reprobe 0.0.0-stage → 0.1.0

package/dist/sources/logs.js

@@ -0,0 +1,324 @@
+import { createHash } from 'node:crypto';
+import { globSync, readFileSync } from 'node:fs';
+import { basename, dirname, resolve } from 'node:path';
+import { config, firstLine } from "../config.js";
+import { run } from "../exec.js";
+// Transcripts sometimes keep the colour codes without their ESC byte, so the ESC is optional.
+const ANSI = /\u001b?\[[0-9;]{1,12}m/g;
+const HTTP = /(?:✅|❌|⚠️)?\s*\b(GET|POST|PUT|PATCH|DELETE)\s+(\/\S*)\s+(\d{3})\b/;
+const KV = /(\w+)=("([^"]*)"|[^\s"]+)/g;
+function timestampMs(value) {
+    const normalized = /^\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d(?:\.\d+)?$/.test(value) ? `${value}Z` : value;
+    return Date.parse(normalized);
+}
+function safeWindow(w) {
+    const timestamp = /^\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d(?:\.\d+)?(?:Z|[+-]\d\d:\d\d)$/;
+    if (!timestamp.test(w.from) || !timestamp.test(w.to))
+        return null;
+    const from = Date.parse(w.from);
+    const to = Date.parse(w.to);
+    if (!Number.isFinite(from) || !Number.isFinite(to) || from > to)
+        return null;
+    return { from: new Date(from).toISOString(), to: new Date(to).toISOString() };
+}
+function kv(text) {
+    const out = {};
+    for (const m of text.matchAll(KV))
+        out[m[1]] = m[3] ?? m[2];
+    return out;
+}
+/** Normalises the three shapes Railway logs come in: `--json` objects, `<ts> [level] <nest line>`, and `<ts> [LEVEL] key=value`. */
+export function parseLogLine(raw) {
+    const line = raw.replace(ANSI, '').trimEnd();
+    let at = null;
+    let text = '';
+    let fields = {};
+    if (line.startsWith('{')) {
+        try {
+            fields = JSON.parse(line);
+        }
+        catch {
+            return null;
+        }
+        at = typeof fields.timestamp === 'string' ? fields.timestamp : null;
+        text = String(fields.message ?? '').replace(ANSI, '');
+        if (fields.event === 'request_completed' || fields.path) {
+            text = `${fields.event ?? 'request'} ${fields.method ?? ''} ${fields.path ?? ''} ${fields.statusCode ?? ''} clientVersion=${fields.clientVersion ?? '?'} userId=${fields.userId ?? '?'} ${text}`.trim();
+        }
+    }
+    else {
+        const m = line.match(/^(\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d(?:\.\d+)?Z)\s+(?:\[(\w+)\]\s*)?(.*)$/);
+        if (!m)
+            return null;
+        at = m[1];
+        text = m[3];
+        fields = { level: m[2], ...kv(text) };
+    }
+    if (!at || !text.trim())
+        return null;
+    const timestamp = timestampMs(at);
+    if (!Number.isFinite(timestamp))
+        return null;
+    const nest = text.match(/\b(LOG|ERROR|WARN|DEBUG|VERBOSE)\s+\[([\w.-]+)\]/);
+    const http = text.match(HTTP);
+    const status = Number(fields.statusCode ?? http?.[3] ?? NaN);
+    const level = (nest?.[1] ?? String(fields.level ?? 'info')).toLowerCase().replace('log', 'info');
+    return {
+        at: new Date(timestamp).toISOString(),
+        text: text.replace(/\s+/g, ' ').trim(),
+        level: level === 'warning' ? 'warn' : level,
+        context: nest?.[2] ?? null,
+        method: fields.method || http?.[1] || null,
+        path: fields.path || http?.[2] || null,
+        status: Number.isFinite(status) ? status : null,
+        userId: typeof fields.userId === 'string' && fields.userId !== '?' ? fields.userId : null,
+        clientVersion: typeof fields.clientVersion === 'string' && fields.clientVersion !== '?' ? fields.clientVersion : null,
+    };
+}
+export function inWindow(at, w) {
+    const value = timestampMs(at);
+    const from = timestampMs(w.from);
+    const to = timestampMs(w.to);
+    return Number.isFinite(value) && Number.isFinite(from) && Number.isFinite(to) && value >= from && value <= to;
+}
+/** Lines worth keeping: anything about the people we care about, every warning/error, every failed request. */
+export function relevant(l, ids) {
+    if (l.level === 'error' || l.level === 'warn')
+        return true;
+    if (l.status !== null && l.status >= 400)
+        return true;
+    if (/Exception|Error:/.test(l.text))
+        return true;
+    return ids.some((id) => l.text.includes(id) || (id.length > 8 && l.text.includes(`${id.slice(0, 8)}…`)));
+}
+const hash = (s) => createHash('sha256').update(s).digest('hex').slice(0, 10);
+function logEvidence(l, source, extra = {}) {
+    return {
+        id: `${source}:${l.at}:${hash(l.text)}`,
+        source,
+        at: l.at,
+        kind: l.status !== null ? (l.status >= 500 ? 'http.5xx' : l.status >= 400 ? 'http.4xx' : 'http.ok') : `log.${l.level}`,
+        summary: (l.method && l.path && l.status !== null ? `${l.method} ${l.path} ${l.status}${l.userId ? ` user ${l.userId.slice(0, 8)}` : ''}${l.clientVersion ? ` app ${l.clientVersion}` : ''} · ${l.text}` : l.text).slice(0, 260),
+        data: { ...l, ...extra },
+    };
+}
+/**
+ * Railway emits a multi-line message (an error object, a stack trace) as one line per row, all with
+ * the same timestamp. Fold those rows back into the line that started them, in source order.
+ */
+export function mergeContinuations(lines) {
+    const out = [];
+    for (const l of lines) {
+        const prev = out.at(-1);
+        const starts = /\[Nest\]|\b(?:LOG|ERROR|WARN|DEBUG|VERBOSE)\s+\[|request_completed|^\S+=/.test(l.text) || l.status !== null;
+        const continuation = /^(?:at\s|Caused by:|status:|message:|stack:|code:|details?:)/i.test(l.text);
+        const boundary = prev && (prev.context !== null && l.context !== null && prev.context !== l.context ||
+            prev.userId !== null && l.userId !== null && prev.userId !== l.userId ||
+            prev.clientVersion !== null && l.clientVersion !== null && prev.clientVersion !== l.clientVersion ||
+            l.level !== prev.level && !continuation);
+        if (prev && prev.at === l.at && !starts && !boundary) {
+            prev.text = `${prev.text} | ${l.text}`.slice(0, 4000);
+            continue;
+        }
+        out.push({ ...l });
+    }
+    return out;
+}
+export function dedupe(lines) {
+    const seen = new Set();
+    return lines
+        .filter((l) => {
+        const k = `${l.at}|${l.text}`;
+        if (seen.has(k))
+            return false;
+        seen.add(k);
+        return true;
+    })
+        .sort((a, b) => a.at.localeCompare(b.at) || a.text.localeCompare(b.text));
+}
+async function railwayLines(src, w, runner) {
+    const opts = { cwd: src.railway.cwd ? resolve(config.repo, src.railway.cwd) : config.repo, timeoutMs: 120_000 };
+    const service = src.railway.service;
+    const list = await runner('railway', ['deployment', 'list', '--service', service, '--json'], opts);
+    if (list.code === 127)
+        return { source: 'logs', state: 'missing-credentials', detail: 'railway CLI not installed' };
+    if (list.code !== 0)
+        return { source: 'logs', state: 'error', detail: `railway deployment list: ${firstLine(list.stderr)}` };
+    let deployments = [];
+    try {
+        const value = JSON.parse(list.stdout);
+        if (!Array.isArray(value) || value.some((d) => !d || typeof d.id !== 'string' || !d.id || typeof d.createdAt !== 'string' || !Number.isFinite(timestampMs(d.createdAt)))) {
+            throw new Error('invalid deployment list shape');
+        }
+        deployments = value;
+    }
+    catch {
+        return { source: 'logs', state: 'error', detail: 'railway deployment list: invalid JSON or deployment list shape' };
+    }
+    deployments.sort((a, b) => timestampMs(a.createdAt) - timestampMs(b.createdAt));
+    const from = timestampMs(w.from);
+    const to = timestampMs(w.to);
+    const overlapping = deployments.filter((d, i) => timestampMs(d.createdAt) <= to && timestampMs(deployments[i + 1]?.createdAt ?? '9999-12-31T23:59:59.999Z') >= from);
+    if (!overlapping.length) {
+        return { source: 'logs', state: 'expired', detail: `no Railway deployment of ${service} covers the window; oldest listed deployment started ${deployments[0]?.createdAt ?? 'unknown'}` };
+    }
+    const lines = [];
+    const errors = [];
+    for (const d of overlapping) {
+        const r = await runner('railway', ['logs', d.id, '--service', service, '--since', w.from, '--until', w.to, '--json'], opts);
+        if (r.code !== 0) {
+            errors.push(`${d.id.slice(0, 8)}: ${firstLine(r.stderr)}`);
+            continue;
+        }
+        lines.push(...mergeContinuations(r.stdout.split('\n').map(parseLogLine).filter((l) => l !== null && inWindow(l.at, w))));
+    }
+    return { lines, errors, note: `${overlapping.length} deployment(s)` };
+}
+async function commandLines(src, w, runner) {
+    const args = src.command.slice(1).map((a) => a.replaceAll('{since}', w.from).replaceAll('{until}', w.to));
+    const r = await runner(src.command[0], args, { cwd: src.cwd ? resolve(config.repo, src.cwd) : config.repo, timeoutMs: 120_000 });
+    if (r.code === 127)
+        return { source: 'logs', state: 'missing-credentials', detail: `${src.command[0]} not installed` };
+    if (r.code !== 0)
+        return { source: 'logs', state: 'error', detail: `${src.command[0]}: ${firstLine(r.stderr || r.stdout)}` };
+    return { lines: mergeContinuations(r.stdout.split('\n').map(parseLogLine).filter((l) => l !== null && inWindow(l.at, w))), errors: [], note: `\`${src.command[0]}\`` };
+}
+function fileLines(src, w) {
+    const files = globSync(src.file, { cwd: config.repo }).map((f) => resolve(config.repo, f)).sort();
+    if (!files.length)
+        return { source: 'logs', state: 'not-found', detail: `no file matches ${src.file}` };
+    const lines = [];
+    const errors = [];
+    for (const f of files) {
+        try {
+            lines.push(...mergeContinuations(readFileSync(f, 'utf8').split('\n').map(parseLogLine).filter((l) => l !== null && inWindow(l.at, w))));
+        }
+        catch (e) {
+            errors.push(`${basename(f)}: ${e.message}`);
+        }
+    }
+    return { lines, errors, note: errors.length ? `${files.length - errors.length} readable file(s)` : `${files.length} file(s)` };
+}
+/** Every configured log source, filtered to lines that mention the ids or look like failures. */
+export async function gatherLogs(w, ids, runner = run) {
+    const sources = config.sources.logs ?? [];
+    if (!sources.length)
+        return [{ status: { source: 'logs', state: 'skipped', detail: 'no log source in the config' }, evidence: [] }];
+    const normalizedWindow = safeWindow(w);
+    if (!normalizedWindow)
+        return sources.map((src) => ({ status: { source: 'logs', state: 'error', detail: `${src.name}: invalid log window; expected ordered ISO timestamps` }, evidence: [] }));
+    const out = [];
+    for (const src of sources) {
+        const got = 'railway' in src ? await railwayLines(src, normalizedWindow, runner) : 'command' in src ? await commandLines(src, normalizedWindow, runner) : fileLines(src, normalizedWindow);
+        if ('state' in got) {
+            out.push({ status: { ...got, detail: `${src.name}: ${got.detail}` }, evidence: [] });
+            continue;
+        }
+        const kept = dedupe(got.lines.filter((l) => relevant(l, ids))).slice(0, 800);
+        if (!kept.length) {
+            const stale = 'railway' in src && Date.now() - Date.parse(w.to) > 7 * 86_400_000;
+            out.push({
+                status: {
+                    source: 'logs',
+                    state: got.errors.length ? 'error' : stale ? 'expired' : 'empty',
+                    detail: `${src.name}: ${got.errors.length ? got.errors.join('; ') : stale ? 'no lines returned: logs past retention (~7 days on Railway)' : 'no relevant lines in the window'}`,
+                },
+                evidence: [],
+            });
+            continue;
+        }
+        out.push({
+            status: { source: 'logs', state: 'ok', detail: `${src.name}: ${kept.length} relevant lines from ${got.note}${got.errors.length ? `; failed: ${got.errors.join('; ')}` : ''}` },
+            evidence: kept.map((l) => logEvidence(l, 'logs')),
+        });
+    }
+    return out;
+}
+// ── archived logs inside saved agent transcripts ─────────────────────────────
+export const globRegex = (g) => new RegExp(`^${g.replace(/[.+?^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '.*')}$`);
+function hourPrefixes(w) {
+    const out = [];
+    for (let t = timestampMs(w.from) - 3_600_000; t <= timestampMs(w.to); t += 3_600_000)
+        out.push(new Date(t).toISOString().slice(0, 13) + ':');
+    return [...new Set(out)];
+}
+function toolResultTexts(o) {
+    if (o?.type === 'assistant' || o?.message?.role === 'assistant')
+        return [];
+    const content = o?.message?.content;
+    if (!Array.isArray(content))
+        return [];
+    const out = [];
+    for (const b of content) {
+        if (b?.type !== 'tool_result')
+            continue;
+        if (typeof b.content === 'string')
+            out.push(b.content);
+        else if (Array.isArray(b.content))
+            for (const c of b.content)
+                if (typeof c?.text === 'string')
+                    out.push(c.text);
+    }
+    return out;
+}
+/**
+ * Log-shaped tool output from a saved Claude Code transcript. Assistant messages are excluded, but
+ * the transcript does not prove which command produced the output or whether it was edited later.
+ */
+export async function gatherArchive(w, ids, runner = run) {
+    const archive = config.sources.archive;
+    if (!archive)
+        return { status: { source: 'archive', state: 'skipped', detail: 'no archive source in the config' }, evidence: [] };
+    const args = ['-l', '-F', '--glob', '*.jsonl', '--glob', '!**/subagents/**'];
+    for (const p of hourPrefixes(w))
+        args.push('-e', p);
+    args.push(archive.dir);
+    const r = await runner('rg', args, { timeoutMs: 120_000 });
+    if (r.code === 127)
+        return { status: { source: 'archive', state: 'skipped', detail: 'ripgrep (rg) not installed' }, evidence: [] };
+    if (r.code !== 0 && r.code !== 1)
+        return { status: { source: 'archive', state: 'error', detail: `transcript search: ${firstLine(r.stderr)}` }, evidence: [] };
+    const files = r.stdout
+        .split('\n')
+        .filter(Boolean)
+        .filter((f) => globRegex(archive.glob).test(basename(dirname(f))))
+        .sort();
+    if (!files.length)
+        return { status: { source: 'archive', state: 'empty', detail: `no saved transcript in ${archive.dir} mentions the window` }, evidence: [] };
+    const found = new Map();
+    for (const file of files) {
+        const rows = readFileSync(file, 'utf8').split('\n');
+        rows.forEach((row, i) => {
+            if (!row.includes('tool_result'))
+                return;
+            let o;
+            try {
+                o = JSON.parse(row);
+            }
+            catch {
+                return;
+            }
+            for (const text of toolResultTexts(o)) {
+                const parsed = text
+                    .split('\n')
+                    .map((raw) => parseLogLine(raw.replace(/^\s*\d+[\t→]/, '')))
+                    .filter((l) => l !== null && inWindow(l.at, w));
+                for (const l of mergeContinuations(parsed)) {
+                    if (!relevant(l, ids))
+                        continue;
+                    const k = `${l.at}|${l.text}`;
+                    if (!found.has(k))
+                        found.set(k, { line: l, file, row: i + 1 });
+                }
+            }
+        });
+    }
+    const kept = [...found.values()].sort((a, b) => a.line.at.localeCompare(b.line.at) || a.line.text.localeCompare(b.line.text)).slice(0, 800);
+    if (!kept.length)
+        return { status: { source: 'archive', state: 'empty', detail: `${files.length} transcript(s) touch the window but hold no relevant log lines` }, evidence: [] };
+    const sessions = new Set(kept.map((k) => basename(k.file)));
+    return {
+        status: { source: 'archive', state: 'ok', detail: `${kept.length} log-shaped tool output lines from ${sessions.size} saved transcript(s); original command and source are unverified` },
+        evidence: kept.map((k) => ({ ...logEvidence(k.line, 'archive', { file: k.file, row: k.row }), link: `${k.file}:${k.row}` })),
+    };
+}

package/dist/sources/postgres.d.ts

@@ -0,0 +1,22 @@
+import { type Runner } from '../exec.ts';
+import type { SourceStatus } from '../types.ts';
+/**
+ * Defence in depth on top of the read-only transaction: only a single SELECT/WITH statement, and no
+ * statement keyword that could write even if the transaction mode were somehow lost.
+ */
+export declare function assertReadOnlySql(sql: string): void;
+/** The exact script psql reads: every query runs inside a READ ONLY transaction that is rolled back. */
+export declare function readOnlyScript(sql: string): string;
+export declare function bindSql(sql: string, vars: Record<string, string>): string;
+export declare function pgEnv(url: string): Record<string, string>;
+export declare class Pg {
+    private url;
+    private runner;
+    constructor(url: string, runner?: Runner);
+    query<T = Record<string, unknown>>(sql: string, vars?: Record<string, string>): Promise<T[]>;
+}
+export declare function connect(runner?: Runner): Promise<{
+    db: Pg | null;
+    status: SourceStatus;
+}>;
+export declare const utc: (v: unknown) => string | null;

package/dist/sources/postgres.js

@@ -0,0 +1,209 @@
+import { config, firstLine, resolveSecret } from "../config.js";
+import { run } from "../exec.js";
+/**
+ * Defence in depth on top of the read-only transaction: only a single SELECT/WITH statement, and no
+ * statement keyword that could write even if the transaction mode were somehow lost.
+ */
+export function assertReadOnlySql(sql) {
+    const s = sql.trim();
+    if (!/^(select|with)\b/i.test(s))
+        throw new Error('reprobe only runs SELECT/WITH queries');
+    if (s.split(/\r?\n/).some((line) => /^\s*\\/.test(line)))
+        throw new Error('reprobe refuses psql meta-commands');
+    const tokens = [];
+    let lastStringWasEscape = false;
+    for (let i = 0; i < s.length;) {
+        if (/\s/.test(s[i])) {
+            i++;
+            continue;
+        }
+        if (s.startsWith('--', i)) {
+            i += 2;
+            while (i < s.length && s[i] !== '\n' && s[i] !== '\r')
+                i++;
+            // PostgreSQL accepts both LF and CR line endings; consume CRLF as one ending.
+            if (s[i] === '\r' && s[i + 1] === '\n')
+                i += 2;
+            else if (i < s.length)
+                i++;
+            continue;
+        }
+        if (s.startsWith('/*', i)) {
+            let depth = 1;
+            i += 2;
+            while (i < s.length && depth) {
+                if (s.startsWith('/*', i)) {
+                    depth++;
+                    i += 2;
+                }
+                else if (s.startsWith('*/', i)) {
+                    depth--;
+                    i += 2;
+                }
+                else
+                    i++;
+            }
+            if (depth)
+                throw new Error('reprobe refuses unterminated SQL comments');
+            continue;
+        }
+        const startsQuotedString = s[i] === "'" || ((s[i] === 'e' || s[i] === 'E') && s[i + 1] === "'");
+        if (lastStringWasEscape && startsQuotedString) {
+            throw new Error('reprobe refuses newline-continued escape strings');
+        }
+        lastStringWasEscape = false;
+        let escapeString = false;
+        if ((s[i] === 'e' || s[i] === 'E') && s[i + 1] === "'") {
+            escapeString = true;
+            i++;
+        }
+        if (s[i] === "'") {
+            i++;
+            let closed = false;
+            while (i < s.length) {
+                if (s[i] === "'" && s[i + 1] === "'") {
+                    i += 2;
+                    continue;
+                }
+                if (s[i] === "'") {
+                    i++;
+                    closed = true;
+                    break;
+                }
+                if (escapeString && s[i] === '\\')
+                    i++;
+                i++;
+            }
+            if (!closed)
+                throw new Error('reprobe refuses unterminated SQL strings');
+            lastStringWasEscape = escapeString;
+            continue;
+        }
+        const dollar = s.slice(i).match(/^\$([A-Za-z_][A-Za-z0-9_]*|)\$/)?.[0];
+        if (dollar) {
+            const end = s.indexOf(dollar, i + dollar.length);
+            if (end < 0)
+                throw new Error('reprobe refuses unterminated dollar-quoted SQL');
+            i = end + dollar.length;
+            continue;
+        }
+        if (s[i] === '$')
+            throw new Error('reprobe refuses unrecognized dollar-quoted SQL');
+        if (/^u&"/i.test(s.slice(i, i + 3)))
+            throw new Error('reprobe refuses Unicode-escaped identifiers');
+        if (s[i] === '"') {
+            i++;
+            let name = '';
+            let closed = false;
+            while (i < s.length) {
+                if (s[i] === '"' && s[i + 1] === '"') {
+                    name += '"';
+                    i += 2;
+                    continue;
+                }
+                if (s[i] === '"') {
+                    i++;
+                    closed = true;
+                    break;
+                }
+                name += s[i++];
+            }
+            if (!closed)
+                throw new Error('reprobe refuses unterminated quoted identifiers');
+            tokens.push(name.toLowerCase());
+            continue;
+        }
+        if (s[i] === ';')
+            throw new Error('reprobe refuses multi-statement SQL');
+        if (s[i] === '\\')
+            throw new Error('reprobe refuses psql meta-commands or escaped identifiers');
+        const word = s.slice(i).match(/^[A-Za-z_][A-Za-z0-9_$]*/)?.[0];
+        if (word) {
+            tokens.push(word.toLowerCase());
+            i += word.length;
+            continue;
+        }
+        tokens.push(s[i++]);
+    }
+    const banned = new Set(['insert', 'update', 'delete', 'merge', 'drop', 'alter', 'create', 'truncate', 'grant', 'revoke', 'copy', 'call', 'do', 'vacuum', 'analyze', 'lock', 'set', 'reset', 'refresh', 'listen', 'notify', 'prepare', 'execute', 'into', 'nextval', 'setval', 'set_config', 'pg_terminate_backend', 'pg_cancel_backend', 'pg_logical_emit_message', 'pg_advisory_lock', 'pg_advisory_lock_shared', 'pg_advisory_unlock', 'pg_advisory_unlock_shared', 'pg_advisory_unlock_all', 'lo_import', 'lo_export']);
+    for (const token of tokens) {
+        if (banned.has(token) || token.startsWith('dblink') || token.startsWith('lo_') || token.startsWith('pg_advisory_') || token.startsWith('pg_try_advisory_') || token.startsWith('pg_stat_reset') || ['pg_notify', 'pg_read_file', 'pg_read_binary_file', 'pg_ls_dir', 'pg_stat_file', 'pg_reload_conf', 'pg_rotate_logfile', 'pg_create_restore_point'].includes(token)) {
+            throw new Error(`reprobe refuses SQL containing "${token}"`);
+        }
+    }
+}
+/** The exact script psql reads: every query runs inside a READ ONLY transaction that is rolled back. */
+export function readOnlyScript(sql) {
+    assertReadOnlySql(sql);
+    return `BEGIN TRANSACTION READ ONLY;\nSELECT coalesce(json_agg(t), '[]'::json) FROM (${sql}\n) t;\nROLLBACK;\n`;
+}
+export function bindSql(sql, vars) {
+    return sql.replace(/:'([A-Za-z_][A-Za-z0-9_]*)'/g, (_placeholder, name) => {
+        if (!Object.prototype.hasOwnProperty.call(vars, name))
+            throw new Error(`missing SQL value: ${name}`);
+        const value = vars[name];
+        if (value.includes('\0'))
+            throw new Error(`SQL value contains NUL: ${name}`);
+        const escaped = value.replace(/'/g, "''").replace(/\r/g, "' || chr(13) || '").replace(/\n/g, "' || chr(10) || '");
+        return `'${escaped}'`;
+    });
+}
+export function pgEnv(url) {
+    const u = new URL(url);
+    return {
+        PGHOST: u.hostname,
+        PGPORT: u.port || '5432',
+        PGUSER: decodeURIComponent(u.username),
+        PGPASSWORD: decodeURIComponent(u.password),
+        PGDATABASE: u.pathname.replace(/^\//, ''),
+        PGSSLMODE: u.searchParams.get('sslmode') ?? 'prefer',
+        PGCONNECT_TIMEOUT: '10',
+        PGAPPNAME: 'reprobe-readonly',
+        // A second guard: even outside the explicit transaction, the session default is read-only.
+        PGOPTIONS: '-c default_transaction_read_only=on -c statement_timeout=20000 -c standard_conforming_strings=on',
+    };
+}
+export class Pg {
+    url;
+    runner;
+    constructor(url, runner = run) {
+        this.url = url;
+        this.runner = runner;
+    }
+    async query(sql, vars = {}) {
+        const args = ['-X', '-q', '-A', '-t', '-v', 'ON_ERROR_STOP=1'];
+        args.push('-f', '-');
+        const r = await this.runner('psql', args, { env: pgEnv(this.url), input: readOnlyScript(bindSql(sql, vars)), timeoutMs: 30_000 });
+        if (r.code !== 0)
+            throw new Error(`psql: ${firstLine(r.stderr) || `exit ${r.code}`}`);
+        // json_agg separates elements with newlines, so the result spans lines.
+        const out = r.stdout.trim();
+        const start = out.indexOf('[');
+        return JSON.parse(start < 0 ? '[]' : out.slice(start));
+    }
+}
+export async function connect(runner = run) {
+    const pgConf = config.sources.postgres;
+    if (!pgConf)
+        return { db: null, status: { source: 'postgres', state: 'skipped', detail: 'no postgres source in the config' } };
+    const { value: url, detail } = await resolveSecret(pgConf.url, runner);
+    if (!url)
+        return { db: null, status: { source: 'postgres', state: 'missing-credentials', detail } };
+    const db = new Pg(url, runner);
+    try {
+        const [row] = await db.query(`SELECT current_setting('transaction_read_only') AS ro`);
+        if (row?.ro !== 'on') {
+            return { db: null, status: { source: 'postgres', state: 'error', detail: 'refusing to continue: session is not read-only' } };
+        }
+    }
+    catch (e) {
+        return { db: null, status: { source: 'postgres', state: 'unreachable', detail: e.message } };
+    }
+    return { db, status: { source: 'postgres', state: 'ok', detail: `${detail}, read-only transaction verified` } };
+}
+export const utc = (v) => {
+    if (typeof v !== 'string' || !v)
+        return null;
+    const date = new Date(/[zZ]|[+-]\d\d:?\d\d$/.test(v) ? v : `${v}Z`);
+    return Number.isNaN(date.getTime()) ? null : date.toISOString();
+};

package/dist/sources/sentry.d.ts

@@ -0,0 +1,24 @@
+import type { Evidence, SourceStatus, Window } from '../types.ts';
+import type { Runner } from '../exec.ts';
+export interface IssueRow {
+    id: string;
+    shortId: string;
+    title: string;
+    lastSeen: string;
+    status: string;
+}
+/** Sentry is reached only through sentry-cli, which holds its own credentials. */
+export declare function sentryAuthState(runner?: Runner): Promise<SourceStatus>;
+/** Logged in is not enough: CI tokens authenticate but get 403 on issues. */
+export declare function sentryReadState(runner?: Runner): Promise<SourceStatus>;
+/** Parses the ASCII table from `sentry-cli issues list`. Columns are mapped by header name. */
+export declare function parseIssueTable(text: string, project: string): IssueRow[];
+export declare function gatherSentry(opts: {
+    window: Window;
+    userId?: string;
+    issue?: string;
+    runner?: Runner;
+}): Promise<{
+    status: SourceStatus;
+    evidence: Evidence[];
+}>;