@telora/daemon 0.21.26 → 0.21.82

package/dist/review-defect-detector.js

@@ -1,148 +0,0 @@
-/**
- * Review-defect classification utilities.
- *
- * The state-cascade engine drives review re-engagement off the focus
- * execution phase (verifying / reviewing) -- the older detector that
- * mutated focus.status (in_review/building/verify) was retired with the
- * focus_status enum trim. What remains here is the issue classifier used
- * by focus-executor and the per-focus remediation cycle counter, which
- * may be folded into a future bounded-iteration check.
- *
- * Identifying review-filed issues:
- *   We use `created_by_role_id` (filters out human/UI-filed issues, which
- *   leave the column NULL) AND timing -- the issue was created after the
- *   focus's most recent `review_requested_at`. A single role is often
- *   shared across team and review sessions, so role alone is insufficient;
- *   the timing-plus-role combination is what reliably identifies
- *   "filed during a review pass".
- */
-import { OPEN_ISSUE_STATUSES } from './constants.js';
-import { loadEnvConfig } from '@telora/daemon-core';
-// ── Configuration ────────────────────────────────────────────────────────
-/**
- * Cap on remediation cycles before escalation. Sourced from the typed
- * env-config (TELORA_REVIEW_REMEDIATION_LIMIT, validated at startup; default 3).
- */
-export const REVIEW_REMEDIATION_LIMIT = loadEnvConfig().TELORA_REVIEW_REMEDIATION_LIMIT;
-// ── Per-focus cycle counter ──────────────────────────────────────────
-/**
- * In-memory map of focus ID -> consecutive remediation cycles. Cycle
- * counts are not persisted -- a daemon restart resets the counter, which
- * is acceptable because the bound exists to prevent runaway loops within
- * a single daemon lifetime, not across restarts.
- */
-const remediationCycles = new Map();
-export function getRemediationCycles(focusId) {
-    return remediationCycles.get(focusId) ?? 0;
-}
-export function incrementRemediationCycles(focusId) {
-    const next = (remediationCycles.get(focusId) ?? 0) + 1;
-    remediationCycles.set(focusId, next);
-    return next;
-}
-export function resetRemediationCycles(focusId) {
-    remediationCycles.delete(focusId);
-}
-/** Test-only: clear all cycle state. */
-export function _resetAllRemediationCyclesForTest() {
-    remediationCycles.clear();
-}
-// ── Issue classification ────────────────────────────────────────────────
-/**
- * Returns true when an issue was filed during the most recent review pass.
- *
- * An issue is "review-filed" when ALL of:
- *   - It has a non-null created_by_role_id (excludes human/UI creates).
- *   - Its created_at is later than the focus's review_requested_at.
- *   - Its status is open (To Do / In Progress / Blocked).
- */
-export function isReviewFiledIssue(issue, reviewRequestedAt) {
-    if (!issue.createdByRoleId)
-        return false;
-    if (!OPEN_ISSUE_STATUSES.has(issue.status))
-        return false;
-    if (!reviewRequestedAt)
-        return false;
-    if (!issue.createdAt)
-        return false;
-    return new Date(issue.createdAt).getTime() >= new Date(reviewRequestedAt).getTime();
-}
-/**
- * Filter a focus's issues to only those that were filed during the most
- * recent review pass and are still open.
- */
-export function filterReviewFiledIssues(issues, reviewRequestedAt) {
-    return issues.filter(i => isReviewFiledIssue(i, reviewRequestedAt));
-}
-/**
- * Returns true when there are any review-filed issues (open or closed)
- * since the most recent review pass.
- */
-export function reviewFiledIssueExists(issues, reviewRequestedAt) {
-    if (!reviewRequestedAt)
-        return false;
-    for (const i of issues) {
-        if (!i.createdByRoleId)
-            continue;
-        if (!i.createdAt)
-            continue;
-        if (new Date(i.createdAt).getTime() >= new Date(reviewRequestedAt).getTime()) {
-            return true;
-        }
-    }
-    return false;
-}
-// ── Deferrability classification ──────────────────────────────────────────
-/**
- * Priority labels that mark a review-filed note as DEFERRABLE (low severity,
- * acceptable to defer past the verify gate). The blocking set is everything
- * else -- P0/P1 AND a null/unset priority. The asymmetry is deliberate: the
- * control loop moves reality toward intent and never lowers the bar, so an
- * unprioritized note is treated as BLOCKING (route to verify_failed), not
- * silently converged. Only an EXPLICIT low priority makes a note deferrable.
- */
-const DEFERRABLE_PRIORITIES = new Set(['P2', 'P3']);
-/**
- * Whether a priority label is an explicit, low (deferrable) severity. Null,
- * empty, P0, and P1 are all NOT deferrable.
- */
-export function isLowPriority(priority) {
-    if (!priority)
-        return false;
-    return DEFERRABLE_PRIORITIES.has(priority.trim().toUpperCase());
-}
-/**
- * Whether an issue is a DEFERRABLE review note: a review-filed, still-open
- * issue (per isReviewFiledIssue) whose priority is an explicit low severity
- * (P2/P3). A deferrable note must NOT route a verify delivery to verify_failed
- * -- the review should converge (approve) and leave the note tracked.
- *
- * Anything that is review-filed but P0/P1 or unprioritized is BLOCKING, and any
- * open work that is NOT review-filed (e.g. pre-existing coding work) is also
- * blocking. Deferrability is a property of low-severity review triage notes
- * only.
- */
-export function isDeferrableReviewNote(issue, reviewRequestedAt) {
-    return isReviewFiledIssue(issue, reviewRequestedAt) && isLowPriority(issue.priority);
-}
-/**
- * Filter a focus's issues to the open, review-filed notes that are deferrable
- * (low severity). The caller uses the ids to mark the matching reconciler
- * issues as `deferrable` so the verify-routing reconciler does not treat them
- * as blocking open work.
- */
-export function filterDeferrableReviewNotes(issues, reviewRequestedAt) {
-    return issues.filter(i => isDeferrableReviewNote(i, reviewRequestedAt));
-}
-/**
- * Returns true when there is at least one BLOCKING review-filed issue since the
- * most recent review pass -- a review-filed, still-open issue that is NOT a
- * deferrable low-severity note (i.e. P0/P1 or unprioritized). This is the gate
- * for the review_missing_report notice: a review that filed ONLY deferrable
- * notes converged cleanly and must not raise the "review skipped its outcome"
- * escalation.
- */
-export function blockingReviewFiledIssueExists(issues, reviewRequestedAt) {
-    return issues.some(i => isReviewFiledIssue(i, reviewRequestedAt) && !isLowPriority(i.priority));
-}
-//# sourceMappingURL=review-defect-detector.js.map

package/dist/review-defect-detector.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"review-defect-detector.js","sourceRoot":"","sources":["../src/review-defect-detector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,4EAA4E;AAE5E;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GACnC,aAAa,EAAE,CAAC,+BAA+B,CAAC;AAElD,wEAAwE;AAExE;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAkB,CAAC;AAEpD,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,OAAO,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,OAAe;IACxD,MAAM,IAAI,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACvD,iBAAiB,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACrC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAAe;IACpD,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACpC,CAAC;AAED,wCAAwC;AACxC,MAAM,UAAU,iCAAiC;IAC/C,iBAAiB,CAAC,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED,2EAA2E;AAE3E;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAChC,KAAuE,EACvE,iBAAgC;IAEhC,IAAI,CAAC,KAAK,CAAC,eAAe;QAAE,OAAO,KAAK,CAAC;IACzC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IACzD,IAAI,CAAC,iBAAiB;QAAE,OAAO,KAAK,CAAC;IACrC,IAAI,CAAC,KAAK,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IACnC,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,IAAI,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE,CAAC;AACtF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAwB,EACxB,iBAAgC;IAEhC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,CAAC;AACtE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAwB,EACxB,iBAAgC;IAEhC,IAAI,CAAC,iBAAiB;QAAE,OAAO,KAAK,CAAC;IACrC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,CAAC,eAAe;YAAE,SAAS;QACjC,IAAI,CAAC,CAAC,CAAC,SAAS;YAAE,SAAS;QAC3B,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,IAAI,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;YAC7E,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,6EAA6E;AAE7E;;;;;;;GAOG;AACH,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAEpD;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,QAAmC;IAC/D,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,OAAO,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAoF,EACpF,iBAAgC;IAEhC,OAAO,kBAAkB,CAAC,KAAK,EAAE,iBAAiB,CAAC,IAAI,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;AACvF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CACzC,MAAwB,EACxB,iBAAgC;IAEhC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,sBAAsB,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,8BAA8B,CAC5C,MAAwB,EACxB,iBAAgC;IAEhC,OAAO,MAAM,CAAC,IAAI,CAChB,CAAC,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,EAAE,iBAAiB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAC5E,CAAC;AACJ,CAAC"}

package/dist/review-spawn-coverage-guard.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"review-spawn-coverage-guard.d.ts","sourceRoot":"","sources":["../src/review-spawn-coverage-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;;;;;;;;;;GAWG;AACH,wBAAgB,6CAA6C,CAC3D,WAAW,EAAE,MAAM,EACnB,cAAc,EAAE,MAAM,GAAG,IAAI,GAC5B,OAAO,CAET"}

package/dist/review-spawn-coverage-guard.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"review-spawn-coverage-guard.js","sourceRoot":"","sources":["../src/review-spawn-coverage-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,6CAA6C,CAC3D,WAAmB,EACnB,cAA6B;IAE7B,OAAO,WAAW,KAAK,QAAQ,IAAI,cAAc,IAAI,IAAI,CAAC;AAC5D,CAAC"}

package/dist/schema-version-gate.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"schema-version-gate.d.ts","sourceRoot":"","sources":["../src/schema-version-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAUH,MAAM,MAAM,cAAc,GAAG,WAAW,GAAG,MAAM,GAAG,KAAK,CAAC;AAE1D,sEAAsE;AACtE,MAAM,MAAM,iBAAiB,GAAG,IAAI,GAAG,WAAW,GAAG,OAAO,CAAC;AAE7D,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,cAAc,CAAC;IACrB,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,uEAAuE;IACvE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,qEAAqE;IACrE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,EAAE,EAAE,OAAO,CAAC;IACZ;;;;;;;OAOG;IACH,cAAc,EAAE,iBAAiB,CAAC;IAClC,6EAA6E;IAC7E,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,cAAc,CAO1F;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAItD;AAMD;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACvC,6EAA6E;IAC7E,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB,wEAAwE;IACxE,cAAc,EAAE,MAAM,CAAC;IACvB,8DAA8D;IAC9D,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,eAAO,MAAM,2BAA2B,EAAE,wBAKzC,CAAC;AAMF;;;;;;;;;GASG;AACH,wBAAgB,+BAA+B,CAC7C,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,wBAAwB,CAQ1B;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAK/D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EAAE,EACjB,OAAO,EAAE,MAAM,EAAE,EACjB,GAAG,EAAE,wBAAwB,GAC5B,OAAO,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAclC;AASD,MAAM,WAAW,sBAAsB;IACrC,IAAI,CAAC,EAAE,cAAc,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,MAAM,EAAE,CAAC;IAC7B,UAAU,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACrC,iEAAiE;IACjE,kBAAkB,CAAC,EAAE,wBAAwB,CAAC;IAC9C,wDAAwD;IACxD,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,+DAA+D;IAC/D,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,wEAAwE;IACxE,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAED,wBAAsB,kBAAkB,CAAC,IAAI,GAAE,sBAA2B,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAgErG;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,gBAAgB,GAAG,IAAI,CA8BrE"}

package/dist/schema-version-gate.js

@@ -1,220 +0,0 @@
-/**
- * Schema-version gate (D3-T3).
- *
- * Compares the publish-time `expectedMigrations` set embedded in
- * build-info.json (T1) against the migrations actually applied in the
- * live DB (T2's daemon_get_applied_migrations action). On mismatch:
- *   - fail-fast (production default): exit 1 with the missing list
- *   - warn (dev default): log and continue
- *   - off: skip the check entirely
- *
- * Runs at startup immediately after validateTrackerAuth so the daemon
- * never reaches its write path with a deploy-order schema drift.
- *
- * Deploy-race tolerance: infra's apply-migrations.sh applies a migration
- * and writes its public._migrations ledger row in SEPARATE (non-atomic)
- * psql invocations. Across a multi-migration deploy this leaves an
- * inter-migration window where the schema is live but the newest ledger
- * rows are not written yet -- a daemon (re)starting in that window reads
- * recently-applied migrations as "missing". To avoid false-tripping into
- * read-only mode, the gate classifies the missing set: a small number of
- * only-very-recent missing migrations is a transient eventual-consistency
- * gap, so the gate re-polls the ledger with bounded backoff (early-exit
- * the moment the gap closes) before deciding. A large gap, or any missing
- * migration older than the recency margin, is genuine drift and trips
- * immediately with no added latency.
- *
- * Operator runbook: docs/runbook-schema-version-gate.md
- * Incident: 2026-05-21 escalation 4bffb633.
- */
-import { getExpectedMigrations as defaultGetExpected } from './build-info.js';
-import { getAppliedMigrations as defaultGetApplied } from './supabase.js';
-import { createLogger } from './log.js';
-import { loadEnvConfig } from '@telora/daemon-core';
-const dlog = createLogger({ module: 'schema-gate' });
-/**
- * Resolve the operating mode from environment.
- *   TELORA_SCHEMA_GATE=off | 0     -> 'off'
- *   TELORA_SCHEMA_GATE=warn        -> 'warn'
- *   TELORA_SCHEMA_GATE=fail-fast   -> 'fail-fast'
- *   unset (default):
- *     NODE_ENV=production -> 'fail-fast'
- *     otherwise           -> 'warn'
- */
-export function resolveSchemaGateMode(env = process.env) {
-    const raw = (loadEnvConfig(env).TELORA_SCHEMA_GATE ?? '').trim().toLowerCase();
-    if (raw === 'off' || raw === '0')
-        return 'off';
-    if (raw === 'warn')
-        return 'warn';
-    if (raw === 'fail-fast')
-        return 'fail-fast';
-    // Default: prod is strict, dev is permissive
-    return env.NODE_ENV === 'production' ? 'fail-fast' : 'warn';
-}
-/**
- * Extract the supabase migration version (timestamp prefix) from a
- * full filename: '20260521233716_daemon_get_applied_migrations.sql'
- *   -> '20260521233716'. Returns the input unchanged if no underscore.
- */
-export function versionPrefix(filename) {
-    const underscore = filename.indexOf('_');
-    if (underscore <= 0)
-        return filename;
-    return filename.slice(0, underscore);
-}
-export const DEFAULT_TRANSIENT_TOLERANCE = {
-    maxMissing: 3,
-    recencyMarginMs: 10 * 60 * 1000, // 10 minutes
-    repollAttempts: 6,
-    repollWindowMs: 45_000, // 45 seconds
-};
-/** Initial re-poll delay; doubles each attempt up to MAX_REPOLL_DELAY_MS. */
-const INITIAL_REPOLL_DELAY_MS = 1_000;
-const MAX_REPOLL_DELAY_MS = 8_000;
-/**
- * Resolve transient-tolerance tunables from environment. Recency margin and
- * the re-poll window are configured in SECONDS for operator friendliness;
- * everything is stored internally in ms.
- *
- *   TELORA_SCHEMA_GATE_TRANSIENT_MAX     -> maxMissing (count)
- *   TELORA_SCHEMA_GATE_RECENCY_MARGIN_SEC -> recencyMarginMs
- *   TELORA_SCHEMA_GATE_REPOLL_ATTEMPTS   -> repollAttempts (count)
- *   TELORA_SCHEMA_GATE_REPOLL_WINDOW_SEC -> repollWindowMs
- */
-export function resolveTransientToleranceConfig(env = process.env) {
-    const envCfg = loadEnvConfig(env);
-    return {
-        maxMissing: envCfg.TELORA_SCHEMA_GATE_TRANSIENT_MAX,
-        recencyMarginMs: envCfg.TELORA_SCHEMA_GATE_RECENCY_MARGIN_SEC * 1000,
-        repollAttempts: envCfg.TELORA_SCHEMA_GATE_REPOLL_ATTEMPTS,
-        repollWindowMs: envCfg.TELORA_SCHEMA_GATE_REPOLL_WINDOW_SEC * 1000,
-    };
-}
-/**
- * Parse a 14-digit migration version (YYYYMMDDHHMMSS, UTC) into epoch ms.
- * Returns NaN for anything that is not exactly 14 digits -- callers treat
- * an unparseable timestamp as non-recent (i.e. genuine drift), which is the
- * conservative choice.
- */
-export function parseMigrationTimestamp(version) {
-    const m = /^(\d{4})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})$/.exec(version);
-    if (!m)
-        return NaN;
-    const [, y, mo, d, h, mi, s] = m;
-    return Date.UTC(Number(y), Number(mo) - 1, Number(d), Number(h), Number(mi), Number(s));
-}
-/**
- * Classify a non-empty missing set as a transient deploy-race tail or
- * genuine drift, given the currently-applied versions.
- *
- * Transient requires BOTH:
- *   - count <= maxMissing, AND
- *   - every missing timestamp is "very recent": newer than the newest
- *     applied timestamp minus the recency margin.
- *
- * Drift otherwise -- including the degenerate cases (no applied baseline,
- * or an unparseable timestamp), which cannot be a recoverable deploy tail.
- */
-export function classifyMissing(missing, applied, cfg) {
-    if (missing.length > cfg.maxMissing)
-        return 'drift';
-    const appliedTs = applied.map(parseMigrationTimestamp).filter((n) => !Number.isNaN(n));
-    if (appliedTs.length === 0)
-        return 'drift'; // no baseline to call anything "recent"
-    const newestApplied = Math.max(...appliedTs);
-    const recencyThreshold = newestApplied - cfg.recencyMarginMs;
-    for (const v of missing) {
-        const ts = parseMigrationTimestamp(v);
-        if (Number.isNaN(ts))
-            return 'drift';
-        if (ts <= recencyThreshold)
-            return 'drift'; // older than the margin -> not a deploy tail
-    }
-    return 'transient';
-}
-function computeMissing(expected, applied) {
-    const appliedSet = new Set(applied);
-    return expected.filter((v) => !appliedSet.has(v));
-}
-const defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
-export async function checkSchemaVersion(deps = {}) {
-    const mode = deps.mode ?? resolveSchemaGateMode();
-    const cfg = deps.transientTolerance ?? resolveTransientToleranceConfig();
-    const getApplied = deps.getApplied ?? defaultGetApplied;
-    const sleep = deps.sleep ?? defaultSleep;
-    const now = deps.now ?? Date.now;
-    const log = deps.log ?? ((msg) => dlog.info(msg));
-    const expectedFilenames = (deps.getExpected ?? defaultGetExpected)();
-    const expected = expectedFilenames.map(versionPrefix);
-    // Dev mode -- build-info missing or empty. Skip the gate.
-    if (expected.length === 0) {
-        return { mode, expected: [], applied: [], missing: [], ok: true, classification: 'ok', attempts: 0 };
-    }
-    let applied = await getApplied();
-    let attempts = 1;
-    let missing = computeMissing(expected, applied);
-    if (missing.length === 0) {
-        return { mode, expected, applied, missing, ok: true, classification: 'ok', attempts };
-    }
-    // Something is missing -- transient deploy tail, or genuine drift?
-    const classification = classifyMissing(missing, applied, cfg);
-    if (classification === 'drift') {
-        // Genuine drift: trip immediately, no re-poll, no added latency.
-        return { mode, expected, applied, missing, ok: false, classification: 'drift', attempts };
-    }
-    // Transient: re-poll the ledger with bounded backoff, exiting early the
-    // moment the gap closes. Bounded by BOTH the attempt count and the total
-    // wall-clock window so a never-resolving gap still trips read-only.
-    log(`[schema-gate] Transient gap: ${missing.length} very-recent migration(s) missing ` +
-        `(<= ${cfg.maxMissing}); re-polling up to ${cfg.repollAttempts}x over ${Math.round(cfg.repollWindowMs / 1000)}s ` +
-        'before deciding (deploy-race tolerance).');
-    const start = now();
-    let delay = INITIAL_REPOLL_DELAY_MS;
-    let repolls = 0;
-    while (repolls < cfg.repollAttempts) {
-        const elapsed = now() - start;
-        if (elapsed >= cfg.repollWindowMs)
-            break;
-        const remaining = cfg.repollWindowMs - elapsed;
-        await sleep(Math.min(delay, remaining));
-        applied = await getApplied();
-        attempts += 1;
-        repolls += 1;
-        missing = computeMissing(expected, applied);
-        if (missing.length === 0) {
-            log(`Transient gap closed after ${repolls} re-poll(s) -- proceeding in write mode.`);
-            return { mode, expected, applied, missing, ok: true, classification: 'transient', attempts };
-        }
-        delay = Math.min(delay * 2, MAX_REPOLL_DELAY_MS);
-    }
-    // Window exhausted and the gap remains -- treat as drift for the decision.
-    log(`[schema-gate] Transient gap did not close after ${repolls} re-poll(s) -- ${missing.length} migration(s) still missing.`);
-    return { mode, expected, applied, missing, ok: false, classification: 'transient', attempts };
-}
-export function reportSchemaGateResult(result) {
-    if (result.mode === 'off')
-        return;
-    if (result.ok) {
-        const repolled = result.classification === 'transient'
-            ? ` (transient deploy-race gap closed after ${result.attempts} ledger read(s))`
-            : '';
-        dlog.info(`[schema-gate] OK -- all ${result.expected.length} expected migrations applied${repolled}`);
-        return;
-    }
-    const cause = result.classification === 'transient'
-        ? ' (transient gap did not close within the re-poll window)'
-        : ' (genuine drift -- large gap or non-recent missing migration)';
-    const lines = result.missing.map((m) => `  - ${m}`).join('\n');
-    const body = `[schema-gate] Missing ${result.missing.length} migration(s) in live DB${cause}:\n${lines}`;
-    if (result.mode === 'fail-fast') {
-        dlog.error(body);
-        dlog.error('[schema-gate] Refusing to start. Apply missing migrations or set TELORA_SCHEMA_GATE=warn to override. ' +
-            'See docs/runbook-schema-version-gate.md.');
-    }
-    else {
-        dlog.warn(body);
-        dlog.warn('[schema-gate] Continuing with TELORA_SCHEMA_GATE=warn -- writes that depend on these migrations will fail.');
-    }
-}
-//# sourceMappingURL=schema-version-gate.js.map

package/dist/schema-version-gate.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"schema-version-gate.js","sourceRoot":"","sources":["../src/schema-version-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,qBAAqB,IAAI,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAC9E,OAAO,EAAE,oBAAoB,IAAI,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,MAAM,IAAI,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;AA8BrD;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACxE,MAAM,GAAG,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/E,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,GAAG,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC;IAClC,IAAI,GAAG,KAAK,WAAW;QAAE,OAAO,WAAW,CAAC;IAC5C,6CAA6C;IAC7C,OAAO,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC5C,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,UAAU,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IACrC,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;AACvC,CAAC;AA2BD,MAAM,CAAC,MAAM,2BAA2B,GAA6B;IACnE,UAAU,EAAE,CAAC;IACb,eAAe,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,aAAa;IAC9C,cAAc,EAAE,CAAC;IACjB,cAAc,EAAE,MAAM,EAAE,aAAa;CACtC,CAAC;AAEF,6EAA6E;AAC7E,MAAM,uBAAuB,GAAG,KAAK,CAAC;AACtC,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAElC;;;;;;;;;GASG;AACH,MAAM,UAAU,+BAA+B,CAC7C,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO;QACL,UAAU,EAAE,MAAM,CAAC,gCAAgC;QACnD,eAAe,EAAE,MAAM,CAAC,qCAAqC,GAAG,IAAI;QACpE,cAAc,EAAE,MAAM,CAAC,kCAAkC;QACzD,cAAc,EAAE,MAAM,CAAC,oCAAoC,GAAG,IAAI;KACnE,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAe;IACrD,MAAM,CAAC,GAAG,8CAA8C,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACvE,IAAI,CAAC,CAAC;QAAE,OAAO,GAAG,CAAC;IACnB,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;IACjC,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1F,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,eAAe,CAC7B,OAAiB,EACjB,OAAiB,EACjB,GAA6B;IAE7B,IAAI,OAAO,CAAC,MAAM,GAAG,GAAG,CAAC,UAAU;QAAE,OAAO,OAAO,CAAC;IAEpD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACvF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC,CAAC,wCAAwC;IACpF,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC;IAC7C,MAAM,gBAAgB,GAAG,aAAa,GAAG,GAAG,CAAC,eAAe,CAAC;IAE7D,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,EAAE,GAAG,uBAAuB,CAAC,CAAC,CAAC,CAAC;QACtC,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAAE,OAAO,OAAO,CAAC;QACrC,IAAI,EAAE,IAAI,gBAAgB;YAAE,OAAO,OAAO,CAAC,CAAC,6CAA6C;IAC3F,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAS,cAAc,CAAC,QAAkB,EAAE,OAAiB;IAC3D,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IACpC,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,YAAY,GAAG,CAAC,EAAU,EAAiB,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAgBtG,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAA+B,EAAE;IACxE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,qBAAqB,EAAE,CAAC;IAClD,MAAM,GAAG,GAAG,IAAI,CAAC,kBAAkB,IAAI,+BAA+B,EAAE,CAAC;IACzE,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB,CAAC;IACxD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,YAAY,CAAC;IACzC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,GAAW,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAE1D,MAAM,iBAAiB,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,kBAAkB,CAAC,EAAE,CAAC;IACrE,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAEtD,0DAA0D;IAC1D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACvG,CAAC;IAED,IAAI,OAAO,GAAG,MAAM,UAAU,EAAE,CAAC;IACjC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,OAAO,GAAG,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAEhD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACxF,CAAC;IAED,mEAAmE;IACnE,MAAM,cAAc,GAAG,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC9D,IAAI,cAAc,KAAK,OAAO,EAAE,CAAC;QAC/B,iEAAiE;QACjE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IAC5F,CAAC;IAED,wEAAwE;IACxE,yEAAyE;IACzE,oEAAoE;IACpE,GAAG,CACD,gCAAgC,OAAO,CAAC,MAAM,oCAAoC;QAChF,OAAO,GAAG,CAAC,UAAU,uBAAuB,GAAG,CAAC,cAAc,UAAU,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,GAAG,IAAI,CAAC,IAAI;QACjH,0CAA0C,CAC7C,CAAC;IACF,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC;IACpB,IAAI,KAAK,GAAG,uBAAuB,CAAC;IACpC,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,OAAO,OAAO,GAAG,GAAG,CAAC,cAAc,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,GAAG,EAAE,GAAG,KAAK,CAAC;QAC9B,IAAI,OAAO,IAAI,GAAG,CAAC,cAAc;YAAE,MAAM;QACzC,MAAM,SAAS,GAAG,GAAG,CAAC,cAAc,GAAG,OAAO,CAAC;QAC/C,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;QAExC,OAAO,GAAG,MAAM,UAAU,EAAE,CAAC;QAC7B,QAAQ,IAAI,CAAC,CAAC;QACd,OAAO,IAAI,CAAC,CAAC;QACb,OAAO,GAAG,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC5C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,GAAG,CAAC,8BAA8B,OAAO,0CAA0C,CAAC,CAAC;YACrF,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;QAC/F,CAAC;QACD,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,EAAE,mBAAmB,CAAC,CAAC;IACnD,CAAC;IAED,2EAA2E;IAC3E,GAAG,CACD,mDAAmD,OAAO,kBAAkB,OAAO,CAAC,MAAM,8BAA8B,CACzH,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;AAChG,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,MAAwB;IAC7D,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO;IAClC,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;QACd,MAAM,QAAQ,GACZ,MAAM,CAAC,cAAc,KAAK,WAAW;YACnC,CAAC,CAAC,4CAA4C,MAAM,CAAC,QAAQ,kBAAkB;YAC/E,CAAC,CAAC,EAAE,CAAC;QACT,IAAI,CAAC,IAAI,CACP,2BAA2B,MAAM,CAAC,QAAQ,CAAC,MAAM,+BAA+B,QAAQ,EAAE,CAC3F,CAAC;QACF,OAAO;IACT,CAAC;IACD,MAAM,KAAK,GACT,MAAM,CAAC,cAAc,KAAK,WAAW;QACnC,CAAC,CAAC,0DAA0D;QAC5D,CAAC,CAAC,+DAA+D,CAAC;IACtE,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,yBAAyB,MAAM,CAAC,OAAO,CAAC,MAAM,2BAA2B,KAAK,MAAM,KAAK,EAAE,CAAC;IACzG,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAChC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACjB,IAAI,CAAC,KAAK,CACR,wGAAwG;YACxG,0CAA0C,CAC3C,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChB,IAAI,CAAC,IAAI,CACP,4GAA4G,CAC7G,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/security-auto-inject.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"security-auto-inject.d.ts","sourceRoot":"","sources":["../src/security-auto-inject.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAM1D,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,QAAQ,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,MAAM,EAAE,MAAM,GAAG,aAAa,GAAG,UAAU,GAAG,WAAW,CAAC;IAC1D,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,MAAM,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAEtD,MAAM,WAAW,cAAc;IAC7B;;;;OAIG;IACH,8BAA8B,EAAE,CAC9B,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,MAAM,KACnB,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClD;;;;;OAKG;IACH,oCAAoC,CAAC,EAAE,CACrC,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,KACjB,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB;;;OAGG;IACH,gBAAgB,EAAE,CAAC,KAAK,EAAE;QACxB,MAAM,EAAE,MAAM,CAAC;QACf,cAAc,EAAE,MAAM,CAAC;QACvB,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAClC,KAAK,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClC;;OAEG;IACH,eAAe,EAAE,CAAC,KAAK,EAAE;QACvB,MAAM,EAAE,MAAM,CAAC;QACf,cAAc,EAAE,MAAM,CAAC;QACvB,SAAS,EAAE,MAAM,CAAC;QAClB,YAAY,EAAE,MAAM,CAAC;QACrB,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACxC,KAAK,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClC;;;;OAIG;IACH,cAAc,EAAE,CAAC,KAAK,EAAE;QACtB,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;QAClB,cAAc,EAAE,MAAM,CAAC;QACvB,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,CAAC;QACpB,eAAe,EAAE,MAAM,CAAC;KACzB,KAAK,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACtC;;;OAGG;IACH,qBAAqB,EAAE,CAAC,KAAK,EAAE;QAC7B,UAAU,EAAE,MAAM,CAAC;QACnB,cAAc,EAAE,MAAM,CAAC;QACvB,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;KAC5B,KAAK,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACnC,+DAA+D;IAC/D,WAAW,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3E,kCAAkC;IAClC,UAAU,EAAE,CAAC,KAAK,EAAE;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,cAAc,EAAE,MAAM,CAAC;QACvB,MAAM,EAAE,eAAe,CAAC;QACxB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACnC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACrB;AA2CD,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,UAAU,GAAG,wBAAwB,CAAC;IAC9C,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+DAA+D;IAC/D,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,mBAAmB,EAC5B,QAAQ,EAAE,iBAAiB,EAC3B,IAAI,EAAE,cAAc,GACnB,OAAO,CAAC,uBAAuB,CAAC,CAmElC;AAMD,wBAAgB,0BAA0B,IAAI,cAAc,CAgD3D"}

package/dist/security-auto-inject.js

@@ -1,168 +0,0 @@
-/**
- * Auto-injection for security findings.
- *
- * Every open finding that the engine sees -- newly observed or with no
- * linked remediation -- is handed to processNewFinding. One scan batch
- * produces one focus + one tree + one entity + one injection + one
- * delivery, no matter how many findings the scan emits; each finding
- * becomes an Issue under that single delivery.
- *
- * Per-batch (memoized across all findings in a scan run by
- * wrapAutoInjectForScanRun):
- *   1. Security remediation focus + tree.
- *   2. Batch entity node representing the codebase's security surface.
- *   3. Batch injection node ("Remediate security findings ...") targeting
- *      the entity node via a reality_tree_edge of kind 'targets'.
- *   4. Batch delivery on the focus, linked to the injection via the
- *      delivery's injection_id column.
- *
- * Per finding:
- *   5. Issue under the batch delivery (title = "Remediate <ioc>:<id>",
- *      description = advisory summary).
- *   6. Sets finding.linked_injection_id to the batch injection.
- *   7. Writes a security_finding_audit row with action='auto_injected'.
- *
- * No severity gate -- AI attempts every finding. The only short-circuit
- * is `skipped_already_linked` when the finding already carries a
- * remediation injection.
- *
- * @module security-auto-inject
- */
-import { callApi } from './queries/shared.js';
-// ---------------------------------------------------------------------------
-// Statement + label builders
-// ---------------------------------------------------------------------------
-function buildAdvisorySummary(finding) {
-    const payload = finding.payload;
-    const candidates = [
-        typeof payload.title === 'string' ? payload.title : null,
-        typeof payload.summary === 'string' ? payload.summary : null,
-        typeof payload.advisory_text === 'string' ? payload.advisory_text : null,
-    ].filter((s) => Boolean(s));
-    const head = candidates[0] ?? `Security finding ${finding.identifier}`;
-    return `${head} (${finding.iocClass}, severity=${finding.severity})`;
-}
-function buildFindingLabel(finding) {
-    return `${finding.iocClass}:${finding.identifier}`;
-}
-/** Generic, per-tree label for the batch entity node. The server-side
- *  upsert dedupes on (treeId, statement, type='entity'), so every finding
- *  in the run reuses the same node. */
-const BATCH_ENTITY_LABEL = 'Codebase security surface';
-/** Generic batch injection statement. The scan-run timestamp + finding
- *  count are not appended here -- focus name finalization carries that
- *  metadata for the dashboard. */
-const BATCH_INJECTION_STATEMENT = 'Remediate security findings in this scan batch';
-function buildBatchDeliveryName() {
-    const nowIso = new Date().toISOString();
-    return `Security Remediation ${nowIso.slice(0, 16).replace('T', ' ')} UTC`;
-}
-const BATCH_DELIVERY_DESCRIPTION = 'Auto-created to hold remediation work for the findings in this security scan batch. Each finding is tracked as an Issue under this delivery.';
-export async function processNewFinding(finding, _options, deps) {
-    if (finding.linkedInjectionId)
-        return { status: 'skipped_already_linked' };
-    // Steps 1-4 are per-batch: focus, entity, injection, delivery. Each is
-    // memoized by wrapAutoInjectForScanRun so every finding in the scan run
-    // resolves the same set of identifiers without re-calling the server.
-    const focus = await deps.createSecurityRemediationFocus(finding.productId, finding.organizationId);
-    const entity = await deps.upsertEntityNode({
-        treeId: focus.treeId,
-        organizationId: finding.organizationId,
-        label: BATCH_ENTITY_LABEL,
-        payload: { batch: true },
-    });
-    const injection = await deps.createInjection({
-        treeId: focus.treeId,
-        organizationId: finding.organizationId,
-        statement: BATCH_INJECTION_STATEMENT,
-        targetNodeId: entity.nodeId,
-        sourcePayload: { batch: true },
-    });
-    const delivery = await deps.createDelivery({
-        focusId: focus.focusId,
-        productId: finding.productId,
-        organizationId: finding.organizationId,
-        name: buildBatchDeliveryName(),
-        description: BATCH_DELIVERY_DESCRIPTION,
-        injectionNodeId: injection.nodeId,
-    });
-    // Per-finding: one Issue under the batch delivery, plus the finding
-    // backlink + audit trail.
-    const issue = await deps.createIssueOnDelivery({
-        deliveryId: delivery.deliveryId,
-        organizationId: finding.organizationId,
-        title: `Remediate ${buildFindingLabel(finding)}`,
-        description: buildAdvisorySummary(finding),
-        issueType: 'Task',
-    });
-    await deps.linkFinding(finding.id, injection.nodeId);
-    await deps.writeAudit({
-        findingId: finding.id,
-        organizationId: finding.organizationId,
-        action: 'auto_injected',
-        reason: 'finding_observed',
-        payload: {
-            severity: finding.severity,
-            delivery_id: delivery.deliveryId,
-            injection_node_id: injection.nodeId,
-            issue_id: issue.issueId,
-        },
-    });
-    return {
-        status: 'injected',
-        focusId: focus.focusId,
-        injectionNodeId: injection.nodeId,
-        deliveryId: delivery.deliveryId,
-        issueId: issue.issueId,
-    };
-}
-// ---------------------------------------------------------------------------
-// Default Deps -- daemon-side wiring via callApi.
-// ---------------------------------------------------------------------------
-export function buildDefaultAutoInjectDeps() {
-    return {
-        createSecurityRemediationFocus: async (productId, organizationId) => {
-            return callApi('daemon_create_security_remediation_focus', { productId, organizationId });
-        },
-        finalizeSecurityRemediationFocusName: async (focusId, findingCount) => {
-            await callApi('daemon_finalize_security_remediation_focus_name', {
-                focusId,
-                findingCount,
-            });
-        },
-        upsertEntityNode: async (input) => {
-            return callApi('daemon_upsert_security_entity_node', input);
-        },
-        createInjection: async (input) => {
-            return callApi('daemon_create_security_injection', input);
-        },
-        createDelivery: async (input) => {
-            return callApi('daemon_create_security_delivery', input);
-        },
-        createIssueOnDelivery: async (input) => {
-            const res = await callApi('issue_create', {
-                deliveryId: input.deliveryId,
-                fields: {
-                    title: input.title,
-                    description: input.description,
-                    issueType: input.issueType ?? 'Task',
-                    status: 'To Do',
-                },
-            });
-            return { issueId: res.issue.id };
-        },
-        linkFinding: async (findingId, injectionNodeId) => {
-            await callApi('daemon_link_finding_to_injection', { findingId, injectionNodeId });
-        },
-        writeAudit: async (input) => {
-            // `action` is reserved at the wire layer for the dispatcher route, so
-            // we rename the audit action to `auditAction` to avoid the collision.
-            const { action, ...rest } = input;
-            await callApi('daemon_write_security_finding_audit', {
-                ...rest,
-                auditAction: action,
-            });
-        },
-    };
-}
-//# sourceMappingURL=security-auto-inject.js.map

package/dist/security-auto-inject.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"security-auto-inject.js","sourceRoot":"","sources":["../src/security-auto-inject.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAiG9C,8EAA8E;AAC9E,6BAA6B;AAC7B,8EAA8E;AAE9E,SAAS,oBAAoB,CAAC,OAA4B;IACxD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAkC,CAAC;IAC3D,MAAM,UAAU,GAAG;QACjB,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;QACxD,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;QAC5D,OAAO,OAAO,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI;KACzE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,oBAAoB,OAAO,CAAC,UAAU,EAAE,CAAC;IACvE,OAAO,GAAG,IAAI,KAAK,OAAO,CAAC,QAAQ,cAAc,OAAO,CAAC,QAAQ,GAAG,CAAC;AACvE,CAAC;AAED,SAAS,iBAAiB,CAAC,OAA4B;IACrD,OAAO,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;AACrD,CAAC;AAED;;uCAEuC;AACvC,MAAM,kBAAkB,GAAG,2BAA2B,CAAC;AAEvD;;kCAEkC;AAClC,MAAM,yBAAyB,GAAG,gDAAgD,CAAC;AAEnF,SAAS,sBAAsB;IAC7B,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACxC,OAAO,wBAAwB,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC;AAC7E,CAAC;AAED,MAAM,0BAA0B,GAC9B,8IAA8I,CAAC;AAgBjJ,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAA4B,EAC5B,QAA2B,EAC3B,IAAoB;IAEpB,IAAI,OAAO,CAAC,iBAAiB;QAAE,OAAO,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;IAE3E,uEAAuE;IACvE,wEAAwE;IACxE,sEAAsE;IACtE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,8BAA8B,CACrD,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,cAAc,CACvB,CAAC;IAEF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC;QACzC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,KAAK,EAAE,kBAAkB;QACzB,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;KACzB,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC;QAC3C,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,SAAS,EAAE,yBAAyB;QACpC,YAAY,EAAE,MAAM,CAAC,MAAM;QAC3B,aAAa,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;KAC/B,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC;QACzC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,IAAI,EAAE,sBAAsB,EAAE;QAC9B,WAAW,EAAE,0BAA0B;QACvC,eAAe,EAAE,SAAS,CAAC,MAAM;KAClC,CAAC,CAAC;IAEH,oEAAoE;IACpE,0BAA0B;IAC1B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC;QAC7C,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,KAAK,EAAE,aAAa,iBAAiB,CAAC,OAAO,CAAC,EAAE;QAChD,WAAW,EAAE,oBAAoB,CAAC,OAAO,CAAC;QAC1C,SAAS,EAAE,MAAM;KAClB,CAAC,CAAC;IAEH,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IAErD,MAAM,IAAI,CAAC,UAAU,CAAC;QACpB,SAAS,EAAE,OAAO,CAAC,EAAE;QACrB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,MAAM,EAAE,eAAe;QACvB,MAAM,EAAE,kBAAkB;QAC1B,OAAO,EAAE;YACP,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,WAAW,EAAE,QAAQ,CAAC,UAAU;YAChC,iBAAiB,EAAE,SAAS,CAAC,MAAM;YACnC,QAAQ,EAAE,KAAK,CAAC,OAAO;SACxB;KACF,CAAC,CAAC;IAEH,OAAO;QACL,MAAM,EAAE,UAAU;QAClB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,eAAe,EAAE,SAAS,CAAC,MAAM;QACjC,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,kDAAkD;AAClD,8EAA8E;AAE9E,MAAM,UAAU,0BAA0B;IACxC,OAAO;QACL,8BAA8B,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,EAAE;YAClE,OAAO,OAAO,CACZ,0CAA0C,EAC1C,EAAE,SAAS,EAAE,cAAc,EAAE,CAC9B,CAAC;QACJ,CAAC;QACD,oCAAoC,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE;YACpE,MAAM,OAAO,CAAC,iDAAiD,EAAE;gBAC/D,OAAO;gBACP,YAAY;aACb,CAAC,CAAC;QACL,CAAC;QACD,gBAAgB,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YAChC,OAAO,OAAO,CAAqB,oCAAoC,EAAE,KAAK,CAAC,CAAC;QAClF,CAAC;QACD,eAAe,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YAC/B,OAAO,OAAO,CAAqB,kCAAkC,EAAE,KAAK,CAAC,CAAC;QAChF,CAAC;QACD,cAAc,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YAC9B,OAAO,OAAO,CAAyB,iCAAiC,EAAE,KAAK,CAAC,CAAC;QACnF,CAAC;QACD,qBAAqB,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YACrC,MAAM,GAAG,GAAG,MAAM,OAAO,CAA4B,cAAc,EAAE;gBACnE,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,MAAM,EAAE;oBACN,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,WAAW,EAAE,KAAK,CAAC,WAAW;oBAC9B,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,MAAM;oBACpC,MAAM,EAAE,OAAO;iBAChB;aACF,CAAC,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACnC,CAAC;QACD,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,EAAE;YAChD,MAAM,OAAO,CAAC,kCAAkC,EAAE,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YAC1B,sEAAsE;YACtE,sEAAsE;YACtE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;YAClC,MAAM,OAAO,CAAC,qCAAqC,EAAE;gBACnD,GAAG,IAAI;gBACP,WAAW,EAAE,MAAM;aACpB,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/security-finding-gate.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"security-finding-gate.d.ts","sourceRoot":"","sources":["../src/security-finding-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAYH,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,aAAa,GAAG,UAAU,GAAG,WAAW,CAAC;AAErF,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,oBAAoB,CAAC;CAC9B;AAED,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,wBAAwB,EAAE,CAAC,eAAe,EAAE,MAAM,KAAK,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;IAC3F;;;OAGG;IACH,eAAe,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvE;AAED,MAAM,MAAM,yBAAyB,GACjC;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GACpD;IAAE,MAAM,EAAE,KAAK,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAMzD;;;;;;;;;;;;GAYG;AACH,wBAAsB,8BAA8B,CAClD,eAAe,EAAE,MAAM,EACvB,IAAI,EAAE,uBAAuB,GAC5B,OAAO,CAAC,yBAAyB,CAAC,CAapC;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,uBAAuB,GAC5B,OAAO,CAAC,IAAI,CAAC,CAQf;AAMD,wBAAgB,mCAAmC,IAAI,uBAAuB,CAc7E"}