mergen-server 1.4.0

package/dist/storage/pg/pg-override-corpus.js

@@ -0,0 +1,447 @@
+import { randomUUID, createHash } from "crypto";
+import { getSql } from "./pg-client.js";
+import { dominantCommandSignatures, overridePackKey } from "../../intelligence/override-corpus.js";
+const DEFAULT_TENANT = "local";
+const DAY_NAMES = ["Sunday", "Monday", "Tuesday", "Wednesday", "Thursday", "Friday", "Saturday"];
+function rowToOverrideEvent(row) {
+  return {
+    id: String(row.id ?? ""),
+    incidentTag: String(row.incident_tag ?? ""),
+    proposedCommand: String(row.proposed_command ?? ""),
+    overrideReason: row.override_reason ?? "other",
+    note: row.note ? String(row.note) : void 0,
+    service: String(row.service ?? ""),
+    environment: String(row.environment ?? "production"),
+    dayOfWeek: Number(row.day_of_week ?? 0),
+    hourOfDay: Number(row.hour_of_day ?? 0),
+    manualAction: row.manual_action ? String(row.manual_action) : void 0,
+    outcome: row.outcome ? row.outcome : void 0,
+    rationale: row.rationale ? String(row.rationale) : void 0,
+    source: row.source === "community" || row.source === "team" ? row.source : void 0,
+    recordedAt: row.recorded_at instanceof Date ? row.recorded_at.getTime() : new Date(String(row.recorded_at ?? 0)).getTime(),
+    reviewedAt: row.reviewed_at == null ? void 0 : row.reviewed_at instanceof Date ? row.reviewed_at.getTime() : new Date(String(row.reviewed_at)).getTime(),
+    // NULL = permanent, mapped to 0 (the file store's explicit "permanent" marker).
+    expiresAt: row.expires_at == null ? 0 : row.expires_at instanceof Date ? row.expires_at.getTime() : new Date(String(row.expires_at)).getTime(),
+    actor: String(row.actor ?? "")
+  };
+}
+class PgOverrideCorpus {
+  async recordOverride(input, tenantId) {
+    const sql = getSql();
+    const tid = tenantId ?? DEFAULT_TENANT;
+    const now = /* @__PURE__ */ new Date();
+    const id = randomUUID();
+    const lastRows = await sql`
+      SELECT hash FROM override_corpus
+      WHERE tenant_id = ${tid}
+      ORDER BY recorded_at DESC, id DESC
+      LIMIT 1
+    `;
+    const prevHash = lastRows.length > 0 && lastRows[0].hash ? String(lastRows[0].hash) : "genesis_override";
+    const payload = [
+      id,
+      input.incidentTag,
+      input.proposedCommand.slice(0, 500),
+      input.overrideReason,
+      input.service,
+      input.actor
+    ].join("|");
+    const hash = createHash("sha256").update(payload + prevHash).digest("hex");
+    const expiresAt = input.expiresAt === 0 ? null : new Date(input.expiresAt ?? now.getTime() + 90 * 24 * 60 * 60 * 1e3);
+    const rows = await sql`
+      INSERT INTO override_corpus (
+        id, tenant_id, incident_tag, proposed_command, override_reason,
+        note, rationale, service, environment, day_of_week, hour_of_day,
+        manual_action, actor, source, recorded_at, expires_at, hash, prev_hash
+      ) VALUES (
+        ${id}, ${tid},
+        ${input.incidentTag},
+        ${input.proposedCommand.slice(0, 500)},
+        ${input.overrideReason},
+        ${input.note?.slice(0, 200) ?? null},
+        ${input.rationale?.slice(0, 300) ?? null},
+        ${input.service},
+        ${input.environment ?? "production"},
+        ${now.getUTCDay()},
+        ${now.getUTCHours()},
+        ${input.manualAction?.slice(0, 500) ?? null},
+        ${input.actor},
+        ${input.source ?? null},
+        ${now},
+        ${expiresAt},
+        ${hash},
+        ${prevHash}
+      )
+      RETURNING *
+    `;
+    return rowToOverrideEvent(rows[0]);
+  }
+  async updateOutcome(id, outcome, tenantId) {
+    const sql = getSql();
+    const tid = tenantId ?? DEFAULT_TENANT;
+    const rows = await sql`
+      UPDATE override_corpus
+      SET outcome = ${outcome}
+      WHERE tenant_id = ${tid} AND id = ${id}
+      RETURNING 1
+    `;
+    return rows.length > 0;
+  }
+  async hasRecentOverride(incidentTag, service, dayOfWeek, hourOfDay, tenantId) {
+    const sql = getSql();
+    const tid = tenantId ?? DEFAULT_TENANT;
+    const rows = await sql`
+      SELECT 1 FROM override_corpus
+      WHERE tenant_id     = ${tid}
+        AND incident_tag  = ${incidentTag}
+        AND service       = ${service}
+        AND day_of_week   = ${dayOfWeek}
+        AND recorded_at   > NOW() - INTERVAL '90 days'
+        AND ABS(hour_of_day - ${hourOfDay}) <= 1
+      LIMIT 1
+    `;
+    return rows.length > 0;
+  }
+  async dominantOverrideReason(incidentTag, service, tenantId) {
+    const sql = getSql();
+    const tid = tenantId ?? DEFAULT_TENANT;
+    const rows = await sql`
+      SELECT override_reason, COUNT(*) AS cnt
+      FROM override_corpus
+      WHERE tenant_id = ${tid} AND incident_tag = ${incidentTag} AND service = ${service}
+      GROUP BY override_reason
+      ORDER BY cnt DESC
+      LIMIT 1
+    `;
+    if (rows.length === 0) return null;
+    return rows[0].override_reason ?? null;
+  }
+  async getOverridesForTag(tag, tenantId) {
+    const sql = getSql();
+    const tid = tenantId ?? DEFAULT_TENANT;
+    const rows = await sql`
+      SELECT * FROM override_corpus
+      WHERE tenant_id = ${tid} AND incident_tag = ${tag}
+      ORDER BY recorded_at DESC
+    `;
+    return rows.map((r) => rowToOverrideEvent(r));
+  }
+  async getOverrideById(id, tenantId) {
+    const sql = getSql();
+    const tid = tenantId ?? DEFAULT_TENANT;
+    const rows = await sql`
+      SELECT * FROM override_corpus
+      WHERE tenant_id = ${tid} AND id = ${id}
+      LIMIT 1
+    `;
+    if (rows.length === 0) return null;
+    return rowToOverrideEvent(rows[0]);
+  }
+  async getAllOverrides(tenantId) {
+    const sql = getSql();
+    const tid = tenantId ?? DEFAULT_TENANT;
+    const rows = await sql`
+      SELECT * FROM override_corpus
+      WHERE tenant_id = ${tid}
+      ORDER BY recorded_at DESC
+    `;
+    return rows.map((r) => rowToOverrideEvent(r));
+  }
+  async compactCorpus(tenantId) {
+    const events = await this.getAllOverrides(tenantId);
+    return _compactEvents([...events]);
+  }
+  async getRulesForTag(incidentTag, service, tenantId) {
+    const rules = await this.compactCorpus(tenantId);
+    return rules.filter((r) => r.incidentTag === incidentTag && r.service === service);
+  }
+  async describeTopRule(incidentTag, service, tenantId) {
+    const rules = await this.getRulesForTag(incidentTag, service, tenantId);
+    if (rules.length === 0) return null;
+    const r = rules[0];
+    const timePart = r.dayOfWeek !== null ? ` (${DAY_NAMES[r.dayOfWeek]}${r.hourWindow ? ` ${r.hourWindow[0]}\u2013${r.hourWindow[1] - 1} UTC` : ""}, ${r.occurrences} overrides)` : ` (${r.occurrences} overrides)`;
+    return `${r.incidentTag} for ${r.service} \u2014 ${r.overrideReason}${timePart}`;
+  }
+  async getOverrideSummary(tenantId) {
+    const events = await this.getAllOverrides(tenantId);
+    return _buildOverrideSummary([...events]);
+  }
+  async compileOverrideFromSlackThread(slackThread, service, tenantId) {
+    if (!slackThread) return null;
+    const backtickCommands = [...slackThread.matchAll(/`([^`]{4,200})`/g)].map((m) => m[1].trim());
+    let proposedCommand = "";
+    let manualAction = "";
+    for (const cmd of backtickCommands) {
+      if (/^(kubectl|docker|systemctl|service|npm|yarn|pnpm|make)\s/i.test(cmd)) {
+        if (/restart|stop|scale|revert|rollback|install/i.test(cmd)) {
+          if (!proposedCommand) proposedCommand = cmd;
+          else if (!manualAction && cmd !== proposedCommand) manualAction = cmd;
+        }
+      }
+    }
+    if (!proposedCommand) {
+      for (const line of slackThread.split("\n")) {
+        const trimmed = line.trim();
+        if (/^(kubectl|docker|systemctl|service|npm|yarn|pnpm|make)\s/i.test(trimmed)) {
+          proposedCommand = trimmed;
+          break;
+        }
+      }
+    }
+    if (!proposedCommand) return null;
+    let reason = "on-call-discretion";
+    let note = "Extracted from Slack thread discussion";
+    const lower = slackThread.toLowerCase();
+    if (lower.includes("window") || lower.includes("settlement") || lower.includes("friday") || lower.includes("batch")) {
+      reason = "batch-window";
+      note = "Override reason mapping: batch-window context discussed";
+    } else if (lower.includes("cost") || lower.includes("budget") || lower.includes("scale")) {
+      reason = "cost-constraint";
+      note = "Override reason mapping: cost constraints discussed";
+    } else if (lower.includes("cab") || lower.includes("freeze") || lower.includes("compliance")) {
+      reason = "compliance-hold";
+      note = "Override reason mapping: compliance hold discussed";
+    } else if (lower.includes("replica") || lower.includes("read") || lower.includes("primary")) {
+      reason = "prefer-read-replica";
+      note = "Override reason mapping: read-replica preference discussed";
+    } else if (lower.includes("maintenance") || lower.includes("scheduled")) {
+      reason = "maintenance-window";
+      note = "Override reason mapping: maintenance window discussed";
+    } else if (lower.includes("wrong diagnosis") || lower.includes("misidentified")) {
+      reason = "wrong-diagnosis";
+      note = "Override reason mapping: wrong root-cause discussed";
+    } else if (lower.includes("wrong fix") || lower.includes("bad command")) {
+      reason = "wrong-fix";
+      note = "Override reason mapping: wrong remediation discussed";
+    }
+    let incidentTag = "infra_db_connection_pool";
+    if (lower.includes("oom") || lower.includes("memory")) incidentTag = "infra_oom_kill";
+    else if (lower.includes("rate") || lower.includes("throttl")) incidentTag = "infra_rate_limit_cascade";
+    else if (lower.includes("cert") || lower.includes("tls")) incidentTag = "infra_certificate_expiry";
+    else if (lower.includes("disk") || lower.includes("space")) incidentTag = "infra_disk_pressure";
+    else if (lower.includes("slow") || lower.includes("query")) incidentTag = "infra_slow_query";
+    return this.recordOverride(
+      {
+        incidentTag,
+        proposedCommand,
+        overrideReason: reason,
+        note,
+        service: service ?? "unknown",
+        environment: "production",
+        manualAction: manualAction || void 0,
+        actor: "Slack NLP Parser"
+      },
+      tenantId
+    );
+  }
+  async compileOverridesFromSlackThread(slackThread, service, tenantId) {
+    const single = await this.compileOverrideFromSlackThread(slackThread, service, tenantId);
+    return single ? [single] : [];
+  }
+  async getStaleOverrides(daysThreshold = 60, tenantId) {
+    const sql = getSql();
+    const tid = tenantId ?? DEFAULT_TENANT;
+    const rows = await sql`
+      SELECT * FROM override_corpus
+      WHERE tenant_id = ${tid}
+        AND COALESCE(reviewed_at, recorded_at) < NOW() - (${daysThreshold} * INTERVAL '1 day')
+      ORDER BY COALESCE(reviewed_at, recorded_at) ASC
+    `;
+    return rows.map((r) => rowToOverrideEvent(r));
+  }
+  async getExpiringSoon(windowDays = 14, tenantId) {
+    const sql = getSql();
+    const tid = tenantId ?? DEFAULT_TENANT;
+    const rows = await sql`
+      SELECT * FROM override_corpus
+      WHERE tenant_id = ${tid}
+        AND expires_at IS NOT NULL
+        AND expires_at > NOW()
+        AND expires_at < NOW() + (${windowDays} * INTERVAL '1 day')
+      ORDER BY expires_at ASC
+    `;
+    return rows.map((r) => rowToOverrideEvent(r));
+  }
+  async markOverrideReviewed(id, tenantId) {
+    const sql = getSql();
+    const tid = tenantId ?? DEFAULT_TENANT;
+    const rows = await sql`
+      UPDATE override_corpus
+      SET reviewed_at = NOW()
+      WHERE tenant_id = ${tid} AND id = ${id}
+      RETURNING 1
+    `;
+    return rows.length > 0;
+  }
+  async importOverrides(entries, opts, tenantId) {
+    const sql = getSql();
+    const tid = tenantId ?? DEFAULT_TENANT;
+    const source = opts?.source ?? "community";
+    const actor = opts?.actor ?? source;
+    const existing = await sql`
+      SELECT incident_tag, override_reason, day_of_week, hour_of_day, service
+      FROM override_corpus WHERE tenant_id = ${tid}
+    `;
+    const existingKeys = new Set(existing.map((r) => overridePackKey({
+      incidentTag: String(r.incident_tag),
+      overrideReason: r.override_reason,
+      dayOfWeek: Number(r.day_of_week),
+      hourOfDay: Number(r.hour_of_day),
+      service: String(r.service)
+    })));
+    let imported = 0;
+    let skipped = 0;
+    for (const entry of entries) {
+      const dayOfWeek = Math.min(6, Math.max(0, Math.trunc(entry.dayOfWeek)));
+      const hourOfDay = Math.min(23, Math.max(0, Math.trunc(entry.hourOfDay)));
+      const key = overridePackKey({ ...entry, dayOfWeek, hourOfDay });
+      if (existingKeys.has(key)) {
+        skipped++;
+        continue;
+      }
+      existingKeys.add(key);
+      const now = /* @__PURE__ */ new Date();
+      const id = randomUUID();
+      const lastRows = await sql`
+        SELECT hash FROM override_corpus
+        WHERE tenant_id = ${tid}
+        ORDER BY recorded_at DESC, id DESC
+        LIMIT 1
+      `;
+      const prevHash = lastRows.length > 0 && lastRows[0].hash ? String(lastRows[0].hash) : "genesis_override";
+      const payload = [
+        id,
+        entry.incidentTag,
+        entry.proposedCommand.slice(0, 500),
+        entry.overrideReason,
+        entry.service,
+        actor
+      ].join("|");
+      const hash = createHash("sha256").update(payload + prevHash).digest("hex");
+      const expiresAt = entry.expiresInDays ? new Date(now.getTime() + entry.expiresInDays * 24 * 60 * 60 * 1e3) : null;
+      await sql`
+        INSERT INTO override_corpus (
+          id, tenant_id, incident_tag, proposed_command, override_reason,
+          note, rationale, service, environment, day_of_week, hour_of_day,
+          manual_action, actor, source, recorded_at, expires_at, hash, prev_hash
+        ) VALUES (
+          ${id}, ${tid},
+          ${entry.incidentTag},
+          ${entry.proposedCommand.slice(0, 500)},
+          ${entry.overrideReason},
+          ${entry.note?.slice(0, 200) ?? null},
+          ${entry.rationale?.slice(0, 300) ?? null},
+          ${entry.service},
+          ${entry.environment ?? "production"},
+          ${dayOfWeek},
+          ${hourOfDay},
+          ${entry.manualAction?.slice(0, 500) ?? null},
+          ${actor},
+          ${source},
+          ${now},
+          ${expiresAt},
+          ${hash},
+          ${prevHash}
+        )
+      `;
+      imported++;
+    }
+    return { imported, skipped };
+  }
+}
+function _compactEvents(events) {
+  const buckets = /* @__PURE__ */ new Map();
+  for (const e of events) {
+    const key = `${e.incidentTag}\0${e.service}\0${e.overrideReason}`;
+    const list = buckets.get(key) ?? [];
+    list.push(e);
+    buckets.set(key, list);
+  }
+  const rules = [];
+  const now = Date.now();
+  for (const evs of buckets.values()) {
+    if (evs.length === 0) continue;
+    const first = evs[0];
+    const dayCounts = /* @__PURE__ */ new Map();
+    for (const e of evs) dayCounts.set(e.dayOfWeek, (dayCounts.get(e.dayOfWeek) ?? 0) + 1);
+    let dominantDay = null;
+    let dominantDayCount = 0;
+    for (const [day, count] of dayCounts) {
+      if (count > dominantDayCount) {
+        dominantDay = day;
+        dominantDayCount = count;
+      }
+    }
+    if (dominantDay !== null && dominantDayCount / evs.length < 0.4) dominantDay = null;
+    const hoursToWindow = dominantDay !== null ? evs.filter((e) => e.dayOfWeek === dominantDay).map((e) => e.hourOfDay) : evs.map((e) => e.hourOfDay);
+    let hourWindow = null;
+    if (hoursToWindow.length > 0) {
+      const minH = Math.min(...hoursToWindow);
+      const maxH = Math.max(...hoursToWindow);
+      if (maxH - minH < 20) hourWindow = [minH, maxH + 1];
+    }
+    rules.push({
+      incidentTag: first.incidentTag,
+      service: first.service,
+      overrideReason: first.overrideReason,
+      dayOfWeek: dominantDay,
+      hourWindow,
+      occurrences: evs.length,
+      commandSignatures: dominantCommandSignatures(evs),
+      compactedAt: now
+    });
+  }
+  rules.sort((a, b) => b.occurrences - a.occurrences);
+  return rules;
+}
+function _buildOverrideSummary(events) {
+  const byTag = /* @__PURE__ */ new Map();
+  for (const e of events) {
+    const list = byTag.get(e.incidentTag) ?? [];
+    list.push(e);
+    byTag.set(e.incidentTag, list);
+  }
+  const out = [];
+  for (const [tag, evs] of byTag) {
+    const reasonCounts = /* @__PURE__ */ new Map();
+    const services = /* @__PURE__ */ new Set();
+    const dayCounts = /* @__PURE__ */ new Map();
+    const outcomes = { resolved: 0, escalated: 0, unresolved: 0, unknown: 0 };
+    for (const e of evs) {
+      reasonCounts.set(e.overrideReason, (reasonCounts.get(e.overrideReason) ?? 0) + 1);
+      services.add(e.service);
+      dayCounts.set(e.dayOfWeek, (dayCounts.get(e.dayOfWeek) ?? 0) + 1);
+      if (e.outcome) outcomes[e.outcome]++;
+      else outcomes.unknown++;
+    }
+    let dominant = null;
+    let bestCount = 0;
+    for (const [r, c] of reasonCounts) {
+      if (c > bestCount) {
+        dominant = r;
+        bestCount = c;
+      }
+    }
+    let dominantDay = null;
+    let dominantDayCount = 0;
+    for (const [day, count] of dayCounts) {
+      if (count > dominantDayCount) {
+        dominantDay = day;
+        dominantDayCount = count;
+      }
+    }
+    let timePattern = null;
+    if (dominantDay !== null && dominantDayCount / evs.length >= 0.4) {
+      const hoursOnDay = evs.filter((e) => e.dayOfWeek === dominantDay).map((e) => e.hourOfDay);
+      const minHour = Math.min(...hoursOnDay);
+      const maxHour = Math.max(...hoursOnDay);
+      timePattern = maxHour > minHour ? `${DAY_NAMES[dominantDay]} ${minHour}\u2013${maxHour} UTC` : `${DAY_NAMES[dominantDay]} ${minHour} UTC`;
+    }
+    out.push({ tag, total: evs.length, dominantReason: dominant, services: [...services], timePattern, outcomes });
+  }
+  out.sort((a, b) => b.total - a.total);
+  return out;
+}
+export {
+  PgOverrideCorpus
+};

package/dist/storage/pg/pg-shadow-log.js

@@ -0,0 +1,129 @@
+import { randomUUID } from "crypto";
+import { getSql } from "./pg-client.js";
+import {
+  computeShadowReport,
+  computeShadowSlackDigest,
+  computeShadowCsv
+} from "../../intelligence/shadow-log.js";
+import { getStores } from "../store-registry.js";
+import logger from "../../sensor/logger.js";
+const DEFAULT_TENANT = "local";
+function rowToEntry(row) {
+  return {
+    id: String(row.id ?? ""),
+    pid: String(row.pid ?? ""),
+    incidentTag: String(row.incident_tag ?? ""),
+    service: String(row.service ?? ""),
+    command: row.command ? String(row.command) : null,
+    diagnosisConfidence: Number(row.diagnosis_confidence ?? 0),
+    remediationConfidence: Number(row.remediation_confidence ?? 0),
+    wouldHaveExecuted: Boolean(row.would_have_executed),
+    skipReason: row.skip_reason ?? "no-command",
+    firedAt: row.fired_at ? Number(row.fired_at) : void 0,
+    recordedAt: Number(row.recorded_at ?? 0),
+    humanVerdict: row.human_verdict ? row.human_verdict : void 0,
+    humanNote: row.human_note ? String(row.human_note) : void 0,
+    verdictAt: row.verdict_at ? Number(row.verdict_at) : void 0,
+    overrideId: row.override_id ? String(row.override_id) : void 0,
+    runbookId: row.runbook_id ? String(row.runbook_id) : void 0
+  };
+}
+class PgShadowLog {
+  async recordShadow(input, tenantId) {
+    const sql = getSql();
+    const tid = tenantId ?? DEFAULT_TENANT;
+    const id = input.id ?? randomUUID();
+    const now = Date.now();
+    await sql`
+      INSERT INTO shadow_log (
+        id, tenant_id, pid, incident_tag, service, command,
+        diagnosis_confidence, remediation_confidence, would_have_executed,
+        skip_reason, fired_at, recorded_at, runbook_id
+      ) VALUES (
+        ${id}, ${tid}, ${input.pid}, ${input.incidentTag}, ${input.service},
+        ${input.command ?? null}, ${input.diagnosisConfidence}, ${input.remediationConfidence},
+        ${input.wouldHaveExecuted}, ${input.skipReason}, ${input.firedAt ?? null}, ${now},
+        ${input.runbookId ?? null}
+      )
+      ON CONFLICT (tenant_id, id) DO NOTHING
+    `;
+    logger.info({ id, pid: input.pid, tag: input.incidentTag, tid }, "pg-shadow-log: entry recorded");
+    return { ...input, id, recordedAt: now };
+  }
+  async recordShadowVerdict(id, verdict, opts = {}, tenantId) {
+    const sql = getSql();
+    const tid = tenantId ?? DEFAULT_TENANT;
+    const rows = await sql`SELECT * FROM shadow_log WHERE tenant_id = ${tid} AND id = ${id}`;
+    if (rows.length === 0) return { found: false };
+    const entry = rowToEntry(rows[0]);
+    const verdictAt = Date.now();
+    const note = opts.note?.slice(0, 200);
+    let overrideId;
+    if (verdict === "would-override" && entry.command) {
+      try {
+        const ov = await getStores().overrides.recordOverride(
+          {
+            incidentTag: entry.incidentTag,
+            proposedCommand: entry.command,
+            overrideReason: opts.overrideReason ?? "on-call-discretion",
+            note: opts.note,
+            service: entry.service,
+            environment: "production",
+            manualAction: opts.manualAction,
+            actor: opts.actor ?? "shadow-review"
+          },
+          tid
+        );
+        overrideId = ov.id;
+      } catch (err) {
+        logger.warn({ err, id }, "pg-shadow-log: failed to record override from verdict");
+      }
+    }
+    await sql`
+      UPDATE shadow_log
+      SET human_verdict = ${verdict},
+          verdict_at    = ${verdictAt},
+          human_note    = ${note ?? null},
+          override_id   = ${overrideId ?? null}
+      WHERE tenant_id = ${tid} AND id = ${id}
+    `;
+    entry.humanVerdict = verdict;
+    entry.verdictAt = verdictAt;
+    if (note) entry.humanNote = note;
+    if (overrideId) entry.overrideId = overrideId;
+    return { found: true, entry, overrideId };
+  }
+  async updateShadowReasonByPid(pid, skipReason, tenantId) {
+    const sql = getSql();
+    const tid = tenantId ?? DEFAULT_TENANT;
+    await sql`
+      UPDATE shadow_log SET skip_reason = ${skipReason}
+      WHERE tenant_id = ${tid} AND pid = ${pid}
+    `;
+  }
+  async getShadowEntries(tenantId) {
+    const sql = getSql();
+    const tid = tenantId ?? DEFAULT_TENANT;
+    const rows = await sql`
+      SELECT * FROM shadow_log
+      WHERE tenant_id = ${tid}
+      ORDER BY recorded_at ASC
+    `;
+    return rows.map((r) => rowToEntry(r));
+  }
+  async getShadowReport(windowDays = 30, tenantId) {
+    const entries = await this.getShadowEntries(tenantId);
+    return computeShadowReport(entries, windowDays);
+  }
+  async getShadowSlackDigest(windowDays = 7, tenantId) {
+    const entries = await this.getShadowEntries(tenantId);
+    return computeShadowSlackDigest(entries, windowDays);
+  }
+  async exportShadowCsv(tenantId) {
+    const entries = await this.getShadowEntries(tenantId);
+    return computeShadowCsv(entries);
+  }
+}
+export {
+  PgShadowLog
+};

package/dist/storage/sqlite/sqlite-action-ledger.js

@@ -0,0 +1,18 @@
+import { actionLedger } from "../../sensor/action-ledger.js";
+class SqliteActionLedger {
+  async append(rec, _tenantId) {
+    actionLedger.appendActionRecord(rec);
+  }
+  async query(opts, _tenantId) {
+    return actionLedger.queryLedger(opts);
+  }
+  async queryCredentialUsage(opts, _tenantId) {
+    return actionLedger.queryCredentialUsage(opts);
+  }
+  async prune(_tenantId) {
+    actionLedger.prune();
+  }
+}
+export {
+  SqliteActionLedger
+};

package/dist/storage/sqlite/sqlite-approval-store.js

@@ -0,0 +1,37 @@
+import { flushApprovals } from "../../intelligence/execution-gate.js";
+class SqliteApprovalStore {
+  /** In-memory store — mirrors the structure of execution-gate's private _pending map. */
+  _map = /* @__PURE__ */ new Map();
+  async add(token, execution, _tenantId) {
+    this._map.set(token, execution);
+  }
+  async get(token) {
+    return Promise.resolve(this._map.get(token) ?? null);
+  }
+  async resolve(token) {
+    return Promise.resolve(this._map.delete(token));
+  }
+  async listPending(_tenantId) {
+    return Promise.resolve([...this._map.entries()]);
+  }
+  /** Remove all entries whose expiresAt has passed. */
+  async pruneExpired() {
+    const now = Date.now();
+    for (const [token, execution] of this._map) {
+      if (execution.expiresAt <= now) {
+        this._map.delete(token);
+      }
+    }
+  }
+  /**
+   * Delegates to execution-gate's flushApprovals() so the SIGTERM handler in
+   * index.ts can flush the approval state without knowing which store is active.
+   * Phase 2 will update this to serialize our own _map to disk.
+   */
+  async flush() {
+    return Promise.resolve(flushApprovals());
+  }
+}
+export {
+  SqliteApprovalStore
+};

package/dist/storage/sqlite/sqlite-blunder-store.js

@@ -0,0 +1,27 @@
+import {
+  recordBlunder,
+  getBlunders,
+  getBlunderStats,
+  verifyChain,
+  isBlunderIntegrityViolated
+} from "../../sensor/agent-blunder-store.js";
+class SqliteBlunderStore {
+  async record(event, _tenantId) {
+    recordBlunder(event);
+  }
+  async list(_tenantId) {
+    return getBlunders();
+  }
+  async getStats(_tenantId) {
+    return getBlunderStats();
+  }
+  async verifyChain(_tenantId) {
+    return verifyChain();
+  }
+  isIntegrityViolated() {
+    return isBlunderIntegrityViolated();
+  }
+}
+export {
+  SqliteBlunderStore
+};

package/dist/storage/sqlite/sqlite-ci-gate-history.js

@@ -0,0 +1,19 @@
+import {
+  recordGateEvaluation,
+  getGateHistoryForPR,
+  getGateHistory
+} from "../../sensor/ci-gate-history.js";
+class SqliteGateHistoryStore {
+  async record(entry, _tenantId) {
+    recordGateEvaluation(entry);
+  }
+  async listForPR(prNumber, repo, _tenantId) {
+    return getGateHistoryForPR(prNumber, repo);
+  }
+  async list(opts, _tenantId) {
+    return getGateHistory(opts);
+  }
+}
+export {
+  SqliteGateHistoryStore
+};