@spool-lab/core 0.4.12 → 0.5.0

package/dist/security/repo.js

@@ -0,0 +1,594 @@
+// Findings + allowlist repository.
+//
+// Plain better-sqlite3 prepared statements. No Effect here — this
+// module is called from both the scan worker (Effect, wraps these in
+// Effect.sync) and the IPC handlers (Promise-shaped). Keeping it
+// effect-free preserves the worker / boundary split documented in
+// the spec's "Implementation: Effect TS scope" section.
+//
+// Invariant: `findings.value_hash` is FNV-1a, computed via the
+// share-kit-aligned `hashValueForRedactExclude` so identity matches
+// across surfaces (share editor's exclude list, security allowlists).
+import { HIGH_SEVERITY_KINDS, INFO_SEVERITY_KINDS, severityOf, } from '@spool-lab/redact';
+function rowToFinding(r) {
+    return {
+        id: r.id,
+        sessionId: r.session_id,
+        messageId: r.message_id,
+        kind: r.kind,
+        valueHash: r.value_hash,
+        confidence: r.confidence,
+        provider: r.provider,
+        startOffset: r.start_offset,
+        endOffset: r.end_offset,
+        state: r.state,
+        detectedAt: r.detected_at,
+        stateChangedAt: r.state_changed_at,
+    };
+}
+/** Insert a batch of findings. Caller wraps in a transaction. */
+export function insertFindings(db, rows) {
+    if (rows.length === 0)
+        return;
+    const stmt = db.prepare(`INSERT INTO findings
+       (session_id, message_id, kind, value_hash, confidence, provider,
+        start_offset, end_offset, state, state_changed_at)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`);
+    for (const r of rows) {
+        stmt.run(r.sessionId, r.messageId, r.kind, r.valueHash, r.confidence, r.provider, r.startOffset, r.endOffset, r.state, r.state !== 'active' ? new Date().toISOString() : null);
+    }
+}
+/** Delete all non-purged rows for the providers being rescanned —
+ *  i.e. wipe the producer's previous output so the upcoming
+ *  `insertFindings` is the canonical truth.
+ *
+ *  Includes `state='dismissed'` deliberately: those rows are derived
+ *  state. The user's "ignore" decisions live in `allowlist_session`
+ *  and `allowlist_global` (preserved here), and the scan path
+ *  re-emits findings as `state='dismissed'` whenever it encounters a
+ *  hit that matches an allowlist row. Re-inserting also keeps
+ *  `findings.value_hash` aligned with the per-kind allowlist
+ *  preference (security.json `kindAllowlist`) — without this delete,
+ *  a mute → unmute cycle would accumulate phantom dismissed rows
+ *  (one set per cycle), inflating audit counts and breaking
+ *  `riskByCategory` totals over time.
+ *
+ *  Purged rows are the only state that's NOT producer-derived —
+ *  they correspond to destructive `messages.content_text` rewrites
+ *  the user explicitly approved. Preserving them is the audit
+ *  contract documented in the design doc. */
+export function deleteRefreshableFindings(db, sessionId, providers) {
+    if (providers.length === 0)
+        return;
+    const placeholders = providers.map(() => '?').join(',');
+    db.prepare(`DELETE FROM findings
+     WHERE session_id = ?
+       AND state IN ('active','dismissed')
+       AND provider IN (${placeholders})`).run(sessionId, ...providers);
+}
+/** @deprecated Renamed to {@link deleteRefreshableFindings} after the
+ *  active-only filter was found to leak phantom dismissed rows
+ *  across mute→unmute cycles. Kept as a thin alias so callers
+ *  outside the repo don't break mid-stack. */
+export const deleteActiveFindings = deleteRefreshableFindings;
+// ─── Counts (denormalised on sessions) ────────────────────────────
+/** Recompute sessions.scan_finding_count + scan_high_count from the
+ *  findings table.
+ *
+ *  Counts EXCLUDE info-tier kinds (absolute-path, ip, internal-host).
+ *  Those are stored — useful for an opt-in "Show informational
+ *  signals" toggle — but they don't drive the Library row badge
+ *  because their pattern-only signal has too high a false-positive
+ *  rate to be meaningful at first glance. */
+export function updateSessionCounts(db, sessionId) {
+    const active = db.prepare(`SELECT
+        SUM(CASE WHEN kind NOT IN (${infoKindsPlaceholders()}) THEN 1 ELSE 0 END) AS total,
+        SUM(CASE WHEN kind IN (${highKindsPlaceholders()}) THEN 1 ELSE 0 END) AS high
+     FROM findings
+     WHERE session_id = ? AND state = 'active'`).get(...INFO_SEVERITY_KINDS_ARRAY, ...HIGH_SEVERITY_KINDS_ARRAY, sessionId);
+    const purged = db.prepare(`SELECT COUNT(*) AS c
+       FROM findings
+      WHERE session_id = ? AND state = 'purged'`).get(sessionId);
+    db.prepare(`UPDATE sessions
+        SET scan_finding_count = ?,
+            scan_high_count    = ?,
+            scan_purged_count  = ?
+      WHERE id = ?`).run(active.total ?? 0, active.high ?? 0, purged.c, sessionId);
+}
+const HIGH_SEVERITY_KINDS_ARRAY = Array.from(HIGH_SEVERITY_KINDS);
+const INFO_SEVERITY_KINDS_ARRAY = Array.from(INFO_SEVERITY_KINDS);
+function highKindsPlaceholders() {
+    return HIGH_SEVERITY_KINDS_ARRAY.map(() => '?').join(',');
+}
+function infoKindsPlaceholders() {
+    return INFO_SEVERITY_KINDS_ARRAY.map(() => '?').join(',');
+}
+export function setSessionScanProfile(db, sessionId, profile, completedAt) {
+    db.prepare(`UPDATE sessions
+        SET scan_profile = ?, scan_completed_at = ?
+      WHERE id = ?`).run(profile, completedAt, sessionId);
+}
+/** Set every session's scan_profile to NULL — used by "Rescan all" so
+ *  every session re-enqueues. */
+export function invalidateAllScanProfiles(db) {
+    const r = db.prepare('UPDATE sessions SET scan_profile = NULL').run();
+    return r.changes;
+}
+/** Drop the scan profile for one session — used by the sync cascade
+ *  when a session's messages change after first scan. */
+export function invalidateSessionScanProfile(db, sessionId) {
+    db.prepare(`UPDATE sessions
+        SET scan_profile = NULL,
+            scan_completed_at = NULL
+      WHERE id = ?`).run(sessionId);
+}
+/** Sessions whose stored profile doesn't structurally match
+ *  `currentProfile`. Used at boot for backfill enqueue. */
+export function listSessionsNeedingScan(db, currentProfile) {
+    const rows = db.prepare(`SELECT id, scan_profile
+       FROM sessions
+      ORDER BY started_at DESC`).all();
+    const out = [];
+    for (const r of rows) {
+        if (r.scan_profile === null || r.scan_profile !== currentProfile) {
+            out.push(r.id);
+        }
+    }
+    return out;
+}
+// ─── Reads (UI path) ──────────────────────────────────────────────
+export function listFindings(db, filter) {
+    const where = [];
+    const params = [];
+    if (filter.sessionId !== undefined) {
+        where.push('session_id = ?');
+        params.push(filter.sessionId);
+    }
+    if (filter.kinds && filter.kinds.length > 0) {
+        const placeholders = filter.kinds.map(() => '?').join(',');
+        where.push(`kind IN (${placeholders})`);
+        params.push(...filter.kinds);
+    }
+    else if (filter.kind !== undefined) {
+        where.push('kind = ?');
+        params.push(filter.kind);
+    }
+    if (filter.state && filter.state !== 'any') {
+        where.push('state = ?');
+        params.push(filter.state);
+    }
+    else if (!filter.state) {
+        // Default: active only.
+        where.push("state = 'active'");
+    }
+    if (filter.severity === 'high') {
+        where.push(`kind IN (${highKindsPlaceholders()})`);
+        params.push(...HIGH_SEVERITY_KINDS_ARRAY);
+    }
+    else if (filter.severity === 'low') {
+        where.push(`kind NOT IN (${highKindsPlaceholders()})`);
+        params.push(...HIGH_SEVERITY_KINDS_ARRAY);
+    }
+    // Skip info-tier kinds unless the caller is explicitly asking for
+    // one. Saves the renderer from paging through 800+ absolute-path
+    // findings before reaching the api-key that actually matters.
+    const explicitKindsInclude = (kinds, kind) => {
+        if (kinds && kinds.length > 0)
+            return kinds.some(k => INFO_SEVERITY_KINDS.has(k));
+        if (kind !== undefined)
+            return INFO_SEVERITY_KINDS.has(kind);
+        return false;
+    };
+    if (filter.excludeInfo && !explicitKindsInclude(filter.kinds, filter.kind)) {
+        where.push(`kind NOT IN (${infoKindsPlaceholders()})`);
+        params.push(...INFO_SEVERITY_KINDS_ARRAY);
+    }
+    let pagination = '';
+    if (filter.limit !== undefined) {
+        pagination = ' LIMIT ? OFFSET ?';
+        params.push(filter.limit, filter.offset ?? 0);
+    }
+    const sql = `SELECT * FROM findings
+               ${where.length ? 'WHERE ' + where.join(' AND ') : ''}
+               ORDER BY detected_at DESC, id DESC${pagination}`;
+    const rows = db.prepare(sql).all(...params);
+    return rows.map(rowToFinding);
+}
+/** limit+1 peek to set `hasMore` without an extra COUNT round-trip. */
+function paginate(filter, fetch) {
+    if (filter.limit === undefined)
+        return { rows: fetch(filter), hasMore: false };
+    const peeked = fetch({ ...filter, limit: filter.limit + 1 });
+    const hasMore = peeked.length > filter.limit;
+    return { rows: hasMore ? peeked.slice(0, filter.limit) : peeked, hasMore };
+}
+export function listFindingsPage(db, filter) {
+    return paginate(filter, f => listFindings(db, f));
+}
+/** Shared WHERE-clause builder for the session-findings join. Used by
+ *  both `listSessionsWithFindings` (paginated rows) and
+ *  `countSessionsWithFindings` (total) so the two stay consistent. */
+function buildSessionFindingWhereSql(filter) {
+    const params = [];
+    const stateCondition = filter.state && filter.state !== 'any'
+        ? 'f.state = ?'
+        : "f.state = 'active'";
+    if (filter.state && filter.state !== 'any')
+        params.push(filter.state);
+    let kindCondition = '';
+    const explicitKinds = filter.kinds && filter.kinds.length > 0
+        ? filter.kinds
+        : filter.kind !== undefined ? [filter.kind] : undefined;
+    if (explicitKinds) {
+        const placeholders = explicitKinds.map(() => '?').join(',');
+        kindCondition = `AND f.kind IN (${placeholders})`;
+        params.push(...explicitKinds);
+    }
+    let severityCondition = '';
+    if (filter.severity === 'high') {
+        severityCondition = `AND f.kind IN (${highKindsPlaceholders()})`;
+        params.push(...HIGH_SEVERITY_KINDS_ARRAY);
+    }
+    else if (filter.severity === 'low') {
+        // Exclude both HIGH (not low) and INFO (noisy infra signals) so
+        // `severity:low` returns only the identity-tier kinds (email,
+        // phone, person-name, etc.).
+        severityCondition = `AND f.kind NOT IN (${highKindsPlaceholders()}) AND f.kind NOT IN (${infoKindsPlaceholders()})`;
+        params.push(...HIGH_SEVERITY_KINDS_ARRAY, ...INFO_SEVERITY_KINDS_ARRAY);
+    }
+    // Default exclusion: info-tier findings don't surface a session on
+    // their own — they're stored as an audit record (see Info drawer at
+    // the bottom of the page). Only when the user has explicitly pinned
+    // an info kind via filter.kind/filter.kinds do we let them through.
+    let infoExclusion = '';
+    if (!explicitKinds && filter.severity !== 'high' && filter.severity !== 'low') {
+        infoExclusion = `AND f.kind NOT IN (${infoKindsPlaceholders()})`;
+        params.push(...INFO_SEVERITY_KINDS_ARRAY);
+    }
+    let textCondition = '';
+    if (filter.text && filter.text.trim().length > 0) {
+        textCondition = `AND s.title LIKE ?`;
+        params.push(`%${filter.text.trim()}%`);
+    }
+    const whereClause = `${stateCondition} ${kindCondition} ${severityCondition} ${infoExclusion} ${textCondition}
+      AND COALESCE(s.message_count, 0) > 0`;
+    return { whereClause, params };
+}
+export function listSessionsWithFindings(db, filter) {
+    // For category/severity-aware filtering we need to compute counts
+    // from the findings table directly (denormalised counters can't
+    // express "only api-key findings"). We always recompute here.
+    const { whereClause, params } = buildSessionFindingWhereSql(filter);
+    const sql = `
+    SELECT
+      s.id              AS id,
+      s.session_uuid    AS session_uuid,
+      s.title           AS title,
+      s.started_at      AS started_at,
+      s.scan_completed_at AS scan_completed_at,
+      s.scan_purged_count AS purged_count,
+      s.message_count   AS message_count,
+      s.model           AS model,
+      s.cwd             AS cwd,
+      src.name          AS source,
+      p.display_name    AS project_display_name,
+      SUM(1) AS finding_count,
+      SUM(CASE WHEN f.kind IN (${highKindsPlaceholders()}) THEN 1 ELSE 0 END) AS high_count
+    FROM sessions s
+    JOIN findings f ON f.session_id = s.id
+    JOIN sources src ON src.id = s.source_id
+    JOIN projects p ON p.id = s.project_id
+    WHERE ${whereClause}
+    GROUP BY s.id
+    ORDER BY high_count DESC, finding_count DESC, s.started_at DESC, s.id DESC
+    ${filter.limit !== undefined ? 'LIMIT ? OFFSET ?' : ''}
+  `;
+    // Placeholder order matches SQL: SELECT's CASE WHEN IN (?) binds first,
+    // then the WHERE clause's params.
+    const allParams = [...HIGH_SEVERITY_KINDS_ARRAY, ...params];
+    if (filter.limit !== undefined) {
+        allParams.push(filter.limit, filter.offset ?? 0);
+    }
+    const rows = db.prepare(sql).all(...allParams);
+    return rows.map(r => ({
+        id: r.id,
+        sessionUuid: r.session_uuid,
+        title: r.title,
+        startedAt: r.started_at,
+        scanCompletedAt: r.scan_completed_at,
+        findingCount: r.finding_count,
+        highCount: r.high_count ?? 0,
+        purgedCount: r.purged_count ?? 0,
+        source: r.source,
+        messageCount: r.message_count ?? 0,
+        model: r.model,
+        cwd: r.cwd,
+        projectDisplayName: r.project_display_name,
+    }));
+}
+export function listSessionsWithFindingsPage(db, filter) {
+    return paginate(filter, f => listSessionsWithFindings(db, f));
+}
+/** Total distinct sessions matching the same filter as
+ *  `listSessionsWithFindings` — used by the renderer to show
+ *  "涉及 N 个会话" without loading every page. Cheaper than the list
+ *  query: no SELECT projection, no GROUP BY, no ORDER BY. */
+export function countSessionsWithFindings(db, filter) {
+    const { whereClause, params } = buildSessionFindingWhereSql(filter);
+    const sql = `
+    SELECT COUNT(DISTINCT s.id) AS total
+    FROM sessions s
+    JOIN findings f ON f.session_id = s.id
+    JOIN sources src ON src.id = s.source_id
+    JOIN projects p ON p.id = s.project_id
+    WHERE ${whereClause}
+  `;
+    const row = db.prepare(sql).get(...params);
+    return row.total;
+}
+/** Risk by category — one row per kind that has ≥ 1 active finding.
+ *  Drives the Watchtower-style panel on the Security page. */
+export function riskByCategory(db) {
+    const rows = db.prepare(`SELECT kind,
+            COUNT(*) AS count,
+            COUNT(DISTINCT session_id) AS sessions
+       FROM findings
+      WHERE state = 'active'
+      GROUP BY kind
+      ORDER BY count DESC`).all();
+    return rows.map(r => ({
+        kind: r.kind,
+        severity: severityOf(r.kind),
+        count: r.count,
+        sessions: r.sessions,
+    }));
+}
+/** Cross-session blast radius for one leaked value. Returns every
+ *  session that has ≥ 1 ACTIVE finding sharing the given
+ *  `(kind, valueHash)`, with the per-session occurrence count, project,
+ *  and most-recent detection time. Ordered most-recent-first.
+ *
+ *  Spool already collapses repeated occurrences of a value WITHIN a
+ *  session into one row (×N); this extends that view across the whole
+ *  archive so the user can see "this same key also leaked in 4 other
+ *  sessions". Dismissed/purged occurrences are excluded — they no
+ *  longer expose the value through search / AI / browse. */
+export function occurrencesByValueHash(db, kind, valueHash) {
+    const rows = db.prepare(`SELECT
+        s.id            AS session_id,
+        s.session_uuid  AS session_uuid,
+        s.title         AS session_title,
+        src.name        AS source,
+        p.display_name  AS project,
+        COUNT(*)        AS count,
+        MAX(f.detected_at) AS last_seen
+       FROM findings f
+       JOIN sessions s ON s.id = f.session_id
+       JOIN sources  src ON src.id = s.source_id
+       JOIN projects p ON p.id = s.project_id
+      WHERE f.kind = ? AND f.value_hash = ? AND f.state = 'active'
+      GROUP BY s.id
+      ORDER BY last_seen DESC, s.id DESC`).all(kind, valueHash);
+    return rows.map(r => ({
+        sessionId: r.session_id,
+        sessionUuid: r.session_uuid,
+        sessionTitle: r.session_title,
+        source: r.source,
+        project: r.project,
+        count: r.count,
+        lastSeen: r.last_seen,
+    }));
+}
+/** The most recent `scan_completed_at` across ALL sessions, regardless
+ *  of whether they currently have active findings. Drives the Security
+ *  page's "scanned X ago" label. Deriving it from the filtered,
+ *  paginated findings list undercounts: a session scanned + cleaned
+ *  (no active findings) drops off that list and stops contributing, so
+ *  the label could read older than the true last scan. Returns null
+ *  when nothing has been scanned yet. */
+export function lastScanCompletedAt(db) {
+    const row = db.prepare(`SELECT MAX(scan_completed_at) AS last
+       FROM sessions
+      WHERE scan_completed_at IS NOT NULL`).get();
+    return row.last;
+}
+/** Read the live raw value for one finding. Used by the UI's review
+ *  panel and the Purge confirm dialog. Returns null when the finding
+ *  no longer points at a valid message (race against session
+ *  deletion) or has been purged (offsets now point at the mask). */
+export function getFindingValue(db, findingId) {
+    const row = db.prepare(`SELECT f.start_offset, f.end_offset, f.state, m.content_text
+       FROM findings f
+       LEFT JOIN messages m ON m.id = f.message_id
+      WHERE f.id = ?`).get(findingId);
+    if (!row || row.content_text === null)
+        return null;
+    if (row.state === 'purged')
+        return null;
+    return row.content_text.slice(row.start_offset, row.end_offset);
+}
+/** Bulk version of `getFindingValue` — one SQL query for N finding
+ *  ids instead of N round-trips. Caller fans the result map back out
+ *  by id; missing keys are treated as `null` (purged / vanished). */
+export function getFindingValues(db, findingIds) {
+    const out = {};
+    if (findingIds.length === 0)
+        return out;
+    const placeholders = findingIds.map(() => '?').join(',');
+    const rows = db.prepare(`SELECT f.id, f.start_offset, f.end_offset, f.state, m.content_text
+       FROM findings f
+       LEFT JOIN messages m ON m.id = f.message_id
+      WHERE f.id IN (${placeholders})`).all(...findingIds);
+    for (const r of rows) {
+        if (r.content_text === null || r.state === 'purged') {
+            out[r.id] = null;
+        }
+        else {
+            out[r.id] = r.content_text.slice(r.start_offset, r.end_offset);
+        }
+    }
+    // Fill in nulls for ids that didn't come back (deleted / cascade).
+    for (const id of findingIds) {
+        if (!(id in out))
+            out[id] = null;
+    }
+    return out;
+}
+const allowKey = (kind, hash) => `${kind}|${hash}`;
+export function getAllowlists(db, sessionId) {
+    const sessionRows = db.prepare('SELECT kind, value_hash FROM allowlist_session WHERE session_id = ?').all(sessionId);
+    const globalRows = db.prepare('SELECT kind, value_hash FROM allowlist_global').all();
+    return {
+        session: new Set(sessionRows.map(r => allowKey(r.kind, r.value_hash))),
+        global: new Set(globalRows.map(r => allowKey(r.kind, r.value_hash))),
+    };
+}
+export function isAllowlisted(allow, kind, valueHash) {
+    const key = allowKey(kind, valueHash);
+    return allow.session.has(key) || allow.global.has(key);
+}
+export function addAllowlistSession(db, sessionId, kind, valueHash) {
+    db.prepare(`INSERT OR IGNORE INTO allowlist_session (session_id, kind, value_hash)
+     VALUES (?, ?, ?)`).run(sessionId, kind, valueHash);
+}
+export function addAllowlistGlobal(db, kind, valueHash) {
+    db.prepare(`INSERT OR IGNORE INTO allowlist_global (kind, value_hash)
+     VALUES (?, ?)`).run(kind, valueHash);
+}
+export function removeAllowlistSession(db, sessionId, kind, valueHash) {
+    db.prepare(`DELETE FROM allowlist_session
+      WHERE session_id = ? AND kind = ? AND value_hash = ?`).run(sessionId, kind, valueHash);
+}
+export function removeAllowlistGlobal(db, kind, valueHash) {
+    db.prepare(`DELETE FROM allowlist_global WHERE kind = ? AND value_hash = ?`).run(kind, valueHash);
+}
+/** All allowlist rows from both tables, joined with the originating
+ *  session metadata. Drives the Settings → Security pane's "Manage…"
+ *  modal so the user can review and revoke past decisions.
+ *
+ *  Each entry's display value is reconstructed live from a matching
+ *  finding's message text — the same plaintext the findings view
+ *  shows (blurred). Nothing is persisted on the allowlist row. */
+export function listAllowlistEntries(db) {
+    const sessionRows = db.prepare(`SELECT a.session_id     AS session_id,
+            a.kind          AS kind,
+            a.value_hash    AS value_hash,
+            a.created_at    AS created_at,
+            s.session_uuid  AS session_uuid,
+            s.title         AS session_title
+       FROM allowlist_session a
+       JOIN sessions s ON s.id = a.session_id
+      ORDER BY a.created_at DESC`).all();
+    const globalRows = db.prepare(`SELECT kind, value_hash, created_at
+       FROM allowlist_global
+      ORDER BY created_at DESC`).all();
+    // Reconstruct the live value from any surviving non-purged finding
+    // whose message text we can still read. N is small (the allowlist is
+    // a hand-curated list), so a prepared statement per row is fine.
+    const sessionValueStmt = db.prepare(`SELECT substr(m.content_text, f.start_offset + 1, f.end_offset - f.start_offset) AS value
+       FROM findings f
+       LEFT JOIN messages m ON m.id = f.message_id
+      WHERE f.session_id = ? AND f.kind = ? AND f.value_hash = ?
+        AND f.state != 'purged' AND m.content_text IS NOT NULL
+      LIMIT 1`);
+    const globalValueStmt = db.prepare(`SELECT substr(m.content_text, f.start_offset + 1, f.end_offset - f.start_offset) AS value
+       FROM findings f
+       LEFT JOIN messages m ON m.id = f.message_id
+      WHERE f.kind = ? AND f.value_hash = ?
+        AND f.state != 'purged' AND m.content_text IS NOT NULL
+      LIMIT 1`);
+    return [
+        ...globalRows.map((r) => ({
+            scope: 'global',
+            kind: r.kind,
+            valueHash: r.value_hash,
+            createdAt: r.created_at,
+            sessionUuid: null,
+            sessionTitle: null,
+            value: globalValueStmt.get(r.kind, r.value_hash)?.value ?? null,
+        })),
+        ...sessionRows.map((r) => ({
+            scope: 'session',
+            kind: r.kind,
+            valueHash: r.value_hash,
+            createdAt: r.created_at,
+            sessionUuid: r.session_uuid,
+            sessionTitle: r.session_title,
+            value: sessionValueStmt.get(r.session_id, r.kind, r.value_hash)?.value ?? null,
+        })),
+    ];
+}
+/** Total allowlist rows across both scopes. A cheap header badge —
+ *  two `SELECT COUNT(*)` summed, no per-row value reconstruction.
+ *  Use this instead of `listAllowlistEntries().length` for counts. */
+export function countAllowlistEntries(db) {
+    const session = db.prepare('SELECT COUNT(*) AS c FROM allowlist_session').get();
+    const global = db.prepare('SELECT COUNT(*) AS c FROM allowlist_global').get();
+    return session.c + global.c;
+}
+// ─── Mutations called from IPC dismiss handlers ───────────────────
+/** Flip a finding to 'dismissed' and, depending on scope, write the
+ *  allowlist entry so future rescans honor the decision. Caller
+ *  wraps in a transaction. */
+export function dismissFinding(db, findingId, scope, recomputeCounts = true) {
+    const f = db.prepare(`SELECT session_id, kind, value_hash FROM findings WHERE id = ?`).get(findingId);
+    if (!f)
+        return null;
+    db.prepare(`UPDATE findings
+        SET state = 'dismissed',
+            state_changed_at = datetime('now')
+      WHERE id = ?`).run(findingId);
+    if (scope === 'session') {
+        addAllowlistSession(db, f.session_id, f.kind, f.value_hash);
+    }
+    else {
+        addAllowlistGlobal(db, f.kind, f.value_hash);
+    }
+    if (recomputeCounts)
+        updateSessionCounts(db, f.session_id);
+    return f.session_id;
+}
+/** Batch variant of {@link dismissFinding}. Dismisses many findings in a
+ *  single transaction — one allowlist write + one `updateSessionCounts`
+ *  per affected session instead of N parallel IPC round-trips, each of
+ *  which recomputes counts. Mirrors the bulk-purge pattern
+ *  (`purgeFindings`). Returns the distinct session ids touched, in
+ *  first-seen order, so the IPC layer can emit one change event per
+ *  session. Unknown ids are skipped. */
+export function dismissFindings(db, findingIds, scope) {
+    if (findingIds.length === 0)
+        return [];
+    const touched = [];
+    const seen = new Set();
+    const txn = db.transaction((ids) => {
+        for (const id of ids) {
+            // Defer count recompute — many ids usually share one session, so
+            // recomputing per-id would redo the same aggregate N times.
+            const sessionId = dismissFinding(db, id, scope, false);
+            if (sessionId != null && !seen.has(sessionId)) {
+                seen.add(sessionId);
+                touched.push(sessionId);
+            }
+        }
+        for (const sessionId of touched)
+            updateSessionCounts(db, sessionId);
+    });
+    txn(findingIds);
+    return touched;
+}
+/** Re-activate a dismissed finding and remove the allowlist entry
+ *  that pinned it (both scopes, since UI doesn't always know which). */
+export function undismissFinding(db, findingId) {
+    const f = db.prepare('SELECT session_id, kind, value_hash FROM findings WHERE id = ?').get(findingId);
+    if (!f)
+        return null;
+    db.prepare(`UPDATE findings
+        SET state = 'active',
+            state_changed_at = datetime('now')
+      WHERE id = ?`).run(findingId);
+    removeAllowlistSession(db, f.session_id, f.kind, f.value_hash);
+    removeAllowlistGlobal(db, f.kind, f.value_hash);
+    updateSessionCounts(db, f.session_id);
+    return f.session_id;
+}
+//# sourceMappingURL=repo.js.map

package/dist/security/repo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repo.js","sourceRoot":"","sources":["../../src/security/repo.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,EAAE;AACF,kEAAkE;AAClE,qEAAqE;AACrE,iEAAiE;AACjE,kEAAkE;AAClE,wDAAwD;AACxD,EAAE;AACF,+DAA+D;AAC/D,oEAAoE;AACpE,sEAAsE;AAItE,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,UAAU,GACX,MAAM,mBAAmB,CAAA;AA0B1B,SAAS,YAAY,CAAC,CAAe;IACnC,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,SAAS,EAAE,CAAC,CAAC,UAAU;QACvB,SAAS,EAAE,CAAC,CAAC,UAAU;QACvB,IAAI,EAAE,CAAC,CAAC,IAAqB;QAC7B,SAAS,EAAE,CAAC,CAAC,UAAU;QACvB,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,WAAW,EAAE,CAAC,CAAC,YAAY;QAC3B,SAAS,EAAE,CAAC,CAAC,UAAU;QACvB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,UAAU,EAAE,CAAC,CAAC,WAAW;QACzB,cAAc,EAAE,CAAC,CAAC,gBAAgB;KACnC,CAAA;AACH,CAAC;AAwDD,iEAAiE;AACjE,MAAM,UAAU,cAAc,CAAC,EAAqB,EAAE,IAA6B;IACjF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAM;IAC7B,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CACrB;;;2CAGuC,CACxC,CAAA;IACD,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,GAAG,CACN,CAAC,CAAC,SAAS,EACX,CAAC,CAAC,SAAS,EACX,CAAC,CAAC,IAAI,EACN,CAAC,CAAC,SAAS,EACX,CAAC,CAAC,UAAU,EACZ,CAAC,CAAC,QAAQ,EACV,CAAC,CAAC,WAAW,EACb,CAAC,CAAC,SAAS,EACX,CAAC,CAAC,KAAK,EACP,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CACvD,CAAA;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;6CAkB6C;AAC7C,MAAM,UAAU,yBAAyB,CACvC,EAAqB,EACrB,SAAiB,EACjB,SAA4B;IAE5B,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAM;IAClC,MAAM,YAAY,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACvD,EAAE,CAAC,OAAO,CACR;;;0BAGsB,YAAY,GAAG,CACtC,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,SAAS,CAAC,CAAA;AAChC,CAAC;AAED;;;8CAG8C;AAC9C,MAAM,CAAC,MAAM,oBAAoB,GAAG,yBAAyB,CAAA;AAE7D,qEAAqE;AAErE;;;;;;;6CAO6C;AAC7C,MAAM,UAAU,mBAAmB,CAAC,EAAqB,EAAE,SAAiB;IAC1E,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CACvB;qCACiC,qBAAqB,EAAE;iCAC3B,qBAAqB,EAAE;;+CAET,CAC5C,CAAC,GAAG,CACH,GAAG,yBAAyB,EAC5B,GAAG,yBAAyB,EAC5B,SAAS,CACuC,CAAA;IAClD,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CACvB;;gDAE4C,CAC7C,CAAC,GAAG,CAAC,SAAS,CAAkB,CAAA;IACjC,EAAE,CAAC,OAAO,CACR;;;;mBAIe,CAChB,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE,SAAS,CAAC,CAAA;AACjE,CAAC;AAED,MAAM,yBAAyB,GAAG,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAA;AACjE,MAAM,yBAAyB,GAAG,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAA;AACjE,SAAS,qBAAqB;IAC5B,OAAO,yBAAyB,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAC3D,CAAC;AACD,SAAS,qBAAqB;IAC5B,OAAO,yBAAyB,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAC3D,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,EAAqB,EACrB,SAAiB,EACjB,OAAe,EACf,WAAmB;IAEnB,EAAE,CAAC,OAAO,CACR;;mBAEe,CAChB,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,SAAS,CAAC,CAAA;AACxC,CAAC;AAED;iCACiC;AACjC,MAAM,UAAU,yBAAyB,CAAC,EAAqB;IAC7D,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,yCAAyC,CAAC,CAAC,GAAG,EAAE,CAAA;IACrE,OAAO,CAAC,CAAC,OAAO,CAAA;AAClB,CAAC;AAED;yDACyD;AACzD,MAAM,UAAU,4BAA4B,CAAC,EAAqB,EAAE,SAAiB;IACnF,EAAE,CAAC,OAAO,CACR;;;mBAGe,CAChB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;AAClB,CAAC;AAED;2DAC2D;AAC3D,MAAM,UAAU,uBAAuB,CACrC,EAAqB,EACrB,cAAsB;IAEtB,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CACrB;;+BAE2B,CAC5B,CAAC,GAAG,EAAwD,CAAA;IAC7D,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,YAAY,KAAK,IAAI,IAAI,CAAC,CAAC,YAAY,KAAK,cAAc,EAAE,CAAC;YACjE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QAChB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,qEAAqE;AAErE,MAAM,UAAU,YAAY,CAAC,EAAqB,EAAE,MAAqB;IACvE,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,MAAM,MAAM,GAAc,EAAE,CAAA;IAC5B,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;QAC5B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IAC/B,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC1D,KAAK,CAAC,IAAI,CAAC,YAAY,YAAY,GAAG,CAAC,CAAA;QACvC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;IAC9B,CAAC;SAAM,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACrC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QACtB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAC1B,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QAC3C,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QACvB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC3B,CAAC;SAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACzB,wBAAwB;QACxB,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAA;IAChC,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,YAAY,qBAAqB,EAAE,GAAG,CAAC,CAAA;QAClD,MAAM,CAAC,IAAI,CAAC,GAAG,yBAAyB,CAAC,CAAA;IAC3C,CAAC;SAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;QACrC,KAAK,CAAC,IAAI,CAAC,gBAAgB,qBAAqB,EAAE,GAAG,CAAC,CAAA;QACtD,MAAM,CAAC,IAAI,CAAC,GAAG,yBAAyB,CAAC,CAAA;IAC3C,CAAC;IACD,kEAAkE;IAClE,iEAAiE;IACjE,8DAA8D;IAC9D,MAAM,oBAAoB,GAAG,CAAC,KAA2C,EAAE,IAA+B,EAAW,EAAE;QACrH,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;QACjF,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QAC5D,OAAO,KAAK,CAAA;IACd,CAAC,CAAA;IACD,IAAI,MAAM,CAAC,WAAW,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3E,KAAK,CAAC,IAAI,CAAC,gBAAgB,qBAAqB,EAAE,GAAG,CAAC,CAAA;QACtD,MAAM,CAAC,IAAI,CAAC,GAAG,yBAAyB,CAAC,CAAA;IAC3C,CAAC;IACD,IAAI,UAAU,GAAG,EAAE,CAAA;IACnB,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,UAAU,GAAG,mBAAmB,CAAA;QAChC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,CAAA;IAC/C,CAAC;IACD,MAAM,GAAG,GAAG;iBACG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE;mDAChB,UAAU,EAAE,CAAA;IAC7D,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,MAAM,CAAmB,CAAA;IAC7D,OAAO,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;AAC/B,CAAC;AAED,uEAAuE;AACvE,SAAS,QAAQ,CACf,MAAS,EACT,KAAoB;IAEpB,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;IAC9E,MAAM,MAAM,GAAG,KAAK,CAAC,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC,CAAA;IAC5D,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAA;IAC5C,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,CAAA;AAC5E,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,EAAqB,EACrB,MAAqB;IAErB,OAAO,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAA;AACnD,CAAC;AAED;;sEAEsE;AACtE,SAAS,2BAA2B,CAAC,MAA4B;IAI/D,MAAM,MAAM,GAAc,EAAE,CAAA;IAC5B,MAAM,cAAc,GAAG,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK;QAC3D,CAAC,CAAC,aAAa;QACf,CAAC,CAAC,oBAAoB,CAAA;IACxB,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK;QAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAErE,IAAI,aAAa,GAAG,EAAE,CAAA;IACtB,MAAM,aAAa,GACjB,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QACrC,CAAC,CAAC,MAAM,CAAC,KAAK;QACd,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAC3D,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,YAAY,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC3D,aAAa,GAAG,kBAAkB,YAAY,GAAG,CAAA;QACjD,MAAM,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,CAAA;IAC/B,CAAC;IACD,IAAI,iBAAiB,GAAG,EAAE,CAAA;IAC1B,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QAC/B,iBAAiB,GAAG,kBAAkB,qBAAqB,EAAE,GAAG,CAAA;QAChE,MAAM,CAAC,IAAI,CAAC,GAAG,yBAAyB,CAAC,CAAA;IAC3C,CAAC;SAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;QACrC,gEAAgE;QAChE,8DAA8D;QAC9D,6BAA6B;QAC7B,iBAAiB,GAAG,sBAAsB,qBAAqB,EAAE,wBAAwB,qBAAqB,EAAE,GAAG,CAAA;QACnH,MAAM,CAAC,IAAI,CAAC,GAAG,yBAAyB,EAAE,GAAG,yBAAyB,CAAC,CAAA;IACzE,CAAC;IAED,mEAAmE;IACnE,oEAAoE;IACpE,oEAAoE;IACpE,oEAAoE;IACpE,IAAI,aAAa,GAAG,EAAE,CAAA;IACtB,IAAI,CAAC,aAAa,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;QAC9E,aAAa,GAAG,sBAAsB,qBAAqB,EAAE,GAAG,CAAA;QAChE,MAAM,CAAC,IAAI,CAAC,GAAG,yBAAyB,CAAC,CAAA;IAC3C,CAAC;IAED,IAAI,aAAa,GAAG,EAAE,CAAA;IACtB,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjD,aAAa,GAAG,oBAAoB,CAAA;QACpC,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IACxC,CAAC;IAED,MAAM,WAAW,GAAG,GAAG,cAAc,IAAI,aAAa,IAAI,iBAAiB,IAAI,aAAa,IAAI,aAAa;2CACpE,CAAA;IACzC,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,CAAA;AAChC,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,EAAqB,EACrB,MAA4B;IAE5B,kEAAkE;IAClE,gEAAgE;IAChE,8DAA8D;IAC9D,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,2BAA2B,CAAC,MAAM,CAAC,CAAA;IAEnE,MAAM,GAAG,GAAG;;;;;;;;;;;;;;iCAcmB,qBAAqB,EAAE;;;;;YAK5C,WAAW;;;MAGjB,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE;GACvD,CAAA;IACD,wEAAwE;IACxE,kCAAkC;IAClC,MAAM,SAAS,GAAG,CAAC,GAAG,yBAAyB,EAAE,GAAG,MAAM,CAAC,CAAA;IAC3D,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,CAAA;IAClD,CAAC;IACD,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,SAAS,CAc3C,CAAA;IACF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACpB,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,WAAW,EAAE,CAAC,CAAC,YAAY;QAC3B,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,SAAS,EAAE,CAAC,CAAC,UAAU;QACvB,eAAe,EAAE,CAAC,CAAC,iBAAiB;QACpC,YAAY,EAAE,CAAC,CAAC,aAAa;QAC7B,SAAS,EAAE,CAAC,CAAC,UAAU,IAAI,CAAC;QAC5B,WAAW,EAAE,CAAC,CAAC,YAAY,IAAI,CAAC;QAChC,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,YAAY,EAAE,CAAC,CAAC,aAAa,IAAI,CAAC;QAClC,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,kBAAkB,EAAE,CAAC,CAAC,oBAAoB;KAC3C,CAAC,CAAC,CAAA;AACL,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,EAAqB,EACrB,MAA4B;IAE5B,OAAO,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,wBAAwB,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAA;AAC/D,CAAC;AAED;;;6DAG6D;AAC7D,MAAM,UAAU,yBAAyB,CACvC,EAAqB,EACrB,MAA4B;IAE5B,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,2BAA2B,CAAC,MAAM,CAAC,CAAA;IACnE,MAAM,GAAG,GAAG;;;;;;YAMF,WAAW;GACpB,CAAA;IACD,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,MAAM,CAAsB,CAAA;IAC/D,OAAO,GAAG,CAAC,KAAK,CAAA;AAClB,CAAC;AAED;8DAC8D;AAC9D,MAAM,UAAU,cAAc,CAAC,EAAqB;IAClD,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CACrB;;;;;;0BAMsB,CACvB,CAAC,GAAG,EAA8D,CAAA;IACnE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACpB,IAAI,EAAE,CAAC,CAAC,IAAqB;QAC7B,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,IAAqB,CAAC;QAC7C,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,QAAQ,EAAE,CAAC,CAAC,QAAQ;KACrB,CAAC,CAAC,CAAA;AACL,CAAC;AAED;;;;;;;;;4DAS4D;AAC5D,MAAM,UAAU,sBAAsB,CACpC,EAAqB,EACrB,IAAmB,EACnB,SAAiB;IAEjB,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CACrB;;;;;;;;;;;;;;yCAcqC,CACtC,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAQnB,CAAA;IACF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACpB,SAAS,EAAE,CAAC,CAAC,UAAU;QACvB,WAAW,EAAE,CAAC,CAAC,YAAY;QAC3B,YAAY,EAAE,CAAC,CAAC,aAAa;QAC7B,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,QAAQ,EAAE,CAAC,CAAC,SAAS;KACtB,CAAC,CAAC,CAAA;AACL,CAAC;AAED;;;;;;yCAMyC;AACzC,MAAM,UAAU,mBAAmB,CAAC,EAAqB;IACvD,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CACpB;;0CAEsC,CACvC,CAAC,GAAG,EAA6B,CAAA;IAClC,OAAO,GAAG,CAAC,IAAI,CAAA;AACjB,CAAC;AAED;;;oEAGoE;AACpE,MAAM,UAAU,eAAe,CAAC,EAAqB,EAAE,SAAiB;IACtE,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CACpB;;;qBAGiB,CAClB,CAAC,GAAG,CAAC,SAAS,CAEF,CAAA;IACb,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,YAAY,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAClD,IAAI,GAAG,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IACvC,OAAO,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,UAAU,CAAC,CAAA;AACjE,CAAC;AAED;;qEAEqE;AACrE,MAAM,UAAU,gBAAgB,CAC9B,EAAqB,EACrB,UAA6B;IAE7B,MAAM,GAAG,GAAkC,EAAE,CAAA;IAC7C,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,CAAA;IACvC,MAAM,YAAY,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACxD,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CACrB;;;uBAGmB,YAAY,GAAG,CACnC,CAAC,GAAG,CAAC,GAAG,UAAU,CAMjB,CAAA;IACF,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,YAAY,KAAK,IAAI,IAAI,CAAC,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACpD,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAA;QAClB,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,UAAU,CAAC,CAAA;QAChE,CAAC;IACH,CAAC;IACD,mEAAmE;IACnE,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;QAC5B,IAAI,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC;YAAE,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAA;IAClC,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAWD,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,IAAY,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAA;AAElE,MAAM,UAAU,aAAa,CAAC,EAAqB,EAAE,SAAiB;IACpE,MAAM,WAAW,GAAG,EAAE,CAAC,OAAO,CAC5B,qEAAqE,CACtE,CAAC,GAAG,CAAC,SAAS,CAAgD,CAAA;IAC/D,MAAM,UAAU,GAAG,EAAE,CAAC,OAAO,CAC3B,+CAA+C,CAChD,CAAC,GAAG,EAAiD,CAAA;IACtD,OAAO;QACL,OAAO,EAAE,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;QACtE,MAAM,EAAE,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;KACrE,CAAA;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,KAAwB,EACxB,IAAmB,EACnB,SAAiB;IAEjB,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;IACrC,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;AACxD,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,EAAqB,EACrB,SAAiB,EACjB,IAAmB,EACnB,SAAiB;IAEjB,EAAE,CAAC,OAAO,CACR;sBACkB,CACnB,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,CAAA;AACnC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,EAAqB,EACrB,IAAmB,EACnB,SAAiB;IAEjB,EAAE,CAAC,OAAO,CACR;mBACe,CAChB,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;AACxB,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,EAAqB,EACrB,SAAiB,EACjB,IAAmB,EACnB,SAAiB;IAEjB,EAAE,CAAC,OAAO,CACR;2DACuD,CACxD,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,CAAA;AACnC,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,EAAqB,EACrB,IAAmB,EACnB,SAAiB;IAEjB,EAAE,CAAC,OAAO,CACR,gEAAgE,CACjE,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;AACxB,CAAC;AAkBD;;;;;;kEAMkE;AAClE,MAAM,UAAU,oBAAoB,CAAC,EAAqB;IACxD,MAAM,WAAW,GAAG,EAAE,CAAC,OAAO,CAC5B;;;;;;;;iCAQ6B,CAC9B,CAAC,GAAG,EAOH,CAAA;IACF,MAAM,UAAU,GAAG,EAAE,CAAC,OAAO,CAC3B;;+BAE2B,CAC5B,CAAC,GAAG,EAIH,CAAA;IAEF,mEAAmE;IACnE,qEAAqE;IACrE,iEAAiE;IACjE,MAAM,gBAAgB,GAAG,EAAE,CAAC,OAAO,CACjC;;;;;cAKU,CACX,CAAA;IACD,MAAM,eAAe,GAAG,EAAE,CAAC,OAAO,CAChC;;;;;cAKU,CACX,CAAA;IAED,OAAO;QACL,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAqB,EAAE,CAAC,CAAC;YAC3C,KAAK,EAAE,QAAQ;YACf,IAAI,EAAE,CAAC,CAAC,IAAqB;YAC7B,SAAS,EAAE,CAAC,CAAC,UAAU;YACvB,SAAS,EAAE,CAAC,CAAC,UAAU;YACvB,WAAW,EAAE,IAAI;YACjB,YAAY,EAAE,IAAI;YAClB,KAAK,EAAG,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,UAAU,CAA0C,EAAE,KAAK,IAAI,IAAI;SAC1G,CAAC,CAAC;QACH,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAqB,EAAE,CAAC,CAAC;YAC5C,KAAK,EAAE,SAAS;YAChB,IAAI,EAAE,CAAC,CAAC,IAAqB;YAC7B,SAAS,EAAE,CAAC,CAAC,UAAU;YACvB,SAAS,EAAE,CAAC,CAAC,UAAU;YACvB,WAAW,EAAE,CAAC,CAAC,YAAY;YAC3B,YAAY,EAAE,CAAC,CAAC,aAAa;YAC7B,KAAK,EAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,UAAU,CAA0C,EAAE,KAAK,IAAI,IAAI;SACzH,CAAC,CAAC;KACJ,CAAA;AACH,CAAC;AAED;;sEAEsE;AACtE,MAAM,UAAU,qBAAqB,CAAC,EAAqB;IACzD,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,CACxB,6CAA6C,CAC9C,CAAC,GAAG,EAAmB,CAAA;IACxB,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CACvB,4CAA4C,CAC7C,CAAC,GAAG,EAAmB,CAAA;IACxB,OAAO,OAAO,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAA;AAC7B,CAAC;AAED,qEAAqE;AAErE;;8BAE8B;AAC9B,MAAM,UAAU,cAAc,CAC5B,EAAqB,EACrB,SAAiB,EACjB,KAA2B,EAC3B,eAAe,GAAG,IAAI;IAEtB,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAClB,gEAAgE,CACjE,CAAC,GAAG,CAAC,SAAS,CAEF,CAAA;IACb,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IACnB,EAAE,CAAC,OAAO,CACR;;;mBAGe,CAChB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IAChB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,mBAAmB,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,IAAqB,EAAE,CAAC,CAAC,UAAU,CAAC,CAAA;IAC9E,CAAC;SAAM,CAAC;QACN,kBAAkB,CAAC,EAAE,EAAE,CAAC,CAAC,IAAqB,EAAE,CAAC,CAAC,UAAU,CAAC,CAAA;IAC/D,CAAC;IACD,IAAI,eAAe;QAAE,mBAAmB,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,CAAA;IAC1D,OAAO,CAAC,CAAC,UAAU,CAAA;AACrB,CAAC;AAED;;;;;;wCAMwC;AACxC,MAAM,UAAU,eAAe,CAC7B,EAAqB,EACrB,UAA6B,EAC7B,KAA2B;IAE3B,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAA;IACtC,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,MAAM,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC,GAAsB,EAAE,EAAE;QACpD,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACrB,iEAAiE;YACjE,4DAA4D;YAC5D,MAAM,SAAS,GAAG,cAAc,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;YACtD,IAAI,SAAS,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC9C,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;gBACnB,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;YACzB,CAAC;QACH,CAAC;QACD,KAAK,MAAM,SAAS,IAAI,OAAO;YAAE,mBAAmB,CAAC,EAAE,EAAE,SAAS,CAAC,CAAA;IACrE,CAAC,CAAC,CAAA;IACF,GAAG,CAAC,UAAU,CAAC,CAAA;IACf,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;wEACwE;AACxE,MAAM,UAAU,gBAAgB,CAAC,EAAqB,EAAE,SAAiB;IACvE,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAClB,gEAAgE,CACjE,CAAC,GAAG,CAAC,SAAS,CAAyE,CAAA;IACxF,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IACnB,EAAE,CAAC,OAAO,CACR;;;mBAGe,CAChB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IAChB,sBAAsB,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,IAAqB,EAAE,CAAC,CAAC,UAAU,CAAC,CAAA;IAC/E,qBAAqB,CAAC,EAAE,EAAE,CAAC,CAAC,IAAqB,EAAE,CAAC,CAAC,UAAU,CAAC,CAAA;IAChE,mBAAmB,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,CAAA;IACrC,OAAO,CAAC,CAAC,UAAU,CAAA;AACrB,CAAC"}

package/dist/security/scan.d.ts

@@ -0,0 +1,50 @@
+import { Effect } from 'effect';
+import type Database from 'better-sqlite3';
+import type { RedactProvider } from '@spool-lab/redact';
+import type { FindingsChange } from './types.js';
+declare const ScanError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "ScanError";
+} & Readonly<A>;
+export declare class ScanError extends ScanError_base<{
+    readonly sessionId: number;
+    readonly cause: unknown;
+    readonly reason: 'session-not-found' | 'provider-failed' | 'db-failed';
+}> {
+}
+/** Result of one session scan — useful for tests and progress UIs. */
+export interface ScanResult {
+    sessionId: number;
+    inserted: number;
+    /** Profile string written to sessions.scan_profile. */
+    profile: string;
+}
+export interface ScanSessionDeps {
+    /** SQLite database handle (same instance the Syncer uses). */
+    db: Database.Database;
+    /** Active providers, evaluated in priority order. First entry wins
+     *  on overlap (regex before pf — pattern matches are authoritative
+     *  for known credential prefixes). */
+    providers: readonly RedactProvider[];
+    /** Profile string for the active provider set; persisted on
+     *  successful scan. */
+    currentProfile: string;
+    /** Names of providers whose prior `active` findings should be
+     *  deleted before re-insert. Almost always equals the names in
+     *  `providers`; passed explicitly so the worker can choose to
+     *  preserve historical pf findings even when pf is disabled. */
+    providerNames: readonly string[];
+    /** Sink for change notifications. The worker layer wraps PubSub
+     *  here; tests pass a simple collector. */
+    publish: (change: FindingsChange) => Effect.Effect<void>;
+    /** Kind-level allowlist. Findings whose kind is in this set get
+     *  inserted with state='dismissed' (instead of 'active') without
+     *  needing a per-value allowlist row. Driven by the Settings →
+     *  Security pane's multi-select. */
+    kindAllowlist?: ReadonlySet<string>;
+}
+/** Scan one session end to end. Idempotent: running twice produces
+ *  the same findings (same value_hash + same offsets → same rows
+ *  after the delete-then-insert reset). */
+export declare function scanSession(sessionId: number, deps: ScanSessionDeps): Effect.Effect<ScanResult, ScanError>;
+export {};
+//# sourceMappingURL=scan.d.ts.map