@spool-lab/core 0.4.12 → 0.4.20

package/dist/projects/sessions.js

@@ -1,6 +1,7 @@
 import { SESSION_SELECT, rowToSession } from '../db/queries.js';
+const DEFAULT_PAGE_SIZE = 50;
 export function listSessionsByIdentity(db, identityKey, options = {}) {
-    const { sources, sortOrder = 'recent', limit = 500, excludePinned = false } = options;
+    const { sources, sortOrder = 'recent', limit = DEFAULT_PAGE_SIZE, excludePinned = false, cursor, } = options;
     const conditions = ['p.identity_key = ?', 's.message_count > 0'];
     const params = [identityKey];
     if (sources && sources.length > 0) {
@@ -11,16 +12,52 @@ export function listSessionsByIdentity(db, identityKey, options = {}) {
     if (excludePinned) {
         conditions.push('NOT EXISTS (SELECT 1 FROM pins WHERE pins.session_uuid = s.session_uuid)');
     }
-    const orderBy = orderByClause(sortOrder);
+    if (cursor) {
+        const c = cursorWhere(sortOrder, cursor);
+        conditions.push(c.sql);
+        params.push(...c.params);
+    }
+    return executePage(db, conditions, params, sortOrder, limit);
+}
+export function listRecentSessionsPage(db, options = {}) {
+    const { limit = DEFAULT_PAGE_SIZE, cursor } = options;
+    const conditions = ['s.message_count > 0'];
+    const params = [];
+    if (cursor) {
+        const c = cursorWhere('recent', cursor);
+        conditions.push(c.sql);
+        params.push(...c.params);
+    }
+    return executePage(db, conditions, params, 'recent', limit);
+}
+/**
+ * Per-cwd counts across the full project. Drives the chip strip's badges
+ * so they show the true distribution rather than just the loaded page.
+ * Honors the same `sources` filter as `listSessionsByIdentity`.
+ */
+export function listProjectDirectoryCounts(db, identityKey, options = {}) {
+    const { sources } = options;
+    const conditions = ['p.identity_key = ?', 's.message_count > 0'];
+    const params = [identityKey];
+    if (sources && sources.length > 0) {
+        const placeholders = sources.map(() => '?').join(',');
+        conditions.push(`src.name IN (${placeholders})`);
+        params.push(...sources);
+    }
     const sql = `
-    ${SESSION_SELECT}
+    SELECT
+      COALESCE(NULLIF(s.cwd, ''), '(unknown)') AS cwd,
+      COUNT(*) AS cnt,
+      MAX(s.started_at) AS last_at
+    FROM sessions s
+    JOIN sources src ON src.id = s.source_id
+    JOIN projects p ON p.id = s.project_id
     WHERE ${conditions.join(' AND ')}
-    ORDER BY ${orderBy}
-    LIMIT ?
+    GROUP BY cwd
+    ORDER BY MAX(s.started_at) DESC
   `;
-    params.push(limit);
     const rows = db.prepare(sql).all(...params);
-    return rows.map(rowToSession);
+    return rows.map(r => ({ cwd: r.cwd, sessionCount: r.cnt, lastSessionAt: r.last_at }));
 }
 export function listPinnedSessionsByIdentity(db, identityKey) {
     const rows = db.prepare(`
@@ -31,17 +68,84 @@ export function listPinnedSessionsByIdentity(db, identityKey) {
   `).all(identityKey);
     return rows.map(rowToSession);
 }
+function executePage(db, conditions, params, sortOrder, limit) {
+    const sql = `
+    ${SESSION_SELECT}
+    WHERE ${conditions.join(' AND ')}
+    ORDER BY ${orderByClause(sortOrder)}
+    LIMIT ?
+  `;
+    // Fetch limit+1 so we can detect "more rows exist" without a count query.
+    const rows = db.prepare(sql).all(...params, limit + 1);
+    const hasMore = rows.length > limit;
+    const pageRows = hasMore ? rows.slice(0, limit) : rows;
+    const sessions = pageRows.map(rowToSession);
+    const last = sessions.at(-1);
+    const nextCursor = hasMore && last
+        ? {
+            startedAt: last.startedAt,
+            sessionUuid: last.sessionUuid,
+            messageCount: last.messageCount,
+            title: last.title ?? '',
+        }
+        : null;
+    return { sessions, nextCursor };
+}
 function orderByClause(sortOrder) {
+    // session_uuid is the unique tiebreaker so the page boundary is deterministic
+    // and keyset pagination skips exactly the rows already shown.
+    switch (sortOrder) {
+        case 'oldest':
+            return 's.started_at ASC, s.session_uuid ASC';
+        case 'most_messages':
+            return 's.message_count DESC, s.started_at DESC, s.session_uuid ASC';
+        case 'title':
+            return "COALESCE(NULLIF(s.title, ''), '') ASC, s.started_at DESC, s.session_uuid ASC";
+        case 'recent':
+        default:
+            return 's.started_at DESC, s.session_uuid ASC';
+    }
+}
+function cursorWhere(sortOrder, c) {
+    const titleExpr = "COALESCE(NULLIF(s.title, ''), '')";
     switch (sortOrder) {
         case 'oldest':
-            return 's.started_at ASC';
+            return {
+                sql: '(s.started_at > ? OR (s.started_at = ? AND s.session_uuid > ?))',
+                params: [c.startedAt, c.startedAt, c.sessionUuid],
+            };
         case 'most_messages':
-            return 's.message_count DESC, s.started_at DESC';
+            return {
+                sql: `(
+          s.message_count < ?
+          OR (s.message_count = ? AND s.started_at < ?)
+          OR (s.message_count = ? AND s.started_at = ? AND s.session_uuid > ?)
+        )`,
+                params: [
+                    c.messageCount,
+                    c.messageCount, c.startedAt,
+                    c.messageCount, c.startedAt, c.sessionUuid,
+                ],
+            };
         case 'title':
-            return 'COALESCE(NULLIF(s.title, \'\'), \'\') ASC, s.started_at DESC';
+            return {
+                sql: `(
+          ${titleExpr} > ?
+          OR (${titleExpr} = ? AND s.started_at < ?)
+          OR (${titleExpr} = ? AND s.started_at = ? AND s.session_uuid > ?)
+        )`,
+                params: [
+                    c.title,
+                    c.title, c.startedAt,
+                    c.title, c.startedAt, c.sessionUuid,
+                ],
+            };
         case 'recent':
         default:
-            return 's.started_at DESC';
+            return {
+                sql: '(s.started_at < ? OR (s.started_at = ? AND s.session_uuid > ?))',
+                params: [c.startedAt, c.startedAt, c.sessionUuid],
+            };
     }
 }
 //# sourceMappingURL=sessions.js.map

package/dist/projects/sessions.js.map

@@ -1 +1 @@
-{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../../src/projects/sessions.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAW/D,MAAM,UAAU,sBAAsB,CACpC,EAAqB,EACrB,WAAmB,EACnB,UAAyC,EAAE;IAE3C,MAAM,EAAE,OAAO,EAAE,SAAS,GAAG,QAAQ,EAAE,KAAK,GAAG,GAAG,EAAE,aAAa,GAAG,KAAK,EAAE,GAAG,OAAO,CAAA;IAErF,MAAM,UAAU,GAAa,CAAC,oBAAoB,EAAE,qBAAqB,CAAC,CAAA;IAC1E,MAAM,MAAM,GAAc,CAAC,WAAW,CAAC,CAAA;IAEvC,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACrD,UAAU,CAAC,IAAI,CAAC,gBAAgB,YAAY,GAAG,CAAC,CAAA;QAChD,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAA;IACzB,CAAC;IAED,IAAI,aAAa,EAAE,CAAC;QAClB,UAAU,CAAC,IAAI,CAAC,0EAA0E,CAAC,CAAA;IAC7F,CAAC;IAED,MAAM,OAAO,GAAG,aAAa,CAAC,SAAS,CAAC,CAAA;IACxC,MAAM,GAAG,GAAG;MACR,cAAc;YACR,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;eACrB,OAAO;;GAEnB,CAAA;IACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAElB,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,MAAM,CAAmC,CAAA;IAC7E,OAAO,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;AAC/B,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,EAAqB,EACrB,WAAmB;IAEnB,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC;MACpB,cAAc;;;;GAIjB,CAAC,CAAC,GAAG,CAAC,WAAW,CAAmC,CAAA;IACrD,OAAO,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;AAC/B,CAAC;AAED,SAAS,aAAa,CAAC,SAAkC;IACvD,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,QAAQ;YACX,OAAO,kBAAkB,CAAA;QAC3B,KAAK,eAAe;YAClB,OAAO,yCAAyC,CAAA;QAClD,KAAK,OAAO;YACV,OAAO,8DAA8D,CAAA;QACvE,KAAK,QAAQ,CAAC;QACd;YACE,OAAO,mBAAmB,CAAA;IAC9B,CAAC;AACH,CAAC"}
+{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../../src/projects/sessions.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAwB/D,MAAM,iBAAiB,GAAG,EAAE,CAAA;AAE5B,MAAM,UAAU,sBAAsB,CACpC,EAAqB,EACrB,WAAmB,EACnB,UAAyC,EAAE;IAE3C,MAAM,EACJ,OAAO,EACP,SAAS,GAAG,QAAQ,EACpB,KAAK,GAAG,iBAAiB,EACzB,aAAa,GAAG,KAAK,EACrB,MAAM,GACP,GAAG,OAAO,CAAA;IAEX,MAAM,UAAU,GAAa,CAAC,oBAAoB,EAAE,qBAAqB,CAAC,CAAA;IAC1E,MAAM,MAAM,GAAc,CAAC,WAAW,CAAC,CAAA;IAEvC,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACrD,UAAU,CAAC,IAAI,CAAC,gBAAgB,YAAY,GAAG,CAAC,CAAA;QAChD,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAA;IACzB,CAAC;IAED,IAAI,aAAa,EAAE,CAAC;QAClB,UAAU,CAAC,IAAI,CAAC,0EAA0E,CAAC,CAAA;IAC7F,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,CAAC,GAAG,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;QACxC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QACtB,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAA;IAC1B,CAAC;IAED,OAAO,WAAW,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,CAAA;AAC9D,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,EAAqB,EACrB,UAAuD,EAAE;IAEzD,MAAM,EAAE,KAAK,GAAG,iBAAiB,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;IACrD,MAAM,UAAU,GAAa,CAAC,qBAAqB,CAAC,CAAA;IACpD,MAAM,MAAM,GAAc,EAAE,CAAA;IAC5B,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,CAAC,GAAG,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;QACvC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QACtB,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAA;IAC1B,CAAC;IACD,OAAO,WAAW,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAA;AAC7D,CAAC;AAQD;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CACxC,EAAqB,EACrB,WAAmB,EACnB,UAAyC,EAAE;IAE3C,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;IAC3B,MAAM,UAAU,GAAa,CAAC,oBAAoB,EAAE,qBAAqB,CAAC,CAAA;IAC1E,MAAM,MAAM,GAAc,CAAC,WAAW,CAAC,CAAA;IACvC,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACrD,UAAU,CAAC,IAAI,CAAC,gBAAgB,YAAY,GAAG,CAAC,CAAA;QAChD,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAA;IACzB,CAAC;IACD,MAAM,GAAG,GAAG;;;;;;;;YAQF,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;;;GAGjC,CAAA;IACD,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,MAAM,CAAyD,CAAA;IACnG,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,YAAY,EAAE,CAAC,CAAC,GAAG,EAAE,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;AACvF,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,EAAqB,EACrB,WAAmB;IAEnB,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC;MACpB,cAAc;;;;GAIjB,CAAC,CAAC,GAAG,CAAC,WAAW,CAAmC,CAAA;IACrD,OAAO,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;AAC/B,CAAC;AAED,SAAS,WAAW,CAClB,EAAqB,EACrB,UAAoB,EACpB,MAAiB,EACjB,SAAkC,EAClC,KAAa;IAEb,MAAM,GAAG,GAAG;MACR,cAAc;YACR,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;eACrB,aAAa,CAAC,SAAS,CAAC;;GAEpC,CAAA;IACD,0EAA0E;IAC1E,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,KAAK,GAAG,CAAC,CAAmC,CAAA;IACxF,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK,CAAA;IACnC,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACtD,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;IAC3C,MAAM,IAAI,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IAC5B,MAAM,UAAU,GAAG,OAAO,IAAI,IAAI;QAChC,CAAC,CAAC;YACE,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE;SACxB;QACH,CAAC,CAAC,IAAI,CAAA;IACR,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAA;AACjC,CAAC;AAED,SAAS,aAAa,CAAC,SAAkC;IACvD,8EAA8E;IAC9E,8DAA8D;IAC9D,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,QAAQ;YACX,OAAO,sCAAsC,CAAA;QAC/C,KAAK,eAAe;YAClB,OAAO,6DAA6D,CAAA;QACtE,KAAK,OAAO;YACV,OAAO,8EAA8E,CAAA;QACvF,KAAK,QAAQ,CAAC;QACd;YACE,OAAO,uCAAuC,CAAA;IAClD,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAClB,SAAkC,EAClC,CAAiB;IAEjB,MAAM,SAAS,GAAG,mCAAmC,CAAA;IACrD,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,QAAQ;YACX,OAAO;gBACL,GAAG,EAAE,iEAAiE;gBACtE,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,WAAW,CAAC;aAClD,CAAA;QACH,KAAK,eAAe;YAClB,OAAO;gBACL,GAAG,EAAE;;;;UAIH;gBACF,MAAM,EAAE;oBACN,CAAC,CAAC,YAAY;oBACd,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,SAAS;oBAC3B,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,WAAW;iBAC3C;aACF,CAAA;QACH,KAAK,OAAO;YACV,OAAO;gBACL,GAAG,EAAE;YACD,SAAS;gBACL,SAAS;gBACT,SAAS;UACf;gBACF,MAAM,EAAE;oBACN,CAAC,CAAC,KAAK;oBACP,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,SAAS;oBACpB,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,WAAW;iBACpC;aACF,CAAA;QACH,KAAK,QAAQ,CAAC;QACd;YACE,OAAO;gBACL,GAAG,EAAE,iEAAiE;gBACtE,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,WAAW,CAAC;aAClD,CAAA;IACL,CAAC;AACH,CAAC"}

package/dist/security/index.d.ts

@@ -0,0 +1,14 @@
+export type { FindingState, FindingRow, SessionWithFindingCounts, RiskByCategoryRow, DismissScope, FindingsChange, ScanStatus, } from './types.js';
+export { REDACT_DETECTOR_VERSION, currentProfileString, parseProfile, profilesMatch, providersInProfile, } from './profile.js';
+export type { ProfileOpts, ParsedProfile } from './profile.js';
+export { insertFindings, deleteActiveFindings, deleteRefreshableFindings, updateSessionCounts, setSessionScanProfile, invalidateAllScanProfiles, invalidateSessionScanProfile, listSessionsNeedingScan, listFindings, listFindingsPage, listSessionsWithFindings, listSessionsWithFindingsPage, countSessionsWithFindings, riskByCategory, getFindingValue, getFindingValues, getAllowlists, isAllowlisted, addAllowlistSession, addAllowlistGlobal, removeAllowlistSession, removeAllowlistGlobal, listAllowlistEntries, dismissFinding, undismissFinding, } from './repo.js';
+export type { FindingFilter, SessionFindingFilter, FindingInput, AllowlistEntryRow, AllowlistSnapshot, Page, } from './repo.js';
+export { scanSession, ScanError } from './scan.js';
+export type { ScanResult, ScanSessionDeps } from './scan.js';
+export { purgeFinding, purgeFindings, orderForBulkPurge, PurgeError } from './purge.js';
+export type { PurgeResult, PurgeDeps } from './purge.js';
+export { makeScanWorker, waitForIdle } from './worker.js';
+export type { ScanWorker, WorkerConfig } from './worker.js';
+export { listBackups, deleteBackups, backupDirFor } from './maintenance.js';
+export type { BackupFileInfo, DeleteBackupsResult, } from './maintenance.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/security/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,YAAY,EACZ,UAAU,EACV,wBAAwB,EACxB,iBAAiB,EACjB,YAAY,EACZ,cAAc,EACd,UAAU,GACX,MAAM,YAAY,CAAA;AAEnB,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,YAAY,EACZ,aAAa,EACb,kBAAkB,GACnB,MAAM,cAAc,CAAA;AACrB,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAE9D,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,yBAAyB,EACzB,mBAAmB,EACnB,qBAAqB,EACrB,yBAAyB,EACzB,4BAA4B,EAC5B,uBAAuB,EACvB,YAAY,EACZ,gBAAgB,EAChB,wBAAwB,EACxB,4BAA4B,EAC5B,yBAAyB,EACzB,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,aAAa,EACb,aAAa,EACb,mBAAmB,EACnB,kBAAkB,EAClB,sBAAsB,EACtB,qBAAqB,EACrB,oBAAoB,EACpB,cAAc,EACd,gBAAgB,GACjB,MAAM,WAAW,CAAA;AAClB,YAAY,EACV,aAAa,EACb,oBAAoB,EACpB,YAAY,EACZ,iBAAiB,EACjB,iBAAiB,EACjB,IAAI,GACL,MAAM,WAAW,CAAA;AAElB,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AAClD,YAAY,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAE5D,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AACvF,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAExD,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzD,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAE3D,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAC3E,YAAY,EACV,cAAc,EACd,mBAAmB,GACpB,MAAM,kBAAkB,CAAA"}

package/dist/security/index.js

@@ -0,0 +1,7 @@
+export { REDACT_DETECTOR_VERSION, currentProfileString, parseProfile, profilesMatch, providersInProfile, } from './profile.js';
+export { insertFindings, deleteActiveFindings, deleteRefreshableFindings, updateSessionCounts, setSessionScanProfile, invalidateAllScanProfiles, invalidateSessionScanProfile, listSessionsNeedingScan, listFindings, listFindingsPage, listSessionsWithFindings, listSessionsWithFindingsPage, countSessionsWithFindings, riskByCategory, getFindingValue, getFindingValues, getAllowlists, isAllowlisted, addAllowlistSession, addAllowlistGlobal, removeAllowlistSession, removeAllowlistGlobal, listAllowlistEntries, dismissFinding, undismissFinding, } from './repo.js';
+export { scanSession, ScanError } from './scan.js';
+export { purgeFinding, purgeFindings, orderForBulkPurge, PurgeError } from './purge.js';
+export { makeScanWorker, waitForIdle } from './worker.js';
+export { listBackups, deleteBackups, backupDirFor } from './maintenance.js';
+//# sourceMappingURL=index.js.map

package/dist/security/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":"AAUA,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,YAAY,EACZ,aAAa,EACb,kBAAkB,GACnB,MAAM,cAAc,CAAA;AAGrB,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,yBAAyB,EACzB,mBAAmB,EACnB,qBAAqB,EACrB,yBAAyB,EACzB,4BAA4B,EAC5B,uBAAuB,EACvB,YAAY,EACZ,gBAAgB,EAChB,wBAAwB,EACxB,4BAA4B,EAC5B,yBAAyB,EACzB,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,aAAa,EACb,aAAa,EACb,mBAAmB,EACnB,kBAAkB,EAClB,sBAAsB,EACtB,qBAAqB,EACrB,oBAAoB,EACpB,cAAc,EACd,gBAAgB,GACjB,MAAM,WAAW,CAAA;AAUlB,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AAGlD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAGvF,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAGzD,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA"}

package/dist/security/maintenance.d.ts

@@ -0,0 +1,15 @@
+import type Database from 'better-sqlite3';
+export interface BackupFileInfo {
+    name: string;
+    sizeBytes: number;
+    mtimeMs: number;
+    kind: 'auto' | 'manual';
+}
+export interface DeleteBackupsResult {
+    deleted: number;
+    bytesFreed: number;
+}
+export declare function backupDirFor(db: Database.Database): string | null;
+export declare function listBackups(db: Database.Database): BackupFileInfo[];
+export declare function deleteBackups(db: Database.Database, names: readonly string[]): DeleteBackupsResult;
+//# sourceMappingURL=maintenance.d.ts.map

package/dist/security/maintenance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"maintenance.d.ts","sourceRoot":"","sources":["../../src/security/maintenance.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAA;AAS1C,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,GAAG,QAAQ,CAAA;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,wBAAgB,YAAY,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,GAAG,MAAM,GAAG,IAAI,CAKjE;AAED,wBAAgB,WAAW,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,GAAG,cAAc,EAAE,CAsBnE;AAED,wBAAgB,aAAa,CAC3B,EAAE,EAAE,QAAQ,CAAC,QAAQ,EACrB,KAAK,EAAE,SAAS,MAAM,EAAE,GACvB,mBAAmB,CAwBrB"}

package/dist/security/maintenance.js

@@ -0,0 +1,68 @@
+import { existsSync, readdirSync, rmSync, statSync, } from 'node:fs';
+import { basename, dirname, join } from 'node:path';
+// Listed in the UI: any snapshot Spool itself produced under
+// ~/.spool/backups/. The narrower regex below distinguishes automated
+// schema-migration snapshots (kind: 'auto') from human-named rollback
+// points (kind: 'manual') so the UI can surface that difference.
+const SPOOL_BACKUP_RE = /^spool-pre-.+\.db$/;
+const AUTO_BACKUP_RE = /^spool-pre-v\d+-/;
+export function backupDirFor(db) {
+    if (db.memory)
+        return null;
+    const dbPath = db.name;
+    if (!dbPath)
+        return null;
+    return join(dirname(dbPath), 'backups');
+}
+export function listBackups(db) {
+    const backupDir = backupDirFor(db);
+    if (!backupDir || !existsSync(backupDir))
+        return [];
+    return readdirSync(backupDir)
+        .filter((name) => SPOOL_BACKUP_RE.test(name))
+        .map((name) => {
+        try {
+            const st = statSync(join(backupDir, name));
+            return {
+                name,
+                sizeBytes: st.size,
+                mtimeMs: st.mtimeMs,
+                kind: AUTO_BACKUP_RE.test(name) ? 'auto' : 'manual',
+            };
+        }
+        catch {
+            // stat may race with a concurrent delete; skip on error.
+            return null;
+        }
+    })
+        .filter((e) => e !== null)
+        .sort((a, b) => b.mtimeMs - a.mtimeMs);
+}
+export function deleteBackups(db, names) {
+    const backupDir = backupDirFor(db);
+    if (!backupDir || !existsSync(backupDir) || names.length === 0) {
+        return { deleted: 0, bytesFreed: 0 };
+    }
+    let deleted = 0;
+    let bytesFreed = 0;
+    for (const name of names) {
+        // Reject path traversal: a malicious or buggy caller must not be
+        // able to delete files outside the backups dir.
+        if (basename(name) !== name)
+            continue;
+        if (!SPOOL_BACKUP_RE.test(name))
+            continue;
+        const full = join(backupDir, name);
+        try {
+            const st = statSync(full);
+            rmSync(full, { force: true });
+            deleted += 1;
+            bytesFreed += st.size;
+        }
+        catch {
+            // best-effort; missing file = already gone, treat as no-op.
+        }
+    }
+    return { deleted, bytesFreed };
+}
+//# sourceMappingURL=maintenance.js.map

package/dist/security/maintenance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"maintenance.js","sourceRoot":"","sources":["../../src/security/maintenance.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,WAAW,EACX,MAAM,EACN,QAAQ,GACT,MAAM,SAAS,CAAA;AAChB,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAGnD,6DAA6D;AAC7D,sEAAsE;AACtE,sEAAsE;AACtE,iEAAiE;AACjE,MAAM,eAAe,GAAG,oBAAoB,CAAA;AAC5C,MAAM,cAAc,GAAG,kBAAkB,CAAA;AAczC,MAAM,UAAU,YAAY,CAAC,EAAqB;IAChD,IAAI,EAAE,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IAC1B,MAAM,MAAM,GAAG,EAAE,CAAC,IAAI,CAAA;IACtB,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IACxB,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,CAAA;AACzC,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,EAAqB;IAC/C,MAAM,SAAS,GAAG,YAAY,CAAC,EAAE,CAAC,CAAA;IAClC,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,CAAA;IAEnD,OAAO,WAAW,CAAC,SAAS,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;SAC5C,GAAG,CAAC,CAAC,IAAI,EAAyB,EAAE;QACnC,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAA;YAC1C,OAAO;gBACL,IAAI;gBACJ,SAAS,EAAE,EAAE,CAAC,IAAI;gBAClB,OAAO,EAAE,EAAE,CAAC,OAAO;gBACnB,IAAI,EAAE,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;aACpD,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACP,yDAAyD;YACzD,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,CAAC,EAAuB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;SAC9C,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAA;AAC1C,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,EAAqB,EACrB,KAAwB;IAExB,MAAM,SAAS,GAAG,YAAY,CAAC,EAAE,CAAC,CAAA;IAClC,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/D,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAA;IACtC,CAAC;IAED,IAAI,OAAO,GAAG,CAAC,CAAA;IACf,IAAI,UAAU,GAAG,CAAC,CAAA;IAClB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,iEAAiE;QACjE,gDAAgD;QAChD,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI;YAAE,SAAQ;QACrC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAQ;QACzC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;QAClC,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;YACzB,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;YAC7B,OAAO,IAAI,CAAC,CAAA;YACZ,UAAU,IAAI,EAAE,CAAC,IAAI,CAAA;QACvB,CAAC;QAAC,MAAM,CAAC;YACP,4DAA4D;QAC9D,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAA;AAChC,CAAC"}

package/dist/security/profile.d.ts

@@ -0,0 +1,47 @@
+export declare const REDACT_DETECTOR_VERSION = 4;
+export interface ProfileOpts {
+    /** Regex detector revision. Bump in lockstep with rule changes. */
+    regexVersion?: number;
+    /** Whether the Privacy Filter ML provider is enabled. */
+    pfEnabled?: boolean;
+    /** Privacy Filter model + quant level, e.g. '1.5b-q4'. Required
+     *  when `pfEnabled` is true. */
+    pfVersion?: string;
+    /** Per-kind allowlist (Settings → Security → "Don't report"). Hashed
+     *  into the profile string so flipping a kind triggers a real
+     *  re-scan via `listSessionsNeedingScan` — otherwise sessions
+     *  scanned before the toggle would never re-evaluate their findings
+     *  and stale `state='active'` rows would linger for the now-
+     *  allowlisted kind.
+     *
+     *  Order-insensitive: we sort + dedupe before hashing. Empty list
+     *  collapses the segment so the profile stays `regex@4` (not
+     *  `regex@4,allow@0`) — backward-compat with sessions stamped
+     *  before the allowlist feature existed. */
+    kindAllowlist?: readonly string[];
+}
+export interface ParsedProfile {
+    regex: number;
+    pf?: string;
+    /** Short hex digest of the sorted kind allowlist; only present when
+     *  the user has configured a non-empty list. */
+    allow?: string;
+}
+/** Build the canonical profile string for the current detector set.
+ *  Order is fixed (regex → pf → allow) so equality is structural. */
+export declare function currentProfileString(opts?: ProfileOpts): string;
+/** Parse a profile string back into structured fields. Returns null
+ *  for inputs that don't look like a profile (e.g. legacy values,
+ *  manual edits). Strict — unknown tokens cause a null return so the
+ *  worker treats them as "stale, rescan". */
+export declare function parseProfile(s: string | null | undefined): ParsedProfile | null;
+/** Structural equality on profile strings — order-insensitive but
+ *  same-content. */
+export declare function profilesMatch(a: string | null | undefined, b: string | null | undefined): boolean;
+/** Names of the providers active in a profile. Used by
+ *  `deleteActiveFindings(... providers)` so rescanning with a smaller
+ *  provider set doesn't clobber prior findings the user may still
+ *  want (e.g. disabling pf shouldn't delete pf's historical hits;
+ *  they just stop being refreshed). */
+export declare function providersInProfile(s: string): string[];
+//# sourceMappingURL=profile.d.ts.map

package/dist/security/profile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile.d.ts","sourceRoot":"","sources":["../../src/security/profile.ts"],"names":[],"mappings":"AAmBA,eAAO,MAAM,uBAAuB,IAAI,CAAA;AAExC,MAAM,WAAW,WAAW;IAC1B,mEAAmE;IACnE,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,yDAAyD;IACzD,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB;oCACgC;IAChC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;;;;;;;;gDAU4C;IAC5C,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAClC;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAA;IACb,EAAE,CAAC,EAAE,MAAM,CAAA;IACX;oDACgD;IAChD,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED;qEACqE;AACrE,wBAAgB,oBAAoB,CAAC,IAAI,GAAE,WAAgB,GAAG,MAAM,CAYnE;AAqBD;;;6CAG6C;AAC7C,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,aAAa,GAAG,IAAI,CA6B/E;AAED;oBACoB;AACpB,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAKjG;AAED;;;;uCAIuC;AACvC,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAMtD"}

package/dist/security/profile.js

@@ -0,0 +1,122 @@
+// Scan profile — a composite identifier for the set of providers
+// that produced the findings in a session.
+//
+// Persisted on `sessions.scan_profile`. Compare to the worker's
+// current profile string at startup to detect rescan candidates:
+//
+//   stored = NULL                  → never scanned, enqueue
+//   stored = 'regex@3'             → matches current 'regex@3', skip
+//   stored = 'regex@3,pf@1.5b-q4'  → user disabled pf, enqueue rescan
+//
+// Provider versions are bumped manually when detection logic changes.
+// REDACT_DETECTOR_VERSION lives next to the regex detector in
+// `@spool-lab/redact` (added in PR 1a); we re-export it here for
+// callers that only depend on @spool-lab/core.
+// v4: tightened IPv6 (rejects HH:MM:SS look-alikes) + dropped
+// `.local` from internal-host TLDs (collides with `.env.local`).
+// Bumping the version forces a rescan on every session, so old
+// findings under the v3 rules get replaced with the cleaner v4 set.
+export const REDACT_DETECTOR_VERSION = 4;
+/** Build the canonical profile string for the current detector set.
+ *  Order is fixed (regex → pf → allow) so equality is structural. */
+export function currentProfileString(opts = {}) {
+    const regexVersion = opts.regexVersion ?? REDACT_DETECTOR_VERSION;
+    const parts = [`regex@${regexVersion}`];
+    if (opts.pfEnabled) {
+        if (!opts.pfVersion) {
+            throw new Error('currentProfileString: pfVersion is required when pfEnabled is true');
+        }
+        parts.push(`pf@${opts.pfVersion}`);
+    }
+    const allowHash = hashKindAllowlist(opts.kindAllowlist);
+    if (allowHash)
+        parts.push(`allow@${allowHash}`);
+    return parts.join(',');
+}
+/** FNV-1a 32-bit over the sorted+deduped kind list. Returns null for
+ *  empty / undefined so the profile string stays minimal when no kinds
+ *  are allowlisted (the common case). 8-char hex; collision risk is
+ *  irrelevant — drift, not authenticity, is what we're detecting. */
+function hashKindAllowlist(kinds) {
+    if (!kinds || kinds.length === 0)
+        return null;
+    const sorted = [...new Set(kinds)].sort();
+    let h = 0x811c9dc5;
+    for (const k of sorted) {
+        for (let i = 0; i < k.length; i++) {
+            h ^= k.charCodeAt(i);
+            h = Math.imul(h, 0x01000193);
+        }
+        h ^= 0x2c; // ',' delimiter so ['a','bc'] !== ['ab','c']
+        h = Math.imul(h, 0x01000193);
+    }
+    return (h >>> 0).toString(16).padStart(8, '0');
+}
+/** Parse a profile string back into structured fields. Returns null
+ *  for inputs that don't look like a profile (e.g. legacy values,
+ *  manual edits). Strict — unknown tokens cause a null return so the
+ *  worker treats them as "stale, rescan". */
+export function parseProfile(s) {
+    if (!s)
+        return null;
+    const parts = s.split(',').map(p => p.trim()).filter(Boolean);
+    let regex;
+    let pf;
+    let allow;
+    for (const part of parts) {
+        const at = part.indexOf('@');
+        if (at <= 0)
+            return null;
+        const name = part.slice(0, at);
+        const ver = part.slice(at + 1);
+        if (!ver)
+            return null;
+        if (name === 'regex') {
+            const n = Number(ver);
+            if (!Number.isInteger(n) || n < 1)
+                return null;
+            regex = n;
+        }
+        else if (name === 'pf') {
+            pf = ver;
+        }
+        else if (name === 'allow') {
+            allow = ver;
+        }
+        else {
+            return null;
+        }
+    }
+    if (regex === undefined)
+        return null;
+    const result = { regex };
+    if (pf !== undefined)
+        result.pf = pf;
+    if (allow !== undefined)
+        result.allow = allow;
+    return result;
+}
+/** Structural equality on profile strings — order-insensitive but
+ *  same-content. */
+export function profilesMatch(a, b) {
+    const pa = parseProfile(a);
+    const pb = parseProfile(b);
+    if (!pa || !pb)
+        return false;
+    return pa.regex === pb.regex && pa.pf === pb.pf && pa.allow === pb.allow;
+}
+/** Names of the providers active in a profile. Used by
+ *  `deleteActiveFindings(... providers)` so rescanning with a smaller
+ *  provider set doesn't clobber prior findings the user may still
+ *  want (e.g. disabling pf shouldn't delete pf's historical hits;
+ *  they just stop being refreshed). */
+export function providersInProfile(s) {
+    const parsed = parseProfile(s);
+    if (!parsed)
+        return [];
+    const out = ['regex'];
+    if (parsed.pf)
+        out.push('pf');
+    return out;
+}
+//# sourceMappingURL=profile.js.map

package/dist/security/profile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile.js","sourceRoot":"","sources":["../../src/security/profile.ts"],"names":[],"mappings":"AAAA,iEAAiE;AACjE,2CAA2C;AAC3C,EAAE;AACF,gEAAgE;AAChE,iEAAiE;AACjE,EAAE;AACF,4DAA4D;AAC5D,qEAAqE;AACrE,sEAAsE;AACtE,EAAE;AACF,sEAAsE;AACtE,8DAA8D;AAC9D,iEAAiE;AACjE,+CAA+C;AAE/C,8DAA8D;AAC9D,iEAAiE;AACjE,+DAA+D;AAC/D,oEAAoE;AACpE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAA;AAgCxC;qEACqE;AACrE,MAAM,UAAU,oBAAoB,CAAC,OAAoB,EAAE;IACzD,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,uBAAuB,CAAA;IACjE,MAAM,KAAK,GAAG,CAAC,SAAS,YAAY,EAAE,CAAC,CAAA;IACvC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAA;QACvF,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,CAAA;IACpC,CAAC;IACD,MAAM,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;IACvD,IAAI,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,SAAS,SAAS,EAAE,CAAC,CAAA;IAC/C,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AACxB,CAAC;AAED;;;qEAGqE;AACrE,SAAS,iBAAiB,CAAC,KAAoC;IAC7D,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAC7C,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IACzC,IAAI,CAAC,GAAG,UAAU,CAAA;IAClB,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAClC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;YACpB,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,UAAU,CAAC,CAAA;QAC9B,CAAC;QACD,CAAC,IAAI,IAAI,CAAA,CAAC,6CAA6C;QACvD,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,UAAU,CAAC,CAAA;IAC9B,CAAC;IACD,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;AAChD,CAAC;AAED;;;6CAG6C;AAC7C,MAAM,UAAU,YAAY,CAAC,CAA4B;IACvD,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IACnB,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IAC7D,IAAI,KAAyB,CAAA;IAC7B,IAAI,EAAsB,CAAA;IAC1B,IAAI,KAAyB,CAAA;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC5B,IAAI,EAAE,IAAI,CAAC;YAAE,OAAO,IAAI,CAAA;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAA;QAC9B,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAA;QACrB,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACrB,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;YACrB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAA;YAC9C,KAAK,GAAG,CAAC,CAAA;QACX,CAAC;aAAM,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACzB,EAAE,GAAG,GAAG,CAAA;QACV,CAAC;aAAM,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YAC5B,KAAK,GAAG,GAAG,CAAA;QACb,CAAC;aAAM,CAAC;YACN,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IACD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IACpC,MAAM,MAAM,GAAkB,EAAE,KAAK,EAAE,CAAA;IACvC,IAAI,EAAE,KAAK,SAAS;QAAE,MAAM,CAAC,EAAE,GAAG,EAAE,CAAA;IACpC,IAAI,KAAK,KAAK,SAAS;QAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAA;IAC7C,OAAO,MAAM,CAAA;AACf,CAAC;AAED;oBACoB;AACpB,MAAM,UAAU,aAAa,CAAC,CAA4B,EAAE,CAA4B;IACtF,MAAM,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,CAAA;IAC1B,MAAM,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,CAAA;IAC1B,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE;QAAE,OAAO,KAAK,CAAA;IAC5B,OAAO,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,KAAK,CAAA;AAC1E,CAAC;AAED;;;;uCAIuC;AACvC,MAAM,UAAU,kBAAkB,CAAC,CAAS;IAC1C,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,CAAA;IAC9B,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAA;IACtB,MAAM,GAAG,GAAa,CAAC,OAAO,CAAC,CAAA;IAC/B,IAAI,MAAM,CAAC,EAAE;QAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC7B,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/security/purge.d.ts

@@ -0,0 +1,49 @@
+import { Effect } from 'effect';
+import type Database from 'better-sqlite3';
+import type { FindingsChange } from './types.js';
+declare const PurgeError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "PurgeError";
+} & Readonly<A>;
+export declare class PurgeError extends PurgeError_base<{
+    readonly findingId: number;
+    readonly reason: 'not-found' | 'already-purged' | 'message-missing' | 'db-failed';
+    readonly cause?: unknown;
+}> {
+}
+export interface PurgeResult {
+    findingId: number;
+    sessionId: number;
+    /** The mask string that replaced the raw value. */
+    maskUsed: string;
+    purgedAt: string;
+}
+export interface PurgeDeps {
+    db: Database.Database;
+    publish: (change: FindingsChange) => Effect.Effect<void>;
+}
+/** Purge one finding. Idempotent on "already purged" → returns a
+ *  PurgeError so the UI can surface a no-op. */
+export declare function purgeFinding(findingId: number, deps: PurgeDeps): Effect.Effect<PurgeResult, PurgeError>;
+/** Bulk purge across many findings. Caller passes an arbitrary
+ *  ordering; we re-sort to the only correct order:
+ *
+ *    1. Group by `message_id`
+ *    2. Within each group, apply in **descending** `start_offset` so
+ *       earlier offsets stay valid as the string shifts.
+ *
+ *  Without this re-sort, two findings inside the same message at
+ *  offsets [10..20] and [40..60] would corrupt: purging [10..20]
+ *  first shifts everything after offset 20 by `mask.length - 10`,
+ *  and the second slice [40..60] now points at the wrong bytes
+ *  (often leaking part of the second secret into the mask, or
+ *  losing it entirely). */
+export declare function purgeFindings(findingIds: readonly number[], deps: PurgeDeps): Effect.Effect<PurgeResult[], PurgeError>;
+/** Produce a purge order that's safe against offset drift. Findings
+ *  with `message_id IS NULL` (orphan rows that the schema permits but
+ *  should never happen in practice) fall to the end so they don't
+ *  interfere with message-grouped batches.
+ *
+ *  Exported only for tests. */
+export declare function orderForBulkPurge(db: Database.Database, findingIds: readonly number[]): number[];
+export {};
+//# sourceMappingURL=purge.d.ts.map

package/dist/security/purge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"purge.d.ts","sourceRoot":"","sources":["../../src/security/purge.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAQ,MAAM,EAAE,MAAM,QAAQ,CAAA;AACrC,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAA;AAI1C,OAAO,KAAK,EAAE,cAAc,EAAgB,MAAM,YAAY,CAAA;;;;AAE9D,qBAAa,UAAW,SAAQ,gBAA+B;IAC7D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,gBAAgB,GAAG,iBAAiB,GAAG,WAAW,CAAA;IACjF,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CACzB,CAAC;CAAG;AAEL,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,mDAAmD;IACnD,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;CACjB;AAYD,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAA;IACrB,OAAO,EAAE,CAAC,MAAM,EAAE,cAAc,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;CACzD;AAED;gDACgD;AAChD,wBAAgB,YAAY,CAC1B,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,SAAS,GACd,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,UAAU,CAAC,CAoCxC;AAED;;;;;;;;;;;;2BAY2B;AAC3B,wBAAgB,aAAa,CAC3B,UAAU,EAAE,SAAS,MAAM,EAAE,EAC7B,IAAI,EAAE,SAAS,GACd,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,UAAU,CAAC,CAsB1C;AAED;;;;;+BAK+B;AAC/B,wBAAgB,iBAAiB,CAC/B,EAAE,EAAE,QAAQ,CAAC,QAAQ,EACrB,UAAU,EAAE,SAAS,MAAM,EAAE,GAC5B,MAAM,EAAE,CAkCV"}