@lunora/do 1.0.0-alpha.35 → 1.0.0-alpha.36

package/dist/index.d.mts

@@ -2757,6 +2757,7 @@ declare const FLAGS_FUNCTION_PREFIX = "__lunora_flags__:";
  */
 declare const ADMIN_FUNCTIONS: {
   readonly applyCdc: "__lunora_admin__:applyCdc";
+  readonly assignIssue: "__lunora_admin__:assignIssue";
   readonly cdcSync: "__lunora_admin__:cdcSync";
   readonly clearCapturedMail: "__lunora_admin__:clearCapturedMail";
   readonly clearQueueMessages: "__lunora_admin__:clearQueueMessages";
@@ -2786,6 +2787,7 @@ declare const ADMIN_FUNCTIONS: {
   readonly getSettings: "__lunora_admin__:getSettings";
   readonly getTraces: "__lunora_admin__:getTraces";
   readonly getWorkflowInstanceStatus: "__lunora_admin__:getWorkflowInstanceStatus";
+  readonly ignoreIssue: "__lunora_admin__:ignoreIssue";
   readonly importShard: "__lunora_admin__:importShard";
   readonly listFlags: "__lunora_admin__:listFlags";
   readonly listQueues: "__lunora_admin__:listQueues";
@@ -2802,12 +2804,14 @@ declare const ADMIN_FUNCTIONS: {
   readonly recordMail: "__lunora_admin__:recordMail";
   readonly recordQueueMessage: "__lunora_admin__:recordQueueMessage";
   readonly replayQueueMessage: "__lunora_admin__:replayQueueMessage";
+  readonly resolveIssue: "__lunora_admin__:resolveIssue";
   readonly rlsPolicies: "__lunora_admin__:rlsPolicies";
   readonly runAs: "__lunora_admin__:runAs";
   readonly runMigration: "__lunora_admin__:runMigration";
   readonly runSql: "__lunora_admin__:runSql";
   readonly sendQueueMessage: "__lunora_admin__:sendQueueMessage";
   readonly sendTestMail: "__lunora_admin__:sendTestMail";
+  readonly setIssueSeverity: "__lunora_admin__:setIssueSeverity";
   readonly storageOrphans: "__lunora_admin__:storageOrphans";
   readonly storageReferences: "__lunora_admin__:storageReferences";
   readonly storageRules: "__lunora_admin__:storageRules";
@@ -5921,6 +5925,29 @@ declare abstract class ShardDO {
    * mirroring `handlePitrAdminOp`.
    */
   private handleExtraAdminOp;
+  /**
+   * Serve the four Issue-triage admin writes — `resolveIssue` / `ignoreIssue`
+   * (a status change), `assignIssue` (set/clear an owner), `setIssueSeverity`
+   * (tag/clear severity). Each upserts one row in the reserved
+   * `__lunora_issue_state__` side table keyed by the Issue's fingerprint
+   * `hash`, then re-derives at read time in {@link readErrorIssues}. Returns
+   * `undefined` for any path it doesn't own so `handleExtraAdminOp` falls
+   * through. Admin-gated by `handleAdminRpc`'s caller (the `LUNORA_ADMIN_TOKEN`
+   * bearer); a bad/missing `hash` (or a bad status/severity value) is a 400.
+   *
+   * The write lands through raw SQL the change-tracker can't observe, so it
+   * marks {@link ISSUE_STATE_TABLE} changed and flushes — the live Issues
+   * subscription is an admin-wildcard memo that re-runs whenever a flush finds
+   * a changed table, so the triage shows up without an unrelated write.
+   */
+  private handleIssueTriageOp;
+  /**
+   * Map an Issue-triage admin path to the `IssueStatePatch` it applies, or
+   * `undefined` when the path isn't a triage write. `assignIssue`/
+   * `setIssueSeverity` accept an explicit `null` to CLEAR the field (unassign /
+   * untag); a missing or malformed value is a 400 rather than a silent no-op.
+   */
+  private parseIssueTriagePatch;
   /**
    * Record one app-level auth attempt for the auth-failure SLO (PLAN3 §2.3).
    * The worker calls this fire-and-forget (via `waitUntil`) after a top-level

package/dist/index.d.ts

@@ -2757,6 +2757,7 @@ declare const FLAGS_FUNCTION_PREFIX = "__lunora_flags__:";
  */
 declare const ADMIN_FUNCTIONS: {
   readonly applyCdc: "__lunora_admin__:applyCdc";
+  readonly assignIssue: "__lunora_admin__:assignIssue";
   readonly cdcSync: "__lunora_admin__:cdcSync";
   readonly clearCapturedMail: "__lunora_admin__:clearCapturedMail";
   readonly clearQueueMessages: "__lunora_admin__:clearQueueMessages";
@@ -2786,6 +2787,7 @@ declare const ADMIN_FUNCTIONS: {
   readonly getSettings: "__lunora_admin__:getSettings";
   readonly getTraces: "__lunora_admin__:getTraces";
   readonly getWorkflowInstanceStatus: "__lunora_admin__:getWorkflowInstanceStatus";
+  readonly ignoreIssue: "__lunora_admin__:ignoreIssue";
   readonly importShard: "__lunora_admin__:importShard";
   readonly listFlags: "__lunora_admin__:listFlags";
   readonly listQueues: "__lunora_admin__:listQueues";
@@ -2802,12 +2804,14 @@ declare const ADMIN_FUNCTIONS: {
   readonly recordMail: "__lunora_admin__:recordMail";
   readonly recordQueueMessage: "__lunora_admin__:recordQueueMessage";
   readonly replayQueueMessage: "__lunora_admin__:replayQueueMessage";
+  readonly resolveIssue: "__lunora_admin__:resolveIssue";
   readonly rlsPolicies: "__lunora_admin__:rlsPolicies";
   readonly runAs: "__lunora_admin__:runAs";
   readonly runMigration: "__lunora_admin__:runMigration";
   readonly runSql: "__lunora_admin__:runSql";
   readonly sendQueueMessage: "__lunora_admin__:sendQueueMessage";
   readonly sendTestMail: "__lunora_admin__:sendTestMail";
+  readonly setIssueSeverity: "__lunora_admin__:setIssueSeverity";
   readonly storageOrphans: "__lunora_admin__:storageOrphans";
   readonly storageReferences: "__lunora_admin__:storageReferences";
   readonly storageRules: "__lunora_admin__:storageRules";
@@ -5921,6 +5925,29 @@ declare abstract class ShardDO {
    * mirroring `handlePitrAdminOp`.
    */
   private handleExtraAdminOp;
+  /**
+   * Serve the four Issue-triage admin writes — `resolveIssue` / `ignoreIssue`
+   * (a status change), `assignIssue` (set/clear an owner), `setIssueSeverity`
+   * (tag/clear severity). Each upserts one row in the reserved
+   * `__lunora_issue_state__` side table keyed by the Issue's fingerprint
+   * `hash`, then re-derives at read time in {@link readErrorIssues}. Returns
+   * `undefined` for any path it doesn't own so `handleExtraAdminOp` falls
+   * through. Admin-gated by `handleAdminRpc`'s caller (the `LUNORA_ADMIN_TOKEN`
+   * bearer); a bad/missing `hash` (or a bad status/severity value) is a 400.
+   *
+   * The write lands through raw SQL the change-tracker can't observe, so it
+   * marks {@link ISSUE_STATE_TABLE} changed and flushes — the live Issues
+   * subscription is an admin-wildcard memo that re-runs whenever a flush finds
+   * a changed table, so the triage shows up without an unrelated write.
+   */
+  private handleIssueTriageOp;
+  /**
+   * Map an Issue-triage admin path to the `IssueStatePatch` it applies, or
+   * `undefined` when the path isn't a triage write. `assignIssue`/
+   * `setIssueSeverity` accept an explicit `null` to CLEAR the field (unassign /
+   * untag); a missing or malformed value is a 400 rather than a silent no-op.
+   */
+  private parseIssueTriagePatch;
   /**
    * Record one app-level auth attempt for the auth-failure SLO (PLAN3 §2.3).
    * The worker calls this fire-and-forget (via `waitUntil`) after a top-level

package/dist/index.mjs

@@ -12,7 +12,7 @@ export { diffExternalSource } from './packem_shared/diffExternalSource-CovHfdyo.
 export { materializeExternalRows, materializeExternalRowsIncremental, readExternalSourceBaseline, runExternalSourceTick } from './packem_shared/materializeExternalRows-DlQWMlw_.mjs';
 export { isSoftDeleted, isSourceDue, liftSourceId, pullExternalSourceIncrementalTick, pullExternalSourceTick } from './packem_shared/isSoftDeleted-YLKR6JYw.mjs';
 export { FUNCTION_METRICS_BUCKETS_TABLE, FUNCTION_METRICS_BUCKET_MS, FUNCTION_METRICS_BUCKET_RETENTION, FUNCTION_METRICS_INDEX_TABLE, FUNCTION_METRICS_TABLE, ensureFunctionMetricsTables, readFunctionMetricBuckets, readFunctionMetricIndexHits, readFunctionMetrics, readFunctionMetricsTotals, recordFunctionMetric } from './packem_shared/FUNCTION_METRICS_BUCKETS_TABLE-UDNVD7FS.mjs';
-export { ADMIN_FUNCTIONS, ADMIN_FUNCTION_PREFIX, FLAGS_FUNCTION_PREFIX, RELATION_FUNCTION_PREFIX, facetColumn, listTables, readTablePage, selectMatchingIds } from './packem_shared/ADMIN_FUNCTIONS-CqVmUVNs.mjs';
+export { ADMIN_FUNCTIONS, ADMIN_FUNCTION_PREFIX, FLAGS_FUNCTION_PREFIX, RELATION_FUNCTION_PREFIX, facetColumn, listTables, readTablePage, selectMatchingIds } from './packem_shared/ADMIN_FUNCTIONS-DVk02KpP.mjs';
 export { LogBuffer } from './packem_shared/LogBuffer-B_Ezju_N.mjs';
 export { MAIL_RETENTION, MAIL_TABLE, clearCapturedMail, ensureMailTable, readCapturedMail, recordCapturedMail } from './packem_shared/MAIL_RETENTION-CPpgl-dX.mjs';
 export { default as NotFoundError } from './packem_shared/NotFoundError-C70b9hLw.mjs';
@@ -20,14 +20,14 @@ export { armRestore, readBookmark } from './packem_shared/armRestore-4Px61hHS.mj
 export { applySelect, buildSeekWhere, decodeCursor, encodeCursor, normalizeOrderKeys, softDeleteScope } from './packem_shared/applySelect-WQY8m62C.mjs';
 export { RANK_TIEBREAK, encodePartitionKey, matchesRankStaticWhere, rankTableName, resolveRankPartition, sortColumnName } from './packem_shared/RANK_TIEBREAK-CXhdcA1o.mjs';
 export { ReactiveCache, reactiveCacheKey } from './packem_shared/ReactiveCache-DnSvbjil.mjs';
-export { serveRelationFanout } from './packem_shared/serveRelationFanout-Yiyx2OQB.mjs';
+export { serveRelationFanout } from './packem_shared/serveRelationFanout-FdrPflv1.mjs';
 export { DEFAULT_MAX_RELATION_KEYS, assertFlatPredicate, assertShapeShardable, containsRelationPredicate, isRelationPredicate, resolveRelationPredicates } from './packem_shared/DEFAULT_MAX_RELATION_KEYS-BEan1CRD.mjs';
 export { applyOnDelete, fanOutScalarCounts, resolveWith, runRowValidators } from './packem_shared/applyOnDelete-BXSq3S70.mjs';
 export { RLS_UNWRAP_SYMBOL, RlsRequiredError, guardWriter } from './packem_shared/RLS_UNWRAP_SYMBOL-DTvHvRzY.mjs';
 export { buildFtsMatch, ftsTableName, scoreDocument, stringifySearchText, tokenizeSearch } from './packem_shared/buildFtsMatch-BLEMawrp.mjs';
 export { M as MIN_ADMIN_TOKEN_LENGTH, a as MIN_AUTH_SECRET_LENGTH, b as buildSecurityAudit } from './packem_shared/security-audit-CucgBice.mjs';
 export { SESSION_DO_TTL_DEFAULT, SessionDO } from './packem_shared/SESSION_DO_TTL_DEFAULT-BnSKgVO4.mjs';
-export { ROOT_DO_SIZE_WARN_BYTES, ROOT_SHARD_NAME, ShardDO } from './packem_shared/ROOT_DO_SIZE_WARN_BYTES-QSOI2hpe.mjs';
+export { ROOT_DO_SIZE_WARN_BYTES, ROOT_SHARD_NAME, ShardDO } from './packem_shared/ROOT_DO_SIZE_WARN_BYTES-CBlw_ir3.mjs';
 export { SHARD_REGISTRY_DO_NAME, ShardRegistryDO } from './packem_shared/SHARD_REGISTRY_DO_NAME-D99roc-r.mjs';
 export { MAX_SQL_ROWS, assertReadonly, runReadonlySql } from './packem_shared/MAX_SQL_ROWS-iFAA8FbD.mjs';
 export { createSystemReader } from './packem_shared/createSystemReader-D12eNH13.mjs';

package/dist/packem_shared/{ADMIN_FUNCTIONS-CqVmUVNs.mjs → ADMIN_FUNCTIONS-DVk02KpP.mjs}

@@ -7,6 +7,7 @@ const RELATION_FUNCTION_PREFIX = "__lunora_relation__:";
 const FLAGS_FUNCTION_PREFIX = "__lunora_flags__:";
 const ADMIN_FUNCTIONS = {
   applyCdc: "__lunora_admin__:applyCdc",
+  assignIssue: "__lunora_admin__:assignIssue",
   cdcSync: "__lunora_admin__:cdcSync",
   clearCapturedMail: "__lunora_admin__:clearCapturedMail",
   clearQueueMessages: "__lunora_admin__:clearQueueMessages",
@@ -37,6 +38,7 @@ const ADMIN_FUNCTIONS = {
   getTraces: "__lunora_admin__:getTraces",
   // eslint-disable-next-line no-secrets/no-secrets -- reserved admin RPC path constant, not a credential
   getWorkflowInstanceStatus: "__lunora_admin__:getWorkflowInstanceStatus",
+  ignoreIssue: "__lunora_admin__:ignoreIssue",
   importShard: "__lunora_admin__:importShard",
   listFlags: "__lunora_admin__:listFlags",
   listQueues: "__lunora_admin__:listQueues",
@@ -53,12 +55,14 @@ const ADMIN_FUNCTIONS = {
   recordMail: "__lunora_admin__:recordMail",
   recordQueueMessage: "__lunora_admin__:recordQueueMessage",
   replayQueueMessage: "__lunora_admin__:replayQueueMessage",
+  resolveIssue: "__lunora_admin__:resolveIssue",
   rlsPolicies: "__lunora_admin__:rlsPolicies",
   runAs: "__lunora_admin__:runAs",
   runMigration: "__lunora_admin__:runMigration",
   runSql: "__lunora_admin__:runSql",
   sendQueueMessage: "__lunora_admin__:sendQueueMessage",
   sendTestMail: "__lunora_admin__:sendTestMail",
+  setIssueSeverity: "__lunora_admin__:setIssueSeverity",
   storageOrphans: "__lunora_admin__:storageOrphans",
   storageReferences: "__lunora_admin__:storageReferences",
   storageRules: "__lunora_admin__:storageRules",

package/dist/packem_shared/{ROOT_DO_SIZE_WARN_BYTES-QSOI2hpe.mjs → ROOT_DO_SIZE_WARN_BYTES-CBlw_ir3.mjs}

@@ -9,7 +9,7 @@ import { n as normalizeLogFields, r as resolveTraceAnchor, a as createTracer, c
 import { DATA_MIGRATION_STATE_TABLE, readMigrationStatus } from './DATA_MIGRATION_STATE_TABLE-CYwBpyTr.mjs';
 import { SCAN_DEP, createDependencyTracker, tableFromDepKey } from './SCAN_DEP-DLJF8dsj.mjs';
 import { readFunctionMetricsTotals, readFunctionMetricIndexHits, recordFunctionMetric, mergeScanAttribution, readFunctionMetrics, readFunctionMetricBuckets } from './FUNCTION_METRICS_BUCKETS_TABLE-UDNVD7FS.mjs';
-import { createFanoutCounters, ADMIN_FUNCTION_PREFIX, RELATION_FUNCTION_PREFIX, selectMatchingIds, ADMIN_FUNCTIONS, findStorageReferences, listTables, summarizeSubscriptions, summarizeFanoutTopics, readTablePage, facetColumn, FLAGS_FUNCTION_PREFIX, recordFanoutPass, MAX_PAGE_SIZE } from './ADMIN_FUNCTIONS-CqVmUVNs.mjs';
+import { createFanoutCounters, ADMIN_FUNCTION_PREFIX, RELATION_FUNCTION_PREFIX, selectMatchingIds, ADMIN_FUNCTIONS, findStorageReferences, listTables, summarizeSubscriptions, summarizeFanoutTopics, readTablePage, facetColumn, FLAGS_FUNCTION_PREFIX, recordFanoutPass, MAX_PAGE_SIZE } from './ADMIN_FUNCTIONS-DVk02KpP.mjs';
 import { LogBuffer } from './LogBuffer-B_Ezju_N.mjs';
 import { recordCapturedMail, clearCapturedMail, readCapturedMail, MAIL_TABLE } from './MAIL_RETENTION-CPpgl-dX.mjs';
 import { stableStringify } from './stableStringify-mC40mZts.mjs';
@@ -93,12 +93,12 @@ const verifyWsAdminToken = async (secret, token, now = Date.now()) => {
 
 const AUDIT_LOG_TABLE = "__lunora_audit__";
 const AUDIT_LOG_RETENTION = 1e3;
-const runSql$3 = (sql, query, ...params) => {
+const runSql$4 = (sql, query, ...params) => {
   const runner = sql.exec;
   return runner.call(sql, query, ...params);
 };
 const ensureAuditTable = (sql) => {
-  runSql$3(
+  runSql$4(
     sql,
     `CREATE TABLE IF NOT EXISTS "${AUDIT_LOG_TABLE}" (
             seq INTEGER PRIMARY KEY AUTOINCREMENT,
@@ -112,7 +112,7 @@ const ensureAuditTable = (sql) => {
 };
 const appendAuditEntry = (sql, entry) => {
   ensureAuditTable(sql);
-  runSql$3(
+  runSql$4(
     sql,
     `INSERT INTO "${AUDIT_LOG_TABLE}" (ts, op, "table", id, detail) VALUES (?, ?, ?, ?, ?)`,
     entry.ts,
@@ -124,13 +124,13 @@ const appendAuditEntry = (sql, entry) => {
     // eslint-disable-next-line unicorn/no-null -- SQL NULL is the correct value for an op with no associated table/id/detail.
     entry.detail === void 0 ? null : JSON.stringify(entry.detail)
   );
-  runSql$3(sql, `DELETE FROM "${AUDIT_LOG_TABLE}" WHERE seq <= (SELECT MAX(seq) - ? FROM "${AUDIT_LOG_TABLE}")`, AUDIT_LOG_RETENTION);
+  runSql$4(sql, `DELETE FROM "${AUDIT_LOG_TABLE}" WHERE seq <= (SELECT MAX(seq) - ? FROM "${AUDIT_LOG_TABLE}")`, AUDIT_LOG_RETENTION);
 };
 const readAuditLog = (sql, options = {}) => {
   ensureAuditTable(sql);
   const sinceSeq = options.sinceSeq ?? 0;
   const limit = Math.max(1, Math.min(options.limit ?? AUDIT_LOG_RETENTION, 1e4));
-  const rows = runSql$3(
+  const rows = runSql$4(
     sql,
     `SELECT seq, ts, op, "table", id, detail FROM "${AUDIT_LOG_TABLE}" WHERE seq > ? ORDER BY seq DESC LIMIT ?`,
     sinceSeq,
@@ -183,6 +183,99 @@ const buildBatchEntryRequest = (batchRequest, entry) => {
   });
 };
 
+const ISSUE_STATE_TABLE = "__lunora_issue_state__";
+const HASH_QUERY_BATCH = 100;
+const ISSUE_STATUSES = ["ignored", "open", "resolved"];
+const ISSUE_SEVERITIES = ["critical", "high", "low", "medium"];
+const runSql$3 = (sql, query, ...parameters) => {
+  const runner = sql.exec;
+  return runner.call(sql, query, ...parameters);
+};
+const SQL_NULL = null;
+const orNull$1 = (value) => value ?? SQL_NULL;
+const ensureIssueStateTable = (sql) => {
+  runSql$3(
+    sql,
+    `CREATE TABLE IF NOT EXISTS "${ISSUE_STATE_TABLE}" (
+            hash TEXT PRIMARY KEY,
+            status TEXT NOT NULL DEFAULT 'open',
+            assignee TEXT,
+            severity TEXT,
+            updated_at REAL NOT NULL,
+            updated_by TEXT
+        )`
+  );
+};
+const hydrate = (row) => {
+  return {
+    ...row.assignee === null ? {} : { assignee: row.assignee },
+    hash: row.hash,
+    ...row.severity === null ? {} : { severity: row.severity },
+    status: row.status,
+    updatedAt: row.updated_at,
+    ...row.updated_by === null ? {} : { updatedBy: row.updated_by }
+  };
+};
+const readIssueStates = (sql, hashes) => {
+  const states = /* @__PURE__ */ new Map();
+  if (hashes.length === 0) {
+    return states;
+  }
+  ensureIssueStateTable(sql);
+  for (let start = 0; start < hashes.length; start += HASH_QUERY_BATCH) {
+    const batch = hashes.slice(start, start + HASH_QUERY_BATCH);
+    const placeholders = batch.map(() => "?").join(", ");
+    const rows = runSql$3(
+      sql,
+      `SELECT hash, status, assignee, severity, updated_at, updated_by FROM "${ISSUE_STATE_TABLE}" WHERE hash IN (${placeholders})`,
+      ...batch
+    ).toArray();
+    for (const row of rows) {
+      states.set(row.hash, hydrate(row));
+    }
+  }
+  return states;
+};
+const upsertIssueState = (sql, hash, patch, updatedAt, updatedBy) => {
+  ensureIssueStateTable(sql);
+  const status = orNull$1(patch.status);
+  const assignee = orNull$1(patch.assignee);
+  const clearAssignee = patch.assignee === null ? 1 : 0;
+  const severity = orNull$1(patch.severity);
+  const clearSeverity = patch.severity === null ? 1 : 0;
+  const actor = orNull$1(updatedBy);
+  runSql$3(
+    sql,
+    `INSERT INTO "${ISSUE_STATE_TABLE}" (hash, status, assignee, severity, updated_at, updated_by)
+         VALUES (?, COALESCE(?, 'open'), ?, ?, ?, ?)
+         ON CONFLICT(hash) DO UPDATE SET
+            status = COALESCE(?, status),
+            assignee = CASE WHEN ? = 1 THEN NULL ELSE COALESCE(?, assignee) END,
+            severity = CASE WHEN ? = 1 THEN NULL ELSE COALESCE(?, severity) END,
+            updated_at = ?,
+            updated_by = ?`,
+    hash,
+    status,
+    assignee,
+    severity,
+    updatedAt,
+    actor,
+    status,
+    clearAssignee,
+    assignee,
+    clearSeverity,
+    severity,
+    updatedAt,
+    actor
+  );
+  const [row] = runSql$3(
+    sql,
+    `SELECT hash, status, assignee, severity, updated_at, updated_by FROM "${ISSUE_STATE_TABLE}" WHERE hash = ?`,
+    hash
+  ).toArray();
+  return row === void 0 ? { hash, status: status ?? "open", updatedAt, ...updatedBy === void 0 ? {} : { updatedBy } } : hydrate(row);
+};
+
 const DEFAULT_CAPACITY$1 = 256;
 const seriesKey = (event) => `${event.kind}\0${event.name}\0${stableStringify(event.attributes ?? {})}`;
 class MetricBuffer {
@@ -1452,6 +1545,23 @@ const readRequestLog = (sql, options = {}) => {
     return base;
   });
 };
+const applyIssueStates = (sql, issues) => {
+  const states = readIssueStates(sql, [...issues.keys()]);
+  for (const issue of issues.values()) {
+    const state = states.get(issue.hash);
+    if (state === void 0) {
+      continue;
+    }
+    issue.stateUpdatedAt = state.updatedAt;
+    if (state.assignee !== void 0) {
+      issue.assignee = state.assignee;
+    }
+    if (state.severity !== void 0) {
+      issue.severity = state.severity;
+    }
+    issue.status = state.status === "resolved" && issue.lastSeen > state.updatedAt ? "open" : state.status;
+  }
+};
 const readErrorIssues = (sql, options = {}) => {
   ensureRequestLogTable(sql);
   const limit = Math.max(1, Math.min(options.limit ?? REQUEST_LOG_RETENTION, 1e4));
@@ -1483,7 +1593,7 @@ const readErrorIssues = (sql, options = {}) => {
     const { culprit, hash, title } = fingerprintError({ functionPath: row.function_path, message });
     const existing = issues.get(hash);
     if (existing === void 0) {
-      issues.set(hash, { count: 1, culprit, firstSeen: row.ts, hash, lastSeen: row.ts, sampleMessage: message, title });
+      issues.set(hash, { count: 1, culprit, firstSeen: row.ts, hash, lastSeen: row.ts, sampleMessage: message, status: "open", title });
       sampleTs.set(hash, row.ts);
       continue;
     }
@@ -1496,7 +1606,10 @@ const readErrorIssues = (sql, options = {}) => {
       existing.title = title;
     }
   }
-  return [...issues.values()].toSorted((a, b) => b.lastSeen - a.lastSeen);
+  applyIssueStates(sql, issues);
+  const folded = [...issues.values()];
+  const filtered = options.status === void 0 ? folded : folded.filter((issue) => issue.status === options.status);
+  return filtered.toSorted((a, b) => b.lastSeen - a.lastSeen);
 };
 
 const runSocketPool = async (items, processOne, concurrency = 8) => {
@@ -1761,6 +1874,36 @@ const parseWriteRowArgs = (args) => {
   }
   return { doc: record, id, op, table };
 };
+const isIssueStatus = (value) => typeof value === "string" && ISSUE_STATUSES.includes(value);
+const isIssueSeverity = (value) => typeof value === "string" && ISSUE_SEVERITIES.includes(value);
+const parseIssueHash = (args) => {
+  const hash = typeof args["hash"] === "string" ? args["hash"].trim() : "";
+  if (hash === "") {
+    throw new LunoraError("BAD_REQUEST", "issue triage: `hash` is required");
+  }
+  return hash;
+};
+const CLEAR = null;
+const parseAssigneeArgument = (args) => {
+  const raw = args["assignee"];
+  if (raw === null) {
+    return CLEAR;
+  }
+  if (typeof raw === "string" && raw.trim() !== "") {
+    return raw;
+  }
+  throw new LunoraError("BAD_REQUEST", "assignIssue: `assignee` must be a non-empty string (assign) or null (unassign)");
+};
+const parseSeverityArgument = (args) => {
+  const raw = args["severity"];
+  if (raw === null) {
+    return CLEAR;
+  }
+  if (isIssueSeverity(raw)) {
+    return raw;
+  }
+  throw new LunoraError("BAD_REQUEST", "setIssueSeverity: `severity` must be one of critical|high|medium|low, or null to clear");
+};
 const parseCreateWorkflowInstanceArgs = (args) => {
   const exportName = typeof args["exportName"] === "string" ? args["exportName"].trim() : "";
   if (exportName === "") {
@@ -4955,8 +5098,63 @@ class ShardDO {
     if (functionPath === ADMIN_FUNCTIONS.listFlags) {
       return this.handleListFlags(args);
     }
+    const triaged = await this.handleIssueTriageOp(functionPath, args);
+    if (triaged !== void 0) {
+      return triaged;
+    }
     return this.handlePitrAdminOp(functionPath, args);
   }
+  /**
+   * Serve the four Issue-triage admin writes — `resolveIssue` / `ignoreIssue`
+   * (a status change), `assignIssue` (set/clear an owner), `setIssueSeverity`
+   * (tag/clear severity). Each upserts one row in the reserved
+   * `__lunora_issue_state__` side table keyed by the Issue's fingerprint
+   * `hash`, then re-derives at read time in {@link readErrorIssues}. Returns
+   * `undefined` for any path it doesn't own so `handleExtraAdminOp` falls
+   * through. Admin-gated by `handleAdminRpc`'s caller (the `LUNORA_ADMIN_TOKEN`
+   * bearer); a bad/missing `hash` (or a bad status/severity value) is a 400.
+   *
+   * The write lands through raw SQL the change-tracker can't observe, so it
+   * marks {@link ISSUE_STATE_TABLE} changed and flushes — the live Issues
+   * subscription is an admin-wildcard memo that re-runs whenever a flush finds
+   * a changed table, so the triage shows up without an unrelated write.
+   */
+  async handleIssueTriageOp(functionPath, args) {
+    const patch = this.parseIssueTriagePatch(functionPath, args);
+    if (patch === void 0) {
+      return void 0;
+    }
+    const hash = parseIssueHash(args);
+    const updatedBy = typeof args["updatedBy"] === "string" ? args["updatedBy"] : void 0;
+    const sql = this.state.storage.sql;
+    const state = upsertIssueState(sql, hash, patch, Date.now(), updatedBy);
+    this.recordChangedTable(ISSUE_STATE_TABLE);
+    await this.flushChangedTables();
+    this.recordAudit(functionPath.slice(ADMIN_FUNCTION_PREFIX.length), { detail: { ...patch, hash } });
+    return jsonResponse({ result: { state } }, 200);
+  }
+  /**
+   * Map an Issue-triage admin path to the `IssueStatePatch` it applies, or
+   * `undefined` when the path isn't a triage write. `assignIssue`/
+   * `setIssueSeverity` accept an explicit `null` to CLEAR the field (unassign /
+   * untag); a missing or malformed value is a 400 rather than a silent no-op.
+   */
+  // eslint-disable-next-line class-methods-use-this -- kept an instance method for symmetry with the other `parse*`/handler seams
+  parseIssueTriagePatch(functionPath, args) {
+    if (functionPath === ADMIN_FUNCTIONS.resolveIssue) {
+      return { status: "resolved" };
+    }
+    if (functionPath === ADMIN_FUNCTIONS.ignoreIssue) {
+      return { status: "ignored" };
+    }
+    if (functionPath === ADMIN_FUNCTIONS.assignIssue) {
+      return { assignee: parseAssigneeArgument(args), status: "open" };
+    }
+    if (functionPath === ADMIN_FUNCTIONS.setIssueSeverity) {
+      return { severity: parseSeverityArgument(args) };
+    }
+    return void 0;
+  }
   /**
    * Record one app-level auth attempt for the auth-failure SLO (PLAN3 §2.3).
    * The worker calls this fire-and-forget (via `waitUntil`) after a top-level
@@ -5729,6 +5927,7 @@ class ShardDO {
         functionPathPrefix: typeof args["functionPathPrefix"] === "string" ? args["functionPathPrefix"] : void 0,
         limit: typeof args["limit"] === "number" ? args["limit"] : void 0,
         shardKey: typeof args["shardKey"] === "string" ? args["shardKey"] : void 0,
+        status: isIssueStatus(args["status"]) ? args["status"] : void 0,
         userId: typeof args["userId"] === "string" ? args["userId"] : void 0
       })
     };

package/dist/packem_shared/{serveRelationFanout-Yiyx2OQB.mjs → serveRelationFanout-FdrPflv1.mjs}

@@ -1,5 +1,5 @@
 import { LunoraError } from '@lunora/errors';
-import { RELATION_FUNCTION_PREFIX } from './ADMIN_FUNCTIONS-CqVmUVNs.mjs';
+import { RELATION_FUNCTION_PREFIX } from './ADMIN_FUNCTIONS-DVk02KpP.mjs';
 
 const serveRelationFanout = async (schema, database, functionPath, args) => {
   const table = typeof args["table"] === "string" ? args["table"] : "";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/do",
-  "version": "1.0.0-alpha.35",
+  "version": "1.0.0-alpha.36",
   "description": "Lunora Durable Objects: ShardDO (SQLite, OCC, hibernated WebSocket subscriptions) and SessionDO",
   "keywords": [
     "cloudflare",