as { completed_at: number } | null;
+    return row ? Number(row.completed_at) : undefined;
+  } finally {
+    closeLabReadConnection(conn);
+  }
+}

package/src/lab/query/index.ts

@@ -0,0 +1,45 @@
+export {
+  LAB_QUERY_DEFAULT_PAGE_SIZE,
+  LAB_QUERY_MAX_PAGE_SIZE,
+} from "./constants";
+export {
+  LabProjectionUnavailableError,
+  LabProjectionIncompatibleError,
+  InvalidCursorError,
+} from "./errors";
+export {
+  openLabReadConnection,
+  closeLabReadConnection,
+  resolveLabSqlitePath,
+  type LabReadConnection,
+} from "./connection";
+export {
+  encodeLabCursor,
+  decodeLabCursor,
+  filterKeyFor,
+} from "./cursor";
+export { queryLabCatalog } from "./catalog";
+export {
+  queryLabStatus,
+  queryLabVerdicts,
+  queryLabSubjects,
+  queryLabSubjectById,
+  queryLabObservations,
+  queryLabEvents,
+  queryLabEventById,
+  queryLabArtifacts,
+  queryLabArtifactByDigest,
+  queryLabCatalogEntries,
+} from "./queries";
+export {
+  PASSIVE_PRODUCTION_DEFAULT_LIMIT,
+  PASSIVE_PRODUCTION_MAX_LIMIT,
+  PASSIVE_PRODUCTION_MAX_SCAN_ROWS,
+  derivePassiveProductionSignals,
+  queryPassiveProductionSignals,
+  type PassiveProductionOutcome,
+  type PassiveProductionQueryResultV1,
+  type PassiveProductionSummaryV1,
+  type PassiveRouteSignalV1,
+} from "./passive-production";
+export { sanitizePublicText } from "./dto-map";