ghcr-cleanup-manager 1.1.0

package/dist/db/_manifest-reachability.js

@@ -0,0 +1,158 @@
+export function rebuildManifestReachability(database, scanId) {
+    _refreshDigestTagEdges(database, scanId);
+    const manifestDigests = _loadManifestDigests(database, scanId);
+    const childDigestsByParent = new Map();
+    const parentDigestsByChild = new Map();
+    const neighborDigestsByDigest = new Map();
+    for (const digest of manifestDigests) {
+        childDigestsByParent.set(digest, new Set());
+        parentDigestsByChild.set(digest, new Set());
+        neighborDigestsByDigest.set(digest, new Set());
+    }
+    for (const manifestEdge of _loadManifestEdges(database, scanId)) {
+        childDigestsByParent.get(manifestEdge.parent_digest)?.add(manifestEdge.child_digest);
+        parentDigestsByChild.get(manifestEdge.child_digest)?.add(manifestEdge.parent_digest);
+        neighborDigestsByDigest.get(manifestEdge.parent_digest)?.add(manifestEdge.child_digest);
+        neighborDigestsByDigest.get(manifestEdge.child_digest)?.add(manifestEdge.parent_digest);
+    }
+    const graphIdsByDigest = _buildGraphIdsByDigest(manifestDigests, neighborDigestsByDigest);
+    const remainingChildrenCount = new Map();
+    const descendantDistancesByDigest = new Map();
+    const readyDigests = [];
+    for (const digest of manifestDigests) {
+        const childCount = childDigestsByParent.get(digest)?.size ?? 0;
+        remainingChildrenCount.set(digest, childCount);
+        if (childCount === 0) {
+            readyDigests.push(digest);
+        }
+    }
+    while (readyDigests.length > 0) {
+        const digest = readyDigests.shift();
+        if (!digest) {
+            continue;
+        }
+        const distances = new Map([[digest, 0]]);
+        for (const childDigest of childDigestsByParent.get(digest) ?? []) {
+            _setMinDistance(distances, childDigest, 1);
+            const childDistances = descendantDistancesByDigest.get(childDigest);
+            if (!childDistances) {
+                throw new Error(`manifest reachability build missing child results for ${childDigest}`);
+            }
+            for (const [descendantDigest, childDistance] of childDistances) {
+                if (descendantDigest === childDigest) {
+                    continue;
+                }
+                _setMinDistance(distances, descendantDigest, childDistance + 1);
+            }
+        }
+        descendantDistancesByDigest.set(digest, distances);
+        for (const parentDigest of parentDigestsByChild.get(digest) ?? []) {
+            const nextCount = (remainingChildrenCount.get(parentDigest) ?? 0) - 1;
+            remainingChildrenCount.set(parentDigest, nextCount);
+            if (nextCount === 0) {
+                readyDigests.push(parentDigest);
+            }
+        }
+    }
+    if (descendantDistancesByDigest.size !== manifestDigests.length) {
+        throw new Error("manifest reachability build detected a cycle in manifest_edges");
+    }
+    const insertRow = database.prepare(`
+      INSERT OR REPLACE INTO manifest_reachability(
+        scan_id,
+        ancestor_digest,
+        descendant_digest,
+        min_distance
+      )
+      VALUES(?, ?, ?, ?)
+    `);
+    const insertGraphRow = database.prepare(`
+      INSERT OR REPLACE INTO manifest_graphs(
+        scan_id,
+        digest,
+        graph_id
+      )
+      VALUES(?, ?, ?)
+    `);
+    const rebuild = database.transaction(() => {
+        database.prepare("DELETE FROM manifest_reachability WHERE scan_id = ?").run(scanId);
+        database.prepare("DELETE FROM manifest_graphs WHERE scan_id = ?").run(scanId);
+        for (const digest of manifestDigests) {
+            insertGraphRow.run(scanId, digest, graphIdsByDigest.get(digest));
+            for (const [descendantDigest, distance] of descendantDistancesByDigest.get(digest) ?? []) {
+                insertRow.run(scanId, digest, descendantDigest, distance);
+            }
+        }
+    });
+    rebuild();
+}
+function _buildGraphIdsByDigest(manifestDigests, neighborDigestsByDigest) {
+    const graphIdsByDigest = new Map();
+    let nextGraphId = 1;
+    for (const rootDigest of manifestDigests) {
+        if (graphIdsByDigest.has(rootDigest)) {
+            continue;
+        }
+        const pendingDigests = [rootDigest];
+        graphIdsByDigest.set(rootDigest, nextGraphId);
+        while (pendingDigests.length > 0) {
+            const digest = pendingDigests.pop();
+            if (!digest) {
+                continue;
+            }
+            for (const neighborDigest of neighborDigestsByDigest.get(digest) ?? []) {
+                if (graphIdsByDigest.has(neighborDigest)) {
+                    continue;
+                }
+                graphIdsByDigest.set(neighborDigest, nextGraphId);
+                pendingDigests.push(neighborDigest);
+            }
+        }
+        nextGraphId += 1;
+    }
+    return graphIdsByDigest;
+}
+function _refreshDigestTagEdges(database, scanId) {
+    database.prepare("DELETE FROM manifest_edges WHERE scan_id = ? AND edge_kind = 'digest-tag-referrer'").run(scanId);
+    database
+        .prepare(`
+        INSERT OR IGNORE INTO manifest_edges(scan_id, parent_digest, child_digest, edge_kind)
+        SELECT
+          t.scan_id,
+          m.digest AS parent_digest,
+          'sha256:' || SUBSTR(t.tag, 8, 64) AS child_digest,
+          'digest-tag-referrer' AS edge_kind
+        FROM tags t
+        JOIN manifests m
+          ON m.scan_id = t.scan_id
+         AND m.version_id = t.version_id
+        JOIN manifests child_manifest
+          ON child_manifest.scan_id = t.scan_id
+         AND child_manifest.digest = 'sha256:' || SUBSTR(t.tag, 8, 64)
+        WHERE t.scan_id = ?
+          AND t.is_digest_tag = 1
+      `)
+        .run(scanId);
+}
+function _loadManifestDigests(database, scanId) {
+    const rows = database
+        .prepare("SELECT digest FROM manifests WHERE scan_id = ? ORDER BY digest")
+        .all(scanId);
+    return rows.map((row) => row.digest);
+}
+function _loadManifestEdges(database, scanId) {
+    return database
+        .prepare(`
+        SELECT DISTINCT parent_digest, child_digest
+        FROM manifest_edges
+        WHERE scan_id = ?
+        ORDER BY parent_digest, child_digest
+      `)
+        .all(scanId);
+}
+function _setMinDistance(distances, digest, distance) {
+    const currentDistance = distances.get(digest);
+    if (currentDistance === undefined || distance < currentDistance) {
+        distances.set(digest, distance);
+    }
+}

package/dist/db/_scan-writer.d.ts

@@ -0,0 +1,20 @@
+import type Database from "better-sqlite3";
+import type { ManifestDescriptorRecord, ManifestEdgeRecord, ManifestRecord, PackageVersionRecord, TagRecord } from "../core/index.js";
+export declare class ScanWriter {
+    #private;
+    constructor(database: Database.Database);
+    startScan(owner: string, packageName: string, scanStartedAt: string, packageMetadata: {
+        rawJson: string;
+    }): void;
+    markScanCompleted(scanCompletedAt: string): void;
+    markScanFailed(scanCompletedAt: string): void;
+    insertPackageVersion(version: PackageVersionRecord): void;
+    insertPackageVersionPayload(versionId: number, rawJson: string): void;
+    insertTag(tag: TagRecord): void;
+    insertManifest(manifest: ManifestRecord): void;
+    insertManifestPayload(digest: string, rawJson: string): void;
+    insertManifestDescriptor(descriptor: ManifestDescriptorRecord): void;
+    insertManifestEdge(edge: ManifestEdgeRecord): void;
+    rebuildManifestReachability(): void;
+    getActiveScanId(): number;
+}

package/dist/db/_scan-writer.js

@@ -0,0 +1,184 @@
+import { randomUUID } from "node:crypto";
+import { isDigestTag } from "../core/index.js";
+import { resolveGitHubActionsRunUrl } from "./_github-actions-run-url.js";
+import { rebuildManifestReachability } from "./_manifest-reachability.js";
+export class ScanWriter {
+    #database;
+    #startScanStatement;
+    #markScanCompletedStatement;
+    #markScanFailedStatement;
+    #insertPackageVersionStatement;
+    #insertPackageVersionPayloadStatement;
+    #insertTagStatement;
+    #insertManifestStatement;
+    #insertManifestPayloadStatement;
+    #insertManifestDescriptorStatement;
+    #insertManifestEdgeStatement;
+    #activeScanId = null;
+    constructor(database) {
+        this.#database = database;
+        this.#startScanStatement = this.#database.prepare(`
+      INSERT INTO package_scans(
+        scan_uuid,
+        owner,
+        package_name,
+        package_metadata_json,
+        github_actions_run_url,
+        scan_started_at,
+        scan_completed_at,
+        status
+      )
+      VALUES(?, ?, ?, ?, ?, ?, NULL, 'running')
+    `);
+        this.#markScanCompletedStatement = this.#database.prepare(`
+      UPDATE package_scans
+      SET scan_completed_at = ?, status = 'completed'
+      WHERE scan_id = ?
+    `);
+        this.#markScanFailedStatement = this.#database.prepare(`
+      UPDATE package_scans
+      SET scan_completed_at = ?, status = 'failed'
+      WHERE scan_id = ?
+    `);
+        this.#insertPackageVersionStatement = this.#database.prepare(`
+      INSERT OR REPLACE INTO package_versions(scan_id, version_id, created_at, updated_at)
+      VALUES(@scanId, @versionId, @createdAt, @updatedAt)
+    `);
+        this.#insertPackageVersionPayloadStatement = this.#database.prepare(`
+      INSERT OR REPLACE INTO package_version_payloads(scan_id, version_id, raw_json)
+      VALUES(?, ?, ?)
+    `);
+        this.#insertTagStatement = this.#database.prepare(`
+      INSERT OR REPLACE INTO tags(scan_id, tag, version_id, is_digest_tag)
+      VALUES(@scanId, @tag, @versionId, @isDigestTag)
+    `);
+        this.#insertManifestStatement = this.#database.prepare(`
+      INSERT OR REPLACE INTO manifests(
+        scan_id,
+        version_id,
+        digest,
+        media_type,
+        artifact_type,
+        config_media_type,
+        subject_digest,
+        annotations_json,
+        manifest_kind
+      )
+      VALUES(
+        @scanId,
+        @versionId,
+        @digest,
+        @mediaType,
+        @artifactType,
+        @configMediaType,
+        @subjectDigest,
+        @annotationsJson,
+        @manifestKind
+      )
+    `);
+        this.#insertManifestPayloadStatement = this.#database.prepare(`
+      INSERT OR REPLACE INTO manifest_payloads(scan_id, digest, raw_json)
+      VALUES(?, ?, ?)
+    `);
+        this.#insertManifestDescriptorStatement = this.#database.prepare(`
+      INSERT OR REPLACE INTO manifest_descriptors(
+        scan_id,
+        parent_digest,
+        child_digest,
+        media_type,
+        artifact_type,
+        platform_os,
+        platform_architecture,
+        platform_variant
+      )
+      VALUES(
+        @scanId,
+        @parentDigest,
+        @childDigest,
+        @mediaType,
+        @artifactType,
+        @platformOs,
+        @platformArchitecture,
+        @platformVariant
+      )
+    `);
+        this.#insertManifestEdgeStatement = this.#database.prepare(`
+      INSERT OR IGNORE INTO manifest_edges(scan_id, parent_digest, child_digest, edge_kind)
+      VALUES(@scanId, @parentDigest, @childDigest, @edgeKind)
+    `);
+    }
+    startScan(owner, packageName, scanStartedAt, packageMetadata) {
+        const result = this.#startScanStatement.run(randomUUID(), owner, packageName, packageMetadata.rawJson, resolveGitHubActionsRunUrl(), scanStartedAt);
+        this.#activeScanId = Number(result.lastInsertRowid);
+    }
+    markScanCompleted(scanCompletedAt) {
+        this.#markScanCompletedStatement.run(scanCompletedAt, this.#requireScanId());
+    }
+    markScanFailed(scanCompletedAt) {
+        this.#markScanFailedStatement.run(scanCompletedAt, this.#requireScanId());
+    }
+    insertPackageVersion(version) {
+        this.#insertPackageVersionStatement.run({
+            scanId: this.#requireScanId(),
+            versionId: version.versionId,
+            createdAt: version.createdAt,
+            updatedAt: version.updatedAt
+        });
+    }
+    insertPackageVersionPayload(versionId, rawJson) {
+        this.#insertPackageVersionPayloadStatement.run(this.#requireScanId(), versionId, rawJson);
+    }
+    insertTag(tag) {
+        this.#insertTagStatement.run({
+            scanId: this.#requireScanId(),
+            ...tag,
+            isDigestTag: isDigestTag(tag.tag) ? 1 : 0
+        });
+    }
+    insertManifest(manifest) {
+        this.#insertManifestStatement.run({
+            scanId: this.#requireScanId(),
+            versionId: manifest.versionId,
+            digest: manifest.digest,
+            mediaType: manifest.mediaType,
+            artifactType: manifest.artifactType ?? null,
+            configMediaType: manifest.configMediaType ?? null,
+            subjectDigest: manifest.subjectDigest ?? null,
+            annotationsJson: manifest.annotations ? JSON.stringify(manifest.annotations) : null,
+            manifestKind: manifest.manifestKind ?? null
+        });
+    }
+    insertManifestPayload(digest, rawJson) {
+        this.#insertManifestPayloadStatement.run(this.#requireScanId(), digest, rawJson);
+    }
+    insertManifestDescriptor(descriptor) {
+        this.#insertManifestDescriptorStatement.run({
+            scanId: this.#requireScanId(),
+            parentDigest: descriptor.parentDigest,
+            childDigest: descriptor.childDigest,
+            mediaType: descriptor.mediaType,
+            artifactType: descriptor.artifactType ?? null,
+            platformOs: descriptor.platform?.os ?? null,
+            platformArchitecture: descriptor.platform?.architecture ?? null,
+            platformVariant: descriptor.platform?.variant ?? null
+        });
+    }
+    insertManifestEdge(edge) {
+        this.#insertManifestEdgeStatement.run({
+            scanId: this.#requireScanId(),
+            ...edge
+        });
+    }
+    rebuildManifestReachability() {
+        rebuildManifestReachability(this.#database, this.#requireScanId());
+    }
+    getActiveScanId() {
+        return this.#requireScanId();
+    }
+    #requireScanId() {
+        if (this.#activeScanId === null) {
+            throw new Error("package not initialized; call startScan(owner, packageName, scanStartedAt, packageMetadata) first");
+        }
+        return this.#activeScanId;
+    }
+}

package/dist/db/_schema.d.ts

@@ -0,0 +1,2 @@
+import type Database from "better-sqlite3";
+export declare function initializeSchema(database: Database.Database): void;

package/dist/db/_schema.js

@@ -0,0 +1,19 @@
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+export function initializeSchema(database) {
+    _initializeSqlDirectory(database, "schema");
+    _initializeSqlDirectory(database, "views");
+}
+function _initializeSqlDirectory(database, directoryName) {
+    const sqlDirectory = join(process.cwd(), "resources", "sql", directoryName);
+    if (!existsSync(sqlDirectory)) {
+        return;
+    }
+    const sqlFiles = readdirSync(sqlDirectory)
+        .filter((file) => file.endsWith(".sql"))
+        .sort();
+    for (const sqlFile of sqlFiles) {
+        const sql = readFileSync(join(sqlDirectory, sqlFile), "utf8");
+        database.exec(sql);
+    }
+}

package/dist/db/_snapshot-repository.d.ts

@@ -0,0 +1,24 @@
+import type Database from "better-sqlite3";
+export declare class SnapshotRepository {
+    #private;
+    constructor(database: Database.Database);
+    getPackageMetadata(scanId: number): {
+        owner: string;
+        packageName: string;
+        scanCompletedAt: string;
+    };
+    countPackageVersions(scanId: number): number;
+    countTaggedVersions(scanId: number): number;
+    countTags(scanId: number): number;
+    countManifests(scanId: number): number;
+    countManifestEdges(scanId: number): number;
+    listManifestDigests(scanId: number): string[];
+    listManifestPayloads(scanId: number): Array<{
+        digest: string;
+        rawJson: string;
+    }>;
+    listPackageVersionManifestRefs(scanId: number): Array<{
+        versionId: number;
+        digest: string;
+    }>;
+}

package/dist/db/_snapshot-repository.js

@@ -0,0 +1,86 @@
+export class SnapshotRepository {
+    #database;
+    constructor(database) {
+        this.#database = database;
+    }
+    getPackageMetadata(scanId) {
+        const row = this.#database
+            .prepare(`
+          SELECT owner, package_name, scan_completed_at
+          FROM package_scans
+          WHERE scan_id = ?
+        `)
+            .get(scanId);
+        if (!row) {
+            throw new Error(`database does not contain package scan for scan_id=${scanId}`);
+        }
+        if (!row.scan_completed_at) {
+            throw new Error(`scan ${scanId} has not completed`);
+        }
+        return {
+            owner: row.owner,
+            packageName: row.package_name,
+            scanCompletedAt: row.scan_completed_at
+        };
+    }
+    countPackageVersions(scanId) {
+        return _count(this.#database, "SELECT COUNT(*) AS total FROM package_versions WHERE scan_id = ?", "total", scanId);
+    }
+    countTaggedVersions(scanId) {
+        return _count(this.#database, "SELECT COUNT(DISTINCT version_id) AS total FROM tags WHERE scan_id = ?", "total", scanId);
+    }
+    countTags(scanId) {
+        return _count(this.#database, "SELECT COUNT(*) AS total FROM tags WHERE scan_id = ?", "total", scanId);
+    }
+    countManifests(scanId) {
+        return _count(this.#database, "SELECT COUNT(*) AS total FROM manifests WHERE scan_id = ?", "total", scanId);
+    }
+    countManifestEdges(scanId) {
+        return _count(this.#database, "SELECT COUNT(*) AS total FROM manifest_edges WHERE scan_id = ?", "total", scanId);
+    }
+    listManifestDigests(scanId) {
+        const rows = this.#database
+            .prepare("SELECT digest FROM manifests WHERE scan_id = ? ORDER BY digest")
+            .all(scanId);
+        return rows.map((row) => row.digest);
+    }
+    listManifestPayloads(scanId) {
+        const rows = this.#database
+            .prepare(`
+          SELECT digest, raw_json
+          FROM manifest_payloads
+          WHERE scan_id = ?
+          ORDER BY digest
+        `)
+            .all(scanId);
+        return rows.map((row) => ({
+            digest: row.digest,
+            rawJson: row.raw_json
+        }));
+    }
+    listPackageVersionManifestRefs(scanId) {
+        const rows = this.#database
+            .prepare(`
+          SELECT version_id, raw_json
+          FROM package_version_payloads
+          WHERE scan_id = ?
+          ORDER BY version_id
+        `)
+            .all(scanId);
+        return rows.map((row) => ({
+            versionId: row.version_id,
+            digest: _parsePackageVersionDigest(row.version_id, row.raw_json)
+        }));
+    }
+}
+function _count(database, sql, field, ...params) {
+    const row = database.prepare(sql).get(...params);
+    return row[field];
+}
+function _parsePackageVersionDigest(versionId, rawJson) {
+    const payload = JSON.parse(rawJson);
+    if (typeof payload.name !== "string" || payload.name.length === 0) {
+        throw new Error(`package version payload for version_id=${versionId} did not include digest name`);
+    }
+    return payload.name;
+}

package/dist/db/_sql-placeholders.d.ts

@@ -0,0 +1,2 @@
+export declare function buildInClausePlaceholders(valueCount: number): string;
+export declare function buildTuplePlaceholders(rowCount: number, columnCount: number): string;

package/dist/db/_sql-placeholders.js

@@ -0,0 +1,16 @@
+export function buildInClausePlaceholders(valueCount) {
+    if (valueCount <= 0) {
+        throw new Error("valueCount must be greater than 0");
+    }
+    return Array.from({ length: valueCount }, () => "?").join(", ");
+}
+export function buildTuplePlaceholders(rowCount, columnCount) {
+    if (rowCount <= 0) {
+        throw new Error("rowCount must be greater than 0");
+    }
+    if (columnCount <= 0) {
+        throw new Error("columnCount must be greater than 0");
+    }
+    const tuple = `(${Array.from({ length: columnCount }, () => "?").join(", ")})`;
+    return Array.from({ length: rowCount }, () => tuple).join(", ");
+}

package/dist/db/index.d.ts

@@ -0,0 +1,10 @@
+import Database from "better-sqlite3";
+export { ScanWriter } from "./_scan-writer.js";
+export { CleanupRunWriter } from "./_cleanup-run-writer.js";
+export { DbMergeRepository } from "./_db-merge-repository.js";
+export { PlannerRepository } from "./planner/index.js";
+export { SnapshotRepository } from "./_snapshot-repository.js";
+export type { DeletePlan, DeletePlanBlockReasonCode, DeletePlanSelectionMode, DeletePlanSelectionReason, DeletePlanValidationReasonCode, DeletePlanValidationStatus } from "./planner/index.js";
+export { DeletePlanValidationReasonCodes, DeletePlanValidationStatuses } from "./planner/index.js";
+export type { DbMergeSourceSummary } from "./_db-merge-repository.js";
+export declare function openDatabase(databasePath: string): Database.Database;

package/dist/db/index.js

@@ -0,0 +1,13 @@
+import Database from "better-sqlite3";
+import { initializeSchema } from "./_schema.js";
+export { ScanWriter } from "./_scan-writer.js";
+export { CleanupRunWriter } from "./_cleanup-run-writer.js";
+export { DbMergeRepository } from "./_db-merge-repository.js";
+export { PlannerRepository } from "./planner/index.js";
+export { SnapshotRepository } from "./_snapshot-repository.js";
+export { DeletePlanValidationReasonCodes, DeletePlanValidationStatuses } from "./planner/index.js";
+export function openDatabase(databasePath) {
+    const database = new Database(databasePath);
+    initializeSchema(database);
+    return database;
+}

package/dist/db/planner/_planner-direct-target-root-options.d.ts

@@ -0,0 +1,11 @@
+export interface DirectTargetRootOptions {
+    deleteTags: string[];
+    deleteTagsRequested: boolean;
+    deleteOrphanedImages?: boolean;
+    excludeTags: string[];
+    deleteUntagged: boolean;
+    keepNTagged?: number;
+    keepNUntagged?: number;
+    useRegex?: boolean;
+    cutoffTimestamp?: string;
+}

package/dist/db/planner/_planner-direct-target-root-options.js

@@ -0,0 +1 @@
+export {};

package/dist/db/planner/_planner-direct-target-root-tag-filters.d.ts

@@ -0,0 +1,7 @@
+import type { DirectTargetRootOptions } from "./_planner-direct-target-root-options.js";
+import type { PlannerSql } from "./_planner-sql.js";
+export interface DirectTargetRootTagFilters {
+    selectedTagsSql: string;
+    selectedParams: Array<number | string>;
+}
+export declare function buildDirectTargetRootTagFilters(sql: PlannerSql, scanId: number, options: DirectTargetRootOptions): DirectTargetRootTagFilters;

package/dist/db/planner/_planner-direct-target-root-tag-filters.js

@@ -0,0 +1,41 @@
+import { buildTagSelectorPredicate } from "./_planner-tag-selectors.js";
+export function buildDirectTargetRootTagFilters(sql, scanId, options) {
+    const selectedTagPredicate = options.deleteTags.length > 0
+        ? buildTagSelectorPredicate(sql.database, "t.tag", options.deleteTags, options.useRegex ?? false)
+        : undefined;
+    const excludedTagPredicate = options.excludeTags.length > 0
+        ? buildTagSelectorPredicate(sql.database, "xt.tag", options.excludeTags, options.useRegex ?? false)
+        : undefined;
+    const selectedTagDigestFlag = options.deleteOrphanedImages ? 1 : 0;
+    const selectedTagsSql = selectedTagPredicate
+        ? `
+        SELECT DISTINCT t.version_id, t.tag
+        FROM tags t
+        WHERE t.scan_id = ?
+          AND t.is_digest_tag = ?
+          AND (${selectedTagPredicate.sql})
+          ${excludedTagPredicate
+            ? `
+          AND NOT EXISTS (
+            SELECT 1
+            FROM tags xt
+            WHERE xt.scan_id = t.scan_id
+              AND xt.version_id = t.version_id
+              AND xt.tag = t.tag
+              AND (${excludedTagPredicate.sql})
+          )
+        `
+            : ""}
+      `
+        : `
+        SELECT NULL AS version_id, NULL AS tag
+        WHERE 1 = 0
+      `;
+    const selectedParams = selectedTagPredicate
+        ? [scanId, selectedTagDigestFlag, ...selectedTagPredicate.params, ...(excludedTagPredicate?.params ?? [])]
+        : [];
+    return {
+        selectedTagsSql,
+        selectedParams
+    };
+}

package/dist/db/planner/_planner-direct-target-roots-combined-sql.d.ts

@@ -0,0 +1,7 @@
+import type { DirectTargetRootOptions } from "./_planner-direct-target-root-options.js";
+export interface CombinedDirectTargetRootsQuery {
+    query: string;
+    baseParams: Array<number | string>;
+    tailParams: Array<number | string>;
+}
+export declare function buildCombinedDirectTargetRootsQuery(scanId: number, options: DirectTargetRootOptions, selectedTagsSql: string): CombinedDirectTargetRootsQuery;