ghcr-cleanup-manager 1.1.0

package/dist/db/planner/_planner-direct-target-roots-combined-sql.js

@@ -0,0 +1,189 @@
+export function buildCombinedDirectTargetRootsQuery(scanId, options, selectedTagsSql) {
+    const baseParams = [scanId];
+    const cutoffSql = options.cutoffTimestamp ? "AND created_at < ?" : "";
+    if (options.cutoffTimestamp) {
+        baseParams.push(options.cutoffTimestamp);
+    }
+    baseParams.push(scanId, scanId);
+    const taggedBranchEnabled = options.deleteTagsRequested || options.keepNTagged !== undefined ? 1 : 0;
+    const deleteTagsRequested = options.deleteTagsRequested ? 1 : 0;
+    const deleteOrphanedImages = options.deleteOrphanedImages ? 1 : 0;
+    const keepNTaggedActive = options.keepNTagged !== undefined ? 1 : 0;
+    const deleteUntagged = options.deleteUntagged ? 1 : 0;
+    const keepNUntaggedActive = options.keepNUntagged !== undefined ? 1 : 0;
+    const tailParams = [
+        deleteOrphanedImages,
+        deleteOrphanedImages,
+        taggedBranchEnabled,
+        deleteTagsRequested,
+        deleteTagsRequested,
+        keepNTaggedActive,
+        deleteTagsRequested,
+        keepNTaggedActive,
+        options.keepNTagged ?? 0,
+        deleteUntagged,
+        keepNUntaggedActive,
+        deleteUntagged,
+        deleteUntagged,
+        keepNUntaggedActive,
+        options.keepNUntagged ?? 0
+    ];
+    const query = `
+    WITH base_manifests AS (
+      SELECT
+        m.version_id,
+        m.digest AS root_digest,
+        m.manifest_kind AS root_manifest_kind,
+        pv.created_at
+      FROM manifests m
+      JOIN package_versions pv
+        ON pv.scan_id = m.scan_id
+       AND pv.version_id = m.version_id
+      WHERE m.scan_id = ?
+        ${cutoffSql}
+    ),
+    root_candidates AS (
+      SELECT
+        bm.version_id,
+        bm.root_digest,
+        bm.root_manifest_kind,
+        bm.created_at,
+        (
+          SELECT COUNT(*)
+          FROM tags t
+          WHERE t.scan_id = ?
+            AND t.version_id = bm.version_id
+            AND t.is_digest_tag = 0
+        ) AS tag_count,
+        CASE
+          WHEN EXISTS (
+            SELECT 1
+            FROM manifest_edges me
+            WHERE me.scan_id = ?
+              AND me.child_digest = bm.root_digest
+              AND me.edge_kind != 'digest-tag-referrer'
+          )
+            THEN 1
+          ELSE 0
+        END AS has_ancestor
+      FROM base_manifests bm
+    ),
+    selected_tags AS (
+      ${selectedTagsSql}
+    ),
+    matched_tag_counts AS (
+      SELECT
+        st.version_id,
+        COUNT(DISTINCT st.tag) AS matched_tag_count
+      FROM selected_tags st
+      GROUP BY st.version_id
+    ),
+    eligible_tagged_roots AS (
+      SELECT
+        rc.version_id,
+        rc.root_digest,
+        rc.root_manifest_kind,
+        rc.created_at,
+        CASE
+          WHEN ? = 1 AND rc.tag_count = 0 AND COALESCE(mtc.matched_tag_count, 0) > 0
+            THEN COALESCE(mtc.matched_tag_count, 0)
+          ELSE rc.tag_count
+        END AS total_tag_count,
+        COALESCE(mtc.matched_tag_count, 0) AS matched_tag_count
+      FROM root_candidates rc
+      LEFT JOIN matched_tag_counts mtc
+        ON mtc.version_id = rc.version_id
+      WHERE (
+          rc.tag_count > 0
+          OR (? = 1 AND COALESCE(mtc.matched_tag_count, 0) > 0)
+        )
+        AND ? = 1
+    ),
+    ranked_tagged_roots AS (
+      SELECT
+        version_id,
+        root_digest,
+        root_manifest_kind,
+        total_tag_count,
+        matched_tag_count,
+        ROW_NUMBER() OVER (
+          ORDER BY created_at DESC, version_id DESC, root_digest DESC
+        ) AS recency_rank
+      FROM eligible_tagged_roots
+      WHERE ? = 0
+         OR matched_tag_count > 0
+    ),
+    final_tagged_targets AS (
+      SELECT
+        version_id,
+        root_digest,
+        root_manifest_kind,
+        CASE
+          WHEN ? = 0
+            THEN 'keep-n-tagged-overflow'
+          WHEN ? = 1 AND total_tag_count = matched_tag_count
+            THEN 'keep-n-tagged-overflow'
+          WHEN total_tag_count = matched_tag_count
+            THEN 'delete-tags-all-tags-selected'
+          ELSE 'delete-tags-partial-tag-match'
+        END AS direct_target_reason,
+        CASE
+          WHEN ? = 0
+            THEN 'delete-root'
+          WHEN total_tag_count = matched_tag_count
+            THEN 'delete-root'
+          ELSE 'untag-only'
+        END AS selection_mode
+      FROM ranked_tagged_roots
+      WHERE ? = 0
+         OR recency_rank > ?
+    ),
+    ranked_untagged_roots AS (
+      SELECT
+        rc.version_id,
+        rc.root_digest,
+        rc.root_manifest_kind,
+        ROW_NUMBER() OVER (
+          ORDER BY rc.created_at DESC, rc.version_id DESC, rc.root_digest DESC
+        ) AS recency_rank
+      FROM root_candidates rc
+      WHERE rc.tag_count = 0
+        AND rc.has_ancestor = 0
+        AND (? = 1 OR ? = 1)
+    ),
+    final_untagged_targets AS (
+      SELECT
+        version_id,
+        root_digest,
+        root_manifest_kind,
+        CASE
+          WHEN ? = 1
+            THEN 'delete-untagged'
+          ELSE 'keep-n-untagged-overflow'
+        END AS direct_target_reason,
+        'delete-root' AS selection_mode
+      FROM ranked_untagged_roots
+      WHERE ? = 1
+         OR (? = 1 AND recency_rank > ?)
+    )
+    SELECT
+      version_id,
+      root_digest,
+      root_manifest_kind,
+      direct_target_reason,
+      selection_mode
+    FROM final_tagged_targets
+
+    UNION ALL
+
+    SELECT
+      version_id,
+      root_digest,
+      root_manifest_kind,
+      direct_target_reason,
+      selection_mode
+    FROM final_untagged_targets
+    ORDER BY root_digest
+  `;
+    return { query, baseParams, tailParams };
+}

package/dist/db/planner/_planner-direct-target-roots-combined.d.ts

@@ -0,0 +1,4 @@
+import type { DirectTargetRootOptions } from "./_planner-direct-target-root-options.js";
+import type { PlannerSql } from "./_planner-sql.js";
+import { type DeletePlanRoot } from "./_planner-types.js";
+export declare function listCombinedDirectTargetRoots(sql: PlannerSql, scanId: number, options: DirectTargetRootOptions): DeletePlanRoot[];

package/dist/db/planner/_planner-direct-target-roots-combined.js

@@ -0,0 +1,10 @@
+import { buildDirectTargetRootTagFilters } from "./_planner-direct-target-root-tag-filters.js";
+import { buildCombinedDirectTargetRootsQuery } from "./_planner-direct-target-roots-combined-sql.js";
+import { mapPlanRootRow } from "./_planner-types.js";
+export function listCombinedDirectTargetRoots(sql, scanId, options) {
+    const { selectedTagsSql, selectedParams } = buildDirectTargetRootTagFilters(sql, scanId, options);
+    const { query, baseParams, tailParams } = buildCombinedDirectTargetRootsQuery(scanId, options, selectedTagsSql);
+    return sql
+        .all(query, [...baseParams, ...selectedParams, ...tailParams])
+        .map(mapPlanRootRow);
+}

package/dist/db/planner/_planner-direct-target-roots-tagged.d.ts

@@ -0,0 +1,4 @@
+import { PlannerSql } from "./_planner-sql.js";
+import { type DeletePlanRoot } from "./_planner-types.js";
+import type { DirectTargetRootOptions } from "./_planner-direct-target-root-options.js";
+export declare function listTaggedOnlyDirectTargetRoots(sql: PlannerSql, scanId: number, options: DirectTargetRootOptions): DeletePlanRoot[];

package/dist/db/planner/_planner-direct-target-roots-tagged.js

@@ -0,0 +1,117 @@
+import { buildTagSelectorPredicate } from "./_planner-tag-selectors.js";
+import { mapPlanRootRow } from "./_planner-types.js";
+export function listTaggedOnlyDirectTargetRoots(sql, scanId, options) {
+    const selectedTagPredicate = options.deleteTags.length > 0
+        ? buildTagSelectorPredicate(sql.database, "t.tag", options.deleteTags, options.useRegex ?? false)
+        : undefined;
+    const excludedTagPredicate = options.excludeTags.length > 0
+        ? buildTagSelectorPredicate(sql.database, "xt.tag", options.excludeTags, options.useRegex ?? false)
+        : undefined;
+    const params = [];
+    const cutoffSql = options.cutoffTimestamp ? "AND pv.created_at < ?" : "";
+    const selectedTagDigestFlag = options.deleteOrphanedImages ? 1 : 0;
+    const selectedTagsSql = selectedTagPredicate
+        ? `
+        SELECT DISTINCT t.version_id, t.tag
+        FROM tags t
+        WHERE t.scan_id = ?
+          AND t.is_digest_tag = ?
+          AND (${selectedTagPredicate.sql})
+          ${excludedTagPredicate
+            ? `
+          AND NOT EXISTS (
+            SELECT 1
+            FROM tags xt
+            WHERE xt.scan_id = t.scan_id
+              AND xt.version_id = t.version_id
+              AND xt.tag = t.tag
+              AND (${excludedTagPredicate.sql})
+          )
+        `
+            : ""}
+      `
+        : `
+        SELECT NULL AS version_id, NULL AS tag
+        WHERE 1 = 0
+      `;
+    if (selectedTagPredicate) {
+        params.push(scanId, selectedTagDigestFlag, ...selectedTagPredicate.params, ...(excludedTagPredicate?.params ?? []));
+    }
+    params.push(scanId);
+    if (options.cutoffTimestamp) {
+        params.push(options.cutoffTimestamp);
+    }
+    const deleteOrphanedImages = options.deleteOrphanedImages ? 1 : 0;
+    const query = `
+    WITH selected_tags AS (
+      ${selectedTagsSql}
+    ),
+    matched_tag_counts AS (
+      SELECT
+        st.version_id,
+        COUNT(DISTINCT st.tag) AS matched_tag_count
+      FROM selected_tags st
+      GROUP BY st.version_id
+    ),
+    tagged_versions AS (
+      SELECT
+        m.version_id,
+        m.digest AS root_digest,
+        m.manifest_kind AS root_manifest_kind,
+        COUNT(t.tag) AS total_tag_count
+      FROM manifests m
+      JOIN package_versions pv
+        ON pv.scan_id = m.scan_id
+       AND pv.version_id = m.version_id
+      LEFT JOIN tags t
+        ON t.scan_id = m.scan_id
+       AND t.version_id = m.version_id
+       AND t.is_digest_tag = 0
+      WHERE m.scan_id = ?
+        ${cutoffSql}
+      GROUP BY
+        m.version_id,
+        m.digest,
+        m.manifest_kind
+    ),
+    eligible_tagged_roots AS (
+      SELECT
+        tv.version_id,
+        tv.root_digest,
+        tv.root_manifest_kind,
+        CASE
+          WHEN ? = 1 AND tv.total_tag_count = 0 AND COALESCE(mtc.matched_tag_count, 0) > 0
+            THEN COALESCE(mtc.matched_tag_count, 0)
+          ELSE tv.total_tag_count
+        END AS total_tag_count,
+        COALESCE(mtc.matched_tag_count, 0) AS matched_tag_count
+      FROM tagged_versions tv
+      LEFT JOIN matched_tag_counts mtc
+        ON mtc.version_id = tv.version_id
+      WHERE (
+          tv.total_tag_count > 0
+          OR (? = 1 AND COALESCE(mtc.matched_tag_count, 0) > 0)
+        )
+        AND matched_tag_count > 0
+    )
+    SELECT
+      version_id,
+      root_digest,
+      root_manifest_kind,
+      CASE
+        WHEN total_tag_count = matched_tag_count
+          THEN 'delete-tags-all-tags-selected'
+        ELSE 'delete-tags-partial-tag-match'
+      END AS direct_target_reason,
+      CASE
+        WHEN total_tag_count = matched_tag_count
+          THEN 'delete-root'
+        ELSE 'untag-only'
+      END AS selection_mode
+    FROM eligible_tagged_roots
+    ORDER BY root_digest
+  `;
+    return sql
+        .all(query, [...params, deleteOrphanedImages, deleteOrphanedImages])
+        .map(mapPlanRootRow);
+}

package/dist/db/planner/_planner-direct-target-roots.d.ts

@@ -0,0 +1,8 @@
+import { PlannerSql } from "./_planner-sql.js";
+import type { DeletePlanRoot } from "./_planner-types.js";
+import type { DirectTargetRootOptions } from "./_planner-direct-target-root-options.js";
+export declare class PlannerDirectTargetRoots {
+    #private;
+    constructor(sql: PlannerSql);
+    list(scanId: number, options: DirectTargetRootOptions): DeletePlanRoot[];
+}

package/dist/db/planner/_planner-direct-target-roots.js

@@ -0,0 +1,17 @@
+import { listCombinedDirectTargetRoots } from "./_planner-direct-target-roots-combined.js";
+import { listTaggedOnlyDirectTargetRoots } from "./_planner-direct-target-roots-tagged.js";
+export class PlannerDirectTargetRoots {
+    #sql;
+    constructor(sql) {
+        this.#sql = sql;
+    }
+    list(scanId, options) {
+        if (options.deleteTagsRequested &&
+            options.keepNTagged === undefined &&
+            !options.deleteUntagged &&
+            options.keepNUntagged === undefined) {
+            return listTaggedOnlyDirectTargetRoots(this.#sql, scanId, options);
+        }
+        return listCombinedDirectTargetRoots(this.#sql, scanId, options);
+    }
+}

package/dist/db/planner/_planner-direct-target-tags.d.ts

@@ -0,0 +1,6 @@
+import { PlannerSql } from "./_planner-sql.js";
+export declare class PlannerDirectTargetTags {
+    #private;
+    constructor(sql: PlannerSql);
+    listDeleteTagDirectTargetTags(scanId: number, deleteTags: string[], excludeTags: string[], useRegex: boolean, deleteOrphanedImages: boolean, cutoffTimestamp?: string): string[];
+}

package/dist/db/planner/_planner-direct-target-tags.js

@@ -0,0 +1,54 @@
+import { buildTagSelectorPredicate } from "./_planner-tag-selectors.js";
+import { mapPlanTagRows } from "./_planner-types.js";
+export class PlannerDirectTargetTags {
+    #sql;
+    constructor(sql) {
+        this.#sql = sql;
+    }
+    listDeleteTagDirectTargetTags(scanId, deleteTags, excludeTags, useRegex, deleteOrphanedImages, cutoffTimestamp) {
+        if (deleteTags.length === 0) {
+            return [];
+        }
+        const selectedTagPredicate = buildTagSelectorPredicate(this.#sql.database, "t.tag", deleteTags, useRegex);
+        const params = [scanId, ...selectedTagPredicate.params];
+        let excludedTagSql = "";
+        let olderThanSql = "";
+        if (excludeTags.length > 0) {
+            const excludedTagPredicate = buildTagSelectorPredicate(this.#sql.database, "xt.tag", excludeTags, useRegex);
+            excludedTagSql = `
+        AND NOT EXISTS (
+          SELECT 1
+          FROM tags xt
+          WHERE xt.scan_id = t.scan_id
+            AND xt.version_id = t.version_id
+            AND xt.tag = t.tag
+            AND (${excludedTagPredicate.sql})
+        )
+      `;
+            params.push(...excludedTagPredicate.params);
+        }
+        if (cutoffTimestamp) {
+            olderThanSql = "AND pv.created_at < ?";
+            params.push(cutoffTimestamp);
+        }
+        const digestTagFlag = deleteOrphanedImages ? 1 : 0;
+        params.splice(1, 0, digestTagFlag);
+        const sql = `
+      SELECT DISTINCT tag AS target_tag
+      FROM tags t
+      JOIN package_versions pv
+        ON pv.scan_id = t.scan_id
+       AND pv.version_id = t.version_id
+      JOIN manifests m
+        ON m.scan_id = pv.scan_id
+       AND m.version_id = pv.version_id
+      WHERE t.scan_id = ?
+        AND t.is_digest_tag = ?
+        AND (${selectedTagPredicate.sql})
+        ${excludedTagSql}
+        ${olderThanSql}
+      ORDER BY tag
+    `;
+        return mapPlanTagRows(this.#sql.all(sql, params));
+    }
+}

package/dist/db/planner/_planner-latest-scan.d.ts

@@ -0,0 +1,10 @@
+import type { ScanRow } from "./_planner-types.js";
+interface LatestScanSql {
+    get<T>(sql: string, params: Array<number | string>): T | undefined;
+}
+export declare class PlannerLatestScan {
+    #private;
+    constructor(sql: LatestScanSql);
+    get(owner: string, packageName: string): ScanRow;
+}
+export {};

package/dist/db/planner/_planner-latest-scan.js

@@ -0,0 +1,20 @@
+export class PlannerLatestScan {
+    #sql;
+    constructor(sql) {
+        this.#sql = sql;
+    }
+    get(owner, packageName) {
+        const sql = `
+      SELECT scan_id, owner, package_name, scan_completed_at
+      FROM v_latest_scan_per_package
+      WHERE owner = ?
+        AND package_name = ?
+      LIMIT 1
+    `;
+        const row = this.#sql.get(sql, [owner, packageName]);
+        if (!row) {
+            throw new Error(`database does not contain completed package scan for ${owner}/${packageName}`);
+        }
+        return row;
+    }
+}

package/dist/db/planner/_planner-output.d.ts

@@ -0,0 +1,5 @@
+import type { DeletePlan, DeletePlanBlockedRoot, DeletePlanProtectedRoot, DeletePlanRoot, DeletePlanRootDecision, PlanArtifacts } from "./_planner-types.js";
+export declare function buildPlanOutputs(directTargetTags: string[], directTargetRoots: DeletePlanRoot[], planArtifacts: PlanArtifacts): Pick<DeletePlan, "directTargetTags" | "directTargetRoots" | "rootDecisions" | "protectedRoots" | "closureManifests" | "blockedRoots" | "fullyDeletableRoots" | "collateralTags">;
+export declare function buildRootDecisions(directTargetRoots: DeletePlanRoot[], planArtifacts: PlanArtifacts): DeletePlanRootDecision[];
+export declare function buildProtectedRoots(blockedRoots: DeletePlanBlockedRoot[]): DeletePlanProtectedRoot[];
+export declare function buildBlockedValidationReason(blockedRoot?: DeletePlanBlockedRoot): string;

package/dist/db/planner/_planner-output.js

@@ -0,0 +1,111 @@
+import { DeletePlanValidationReasonCodes, DeletePlanValidationStatuses } from "./_planner-types.js";
+export function buildPlanOutputs(directTargetTags, directTargetRoots, planArtifacts) {
+    const rootDecisions = buildRootDecisions(directTargetRoots, planArtifacts);
+    const fullyDeletableDigests = new Set(rootDecisions
+        .filter((decision) => decision.validationStatus === DeletePlanValidationStatuses.fullyDeletable)
+        .map((decision) => decision.digest));
+    const blockedDigests = new Set(rootDecisions
+        .filter((decision) => decision.validationStatus === DeletePlanValidationStatuses.blocked)
+        .map((decision) => decision.digest));
+    const blockedRoots = planArtifacts.blockedRoots.filter((blockedRoot) => blockedDigests.has(blockedRoot.blockedDigest));
+    const protectedRoots = buildProtectedRoots(blockedRoots);
+    return {
+        directTargetTags,
+        directTargetRoots,
+        rootDecisions,
+        protectedRoots,
+        closureManifests: planArtifacts.closureManifests,
+        blockedRoots,
+        fullyDeletableRoots: planArtifacts.fullyDeletableRoots.filter((root) => fullyDeletableDigests.has(root.digest)),
+        collateralTags: []
+    };
+}
+export function buildRootDecisions(directTargetRoots, planArtifacts) {
+    const fullyDeletableDigests = new Set(planArtifacts.fullyDeletableRoots.map((root) => root.digest));
+    const supportedUntagOnlyRootDigests = planArtifacts.supportedUntagOnlyRootDigests;
+    const blockedRootByDigest = new Map();
+    for (const blockedRoot of planArtifacts.blockedRoots) {
+        if (!blockedRootByDigest.has(blockedRoot.blockedDigest)) {
+            blockedRootByDigest.set(blockedRoot.blockedDigest, blockedRoot);
+        }
+    }
+    return directTargetRoots.map((root) => {
+        const blockedRoot = blockedRootByDigest.get(root.digest);
+        if (_isUntagOnly(root, blockedRoot, supportedUntagOnlyRootDigests)) {
+            return {
+                versionId: root.versionId,
+                digest: root.digest,
+                manifestKind: root.manifestKind,
+                selectionMode: "untag-only",
+                selectionReason: root.reason,
+                validationStatus: DeletePlanValidationStatuses.untagOnly,
+                validationReasonCode: root.selectionMode === "untag-only"
+                    ? DeletePlanValidationReasonCodes.untagOnlyPartialTagMatch
+                    : DeletePlanValidationReasonCodes.untagOnlyRetainedManifest,
+                validationReason: root.selectionMode === "untag-only"
+                    ? "matched tags cover only part of this root's tag set, so the version is retained and only those tags can be detached"
+                    : "selected tags can be detached, but the manifest itself must remain because surviving tags still need it"
+            };
+        }
+        if (fullyDeletableDigests.has(root.digest)) {
+            return {
+                versionId: root.versionId,
+                digest: root.digest,
+                manifestKind: root.manifestKind,
+                selectionMode: root.selectionMode,
+                selectionReason: root.reason,
+                validationStatus: DeletePlanValidationStatuses.fullyDeletable,
+                validationReasonCode: DeletePlanValidationReasonCodes.fullyDeletableNoRetainedOverlap,
+                validationReason: "selected tags cover the whole root and its manifest closure does not overlap any retained root"
+            };
+        }
+        return {
+            versionId: root.versionId,
+            digest: root.digest,
+            manifestKind: root.manifestKind,
+            selectionMode: root.selectionMode,
+            selectionReason: root.reason,
+            validationStatus: DeletePlanValidationStatuses.blocked,
+            validationReasonCode: DeletePlanValidationReasonCodes.blockedOverlapWithRetainedRoot,
+            validationReason: buildBlockedValidationReason(blockedRoot),
+            blockingVersionId: blockedRoot?.blockingVersionId,
+            blockingDigest: blockedRoot?.blockingDigest,
+            overlapDigest: blockedRoot?.overlapDigest,
+            overlapManifestKind: blockedRoot?.overlapManifestKind
+        };
+    });
+}
+export function buildProtectedRoots(blockedRoots) {
+    const protectedRoots = new Map();
+    for (const blockedRoot of blockedRoots) {
+        const key = `${blockedRoot.blockingVersionId}:${blockedRoot.blockingDigest}`;
+        const current = protectedRoots.get(key) ?? {
+            versionId: blockedRoot.blockingVersionId,
+            digest: blockedRoot.blockingDigest,
+            blocks: []
+        };
+        current.blocks.push({
+            blockedVersionId: blockedRoot.blockedVersionId,
+            blockedDigest: blockedRoot.blockedDigest,
+            blockReasonCode: blockedRoot.reason,
+            overlapDigest: blockedRoot.overlapDigest,
+            overlapManifestKind: blockedRoot.overlapManifestKind
+        });
+        protectedRoots.set(key, current);
+    }
+    return [...protectedRoots.values()].sort((left, right) => left.digest.localeCompare(right.digest));
+}
+export function buildBlockedValidationReason(blockedRoot) {
+    if (!blockedRoot) {
+        return "root closure overlaps manifest members still required by a retained root";
+    }
+    return `blocked because retained root ${blockedRoot.blockingDigest} still requires shared manifest ${blockedRoot.overlapDigest}`;
+}
+function _isUntagOnly(root, blockedRoot, supportedUntagOnlyRootDigests) {
+    if (root.selectionMode === "untag-only") {
+        return true;
+    }
+    return (root.reason === "delete-tags-all-tags-selected" &&
+        ((blockedRoot !== undefined && blockedRoot.overlapDigest === root.digest) ||
+            supportedUntagOnlyRootDigests.has(root.digest)));
+}

package/dist/db/planner/_planner-plan-artifacts-blocked-roots-sql.d.ts

@@ -0,0 +1 @@
+export declare const _LIST_BLOCKED_ROOTS_SQL = "\n  WITH selected_root_graphs AS (\n    SELECT\n      dtr.root_version_id,\n      dtr.root_digest,\n      dtr.root_manifest_kind,\n      manifest_graphs.graph_id\n    FROM temp_direct_target_roots dtr\n    CROSS JOIN manifest_graphs\n    WHERE manifest_graphs.scan_id = ?\n      AND manifest_graphs.digest = dtr.root_digest\n  ),\n  selected_graphs AS (\n    SELECT DISTINCT\n      selected_root_graphs.graph_id\n    FROM selected_root_graphs\n  ),\n  retained_tagged_manifests AS (\n    SELECT DISTINCT\n      manifest_graphs.graph_id,\n      m.version_id AS tagged_version_id,\n      m.digest AS tagged_digest\n    FROM selected_graphs\n    CROSS JOIN manifest_graphs\n    CROSS JOIN manifests m\n    JOIN tags t\n      ON t.scan_id = m.scan_id\n     AND t.version_id = m.version_id\n     AND t.is_digest_tag = 0\n    WHERE manifest_graphs.scan_id = m.scan_id\n      AND selected_graphs.graph_id = manifest_graphs.graph_id\n      AND manifest_graphs.digest = m.digest\n      AND m.scan_id = ?\n      AND NOT EXISTS (\n        SELECT 1\n        FROM temp_direct_target_roots dtr\n        WHERE dtr.root_digest = m.digest\n      )\n  ),\n  protected_manifests AS (\n    SELECT\n      retained.graph_id,\n      retained.tagged_version_id AS blocking_version_id,\n      retained.tagged_digest AS blocking_digest,\n      retained.tagged_digest AS digest,\n      0 AS min_distance\n    FROM retained_tagged_manifests retained\n\n    UNION\n\n    SELECT\n      retained.graph_id,\n      retained.tagged_version_id AS blocking_version_id,\n      retained.tagged_digest AS blocking_digest,\n      retained_overlap.descendant_digest AS digest,\n      retained_overlap.min_distance\n    FROM retained_tagged_manifests retained\n    JOIN manifest_reachability retained_overlap\n      ON retained_overlap.scan_id = ?\n     AND retained_overlap.ancestor_digest = retained.tagged_digest\n     AND retained_overlap.min_distance > 0\n  ),\n  ranked_blocks AS (\n    SELECT\n      root_graph.root_version_id AS blocked_version_id,\n      root_graph.root_digest AS blocked_digest,\n      retained.tagged_version_id AS blocking_version_id,\n      retained.tagged_digest AS blocking_digest,\n      COALESCE(retained_overlap.descendant_digest, helper_overlap.digest) AS overlap_digest,\n      root_graph.root_manifest_kind AS overlap_manifest_kind,\n      'overlap-with-retained-root' AS block_reason,\n      ROW_NUMBER() OVER (\n        PARTITION BY root_graph.root_digest, retained.tagged_digest\n        ORDER BY\n          COALESCE(retained_overlap.min_distance, helper_overlap.min_distance),\n          COALESCE(retained_overlap.descendant_digest, helper_overlap.digest),\n          root_graph.root_digest\n      ) AS rn\n    FROM selected_root_graphs root_graph\n    JOIN retained_tagged_manifests retained\n      ON retained.graph_id = root_graph.graph_id\n     AND retained.tagged_digest <> root_graph.root_digest\n    LEFT JOIN manifest_reachability retained_overlap\n      ON retained_overlap.scan_id = ?\n     AND retained_overlap.ancestor_digest = retained.tagged_digest\n     AND retained_overlap.descendant_digest = root_graph.root_digest\n     AND retained_overlap.min_distance > 0\n    LEFT JOIN manifest_edges helper_edge INDEXED BY idx_manifest_edges_scan_parent\n      ON helper_edge.scan_id = ?\n     AND helper_edge.parent_digest = root_graph.root_digest\n     AND helper_edge.edge_kind = 'digest-tag-referrer'\n    LEFT JOIN protected_manifests helper_overlap\n      ON helper_overlap.graph_id = root_graph.graph_id\n     AND helper_overlap.blocking_digest = retained.tagged_digest\n     AND helper_overlap.digest = helper_edge.child_digest\n    WHERE retained_overlap.descendant_digest IS NOT NULL\n       OR helper_overlap.digest IS NOT NULL\n  )\n  SELECT\n    blocked_version_id,\n    blocked_digest,\n    blocking_version_id,\n    blocking_digest,\n    overlap_digest,\n    overlap_manifest_kind,\n    block_reason\n  FROM ranked_blocks\n  WHERE rn = 1\n  ORDER BY blocked_digest, blocking_digest, overlap_digest\n";