@substrat-run/kernel 0.138.0 → 0.139.0

package/dist/entity-state.js

@@ -0,0 +1,345 @@
+/**
+ * Entity archive and trash (#119): the kernel half, written once — both adapters hand
+ * `createEntityStateVerbs` the same things, the way `createEntityEdgeVerbs` is shared.
+ *
+ * ## What the kernel owns, and what it leaves to the vertical
+ *
+ * | Kernel | Vertical |
+ * |---|---|
+ * | The two columns on the entity's table, added by a derived migration | Which entities declare `archive` / `trash`, and the keys |
+ * | The transitions, their refusals, and the event each one emits | The operations that call the verbs, and their routes |
+ * | The declared key, re-checked on the entity by every verb and every trashed read | What an archived row looks like on a screen |
+ * | `ctx.page` / `ctx.search` leaving archived and trashed rows out by default | Its own hand-written `SELECT`s — see the gap below |
+ *
+ * ## The state is two columns
+ *
+ * `_substrat_archived_at` and `_substrat_trashed_at`, each an ISO instant or NULL. Apart, not
+ * one enum, so a trash never forgets an archive: `restore` clears the trash and leaves the
+ * archive, and an archived row that went to the bin comes back archived. The visible state is
+ * derived (contracts `entity-state.ts`): trashed, else archived, else active.
+ *
+ * Module code cannot write either column: `ctx.sql` refuses a write naming a `_substrat_*`
+ * column (`spine-guard.ts`), so the only way into or out of the trash is a verb that checks
+ * the key and emits the event. It can READ them, which is how a vertical's own `SELECT` keeps
+ * archived rows out of a screen `ctx.page` does not compose.
+ *
+ * ## The gap, stated
+ *
+ * The kernel filters the reads it composes — `ctx.page` and `ctx.search` — and nothing else.
+ * A handler's own `SELECT … FROM todo_lists WHERE id = ?` sees an archived or trashed row
+ * exactly as before. That is the honest limit of a kernel that does not parse module SQL:
+ * a get-by-id asks `ctx.entityState(ref)` and decides, and a hand-written list adds the
+ * predicate itself (`entityStateWhere`).
+ *
+ * ## Trash is not erasure, and not tenant deletion
+ *
+ * Trash keeps the row and every event about it. Subject erasure (#37) reaches a trashed row
+ * exactly as it reaches any other, because the row never moved tables; a tenant's deletion
+ * (#36) removes it with everything else. Nothing here extends a retention or shortens one.
+ */
+import { ARCHIVED_AT_COLUMN, ENTITY_ARCHIVED, ENTITY_RESTORED, ENTITY_TRASHED, ENTITY_UNARCHIVED, TRASHED_AT_COLUMN, entityStateChangedPayload, substratError, } from '@substrat-run/contracts';
+import { assertAllowed } from './permission-checker.js';
+import { assertSqlIdentifier } from './sql-identifier.js';
+/**
+ * Resolve one module's declarations. Refuses rather than skips, for `searchIndexPlans`'s
+ * reason: a declaration the author believes is live that silently is not leaves a trashed
+ * row in every list with no error anywhere.
+ */
+export function entityStatePlans(moduleId, declarations) {
+    if (!declarations?.length)
+        return [];
+    const plans = [];
+    const seen = new Set();
+    for (const decl of declarations) {
+        const where = `${moduleId} entityStates['${decl.entityType}']`;
+        if (seen.has(decl.entityType))
+            throw new Error(`entity state: ${where} is declared twice`);
+        seen.add(decl.entityType);
+        if (!decl.table) {
+            throw new Error(`entity state: ${where} carries no table — declare \`archive\`/\`trash\` on the entity and ` +
+                'spread `manifestEntities()`, so the entity registry supplies it');
+        }
+        if (!decl.archivePermission && !decl.trashPermission) {
+            throw new Error(`entity state: ${where} declares neither an archive nor a trash permission`);
+        }
+        plans.push({
+            moduleId,
+            entityType: decl.entityType,
+            table: assertSqlIdentifier('entity state', 'a table', decl.table, where),
+            idColumn: assertSqlIdentifier('entity state', 'an id column', decl.idColumn ?? 'id', where),
+            ...(decl.archivePermission ? { archivePermission: decl.archivePermission } : {}),
+            ...(decl.trashPermission ? { trashPermission: decl.trashPermission } : {}),
+        });
+    }
+    return plans;
+}
+/**
+ * The migrations that add the columns — one per column, so declaring `trash` on an entity
+ * that already declared `archive` adds one column and re-runs nothing.
+ *
+ * **The version is the declaration**, as for search and list indexes. Unlike theirs, this DDL
+ * is not drop-then-create: a column holds the state, and dropping it would un-trash every row.
+ * So it runs once per column, ever. Withdrawing a declaration leaves the column where it is,
+ * holding what it held; re-declaring it finds the migration already applied.
+ *
+ * Applied after the module's own migrations (the table must exist) and before its list
+ * indexes (their partial `WHERE` names these columns) — `moduleMigrations` writes that order.
+ */
+export function entityStateMigrations(moduleId, declarations) {
+    const out = [];
+    for (const plan of entityStatePlans(moduleId, declarations)) {
+        if (plan.archivePermission) {
+            out.push({
+                version: `state/${plan.entityType}:archive`,
+                sql: `ALTER TABLE ${plan.table} ADD COLUMN ${ARCHIVED_AT_COLUMN} TEXT;`,
+            });
+        }
+        if (plan.trashPermission) {
+            out.push({
+                version: `state/${plan.entityType}:trash`,
+                sql: `ALTER TABLE ${plan.table} ADD COLUMN ${TRASHED_AT_COLUMN} TEXT;`,
+            });
+        }
+        // After the columns they name. Versioned by which columns they guard, so declaring a trash
+        // on an archivable entity rebuilds them to guard both.
+        out.push({ version: `state/${plan.entityType}:guard:${columnNamesOf(plan).join('+')}`, sql: entityStateTriggerDdl(plan) });
+    }
+    return out;
+}
+const columnNamesOf = (plan) => [
+    ...(plan.archivePermission ? ['archive'] : []),
+    ...(plan.trashPermission ? ['trash'] : []),
+];
+/** The prefix of every trigger this module derives — kernel-owned, so the reserved one. */
+export const ENTITY_STATE_TRIGGER_PREFIX = '_substrat_state_';
+/**
+ * The kernel's authorization for ONE move (#119, Codex r2): the row `ctx.archive` & co. write
+ * just before their `UPDATE` and delete just after it, in the same transaction. The update
+ * trigger below refuses any change to the columns that has no such row — so the only writer the
+ * columns admit is the one that can write a `_substrat_*` TABLE, which `ctx.sql` refuses by name
+ * (a far simpler reading than finding an assignment target in an expression).
+ *
+ * Never holds a row between operations: written and removed inside one move, and a move that
+ * throws rolls back with its operation. Shared by both adapters' `KERNEL_DDL`, like the other
+ * kernel-owned spine tables, so the two cannot part company.
+ */
+export const ENTITY_STATE_MOVES_TABLE = '_substrat_state_moves';
+export const ENTITY_STATE_MOVES_DDL = `
+  CREATE TABLE IF NOT EXISTS _substrat_state_moves (
+    entity_type TEXT NOT NULL,
+    entity_id TEXT NOT NULL,
+    PRIMARY KEY (entity_type, entity_id)
+  );
+`;
+/** A string literal for SQL text: the entity type is a declaration, still quoted rather than trusted. */
+const literal = (value) => `'${value.replace(/'/g, "''")}'`;
+/**
+ * The invariant below the column guard, as two triggers on the entity's table.
+ *
+ * `ctx.sql` refuses the writes that would set the columns (`assertNoReservedColumnWrite`), but
+ * that is a reading of SQL text, and a reading can miss a form — it did, twice. These hold
+ * whatever the text says:
+ *
+ * - **born** — `BEFORE INSERT`: a row is never inserted archived or trashed. Every row enters
+ *   active.
+ * - **moved** — `BEFORE UPDATE OF` the columns: a change to either aborts unless the kernel's
+ *   authorization row for this entity exists (`ENTITY_STATE_MOVES_TABLE`), which only a move
+ *   writes. An `UPDATE` that does not name the columns does not fire it.
+ *
+ * Drop-then-create, like the search triggers, and re-run after a dump load: a load drops the
+ * table and with it the triggers, then inserts the rows first — a restored binned row is
+ * legitimately born trashed, so the triggers are put back only after them.
+ */
+export function entityStateTriggerDdl(plan) {
+    const born = `${ENTITY_STATE_TRIGGER_PREFIX}${plan.table}_born`;
+    const moved = `${ENTITY_STATE_TRIGGER_PREFIX}${plan.table}_moved`;
+    const columns = [
+        ...(plan.archivePermission ? [ARCHIVED_AT_COLUMN] : []),
+        ...(plan.trashPermission ? [TRASHED_AT_COLUMN] : []),
+    ];
+    return [
+        `DROP TRIGGER IF EXISTS ${born};`,
+        `CREATE TRIGGER ${born} BEFORE INSERT ON ${plan.table} WHEN ${columns.map((c) => `NEW.${c} IS NOT NULL`).join(' OR ')} BEGIN`,
+        `  SELECT RAISE(ABORT, 'a row is never inserted archived or trashed - ctx.archive and ctx.trash move it (#119)');`,
+        `END;`,
+        `DROP TRIGGER IF EXISTS ${moved};`,
+        `CREATE TRIGGER ${moved} BEFORE UPDATE OF ${columns.join(', ')} ON ${plan.table}`,
+        `WHEN NOT EXISTS (SELECT 1 FROM ${ENTITY_STATE_MOVES_TABLE} WHERE entity_type = ${literal(plan.entityType)} AND entity_id = OLD.${plan.idColumn}) BEGIN`,
+        `  SELECT RAISE(ABORT, 'archive and trash state moves only through ctx.archive, ctx.trash and ctx.restore (#119)');`,
+        `END;`,
+    ].join('\n');
+}
+/**
+ * Add one module's plans to a scope's registry, refusing a second declaration of a type — the
+ * table is one module's, and two answers to "who may trash it" is no answer — and a key the
+ * module does not declare. The entity is the module's, so its keys are too: a key nobody
+ * declared reaches no role, no grant shape and no `PERMISSIONS.md`, and would make the verb
+ * look gated while nobody could ever pass it.
+ */
+export function addStatePlans(byType, moduleId, declarations, declaredKeys) {
+    for (const plan of entityStatePlans(moduleId, declarations)) {
+        for (const key of [plan.archivePermission, plan.trashPermission]) {
+            if (key && !declaredKeys.some((p) => p.key === key)) {
+                throw new Error(`entity state: ${moduleId} gates '${plan.entityType}' on '${key}', which it does not declare in \`permissions\``);
+            }
+        }
+        const existing = byType.get(plan.entityType);
+        if (existing) {
+            throw new Error(`entity state: '${plan.entityType}' is declared archivable/trashable by both ` +
+                `'${existing.moduleId}' and '${plan.moduleId}' — one entity type, one owner`);
+        }
+        byType.set(plan.entityType, plan);
+    }
+}
+/** The tables whose rows carry the columns, lowercased as SQLite resolves a name — `guardSpine`'s input. */
+export const statefulTablesOf = (plans) => new Set([...plans.values()].map((p) => p.table.toLowerCase()));
+export const stateColumnsOf = (plan) => ({
+    archive: plan.archivePermission !== undefined,
+    trash: plan.trashPermission !== undefined,
+});
+/** The views an entity with these columns has — `active` always, then one per column. */
+export function viewsOf(columns) {
+    return ['active', ...(columns.archive ? ['archived'] : []), ...(columns.trash ? ['trashed'] : [])];
+}
+export function entityStateWhere(entityType, columns, view, alias) {
+    const asked = view ?? 'active';
+    if ((asked === 'archived' && !columns?.archive) || (asked === 'trashed' && !columns?.trash)) {
+        throw substratError('validation_failed', `'${entityType}' has no ${asked} view — it declares no ${asked === 'archived' ? 'archive' : 'trash'}`, { errors: [{ path: 'view', message: `not declared for '${entityType}'` }] });
+    }
+    if (!columns)
+        return undefined;
+    const col = (name) => (alias ? `${alias}.${name}` : name);
+    if (asked === 'trashed')
+        return `${col(TRASHED_AT_COLUMN)} IS NOT NULL`;
+    const terms = [];
+    if (columns.archive)
+        terms.push(`${col(ARCHIVED_AT_COLUMN)} IS ${asked === 'archived' ? 'NOT ' : ''}NULL`);
+    if (columns.trash)
+        terms.push(`${col(TRASHED_AT_COLUMN)} IS NULL`);
+    return terms.join(' AND ');
+}
+const stateOf = (row) => row.trashed_at !== null ? 'trashed' : row.archived_at !== null ? 'archived' : 'active';
+/** One row's two columns, or `undefined` when the row does not exist. */
+function readStateRow(sql, plan, entityId) {
+    const columns = stateColumnsOf(plan);
+    return sql.query(`SELECT ${columns.archive ? ARCHIVED_AT_COLUMN : 'NULL'} AS archived_at, ` +
+        `${columns.trash ? TRASHED_AT_COLUMN : 'NULL'} AS trashed_at ` +
+        `FROM ${plan.table} WHERE ${plan.idColumn} = ?`, [entityId])[0];
+}
+/**
+ * The plan for `entityType`, and the key one of its states is gated on — or `validation_failed`
+ * naming what the entity does not declare. Shared by the verbs and the trashed readers, so
+ * "declares no trash" is one sentence.
+ */
+export function stateKeyOf(plans, verb, entityType, which) {
+    const plan = plans.get(entityType);
+    const key = which === 'archive' ? plan?.archivePermission : plan?.trashPermission;
+    if (!plan || !key) {
+        throw substratError('validation_failed', `${verb}: '${entityType}' declares no ${which}`, {
+            errors: [{ path: 'entityType', message: `'${entityType}' declares no ${which}` }],
+        });
+    }
+    return { plan, key };
+}
+const COLUMN = { archived_at: ARCHIVED_AT_COLUMN, trashed_at: TRASHED_AT_COLUMN };
+const MOVES = {
+    archive: { verb: 'ctx.archive', which: 'archive', from: ['active'], column: 'archived_at', set: true, type: ENTITY_ARCHIVED },
+    unarchive: { verb: 'ctx.unarchive', which: 'archive', from: ['archived'], column: 'archived_at', set: false, type: ENTITY_UNARCHIVED },
+    // Archived rows may be trashed: "delete this old thing" is the commonest reason to open an
+    // archive at all. The archive survives the trip, which is what `restore` relies on.
+    trash: { verb: 'ctx.trash', which: 'trash', from: ['active', 'archived'], column: 'trashed_at', set: true, type: ENTITY_TRASHED },
+    restore: { verb: 'ctx.restore', which: 'trash', from: ['trashed'], column: 'trashed_at', set: false, type: ENTITY_RESTORED },
+};
+export function createEntityStateVerbs(deps) {
+    const move = async (m, entity) => {
+        deps.assertWrites(m.verb);
+        const { plan, key } = stateKeyOf(deps.plans, m.verb, entity.entityType, m.which);
+        // The DECLARED key, on THIS entity, before anything about the row is read: whether it
+        // exists is not something a caller without the key gets to learn.
+        assertAllowed(await deps.check(key, entity));
+        const row = readStateRow(deps.sql, plan, entity.entityId);
+        if (!row) {
+            throw substratError('not_found', `${m.verb}: ${entity.entityType}:${entity.entityId} does not exist`);
+        }
+        const from = stateOf(row);
+        if (!m.from.includes(from)) {
+            throw substratError('conflict', `${m.verb}: ${entity.entityType}:${entity.entityId} is ${from} — ` +
+                `only ${m.from.join(' or ')} can be moved this way`, { reason: 'invalid_transition' });
+        }
+        const at = m.set ? deps.now : null;
+        // The authorization the update trigger asks for, held for exactly this one statement.
+        const authorize = [entity.entityType, entity.entityId];
+        deps.sql.exec(`INSERT OR IGNORE INTO ${ENTITY_STATE_MOVES_TABLE} (entity_type, entity_id) VALUES (?, ?)`, authorize);
+        try {
+            const { changes } = deps.sql.exec(`UPDATE ${plan.table} SET ${COLUMN[m.column]} = ? WHERE ${plan.idColumn} = ?`, [
+                at,
+                entity.entityId,
+            ]);
+            // The row exists (read above), so an UPDATE that changed nothing was swallowed — a trigger's
+            // RAISE(IGNORE), say. Recording a move that did not happen is the one thing this must not do.
+            // `0`, not `!== 1`: a Durable Object's count includes the index rows the move rewrote.
+            if (changes === 0) {
+                throw substratError('internal', `${m.verb}: the update of ${entity.entityType}:${entity.entityId} changed no row — nothing was recorded`);
+            }
+        }
+        finally {
+            deps.sql.exec(`DELETE FROM ${ENTITY_STATE_MOVES_TABLE} WHERE entity_type = ? AND entity_id = ?`, authorize);
+        }
+        const to = stateOf({ ...row, [m.column]: at });
+        const payload = entityStateChangedPayload.parse({ entity, from, to }); // strips extra keys
+        deps.emit({ type: m.type, schemaVersion: 1, entity: payload.entity, piiClass: 'none', payload });
+        return to;
+    };
+    return {
+        archive: (entity) => move(MOVES.archive, entity),
+        unarchive: (entity) => move(MOVES.unarchive, entity),
+        trash: (entity) => move(MOVES.trash, entity),
+        restore: (entity) => move(MOVES.restore, entity),
+        entityState: (entity) => {
+            const plan = deps.plans.get(entity.entityType);
+            if (!plan) {
+                throw substratError('validation_failed', `ctx.entityState: '${entity.entityType}' declares no archive or trash — declare one on the entity`);
+            }
+            const row = readStateRow(deps.sql, plan, entity.entityId);
+            return row ? stateOf(row) : null;
+        },
+    };
+}
+/**
+ * After runtime DDL (#119, Codex r3): does every stateful table still carry what the kernel
+ * derived for it? The guard refuses the DDL known to take it away; this is the check that does not
+ * depend on having known. Read from `main`'s own catalogue, so a same-named temp object cannot
+ * stand in for the real table. Throws — the operation and its DDL roll back — rather than
+ * re-deriving: a schema the kernel did not expect is not one to repair silently.
+ *
+ * `indexes` names the derived list indexes each stateful table must keep, by table.
+ */
+export function assertEntityStateIntact(sql, plans, indexes = new Map()) {
+    for (const plan of plans.values()) {
+        const fail = (what) => {
+            throw substratError('internal', `runtime DDL left '${plan.table}' without ${what} — its archive/trash guarantees depend on it; nothing was changed`);
+        };
+        const objects = new Map(sql
+            .query(`SELECT type, name FROM main.sqlite_master WHERE tbl_name = ? COLLATE NOCASE`, [plan.table])
+            .map((r) => [r.name.toLowerCase(), r.type]));
+        if (objects.get(plan.table.toLowerCase()) !== 'table')
+            fail('its table');
+        const columns = new Set(sql
+            .query(`SELECT name FROM pragma_table_info(?, 'main')`, [plan.table])
+            .map((r) => r.name.toLowerCase()));
+        if (plan.archivePermission && !columns.has(ARCHIVED_AT_COLUMN))
+            fail(ARCHIVED_AT_COLUMN);
+        if (plan.trashPermission && !columns.has(TRASHED_AT_COLUMN))
+            fail(TRASHED_AT_COLUMN);
+        for (const suffix of ['born', 'moved']) {
+            const trigger = `${ENTITY_STATE_TRIGGER_PREFIX}${plan.table}_${suffix}`.toLowerCase();
+            if (objects.get(trigger) !== 'trigger')
+                fail(`its ${suffix} trigger`);
+        }
+        for (const index of indexes.get(plan.table) ?? []) {
+            if (objects.get(index.toLowerCase()) !== 'index')
+                fail(`its list index ${index}`);
+        }
+    }
+}
+//# sourceMappingURL=entity-state.js.map

package/dist/entity-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entity-state.js","sourceRoot":"","sources":["../src/entity-state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EACjB,yBAAyB,EACzB,aAAa,GAOd,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAExD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAiB1D;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAAgB,EAChB,YAA2D;IAE3D,IAAI,CAAC,YAAY,EAAE,MAAM;QAAE,OAAO,EAAE,CAAC;IACrC,MAAM,KAAK,GAAsB,EAAE,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,GAAG,QAAQ,kBAAkB,IAAI,CAAC,UAAU,IAAI,CAAC;QAC/D,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,KAAK,oBAAoB,CAAC,CAAC;QAC3F,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1B,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACb,iBAAiB,KAAK,sEAAsE;gBAC1F,iEAAiE,CACpE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,iBAAiB,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,iBAAiB,KAAK,qDAAqD,CAAC,CAAC;QAC/F,CAAC;QACD,KAAK,CAAC,IAAI,CAAC;YACT,QAAQ;YACR,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,KAAK,EAAE,mBAAmB,CAAC,cAAc,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC;YACxE,QAAQ,EAAE,mBAAmB,CAAC,cAAc,EAAE,cAAc,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI,EAAE,KAAK,CAAC;YAC3F,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChF,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3E,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAAgB,EAChB,YAA2D;IAE3D,MAAM,GAAG,GAAmB,EAAE,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,gBAAgB,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC;QAC5D,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC3B,GAAG,CAAC,IAAI,CAAC;gBACP,OAAO,EAAE,SAAS,IAAI,CAAC,UAAU,UAAU;gBAC3C,GAAG,EAAE,eAAe,IAAI,CAAC,KAAK,eAAe,kBAAkB,QAAQ;aACxE,CAAC,CAAC;QACL,CAAC;QACD,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzB,GAAG,CAAC,IAAI,CAAC;gBACP,OAAO,EAAE,SAAS,IAAI,CAAC,UAAU,QAAQ;gBACzC,GAAG,EAAE,eAAe,IAAI,CAAC,KAAK,eAAe,iBAAiB,QAAQ;aACvE,CAAC,CAAC;QACL,CAAC;QACD,2FAA2F;QAC3F,uDAAuD;QACvD,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,SAAS,IAAI,CAAC,UAAU,UAAU,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7H,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,aAAa,GAAG,CAAC,IAAqB,EAAY,EAAE,CAAC;IACzD,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9C,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;CAC3C,CAAC;AAEF,2FAA2F;AAC3F,MAAM,CAAC,MAAM,2BAA2B,GAAG,kBAAkB,CAAC;AAE9D;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,uBAAuB,CAAC;AAChE,MAAM,CAAC,MAAM,sBAAsB,GAAG;;;;;;CAMrC,CAAC;AAEF,yGAAyG;AACzG,MAAM,OAAO,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;AAE5E;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAqB;IACzD,MAAM,IAAI,GAAG,GAAG,2BAA2B,GAAG,IAAI,CAAC,KAAK,OAAO,CAAC;IAChE,MAAM,KAAK,GAAG,GAAG,2BAA2B,GAAG,IAAI,CAAC,KAAK,QAAQ,CAAC;IAClE,MAAM,OAAO,GAAG;QACd,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACrD,CAAC;IACF,OAAO;QACL,0BAA0B,IAAI,GAAG;QACjC,kBAAkB,IAAI,qBAAqB,IAAI,CAAC,KAAK,SAAS,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ;QAC7H,kHAAkH;QAClH,MAAM;QACN,0BAA0B,KAAK,GAAG;QAClC,kBAAkB,KAAK,qBAAqB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,EAAE;QACjF,kCAAkC,wBAAwB,wBAAwB,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,wBAAwB,IAAI,CAAC,QAAQ,SAAS;QACxJ,oHAAoH;QACpH,MAAM;KACP,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAC3B,MAAoC,EACpC,QAAgB,EAChB,YAA2D,EAC3D,YAAiD;IAEjD,KAAK,MAAM,IAAI,IAAI,gBAAgB,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC;QAC5D,KAAK,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;YACjE,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,EAAE,CAAC;gBACpD,MAAM,IAAI,KAAK,CACb,iBAAiB,QAAQ,WAAW,IAAI,CAAC,UAAU,SAAS,GAAG,iDAAiD,CACjH,CAAC;YACJ,CAAC;QACH,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC7C,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,kBAAkB,IAAI,CAAC,UAAU,6CAA6C;gBAC5E,IAAI,QAAQ,CAAC,QAAQ,UAAU,IAAI,CAAC,QAAQ,gCAAgC,CAC/E,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACpC,CAAC;AACH,CAAC;AAED,4GAA4G;AAC5G,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,KAA2C,EAAuB,EAAE,CACnG,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AAQjE,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,IAAqB,EAAgB,EAAE,CAAC,CAAC;IACtE,OAAO,EAAE,IAAI,CAAC,iBAAiB,KAAK,SAAS;IAC7C,KAAK,EAAE,IAAI,CAAC,eAAe,KAAK,SAAS;CAC1C,CAAC,CAAC;AAEH,yFAAyF;AACzF,MAAM,UAAU,OAAO,CAAC,OAAqB;IAC3C,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,UAAU,CAAW,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,SAAS,CAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC3H,CAAC;AA0BD,MAAM,UAAU,gBAAgB,CAC9B,UAAkB,EAClB,OAAiC,EACjC,IAAiC,EACjC,KAAc;IAEd,MAAM,KAAK,GAAG,IAAI,IAAI,QAAQ,CAAC;IAC/B,IAAI,CAAC,KAAK,KAAK,UAAU,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;QAC5F,MAAM,aAAa,CACjB,mBAAmB,EACnB,IAAI,UAAU,YAAY,KAAK,0BAA0B,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,EACrG,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,UAAU,GAAG,EAAE,CAAC,EAAE,CAC5E,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAClE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,GAAG,GAAG,CAAC,iBAAiB,CAAC,cAAc,CAAC;IACxE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,OAAO,CAAC,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,kBAAkB,CAAC,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAC3G,IAAI,OAAO,CAAC,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;IACnE,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC7B,CAAC;AAQD,MAAM,OAAO,GAAG,CAAC,GAAa,EAAmB,EAAE,CACjD,GAAG,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;AAEzF,yEAAyE;AACzE,SAAS,YAAY,CAAC,GAAc,EAAE,IAAqB,EAAE,QAAgB;IAC3E,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACrC,OAAO,GAAG,CAAC,KAAK,CACd,UAAU,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,MAAM,mBAAmB;QACxE,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,MAAM,iBAAiB;QAC9D,QAAQ,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,QAAQ,MAAM,EACjD,CAAC,QAAQ,CAAC,CACX,CAAC,CAAC,CAAC,CAAC;AACP,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CACxB,KAA2C,EAC3C,IAAY,EACZ,UAAkB,EAClB,KAA0B;IAE1B,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC,IAAI,EAAE,eAAe,CAAC;IAClF,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QAClB,MAAM,aAAa,CAAC,mBAAmB,EAAE,GAAG,IAAI,MAAM,UAAU,iBAAiB,KAAK,EAAE,EAAE;YACxF,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,UAAU,iBAAiB,KAAK,EAAE,EAAE,CAAC;SAClF,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AACvB,CAAC;AA6BD,MAAM,MAAM,GAAG,EAAE,WAAW,EAAE,kBAAkB,EAAE,UAAU,EAAE,iBAAiB,EAAW,CAAC;AAE3F,MAAM,KAAK,GAAG;IACZ,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,eAAe,EAAE;IAC7H,SAAS,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE;IACtI,2FAA2F;IAC3F,oFAAoF;IACpF,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE;IACjI,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE;CACrF,CAAC;AAE1C,MAAM,UAAU,sBAAsB,CAAC,IAAqB;IAC1D,MAAM,IAAI,GAAG,KAAK,EAAE,CAAO,EAAE,MAAiB,EAA4B,EAAE;QAC1E,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC1B,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QACjF,sFAAsF;QACtF,kEAAkE;QAClE,aAAa,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC1D,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,aAAa,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,iBAAiB,CAAC,CAAC;QACxG,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,MAAM,aAAa,CACjB,UAAU,EACV,GAAG,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,OAAO,IAAI,KAAK;gBAChE,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,wBAAwB,EACrD,EAAE,MAAM,EAAE,oBAAoB,EAAE,CACjC,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QACnC,sFAAsF;QACtF,MAAM,SAAS,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,yBAAyB,wBAAwB,yCAAyC,EAAE,SAAS,CAAC,CAAC;QACrH,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,KAAK,QAAQ,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,IAAI,CAAC,QAAQ,MAAM,EAAE;gBAC/G,EAAE;gBACF,MAAM,CAAC,QAAQ;aAChB,CAAC,CAAC;YACH,6FAA6F;YAC7F,8FAA8F;YAC9F,uFAAuF;YACvF,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;gBAClB,MAAM,aAAa,CACjB,UAAU,EACV,GAAG,CAAC,CAAC,IAAI,mBAAmB,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,wCAAwC,CACzG,CAAC;YACJ,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,wBAAwB,0CAA0C,EAAE,SAAS,CAAC,CAAC;QAC9G,CAAC;QACD,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,yBAAyB,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,oBAAoB;QAC3F,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,aAAa,EAAE,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QACjG,OAAO,EAAE,CAAC;IACZ,CAAC,CAAC;IAEF,OAAO;QACL,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC;QAChD,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC;QACpD,KAAK,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC;QAC5C,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC;QAChD,WAAW,EAAE,CAAC,MAAM,EAAE,EAAE;YACtB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAC/C,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,aAAa,CACjB,mBAAmB,EACnB,qBAAqB,MAAM,CAAC,UAAU,4DAA4D,CACnG,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC1D,OAAO,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACnC,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CACrC,GAAc,EACd,KAA2C,EAC3C,OAAO,GAA2C,IAAI,GAAG,EAAE;IAE3D,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,CAAC,IAAY,EAAS,EAAE;YACnC,MAAM,aAAa,CACjB,UAAU,EACV,qBAAqB,IAAI,CAAC,KAAK,aAAa,IAAI,mEAAmE,CACpH,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,GAAG;aACA,KAAK,CACJ,6EAA6E,EAC7E,CAAC,IAAI,CAAC,KAAK,CAAC,CACb;aACA,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAC9C,CAAC;QACF,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,KAAK,OAAO;YAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACzE,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,GAAG;aACA,KAAK,CAAmB,+CAA+C,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;aACtF,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CACpC,CAAC;QACF,IAAI,IAAI,CAAC,iBAAiB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;YAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACzF,IAAI,IAAI,CAAC,eAAe,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;YAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACrF,KAAK,MAAM,MAAM,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;YACvC,MAAM,OAAO,GAAG,GAAG,2BAA2B,GAAG,IAAI,CAAC,KAAK,IAAI,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC;YACtF,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,SAAS;gBAAE,IAAI,CAAC,OAAO,MAAM,UAAU,CAAC,CAAC;QACxE,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;YAClD,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,KAAK,OAAO;gBAAE,IAAI,CAAC,kBAAkB,KAAK,EAAE,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/findings.d.ts

@@ -0,0 +1,143 @@
+import { type ErrorCode, type FindingEntry, type FindingEvidence, type FindingFilter, type FindingKind, type FindingRuleEntry, type FindingRuleInput, type FindingSeverity, type FindingStatusInput, type TenantId } from '@substrat-run/contracts';
+import type { RedactionSql } from './subject-redaction.js';
+/**
+ * How long a finding outlives its last occurrence — the issue store's window, since a Recurring
+ * finding is the tenant's projection of an issue and should be recognisable for as long.
+ */
+export declare const FINDING_RETENTION_DAYS = 180;
+/**
+ * The findings store (#1748), as statements both adapters run against their directory — the
+ * SQLite host over better-sqlite3, the hosted one inside ControlPlaneDO — so the lifecycle is
+ * written once. `sql` is the row-returning executor subject erasure already uses.
+ *
+ * Detection is ON WRITE: the call that records an ops failure or a sweep run also observes the
+ * finding it implies, so there is no cron and no scan. Per occurrence that is one indexed rule
+ * lookup and one primary-key upsert, over evidence that is already bounded upstream.
+ */
+export declare const FINDINGS_DDL = "\n  CREATE TABLE IF NOT EXISTS _substrat_findings (\n    id TEXT PRIMARY KEY,\n    tenant_id TEXT NOT NULL,\n    kind TEXT NOT NULL,\n    subject TEXT NOT NULL,\n    status TEXT NOT NULL,\n    regressed INTEGER NOT NULL DEFAULT 0,\n    severity TEXT NOT NULL,\n    title TEXT NOT NULL,\n    operation TEXT,\n    codes TEXT NOT NULL DEFAULT '[]',\n    vertical TEXT,\n    scope_id TEXT,\n    seen_count INTEGER NOT NULL,\n    first_seen TEXT NOT NULL,\n    last_seen TEXT NOT NULL,\n    last_version TEXT,\n    resolved_version TEXT,\n    resolved_at TEXT,\n    resolution TEXT,\n    acknowledged_at TEXT,\n    rule_id TEXT,\n    evidence TEXT NOT NULL,\n    likely_cause TEXT,\n    UNIQUE (tenant_id, kind, subject)\n  );\n  CREATE INDEX IF NOT EXISTS _substrat_findings_tenant_seen ON _substrat_findings (tenant_id, last_seen);\n  CREATE INDEX IF NOT EXISTS _substrat_findings_seen ON _substrat_findings (last_seen);\n  CREATE INDEX IF NOT EXISTS _substrat_findings_quiet ON _substrat_findings (last_seen) WHERE status IN ('open', 'acked');\n  CREATE TABLE IF NOT EXISTS _substrat_finding_rules (\n    id TEXT PRIMARY KEY,\n    tenant_id TEXT NOT NULL,\n    kind TEXT,\n    operation TEXT,\n    code TEXT,\n    subject TEXT,\n    expires_at TEXT NOT NULL,\n    reason TEXT NOT NULL,\n    created_by TEXT NOT NULL,\n    created_at TEXT NOT NULL\n  );\n  CREATE INDEX IF NOT EXISTS _substrat_finding_rules_tenant ON _substrat_finding_rules (tenant_id, expires_at);\n  CREATE INDEX IF NOT EXISTS _substrat_finding_rules_expiry ON _substrat_finding_rules (expires_at);\n";
+/** One occurrence, as a source hands it to `observeFinding`. */
+export interface FindingObservation {
+    tenantId: string;
+    kind: FindingKind;
+    subject: string;
+    severity: FindingSeverity;
+    title: string;
+    operation: string | null;
+    code: ErrorCode | null;
+    vertical: string | null;
+    scopeId: string | null;
+    version: string | null;
+    evidence: FindingEvidence;
+}
+/**
+ * The Recurring source: a tenant's own ops failure, keyed on the same fingerprint as the fleet
+ * issue. A failure with no tenant is the platform's own and stays in the staff issue store.
+ */
+export declare function findingOfOpsFailure(f: {
+    tenantId?: string | null;
+    scopeId?: string | null;
+    operation: string;
+    stage?: string | null;
+    code?: ErrorCode | null;
+    vertical?: string | null;
+    version?: string | null;
+}): FindingObservation | null;
+/**
+ * The Invariant and Drift sources: a scheduled run that failed (expected 0 failed runs,
+ * observed N) and a freshness expectation judged stale. Every other sweep row implies nothing.
+ */
+export declare function findingOfSweepRun(r: {
+    kind: string;
+    unit: string;
+    outcome: string;
+    tenantId?: string | null;
+    scopeId?: string | null;
+    vertical?: string | null;
+    version?: string | null;
+    operation?: string | null;
+    eventType?: string | null;
+}): FindingObservation | null;
+/**
+ * Record one occurrence on its finding, opening it if new. The transitions, in order:
+ * - an unexpired rule covers it → `suppressed` (counted all the same: suppressing hides the
+ *   finding, never the evidence);
+ * - it was `resolved` → `open`, `regressed`, and its likely cause is worked out afresh from
+ *   THIS regression: the version it came back under, when that is not the one it was resolved
+ *   under, and none otherwise — never a cause left over from an earlier cycle;
+ * - it was `suppressed` and no rule covers it any longer → `open`;
+ * - otherwise the status stands (`acked` stays acked: somebody is already on it).
+ */
+export declare function observeFinding(sql: RedactionSql, o: FindingObservation, at: string): void;
+/**
+ * Findings, most recently seen first. No cursor, like the issue read it projects: the
+ * cardinality is the number of distinct shapes a tenant has, and `limit` bounds it.
+ */
+export declare function listFindings(sql: RedactionSql, filter?: FindingFilter): FindingEntry[];
+export interface FindingChange {
+    before: FindingEntry;
+    after: FindingEntry;
+}
+/**
+ * The audit row a findings mutation writes — `recordAdmin`'s action, target, before and after.
+ * Every mutation below hands it to `audit` INSIDE its own statements, so the adapter that runs
+ * them in one unit commits the change and its row together, or neither (#1748).
+ */
+export interface FindingAudit {
+    action: 'setFindingStatus' | 'createFindingRule' | 'revokeFindingRule' | 'resolveStaleFinding';
+    target: {
+        tenantId: TenantId;
+        vertical: string | null;
+    };
+    before: unknown;
+    after: unknown;
+}
+/**
+ * A person's verdict: acknowledge, resolve, or reopen. Keyed on (tenant, id), so a tenant can
+ * never move another tenant's finding by guessing its id. Reopening a suppressed finding lifts
+ * it out of its rule for now; the next occurrence the rule still covers suppresses it again —
+ * revoking the rule is what ends a suppression.
+ */
+export declare function setFindingStatus(sql: RedactionSql, tenantId: TenantId, id: string, status: FindingStatusInput, at: string, audit: (row: FindingAudit) => void): FindingChange | undefined;
+/**
+ * Create a suppress rule and apply it to the findings it covers now: each one not already
+ * resolved becomes `suppressed` under it. Returns the rule and the ids it suppressed, for the
+ * caller's audit row. The input is parsed by the caller (`findingRuleInput`); the expiry is
+ * held here (`assertFindingRuleExpiry`), against the same `at` every other write in the call uses.
+ */
+export declare function createFindingRule(sql: RedactionSql, tenantId: TenantId, input: FindingRuleInput, createdBy: string, at: string, audit: (row: FindingAudit) => void): {
+    rule: FindingRuleEntry;
+    suppressed: string[];
+};
+/**
+ * End a rule now. Its findings stay suppressed until their next occurrence, which then opens
+ * them — the same thing an expiry does, brought forward.
+ */
+export declare function revokeFindingRule(sql: RedactionSql, tenantId: TenantId, ruleId: string, at: string, audit: (row: FindingAudit) => void): {
+    before: FindingRuleEntry;
+    after: FindingRuleEntry;
+} | undefined;
+/** A tenant's rules, newest first; `activeAt` keeps only those unexpired at that instant. */
+export declare function listFindingRules(sql: RedactionSql, tenantId: TenantId | undefined, activeAt?: string, limit?: number): FindingRuleEntry[];
+/** What one `pruneFindings` pass did. */
+export interface FindingPruneReport {
+    /** Resolved and suppressed findings deleted. */
+    deleted: number;
+    /** Open or acked findings resolved as `stale`, each audited. */
+    staled: number;
+    /** Expired suppress rules deleted. */
+    rulesDeleted: number;
+}
+/**
+ * The findings retention pass, bounded by `limit` per step, oldest first. Run in ONE unit with
+ * `audit`, which the adapter points at its own admin-log write, so a stale resolution never
+ * lands without its row.
+ *
+ * An `open` or `acked` finding is never deleted for going quiet: deleting it would take it out
+ * of the inbox of whoever was watching it with nothing said. One quiet for the whole
+ * `FINDING_RETENTION_DAYS` is RESOLVED as `stale` instead, and audited. A `resolved` or
+ * `suppressed` finding is deleted once both its last occurrence and its last resolve are past
+ * the horizon — so a stale-resolved finding stays readable for one more window. An expired rule
+ * is deleted once its expiry is past the horizon; the admin log keeps its story.
+ */
+export declare function pruneFindings(sql: RedactionSql, nowMs: number, limit: number, audit: (row: FindingAudit) => void): FindingPruneReport;
+//# sourceMappingURL=findings.d.ts.map

package/dist/findings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"findings.d.ts","sourceRoot":"","sources":["../src/findings.ts"],"names":[],"mappings":"AAAA,OAAO,EAML,KAAK,SAAS,EACd,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,WAAW,EAEhB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EAEpB,KAAK,kBAAkB,EACvB,KAAK,QAAQ,EACd,MAAM,yBAAyB,CAAC;AAEjC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAG3D;;;GAGG;AACH,eAAO,MAAM,sBAAsB,MAAuB,CAAC;AAE3D;;;;;;;;GAQG;AACH,eAAO,MAAM,YAAY,oiDA4CxB,CAAC;AAEF,gEAAgE;AAChE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,WAAW,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,eAAe,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,IAAI,EAAE,SAAS,GAAG,IAAI,CAAC;IACvB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,QAAQ,EAAE,eAAe,CAAC;CAC3B;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,EAAE;IACrC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,GAAG,kBAAkB,GAAG,IAAI,CAgB5B;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B,GAAG,kBAAkB,GAAG,IAAI,CA+B5B;AAmHD;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,YAAY,EAAE,CAAC,EAAE,kBAAkB,EAAE,EAAE,EAAE,MAAM,GAAG,IAAI,CA2EzF;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,YAAY,EAAE,MAAM,GAAE,aAAkB,GAAG,YAAY,EAAE,CAuB1F;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,YAAY,CAAC;IACrB,KAAK,EAAE,YAAY,CAAC;CACrB;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,kBAAkB,GAAG,mBAAmB,GAAG,mBAAmB,GAAG,qBAAqB,CAAC;IAC/F,MAAM,EAAE;QAAE,QAAQ,EAAE,QAAQ,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACxD,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,YAAY,EACjB,QAAQ,EAAE,QAAQ,EAClB,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,kBAAkB,EAC1B,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,CAAC,GAAG,EAAE,YAAY,KAAK,IAAI,GACjC,aAAa,GAAG,SAAS,CA+B3B;AAcD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,YAAY,EACjB,QAAQ,EAAE,QAAQ,EAClB,KAAK,EAAE,gBAAgB,EACvB,SAAS,EAAE,MAAM,EACjB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,CAAC,GAAG,EAAE,YAAY,KAAK,IAAI,GACjC;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAA;CAAE,CAgDlD;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,YAAY,EACjB,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,MAAM,EACd,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,CAAC,GAAG,EAAE,YAAY,KAAK,IAAI,GACjC;IAAE,MAAM,EAAE,gBAAgB,CAAC;IAAC,KAAK,EAAE,gBAAgB,CAAA;CAAE,GAAG,SAAS,CAiBnE;AAED,6FAA6F;AAC7F,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,YAAY,EACjB,QAAQ,EAAE,QAAQ,GAAG,SAAS,EAC9B,QAAQ,CAAC,EAAE,MAAM,EACjB,KAAK,SAAM,GACV,gBAAgB,EAAE,CAoBpB;AAED,yCAAyC;AACzC,MAAM,WAAW,kBAAkB;IACjC,gDAAgD;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;IACf,sCAAsC;IACtC,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAC3B,GAAG,EAAE,YAAY,EACjB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,CAAC,GAAG,EAAE,YAAY,KAAK,IAAI,GACjC,kBAAkB,CAmCpB"}