cursedbelt 2.7.0 → 3.0.0

package/dist/server/incidents/migrations.js

@@ -1,59 +0,0 @@
-/** The one table this primitive owns. */
-export const INCIDENTS_TABLE = "incidents";
-/**
- * ONE row per CONDITION, keyed by its fingerprint — not one row per observation.
- *
- * That is the whole dedupe design expressed as a schema: a poller that notices
- * the same broken thing 288 times a day cannot produce 288 rows, because there
- * is nowhere to put them. `seen_count` and `last_seen` absorb the repetition,
- * and the notification columns record that the owner was told ONCE.
- *
- * 🔴 **Never retention-managed.** Every other telemetry table in this package
- * is capped or aged out; this one is not, and must not be declared as a
- * retention target. An incident is the record of something having gone wrong on
- * a fleet whose owner's stated problem is *"I missed this for a long time"* —
- * the row that answers "has this happened before?" six months later is the
- * expensive one to have thrown away. The table is bounded by reality instead:
- * a fingerprint is stable, so a recurring problem re-uses its row forever.
- */
-export const INCIDENT_MIGRATIONS = [
-    {
-        name: "0001_incidents",
-        up(db) {
-            db.run(`
-				CREATE TABLE IF NOT EXISTS ${INCIDENTS_TABLE} (
-					fingerprint          TEXT PRIMARY KEY,
-					source               TEXT NOT NULL,
-					check_key            TEXT NOT NULL,
-					kind                 TEXT NOT NULL,
-					subject              TEXT NOT NULL,
-					severity             TEXT NOT NULL
-					                     CHECK (severity IN ('blocking', 'warning')),
-					state                TEXT NOT NULL
-					                     CHECK (state IN ('open', 'acknowledged', 'resolved')),
-					title                TEXT NOT NULL,
-					what_broke           TEXT NOT NULL,
-					what_it_blocks       TEXT NOT NULL,
-					what_to_do           TEXT NOT NULL,
-					facts_json           TEXT,
-					first_seen           INTEGER NOT NULL,
-					last_seen            INTEGER NOT NULL,
-					seen_count           INTEGER NOT NULL DEFAULT 1,
-					episodes             INTEGER NOT NULL DEFAULT 1,
-					acknowledged_at      INTEGER,
-					resolved_at          INTEGER,
-					notified_at          INTEGER,
-					notify_result        TEXT,
-					resolved_notified_at INTEGER
-				)
-			`);
-            // The read every screen starts from: what is wrong right now.
-            db.run(`CREATE INDEX IF NOT EXISTS idx_incidents_state
-					ON ${INCIDENTS_TABLE} (state, severity, last_seen DESC)`);
-            // The read `reconcile` does on every sweep, for every check.
-            db.run(`CREATE INDEX IF NOT EXISTS idx_incidents_check
-					ON ${INCIDENTS_TABLE} (check_key, state)`);
-        },
-    },
-];
-//# sourceMappingURL=migrations.js.map

package/dist/server/incidents/migrations.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"migrations.js","sourceRoot":"","sources":["../../../src/server/incidents/migrations.ts"],"names":[],"mappings":"AAGA,yCAAyC;AACzC,MAAM,CAAC,MAAM,eAAe,GAAG,WAAW,CAAC;AAE3C;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAyB;IACxD;QACC,IAAI,EAAE,gBAAgB;QACtB,EAAE,CAAC,EAAY;YACd,EAAE,CAAC,GAAG,CAAC;iCACuB,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;IAyB5C,CAAC,CAAC;YACH,8DAA8D;YAC9D,EAAE,CAAC,GAAG,CACL;UACM,eAAe,oCAAoC,CACzD,CAAC;YACF,6DAA6D;YAC7D,EAAE,CAAC,GAAG,CACL;UACM,eAAe,qBAAqB,CAC1C,CAAC;QACH,CAAC;KACD;CACD,CAAC"}

package/dist/server/incidents/notifier.d.ts

@@ -1,80 +0,0 @@
-/**
- * Turning a state TRANSITION into a message, and sending it exactly once.
- *
- * Everything that decides "does the owner hear about this?" is here, and there
- * is very little of it, because the hard part was done in `store.ts`: this
- * module only ever sees `opened`, `escalated` and `resolved`. There is no
- * de-duplication logic in this file and there must never be — a second dedupe,
- * on a timer, is how a system ends up with two disagreeing answers to "have I
- * already said this?".
- *
- * ── The message the owner actually gets ─────────────────────────────────────
- * The owner's standing complaint about agent hand-offs is that they name a
- * symptom, a command and a credential without saying what any of them are. So
- * an incident message is three sentences with fixed jobs, in this order:
- *
- *   WHAT BROKE      — in words, naming the app. Assume he does not know what
- *                     your daemon, flag, tab or port is.
- *   WHAT IT BLOCKS  — what he cannot do until it is fixed. This is the sentence
- *                     that earns a text message at 2am; if you cannot write it,
- *                     the incident is a `warning`.
- *   WHAT TO DO      — a next step. A command carries its own `cd`, because he
- *                     opens terminals anywhere (`fleet/rules/
- *                     commands-must-run-from-anywhere.md`).
- *
- * ── 🔴 What is deliberately NOT in a message ────────────────────────────────
- * File names, note titles, vault keys, e-mail addresses, anything a person
- * typed. `subject` is an identifier and `facts` are numbers, both enforced at
- * the store (`assertNoContent`). A text message is the least private surface
- * this fleet has and several of its apps are private by construction.
- */
-import type { ChannelMessage, ChannelResult, IncidentChannel } from "./channels";
-import type { IncidentStore } from "./store";
-import type { Incident, IncidentTransitions } from "./types";
-export interface IncidentNotifier {
-    /** Send for every transition in `t`. Returns one result per message sent. */
-    announce: (t: IncidentTransitions) => Promise<AnnounceResult[]>;
-    /** The channels registered on this host, for the console's health row. */
-    readonly channels: readonly IncidentChannel[];
-}
-export interface AnnounceResult {
-    fingerprint: string;
-    transition: "opened" | "escalated" | "resolved";
-    results: ChannelResult[];
-}
-/**
- * How long to wait before trying a BLOCKING incident again when no channel
- * managed to deliver it.
- *
- * 🔴 This exists because of a real hole found on the first live sweep: `roms`'
- * overdue backup opened as blocking while the email channel was still
- * misconfigured, both channels failed, and — because `notifiedAt` was stamped —
- * nothing would ever have tried again. The owner would have had a blocking
- * incident on a board he had no reason to open. The dedupe promise is "you are
- * told ONCE", not "we attempt once": an attempt that reached nobody has not told
- * him anything.
- *
- * It retries at most hourly, and it STOPS the moment any channel reports
- * `delivered` — so a permanently broken channel costs one send an hour, and a
- * working one costs exactly one message, which is the guarantee.
- */
-export declare const UNDELIVERED_RETRY_MS: number;
-/** The message for a newly-open (or newly-blocking) incident. */
-export declare function composeOpened(incident: Incident): ChannelMessage;
-/**
- * The message for a resolve. It exists so "is it fixed?" is answered without
- * him having to go and look — the same reason the open message exists.
- */
-export declare function composeResolved(incident: Incident): ChannelMessage;
-export interface CreateNotifierOptions {
-    store: IncidentStore;
-    channels: readonly IncidentChannel[];
-    /**
-     * Called with every channel result, so a host can record channel health.
-     * `detectChannelHealth` in `detectors.ts` turns a run of failures into its
-     * own incident — which is why `ChannelMessage.avoid` exists.
-     */
-    onChannelResult?: (fingerprint: string, result: ChannelResult) => void;
-}
-export declare function createIncidentNotifier(options: CreateNotifierOptions): IncidentNotifier;
-//# sourceMappingURL=notifier.d.ts.map

package/dist/server/incidents/notifier.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"notifier.d.ts","sourceRoot":"","sources":["../../../src/server/incidents/notifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AACjF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7C,OAAO,KAAK,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAE7D,MAAM,WAAW,gBAAgB;IAChC,6EAA6E;IAC7E,QAAQ,EAAE,CAAC,CAAC,EAAE,mBAAmB,KAAK,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAChE,0EAA0E;IAC1E,QAAQ,CAAC,QAAQ,EAAE,SAAS,eAAe,EAAE,CAAC;CAC9C;AAED,MAAM,WAAW,cAAc;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,QAAQ,GAAG,WAAW,GAAG,UAAU,CAAC;IAChD,OAAO,EAAE,aAAa,EAAE,CAAC;CACzB;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,oBAAoB,QAAiB,CAAC;AAYnD,iEAAiE;AACjE,wBAAgB,aAAa,CAAC,QAAQ,EAAE,QAAQ,GAAG,cAAc,CAYhE;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,QAAQ,GAAG,cAAc,CAWlE;AAED,MAAM,WAAW,qBAAqB;IACrC,KAAK,EAAE,aAAa,CAAC;IACrB,QAAQ,EAAE,SAAS,eAAe,EAAE,CAAC;IACrC;;;;OAIG;IACH,eAAe,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,KAAK,IAAI,CAAC;CACvE;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,qBAAqB,GAAG,gBAAgB,CAgGvF"}

package/dist/server/incidents/notifier.js

@@ -1,142 +0,0 @@
-/**
- * How long to wait before trying a BLOCKING incident again when no channel
- * managed to deliver it.
- *
- * 🔴 This exists because of a real hole found on the first live sweep: `roms`'
- * overdue backup opened as blocking while the email channel was still
- * misconfigured, both channels failed, and — because `notifiedAt` was stamped —
- * nothing would ever have tried again. The owner would have had a blocking
- * incident on a board he had no reason to open. The dedupe promise is "you are
- * told ONCE", not "we attempt once": an attempt that reached nobody has not told
- * him anything.
- *
- * It retries at most hourly, and it STOPS the moment any channel reports
- * `delivered` — so a permanently broken channel costs one send an hour, and a
- * working one costs exactly one message, which is the guarantee.
- */
-export const UNDELIVERED_RETRY_MS = 60 * 60 * 1000;
-/** Did any channel actually get it out? `skipped` is not delivery. */
-const wasDelivered = (notifyResult) => Boolean(notifyResult?.includes("=delivered"));
-const factLine = (incident) => {
-    const facts = Object.entries(incident.facts ?? {});
-    if (facts.length === 0)
-        return "";
-    return `\n${facts.map(([k, v]) => `${k}: ${v}`).join(" · ")}`;
-};
-/** The message for a newly-open (or newly-blocking) incident. */
-export function composeOpened(incident) {
-    const tag = incident.severity === "blocking" ? "BLOCKED" : "Heads up";
-    return {
-        severity: incident.severity,
-        subject: `[${tag}] ${incident.title}`,
-        text: [
-            `What broke: ${incident.whatBroke}`,
-            `What it blocks: ${incident.whatItBlocks}`,
-            `What to do: ${incident.whatToDo}`,
-            `(${incident.source} · ${incident.kind} · ${incident.subject})${factLine(incident)}`,
-        ].join("\n\n"),
-    };
-}
-/**
- * The message for a resolve. It exists so "is it fixed?" is answered without
- * him having to go and look — the same reason the open message exists.
- */
-export function composeResolved(incident) {
-    const minutes = Math.max(1, Math.round(((incident.resolvedAt ?? 0) - incident.firstSeen) / 60000));
-    return {
-        severity: incident.severity,
-        subject: `[cleared] ${incident.title}`,
-        text: [
-            `This is no longer happening. It was open for about ${minutes} minute${minutes === 1 ? "" : "s"}.`,
-            `It was: ${incident.whatBroke}`,
-            `(${incident.source} · ${incident.kind} · ${incident.subject})`,
-        ].join("\n\n"),
-    };
-}
-export function createIncidentNotifier(options) {
-    const { store, channels } = options;
-    const dispatch = async (incident, message, transition) => {
-        // An incident that IS a channel failure must not be announced down the
-        // channel it is about. Without this the first SES outage produces an
-        // endless retry loop against SES.
-        const avoid = incident.kind === "notification-channel-failing" ? [incident.subject] : undefined;
-        const withAvoid = avoid ? { ...message, avoid } : message;
-        const results = [];
-        for (const channel of channels) {
-            // 🔴 The `avoid` guard lives HERE, not in each channel. It was in every
-            // channel first and a spy channel in the spec walked straight past it —
-            // which is the same hole any channel added later would have had. One
-            // enforcement point, and a new channel inherits it by existing.
-            if (withAvoid.avoid?.includes(channel.key)) {
-                results.push({
-                    channel: channel.key,
-                    outcome: "skipped",
-                    detail: "this message is ABOUT this channel — not sent down it",
-                });
-                continue;
-            }
-            // Channels are awaited in series on purpose: there are at most three,
-            // they are all fast, and a serial loop means the text channel's
-            // delivery-proof read cannot race the email channel's for the same
-            // laptop resources.
-            const result = await channel.send(withAvoid).catch((err) => ({
-                channel: channel.key,
-                outcome: "failed",
-                detail: err instanceof Error ? err.message.slice(0, 200) : String(err),
-            }));
-            results.push(result);
-            options.onChannelResult?.(incident.fingerprint, result);
-        }
-        return { fingerprint: incident.fingerprint, transition, results };
-    };
-    const summarise = (results) => results.map((r) => `${r.channel}=${r.outcome}`).join(" ");
-    return {
-        channels,
-        async announce(t) {
-            const out = [];
-            for (const incident of [...t.opened, ...t.escalated]) {
-                const transition = t.opened.includes(incident) ? "opened" : "escalated";
-                const result = await dispatch(incident, composeOpened(incident), transition);
-                // 🔴 Only stamp `notifiedAt` when there was actually a channel to try.
-                // A host with none (a prod deployment that only stores what the Mac
-                // pushes it) has not told him anything, and stamping it there is what
-                // made the resolve message below fire for an open he never saw.
-                if (result.results.length > 0) {
-                    store.markNotified([incident.fingerprint], summarise(result.results));
-                }
-                out.push(result);
-            }
-            // A blocking incident nobody could be told about is retried, hourly,
-            // until one channel lands it. See `UNDELIVERED_RETRY_MS`.
-            for (const incident of t.unchanged) {
-                if (incident.severity !== "blocking")
-                    continue;
-                if (incident.notifiedAt === null)
-                    continue;
-                if (wasDelivered(incident.notifyResult))
-                    continue;
-                if (Date.now() - incident.notifiedAt < UNDELIVERED_RETRY_MS)
-                    continue;
-                const result = await dispatch(incident, composeOpened(incident), "opened");
-                if (result.results.length > 0) {
-                    store.markNotified([incident.fingerprint], summarise(result.results));
-                }
-                out.push(result);
-            }
-            for (const incident of t.resolved) {
-                // Never announce a resolve for something whose OPEN was never
-                // announced — the owner would get "cleared: X" for an X he has never
-                // heard of, which reads as a bug in the alerting rather than as good
-                // news. This happens for real: an incident opened, acknowledged and
-                // resolved between two sweeps of a host that had no channels.
-                if (incident.notifiedAt === null)
-                    continue;
-                const result = await dispatch(incident, composeResolved(incident), "resolved");
-                store.markResolvedNotified([incident.fingerprint]);
-                out.push(result);
-            }
-            return out;
-        },
-    };
-}
-//# sourceMappingURL=notifier.js.map

package/dist/server/incidents/notifier.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"notifier.js","sourceRoot":"","sources":["../../../src/server/incidents/notifier.ts"],"names":[],"mappings":"AA+CA;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnD,sEAAsE;AACtE,MAAM,YAAY,GAAG,CAAC,YAA2B,EAAW,EAAE,CAC7D,OAAO,CAAC,YAAY,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;AAE/C,MAAM,QAAQ,GAAG,CAAC,QAAkB,EAAU,EAAE;IAC/C,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IACnD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAClC,OAAO,KAAK,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;AAC/D,CAAC,CAAC;AAEF,iEAAiE;AACjE,MAAM,UAAU,aAAa,CAAC,QAAkB;IAC/C,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;IACtE,OAAO;QACN,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,OAAO,EAAE,IAAI,GAAG,KAAK,QAAQ,CAAC,KAAK,EAAE;QACrC,IAAI,EAAE;YACL,eAAe,QAAQ,CAAC,SAAS,EAAE;YACnC,mBAAmB,QAAQ,CAAC,YAAY,EAAE;YAC1C,eAAe,QAAQ,CAAC,QAAQ,EAAE;YAClC,IAAI,QAAQ,CAAC,MAAM,MAAM,QAAQ,CAAC,IAAI,MAAM,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,EAAE;SACpF,CAAC,IAAI,CAAC,MAAM,CAAC;KACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,QAAkB;IACjD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,QAAQ,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;IACnG,OAAO;QACN,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,OAAO,EAAE,aAAa,QAAQ,CAAC,KAAK,EAAE;QACtC,IAAI,EAAE;YACL,sDAAsD,OAAO,UAAU,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG;YAClG,WAAW,QAAQ,CAAC,SAAS,EAAE;YAC/B,IAAI,QAAQ,CAAC,MAAM,MAAM,QAAQ,CAAC,IAAI,MAAM,QAAQ,CAAC,OAAO,GAAG;SAC/D,CAAC,IAAI,CAAC,MAAM,CAAC;KACd,CAAC;AACH,CAAC;AAaD,MAAM,UAAU,sBAAsB,CAAC,OAA8B;IACpE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IAEpC,MAAM,QAAQ,GAAG,KAAK,EACrB,QAAkB,EAClB,OAAuB,EACvB,UAAwC,EACd,EAAE;QAC5B,uEAAuE;QACvE,qEAAqE;QACrE,kCAAkC;QAClC,MAAM,KAAK,GACV,QAAQ,CAAC,IAAI,KAAK,8BAA8B,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACnF,MAAM,SAAS,GAAmB,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;QAE1E,MAAM,OAAO,GAAoB,EAAE,CAAC;QACpC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAChC,wEAAwE;YACxE,wEAAwE;YACxE,qEAAqE;YACrE,gEAAgE;YAChE,IAAI,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5C,OAAO,CAAC,IAAI,CAAC;oBACZ,OAAO,EAAE,OAAO,CAAC,GAAG;oBACpB,OAAO,EAAE,SAAS;oBAClB,MAAM,EAAE,uDAAuD;iBAC/D,CAAC,CAAC;gBACH,SAAS;YACV,CAAC;YACD,sEAAsE;YACtE,gEAAgE;YAChE,mEAAmE;YACnE,oBAAoB;YACpB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CACjD,CAAC,GAAG,EAAiB,EAAE,CAAC,CAAC;gBACxB,OAAO,EAAE,OAAO,CAAC,GAAG;gBACpB,OAAO,EAAE,QAAQ;gBACjB,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACtE,CAAC,CACF,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACrB,OAAO,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QACzD,CAAC;QACD,OAAO,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;IACnE,CAAC,CAAC;IAEF,MAAM,SAAS,GAAG,CAAC,OAAwB,EAAU,EAAE,CACtD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAE3D,OAAO;QACN,QAAQ;QACR,KAAK,CAAC,QAAQ,CAAC,CAAC;YACf,MAAM,GAAG,GAAqB,EAAE,CAAC;YAEjC,KAAK,MAAM,QAAQ,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;gBACtD,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC;gBACxE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,QAAQ,CAAC,EAAE,UAAU,CAAC,CAAC;gBAC7E,uEAAuE;gBACvE,oEAAoE;gBACpE,sEAAsE;gBACtE,gEAAgE;gBAChE,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC/B,KAAK,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;gBACvE,CAAC;gBACD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAClB,CAAC;YAED,qEAAqE;YACrE,0DAA0D;YAC1D,KAAK,MAAM,QAAQ,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;gBACpC,IAAI,QAAQ,CAAC,QAAQ,KAAK,UAAU;oBAAE,SAAS;gBAC/C,IAAI,QAAQ,CAAC,UAAU,KAAK,IAAI;oBAAE,SAAS;gBAC3C,IAAI,YAAY,CAAC,QAAQ,CAAC,YAAY,CAAC;oBAAE,SAAS;gBAClD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,UAAU,GAAG,oBAAoB;oBAAE,SAAS;gBACtE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;gBAC3E,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC/B,KAAK,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;gBACvE,CAAC;gBACD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAClB,CAAC;YAED,KAAK,MAAM,QAAQ,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;gBACnC,8DAA8D;gBAC9D,qEAAqE;gBACrE,qEAAqE;gBACrE,oEAAoE;gBACpE,8DAA8D;gBAC9D,IAAI,QAAQ,CAAC,UAAU,KAAK,IAAI;oBAAE,SAAS;gBAC3C,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC,QAAQ,CAAC,EAAE,UAAU,CAAC,CAAC;gBAC/E,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;gBACnD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAClB,CAAC;YAED,OAAO,GAAG,CAAC;QACZ,CAAC;KACD,CAAC;AACH,CAAC"}

package/dist/server/incidents/reporter.d.ts

@@ -1,61 +0,0 @@
-/**
- * The other side of `POST /incidents/report` — how a service that is NOT the
- * console tells the console what it can see.
- *
- * ── Why a service reports rather than being polled ──────────────────────────
- * The console can measure a service's disk, its port and its HTTP status from
- * outside. It cannot measure the things that actually go wrong inside one: an
- * ingest run where every item failed, a queue whose worker is looping on the
- * same error, a store that is refusing writes for a reason of its own. Those
- * facts exist for a few milliseconds inside the process that has them, and the
- * only place they can be turned into an incident is there.
- *
- * ── 🔴 Reporting is a HEARTBEAT, not an event ───────────────────────────────
- * A reporter sends the complete set of conditions that are true right now — the
- * same contract a local check has — and sends it on a schedule whether or not
- * anything is wrong. That is what lets the console clear an incident when the
- * service recovers. A reporter that only posts on failure can open an incident
- * and can never close one, and the owner ends up with a permanently red board,
- * which is the same uselessness as a permanently green one.
- *
- * The dedupe is entirely the console's: post the same thing every five minutes
- * for a week and he is told once. So a reporter needs no state, no "have I said
- * this?" flag, and no backoff — which is why this file is forty lines and not
- * four hundred.
- *
- * ── It never throws, and never blocks the service ───────────────────────────
- * A service whose real work fails because its ALERTING is unreachable is worse
- * than one with no alerting. Every failure here is logged and swallowed, and the
- * console notices the silence by other means (the service's own health probe).
- */
-import type { IncidentReport } from "./types";
-export interface IncidentReporterOptions {
-    /** e.g. `http://127.0.0.1:3024/api/station/incidents/report`. */
-    url: string;
-    /** The shared bearer the console's `reporterToken` compares against. */
-    token: string;
-    /** This service's name — the `source` of everything it reports. */
-    source: string;
-    /** A stable key for this reporter, owning the incidents it opens. */
-    checkKey: string;
-    /**
-     * Every `kind` this reporter can produce. Required, not optional: without it
-     * the console cannot tell "nothing is wrong" from "nothing was said", so a
-     * recovered service would stay red for ever. See `ReconcileOptions`.
-     */
-    kinds: readonly string[];
-    /** Produce the current set of true conditions. Called on every beat. */
-    collect: () => Promise<IncidentReport[]> | IncidentReport[];
-    /** Default 5 minutes. The console dedupes, so this is chosen for the network. */
-    intervalMs?: number;
-    fetchImpl?: typeof fetch;
-    log?: (message: string) => void;
-}
-export interface IncidentReporter {
-    /** Send one beat now. Resolves `false` on any failure — it never throws. */
-    beat: () => Promise<boolean>;
-    start: () => void;
-    stop: () => void;
-}
-export declare function createIncidentReporter(options: IncidentReporterOptions): IncidentReporter;
-//# sourceMappingURL=reporter.d.ts.map

package/dist/server/incidents/reporter.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"reporter.d.ts","sourceRoot":"","sources":["../../../src/server/incidents/reporter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE9C,MAAM,WAAW,uBAAuB;IACvC,iEAAiE;IACjE,GAAG,EAAE,MAAM,CAAC;IACZ,wEAAwE;IACxE,KAAK,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,wEAAwE;IACxE,OAAO,EAAE,MAAM,OAAO,CAAC,cAAc,EAAE,CAAC,GAAG,cAAc,EAAE,CAAC;IAC5D,iFAAiF;IACjF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC;AAED,MAAM,WAAW,gBAAgB;IAChC,4EAA4E;IAC5E,IAAI,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7B,KAAK,EAAE,MAAM,IAAI,CAAC;IAClB,IAAI,EAAE,MAAM,IAAI,CAAC;CACjB;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,uBAAuB,GAAG,gBAAgB,CA+CzF"}

package/dist/server/incidents/reporter.js

@@ -1,50 +0,0 @@
-export function createIncidentReporter(options) {
-    const doFetch = options.fetchImpl ?? fetch;
-    const log = options.log ?? ((m) => console.warn(`[incidents] ${m}`));
-    const intervalMs = options.intervalMs ?? 5 * 60_000;
-    let timer = null;
-    const beat = async () => {
-        try {
-            const reports = await options.collect();
-            const res = await doFetch(options.url, {
-                method: "POST",
-                headers: {
-                    "content-type": "application/json",
-                    authorization: `Bearer ${options.token}`,
-                },
-                body: JSON.stringify({
-                    checkKey: options.checkKey,
-                    source: options.source,
-                    kinds: options.kinds,
-                    reports,
-                }),
-                signal: AbortSignal.timeout(10_000),
-            });
-            if (!res.ok) {
-                log(`the console answered ${res.status} — ${reports.length} finding(s) not filed`);
-                return false;
-            }
-            return true;
-        }
-        catch (err) {
-            log(`could not reach the console: ${err instanceof Error ? err.message : String(err)}`);
-            return false;
-        }
-    };
-    return {
-        beat,
-        start() {
-            if (timer)
-                return;
-            timer = setInterval(() => void beat(), intervalMs);
-            // Never hold the process open for the sake of its own alerting.
-            timer.unref?.();
-        },
-        stop() {
-            if (timer)
-                clearInterval(timer);
-            timer = null;
-        },
-    };
-}
-//# sourceMappingURL=reporter.js.map

package/dist/server/incidents/reporter.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"reporter.js","sourceRoot":"","sources":["../../../src/server/incidents/reporter.ts"],"names":[],"mappings":"AA8DA,MAAM,UAAU,sBAAsB,CAAC,OAAgC;IACtE,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC3C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7E,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,CAAC,GAAG,MAAM,CAAC;IACpD,IAAI,KAAK,GAA0C,IAAI,CAAC;IAExD,MAAM,IAAI,GAAG,KAAK,IAAsB,EAAE;QACzC,IAAI,CAAC;YACJ,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;YACxC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE;gBACtC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACR,cAAc,EAAE,kBAAkB;oBAClC,aAAa,EAAE,UAAU,OAAO,CAAC,KAAK,EAAE;iBACxC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,OAAO;iBACP,CAAC;gBACF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;aACnC,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACb,GAAG,CAAC,wBAAwB,GAAG,CAAC,MAAM,MAAM,OAAO,CAAC,MAAM,uBAAuB,CAAC,CAAC;gBACnF,OAAO,KAAK,CAAC;YACd,CAAC;YACD,OAAO,IAAI,CAAC;QACb,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,GAAG,CAAC,gCAAgC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACxF,OAAO,KAAK,CAAC;QACd,CAAC;IACF,CAAC,CAAC;IAEF,OAAO;QACN,IAAI;QACJ,KAAK;YACJ,IAAI,KAAK;gBAAE,OAAO;YAClB,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,EAAE,EAAE,UAAU,CAAC,CAAC;YACnD,gEAAgE;YAChE,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QACjB,CAAC;QACD,IAAI;YACH,IAAI,KAAK;gBAAE,aAAa,CAAC,KAAK,CAAC,CAAC;YAChC,KAAK,GAAG,IAAI,CAAC;QACd,CAAC;KACD,CAAC;AACH,CAAC"}

package/dist/server/incidents/routes.d.ts

@@ -1,92 +0,0 @@
-/**
- * The mountable half — ordinary Hono routes, so any app can expose its incidents
- * without adopting another app's rpc layer (the same reasoning, and the same
- * shape, as `server/notifications/routes.ts`).
- *
- * ```ts
- * // BEFORE the session gate — the machine doors carry their own bearer:
- * mountIncidentMachineRoutes(app, { store, notifier, reporterToken });
- * // INSIDE it — the owner's own surface:
- * mountIncidentOwnerRoutes(app, { store, notifier, sweep, authorize: isOwner });
- * ```
- *
- * ── 🔴 Two doors, two MOUNTS, and that is the whole point ───────────────────
- * `authorize` is the OWNER's session — it guards the list, the acks, the manual
- * sweep and the channel test. `reporterToken` is a shared bearer and guards the
- * two routes a DAEMON uses. They answer different questions ("is this the
- * owner's browser?" and "is this one of my own processes?"), so a reporter can
- * never read the incident list and a browser session can never forge an
- * incident.
- *
- * They were one function first, and the console mounted it inside its session
- * gate. Every beat from binary-server and orch came back
- * `{"error":"unauthorized"}` — from the GATE, so nothing in this module logged
- * anything and the console showed a perfectly calm, empty board. A reporter
- * cannot report that it could not reach the reporting door. Two functions make
- * the mount order a thing you have to get right rather than a thing you can
- * forget, and they stop the opposite mistake too: registering the owner's
- * `GET /incidents` outside the gate, where Hono's first-match would shadow the
- * real one for ever.
- *
- * 🔴 `POST /report` is the ONE route that accepts incident text from off-box, so
- * it is also the one that has to be paranoid about it: every field is length-
- * capped and `facts` is re-validated through the store's `assertNoContent`
- * before anything is written. A reporter is trusted to be honest, not to be
- * correct.
- */
-import type { Hono } from "hono";
-import type { IncidentChannel } from "./channels";
-import type { IncidentNotifier } from "./notifier";
-import { type IncidentStore } from "./store";
-import type { SweepResult } from "./checks";
-export interface IncidentRoutesOptions {
-    store: IncidentStore;
-    /** Owner-only gate for the read + write surface. Return false to 403. */
-    authorize: (c: unknown) => boolean | Promise<boolean>;
-    /** Run the checks now. Omitted on a host that runs no detectors (prod). */
-    sweep?: () => Promise<SweepResult>;
-    /** Used to announce anything a remote report opens, and to list channel health. */
-    notifier?: IncidentNotifier;
-    /** Shared bearer for `POST /report`. Omitted, the route is not mounted. */
-    reporterToken?: string;
-    /**
-     * Deliver one message as this host. Mounted as `POST /relay-email` and used
-     * by the local console, which cannot reach SES — see `channels.ts`.
-     */
-    relayEmail?: (msg: {
-        subject: string;
-        text: string;
-        html?: string;
-    }) => Promise<{
-        sent: boolean;
-        reason?: string;
-    }>;
-    /** The last sweep, for the health route. */
-    lastSweep?: () => SweepResult | null;
-    /** Send a test message down one channel, so the owner can prove it works. */
-    channelsOf?: () => readonly IncidentChannel[];
-}
-/**
- * The OWNER's surface: the list, the acks, the health strip, the manual sweep,
- * the channel test. Mount it INSIDE the app's session gate.
- */
-export declare function mountIncidentOwnerRoutes(app: Hono, options: IncidentRoutesOptions, basePath?: string): void;
-/**
- * The MACHINE doors: `POST /report`, which another service beats its findings
- * into, and `POST /relay-email`, which a host that cannot send mail hands a
- * message to. Both carry a shared bearer.
- *
- * 🔴 **Mount this BEFORE the session gate, and never call it with `authorize`
- * expecting it to matter — it registers no route a browser should reach.**
- * Mounting the two together inside a cookie gate is the trap this split exists
- * to make impossible: every beat from binary-server and orch came back
- * `{"error":"unauthorized"}` from the gate, so no log line in this module said
- * anything was wrong and the console rendered a perfectly calm, empty board.
- * A reporter cannot report the failure to reach the reporting door.
- *
- * Keeping them in one function also risked the opposite mistake — registering
- * the owner's `GET /incidents` outside the gate, where Hono's first-match would
- * have shadowed the real one for ever.
- */
-export declare function mountIncidentMachineRoutes(app: Hono, options: Pick<IncidentRoutesOptions, "store" | "notifier" | "reporterToken" | "relayEmail">, basePath?: string): void;
-//# sourceMappingURL=routes.d.ts.map

package/dist/server/incidents/routes.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../../src/server/incidents/routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,EAAmB,KAAK,aAAa,EAAE,MAAM,SAAS,CAAC;AAE9D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAQ5C,MAAM,WAAW,qBAAqB;IACrC,KAAK,EAAE,aAAa,CAAC;IACrB,yEAAyE;IACzE,SAAS,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACtD,2EAA2E;IAC3E,KAAK,CAAC,EAAE,MAAM,OAAO,CAAC,WAAW,CAAC,CAAC;IACnC,mFAAmF;IACnF,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,2EAA2E;IAC3E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE;QAClB,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,CAAC,EAAE,MAAM,CAAC;KACd,KAAK,OAAO,CAAC;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClD,4CAA4C;IAC5C,SAAS,CAAC,EAAE,MAAM,WAAW,GAAG,IAAI,CAAC;IACrC,6EAA6E;IAC7E,UAAU,CAAC,EAAE,MAAM,SAAS,eAAe,EAAE,CAAC;CAC9C;AA+BD;;;GAGG;AACH,wBAAgB,wBAAwB,CACvC,GAAG,EAAE,IAAI,EACT,OAAO,EAAE,qBAAqB,EAC9B,QAAQ,SAAe,GACrB,IAAI,CA4EN;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,0BAA0B,CACzC,GAAG,EAAE,IAAI,EACT,OAAO,EAAE,IAAI,CAAC,qBAAqB,EAAE,OAAO,GAAG,UAAU,GAAG,eAAe,GAAG,YAAY,CAAC,EAC3F,QAAQ,SAAe,GACrB,IAAI,CAuGN"}