@weave-kit/engine 0.1.0

package/dist/subsystems/audit/store.js

@@ -0,0 +1,215 @@
+import { FILTER_OPS } from '../../runtime/data-access/values.js';
+/** generic-filter whitelist: `weavekit_audit` columns → SQL kind (only these are ever interpolated as identifiers) */
+const AUDIT_FILTER_COLUMNS = new Map([
+    ['ts', 'timestamptz'],
+    ['actor_type', 'text'],
+    ['actor_id', 'text'],
+    ['action', 'text'],
+    ['object', 'text'],
+    ['object_id', 'text'],
+    ['is_error', 'boolean'],
+    ['error_code', 'text'],
+]);
+const TABLE = 'weavekit_audit';
+/** create the append-only audit table (idempotent); `before`/`after` columns are always present (M10 D7 — replay only decides whether they are filled, so toggling the switch needs no migration) */
+export async function ensureAuditTable(pool) {
+    await pool.query(`CREATE TABLE IF NOT EXISTS ${TABLE} (
+       id          bigserial PRIMARY KEY,
+       ts          timestamptz NOT NULL DEFAULT now(),
+       actor_type  text NOT NULL,
+       actor_id    text NOT NULL,
+       action      text NOT NULL,
+       object      text,
+       object_id   text,
+       changes     jsonb,
+       before      jsonb,
+       after       jsonb,
+       is_error    boolean NOT NULL DEFAULT false,
+       error_code  text,
+       meta        jsonb
+     )`);
+    await pool.query(`CREATE INDEX IF NOT EXISTS ${TABLE}_ts_idx ON ${TABLE} (ts DESC)`);
+    await pool.query(`CREATE INDEX IF NOT EXISTS ${TABLE}_actor_idx ON ${TABLE} (actor_id)`);
+    await pool.query(`CREATE INDEX IF NOT EXISTS ${TABLE}_obj_idx ON ${TABLE} (object, object_id)`);
+}
+/** single append-only insert (writes the event's own timestamp — the audit is time-anchored to the business moment) */
+export async function insertAudit(pool, event) {
+    await pool.query(`INSERT INTO ${TABLE} (actor_type, actor_id, action, object, object_id, changes, before, after, is_error, error_code, meta, ts)
+     VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12)`, [
+        event.actorType,
+        event.actorId,
+        event.action,
+        event.objectName ?? null,
+        event.objectId ?? null,
+        event.changes === undefined ? null : JSON.stringify(event.changes),
+        event.before === undefined ? null : JSON.stringify(event.before),
+        event.after === undefined ? null : JSON.stringify(event.after),
+        event.isError ?? false,
+        event.errorCode ?? null,
+        event.meta === undefined ? null : JSON.stringify(event.meta),
+        event.timestamp,
+    ]);
+}
+/** batch append-only insert (single multi-row statement, one transaction) */
+export async function insertAuditBatch(pool, events) {
+    if (events.length === 0)
+        return;
+    const values = [];
+    const params = [];
+    for (const event of events) {
+        const i = params.length;
+        params.push(event.actorType, event.actorId, event.action, event.objectName ?? null, event.objectId ?? null, event.changes === undefined ? null : JSON.stringify(event.changes), event.before === undefined ? null : JSON.stringify(event.before), event.after === undefined ? null : JSON.stringify(event.after), event.isError ?? false, event.errorCode ?? null, event.meta === undefined ? null : JSON.stringify(event.meta), event.timestamp);
+        values.push(`($${i + 1}, $${i + 2}, $${i + 3}, $${i + 4}, $${i + 5}, $${i + 6}, $${i + 7}, $${i + 8}, $${i + 9}, $${i + 10}, $${i + 11}, $${i + 12})`);
+    }
+    await pool.query(`INSERT INTO ${TABLE} (actor_type, actor_id, action, object, object_id, changes, before, after, is_error, error_code, meta, ts)
+     VALUES ${values.join(', ')}`, params);
+}
+/**
+ * One `weavekit_audit` field condition. `rawValue` is a bare scalar (`eq`) or a
+ * `{ op: value }` object (multiple ops AND'd, e.g. a `ts` range). Unknown
+ * column → `null` (ignored); unsupported op for the column's kind → its piece is
+ * skipped. Returns `{ sql, params }` where params are `$1..$k` (callers append
+ * via `params.push(...)`).
+ */
+function auditFieldCondition(name, rawValue) {
+    const kind = AUDIT_FILTER_COLUMNS.get(name);
+    if (kind === undefined)
+        return null;
+    const ops = typeof rawValue === 'object' && rawValue !== null && !Array.isArray(rawValue)
+        ? Object.entries(rawValue).map(([op, value]) => ({ op, value }))
+        : [{ op: FILTER_OPS.EQ, value: rawValue }];
+    const col = `"${name}"`;
+    const pieces = [];
+    for (const { op, value } of ops) {
+        const supported = (() => {
+            if (kind === 'boolean')
+                return op === FILTER_OPS.EQ || op === FILTER_OPS.NE;
+            return (op === FILTER_OPS.EQ ||
+                op === FILTER_OPS.NE ||
+                op === FILTER_OPS.GT ||
+                op === FILTER_OPS.GTE ||
+                op === FILTER_OPS.LT ||
+                op === FILTER_OPS.LTE ||
+                op === FILTER_OPS.IN ||
+                op === FILTER_OPS.LIKE);
+        })();
+        if (!supported)
+            continue;
+        switch (op) {
+            case FILTER_OPS.EQ:
+                pieces.push({ sql: `${col} = ?`, value });
+                break;
+            case FILTER_OPS.NE:
+                pieces.push({ sql: `${col} <> ?`, value });
+                break;
+            case FILTER_OPS.GT:
+                pieces.push({ sql: `${col} > ?`, value });
+                break;
+            case FILTER_OPS.GTE:
+                pieces.push({ sql: `${col} >= ?`, value });
+                break;
+            case FILTER_OPS.LT:
+                pieces.push({ sql: `${col} < ?`, value });
+                break;
+            case FILTER_OPS.LTE:
+                pieces.push({ sql: `${col} <= ?`, value });
+                break;
+            case FILTER_OPS.IN:
+                pieces.push({ sql: `${col} = ANY(?)`, value });
+                break;
+            case FILTER_OPS.LIKE:
+                pieces.push({ sql: `${col} ILIKE ?`, value: `%${String(value)}%` });
+                break;
+        }
+    }
+    if (pieces.length === 0)
+        return null;
+    const params = [];
+    const sql = pieces
+        .map((p, i) => {
+        params.push(p.value);
+        return p.sql.replace('?', `$${i + 1}`);
+    })
+        .join(' AND ');
+    return pieces.length === 1 ? { sql, params } : { sql: `(${sql})`, params };
+}
+/** build the generic-filter WHERE fragment (appended to the typed-field `where`) */
+function auditFilterWhere(filter, where, params) {
+    if (filter === undefined)
+        return;
+    for (const [name, rawValue] of Object.entries(filter)) {
+        if (name === '$or')
+            continue;
+        const built = auditFieldCondition(name, rawValue);
+        if (built === null)
+            continue;
+        const renumbered = built.sql.replace(/\$\d+/g, (m) => `$${params.length + Number(m.slice(1))}`);
+        params.push(...built.params);
+        where.push(renumbered);
+    }
+    const orGroups = filter.$or;
+    if (orGroups !== undefined && orGroups.length > 0) {
+        const orClauses = [];
+        for (const group of orGroups) {
+            const inner = [];
+            for (const [name, rawValue] of Object.entries(group)) {
+                const built = auditFieldCondition(name, rawValue);
+                if (built === null)
+                    continue;
+                const renumbered = built.sql.replace(/\$\d+/g, (m) => `$${params.length + Number(m.slice(1))}`);
+                params.push(...built.params);
+                inner.push(renumbered);
+            }
+            if (inner.length > 0)
+                orClauses.push(`(${inner.join(' AND ')})`);
+        }
+        if (orClauses.length > 0)
+            where.push(`(${orClauses.join(' OR ')})`);
+    }
+}
+/** parameterized query over the audit trail */
+export async function queryAudit(pool, query = {}) {
+    const where = [];
+    const params = [];
+    const push = (clause, value) => {
+        params.push(value);
+        where.push(clause.replace('?', `$${params.length}`));
+    };
+    if (query.actorId !== undefined)
+        push('actor_id = ?', query.actorId);
+    if (query.action !== undefined)
+        push('action = ?', query.action);
+    if (query.object !== undefined)
+        push('object = ?', query.object);
+    if (query.from !== undefined)
+        push('ts >= ?', query.from);
+    if (query.to !== undefined)
+        push('ts <= ?', query.to);
+    auditFilterWhere(query.filter, where, params);
+    const whereSql = where.length === 0 ? '' : ` WHERE ${where.join(' AND ')}`;
+    const count = await pool.query(`SELECT count(*)::int AS n FROM ${TABLE}${whereSql}`, params);
+    const total = count.rows[0]?.n ?? 0;
+    const limit = query.limit ?? 100;
+    const offset = query.offset ?? 0;
+    const pageParams = [...params, limit, offset];
+    const result = await pool.query(`SELECT ts, actor_type, actor_id, action, object, object_id, changes, before, after, is_error, error_code, meta
+     FROM ${TABLE}${whereSql}
+     ORDER BY ts DESC, id DESC
+     LIMIT $${params.length + 1} OFFSET $${params.length + 2}`, pageParams);
+    const rows = result.rows.map((row) => ({
+        actorType: row.actor_type,
+        actorId: row.actor_id,
+        action: row.action,
+        objectName: row.object ?? undefined,
+        objectId: row.object_id ?? undefined,
+        changes: row.changes ?? undefined,
+        before: row.before ?? undefined,
+        after: row.after ?? undefined,
+        isError: row.is_error,
+        errorCode: row.error_code ?? undefined,
+        meta: row.meta ?? undefined,
+        timestamp: new Date(row.ts),
+    }));
+    return { rows, total };
+}
+//# sourceMappingURL=store.js.map

package/dist/subsystems/audit/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../../src/subsystems/audit/store.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,MAAM,qCAAqC,CAAC;AAIjE,sHAAsH;AACtH,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAA6C;IAC/E,CAAC,IAAI,EAAE,aAAa,CAAC;IACrB,CAAC,YAAY,EAAE,MAAM,CAAC;IACtB,CAAC,UAAU,EAAE,MAAM,CAAC;IACpB,CAAC,QAAQ,EAAE,MAAM,CAAC;IAClB,CAAC,QAAQ,EAAE,MAAM,CAAC;IAClB,CAAC,WAAW,EAAE,MAAM,CAAC;IACrB,CAAC,UAAU,EAAE,SAAS,CAAC;IACvB,CAAC,YAAY,EAAE,MAAM,CAAC;CACvB,CAAC,CAAC;AAEH,MAAM,KAAK,GAAG,gBAAgB,CAAC;AAE/B,qMAAqM;AACrM,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAU;IAC/C,MAAM,IAAI,CAAC,KAAK,CACd,8BAA8B,KAAK;;;;;;;;;;;;;;OAchC,CACJ,CAAC;IACF,MAAM,IAAI,CAAC,KAAK,CAAC,8BAA8B,KAAK,cAAc,KAAK,YAAY,CAAC,CAAC;IACrF,MAAM,IAAI,CAAC,KAAK,CAAC,8BAA8B,KAAK,iBAAiB,KAAK,aAAa,CAAC,CAAC;IACzF,MAAM,IAAI,CAAC,KAAK,CAAC,8BAA8B,KAAK,eAAe,KAAK,sBAAsB,CAAC,CAAC;AAClG,CAAC;AAED,uHAAuH;AACvH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAU,EAAE,KAAiB;IAC7D,MAAM,IAAI,CAAC,KAAK,CACd,eAAe,KAAK;gEACwC,EAC5D;QACE,KAAK,CAAC,SAAS;QACf,KAAK,CAAC,OAAO;QACb,KAAK,CAAC,MAAM;QACZ,KAAK,CAAC,UAAU,IAAI,IAAI;QACxB,KAAK,CAAC,QAAQ,IAAI,IAAI;QACtB,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC;QAClE,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC;QAChE,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC;QAC9D,KAAK,CAAC,OAAO,IAAI,KAAK;QACtB,KAAK,CAAC,SAAS,IAAI,IAAI;QACvB,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC;QAC5D,KAAK,CAAC,SAAS;KAChB,CACF,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAU,EAAE,MAAoB;IACrE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAChC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAc,EAAE,CAAC;IAC7B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,EACtD,KAAK,CAAC,UAAU,IAAI,IAAI,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,EAChD,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,EAClE,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,EAChE,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,EAC9D,KAAK,CAAC,OAAO,IAAI,KAAK,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI,EAC/C,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,EAC5D,KAAK,CAAC,SAAS,CAAC,CAAC;QACnB,MAAM,CAAC,IAAI,CACT,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,CAC1I,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,CAAC,KAAK,CACd,eAAe,KAAK;cACV,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAC7B,MAAM,CACP,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,mBAAmB,CAC1B,IAAY,EACZ,QAAiB;IAEjB,MAAM,IAAI,GAAG,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAEpC,MAAM,GAAG,GACP,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC3E,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAChE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IAE/C,MAAM,GAAG,GAAG,IAAI,IAAI,GAAG,CAAC;IACxB,MAAM,MAAM,GAA2C,EAAE,CAAC;IAC1D,KAAK,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,CAAC,GAAY,EAAE;YAC/B,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,EAAE,KAAK,UAAU,CAAC,EAAE,IAAI,EAAE,KAAK,UAAU,CAAC,EAAE,CAAC;YAC5E,OAAO,CACL,EAAE,KAAK,UAAU,CAAC,EAAE;gBACpB,EAAE,KAAK,UAAU,CAAC,EAAE;gBACpB,EAAE,KAAK,UAAU,CAAC,EAAE;gBACpB,EAAE,KAAK,UAAU,CAAC,GAAG;gBACrB,EAAE,KAAK,UAAU,CAAC,EAAE;gBACpB,EAAE,KAAK,UAAU,CAAC,GAAG;gBACrB,EAAE,KAAK,UAAU,CAAC,EAAE;gBACpB,EAAE,KAAK,UAAU,CAAC,IAAI,CACvB,CAAC;QACJ,CAAC,CAAC,EAAE,CAAC;QACL,IAAI,CAAC,SAAS;YAAE,SAAS;QACzB,QAAQ,EAAE,EAAE,CAAC;YACX,KAAK,UAAU,CAAC,EAAE;gBAChB,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,GAAG,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC1C,MAAM;YACR,KAAK,UAAU,CAAC,EAAE;gBAChB,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC3C,MAAM;YACR,KAAK,UAAU,CAAC,EAAE;gBAChB,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,GAAG,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC1C,MAAM;YACR,KAAK,UAAU,CAAC,GAAG;gBACjB,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC3C,MAAM;YACR,KAAK,UAAU,CAAC,EAAE;gBAChB,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,GAAG,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC1C,MAAM;YACR,KAAK,UAAU,CAAC,GAAG;gBACjB,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC3C,MAAM;YACR,KAAK,UAAU,CAAC,EAAE;gBAChB,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,GAAG,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC/C,MAAM;YACR,KAAK,UAAU,CAAC,IAAI;gBAClB,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,GAAG,UAAU,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;gBACpE,MAAM;QACV,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAErC,MAAM,MAAM,GAAc,EAAE,CAAC;IAC7B,MAAM,GAAG,GAAG,MAAM;SACf,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACZ,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACrB,OAAO,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC;SACD,IAAI,CAAC,OAAO,CAAC,CAAC;IACjB,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,GAAG,GAAG,EAAE,MAAM,EAAE,CAAC;AAC7E,CAAC;AAED,oFAAoF;AACpF,SAAS,gBAAgB,CAAC,MAA4B,EAAE,KAAe,EAAE,MAAiB;IACxF,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO;IACjC,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACtD,IAAI,IAAI,KAAK,KAAK;YAAE,SAAS;QAC7B,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAClD,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS;QAC7B,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAChG,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACzB,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC;IAC5B,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClD,MAAM,SAAS,GAAa,EAAE,CAAC;QAC/B,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrD,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;gBAClD,IAAI,KAAK,KAAK,IAAI;oBAAE,SAAS;gBAC7B,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBAChG,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;gBAC7B,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACzB,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;gBAAE,SAAS,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED,+CAA+C;AAC/C,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAU,EAAE,QAAoB,EAAE;IACjE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAc,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,KAAc,EAAQ,EAAE;QACpD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACvD,CAAC,CAAC;IACF,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;QAAE,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACrE,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;QAAE,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACjE,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;QAAE,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACjE,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;QAAE,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1D,IAAI,KAAK,CAAC,EAAE,KAAK,SAAS;QAAE,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IACtD,gBAAgB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;IAE3E,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,kCAAkC,KAAK,GAAG,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAC;IAC7F,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;IAEpC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,GAAG,CAAC;IACjC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC;IACjC,MAAM,UAAU,GAAG,CAAC,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;YACQ,KAAK,GAAG,QAAQ;;cAEd,MAAM,CAAC,MAAM,GAAG,CAAC,YAAY,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,EAC1D,UAAU,CACX,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACrC,SAAS,EAAE,GAAG,CAAC,UAAqC;QACpD,OAAO,EAAE,GAAG,CAAC,QAAkB;QAC/B,MAAM,EAAE,GAAG,CAAC,MAAgB;QAC5B,UAAU,EAAE,GAAG,CAAC,MAAM,IAAI,SAAS;QACnC,QAAQ,EAAE,GAAG,CAAC,SAAS,IAAI,SAAS;QACpC,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,SAAS;QACjC,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,SAAS;QAC/B,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,SAAS;QAC7B,OAAO,EAAE,GAAG,CAAC,QAAmB;QAChC,SAAS,EAAE,GAAG,CAAC,UAAU,IAAI,SAAS;QACtC,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,SAAS;QAC3B,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,EAAY,CAAC;KACtC,CAAC,CAAC,CAAC;IACJ,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACzB,CAAC"}

package/dist/subsystems/quota/index.d.ts

@@ -0,0 +1,2 @@
+export { createPgCounterStore } from './store.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/subsystems/quota/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/subsystems/quota/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC"}

package/dist/subsystems/quota/index.js

@@ -0,0 +1,2 @@
+export { createPgCounterStore } from './store.js';
+//# sourceMappingURL=index.js.map

package/dist/subsystems/quota/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/subsystems/quota/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC"}

package/dist/subsystems/quota/store.d.ts

@@ -0,0 +1,4 @@
+import type { Pool } from 'pg';
+import type { CounterStore } from '../../core/limiter/index.js';
+export declare function createPgCounterStore(pool: Pool): Promise<CounterStore>;
+//# sourceMappingURL=store.d.ts.map

package/dist/subsystems/quota/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../src/subsystems/quota/store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAC/B,OAAO,KAAK,EAAkB,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAoBhF,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,YAAY,CAAC,CAgC5E"}

package/dist/subsystems/quota/store.js

@@ -0,0 +1,44 @@
+/**
+ * PostgreSQL-backed {@link CounterStore} (MIT, ships with the engine).
+ *
+ * One table, keyed by `(key, period_start)`. `consume` is a single atomic
+ * `INSERT … ON CONFLICT DO UPDATE … WHERE value + amount <= limit RETURNING`,
+ * so concurrent engine instances cannot overspend a budget. Counters live in
+ * the same database as the business data (no extra infrastructure); a future
+ * Redis/cloud backend can be injected behind the same contract.
+ */
+const CREATE_TABLE = `CREATE TABLE IF NOT EXISTS weavekit_counters (
+  key text NOT NULL,
+  period_start timestamptz NOT NULL,
+  value bigint NOT NULL DEFAULT 0,
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (key, period_start)
+)`;
+export async function createPgCounterStore(pool) {
+    await pool.query(CREATE_TABLE);
+    async function value(key, periodStart) {
+        const res = await pool.query('SELECT value FROM weavekit_counters WHERE key = $1 AND period_start = $2', [key, periodStart]);
+        return res.rows.length === 0 ? 0 : Number(res.rows[0].value);
+    }
+    return {
+        async consume(key, amount, limit, periodStart) {
+            if (amount <= 0)
+                return { allowed: true, value: await value(key, periodStart) };
+            if (amount > limit)
+                return { allowed: false, value: await value(key, periodStart) };
+            const res = await pool.query(`INSERT INTO weavekit_counters (key, period_start, value)
+         VALUES ($1, $2, $3)
+         ON CONFLICT (key, period_start)
+         DO UPDATE SET value = weavekit_counters.value + EXCLUDED.value, updated_at = now()
+         WHERE weavekit_counters.value + EXCLUDED.value <= $4
+         RETURNING value`, [key, periodStart, amount, limit]);
+            if (res.rows.length === 0) {
+                // the conflict branch was rejected by the WHERE guard (budget exhausted)
+                return { allowed: false, value: await value(key, periodStart) };
+            }
+            return { allowed: true, value: Number(res.rows[0].value) };
+        },
+        value,
+    };
+}
+//# sourceMappingURL=store.js.map

package/dist/subsystems/quota/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../../src/subsystems/quota/store.ts"],"names":[],"mappings":"AAGA;;;;;;;;GAQG;AAEH,MAAM,YAAY,GAAG;;;;;;EAMnB,CAAC;AAEH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAAU;IACnD,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAE/B,KAAK,UAAU,KAAK,CAAC,GAAW,EAAE,WAAiB;QACjD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAC1B,0EAA0E,EAC1E,CAAC,GAAG,EAAE,WAAW,CAAC,CACnB,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,CAAC;IAChE,CAAC;IAED,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,GAAW,EAAE,MAAc,EAAE,KAAa,EAAE,WAAiB;YACzE,IAAI,MAAM,IAAI,CAAC;gBAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,CAAC;YAChF,IAAI,MAAM,GAAG,KAAK;gBAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,CAAC;YACpF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAC1B;;;;;yBAKiB,EACjB,CAAC,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,CAClC,CAAC;YACF,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,yEAAyE;gBACzE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,CAAC;YAClE,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9D,CAAC;QACD,KAAK;KACN,CAAC;AACJ,CAAC"}

package/dist/subsystems/script/backend/isolated-vm.d.ts

@@ -0,0 +1,8 @@
+import type { SandboxBackend } from './types.js';
+export interface IsolatedVmSandboxOptions {
+    timeoutMs: number;
+    queryTimeoutMs: number;
+    memoryLimitMb: number;
+}
+export declare function createIsolatedVmSandboxBackend(options: IsolatedVmSandboxOptions): SandboxBackend;
+//# sourceMappingURL=isolated-vm.d.ts.map

package/dist/subsystems/script/backend/isolated-vm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"isolated-vm.d.ts","sourceRoot":"","sources":["../../../../src/subsystems/script/backend/isolated-vm.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAe,cAAc,EAAoD,MAAM,YAAY,CAAC;AA2LhH,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;CACvB;AA4MD,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,wBAAwB,GAAG,cAAc,CAShG"}