@aeolus-fleet/gateway 0.0.0-stage → 0.28.0

package/src/adapters/prisma/schema.prisma

@@ -0,0 +1,312 @@
+// The gateway's tables, in its own database: core never reads them, and the
+// gateway never reads core's; it reaches the fleet only through core's public
+// API, as the ships it crews. Every table has fleet_id.
+//
+// Timestamps have no database default: the application's Clock port sets every
+// one of them, so tests control time.
+
+generator client {
+  provider            = "prisma-client"
+  output              = "./generated"
+  moduleFormat        = "esm"
+  importFileExtension = "js"
+  runtime             = "nodejs"
+}
+
+datasource db {
+  provider = "postgresql"
+}
+
+/// The crew token the gateway holds for each fleet's gateway ship, so a restart
+/// crews it again without a new secret. One row per fleet: one install serves
+/// many fleets.
+model Connection {
+  fleetId   String   @id @map("fleet_id")
+  shipId    String   @map("ship_id")
+  shipName  String   @map("ship_name")
+  /// Null while the gateway is not connected: the fleet and ship stay, as the last connection.
+  crewToken String?  @map("crew_token")
+  crewedAt  DateTime @map("crewed_at") @db.Timestamptz(3)
+
+  @@map("connections")
+}
+
+/// Whether the hosting service switched the gateway on for a fleet (decision
+/// 0021). None before the first switch.
+model FleetSwitch {
+  fleetId   String   @id @map("fleet_id")
+  enabled   Boolean
+  changedAt DateTime @map("changed_at") @db.Timestamptz(3)
+
+  @@map("fleet_switches")
+}
+
+/// Whether a fleet's outside parties are on (interop I-3); a fleet without a
+/// row has them off.
+model OutsidePartySwitch {
+  fleetId   String   @id @map("fleet_id")
+  isOn      Boolean  @map("is_on")
+  changedAt DateTime @map("changed_at") @db.Timestamptz(3)
+
+  @@map("outside_party_switches")
+}
+
+/// The installation's requests, by the caller's request id, so a replay answers
+/// what the first call answered. A switch names its fleet and goes with it; a
+/// delete keeps only the request's hash, so nothing of the deleted fleet stays.
+model InstallationRequest {
+  requestId   String   @id @map("request_id")
+  kind        String
+  requestHash String   @map("request_hash")
+  fleetId     String?  @map("fleet_id")
+  enabled     Boolean?
+  at          DateTime @db.Timestamptz(3)
+
+  @@index([fleetId])
+  @@map("installation_requests")
+}
+
+/// The outside parties argo approved (interop I-5): one app proxy ship each,
+/// known by its ship's name in the fleet. The vault: the credential the
+/// gateway calls the party with, kept as squadrons keeps crew tokens, and the
+/// proxy ship's crew token.
+model Party {
+  fleetId          String   @map("fleet_id")
+  name             String
+  kind             String
+  /// An MCP server's: its URL, its credential as JSON (a static bearer, or OAuth client credentials), and its calls at once.
+  url              String?
+  credential       Json?
+  concurrencyLimit Int?     @map("concurrency_limit")
+  /// An MCP client's: its OAuth client id.
+  clientId         String?  @map("client_id")
+  state            String
+  proxyShipId      String?  @map("proxy_ship_id")
+  /// Kept only from the proxy ship's commission until the gateway crews it.
+  secret           String?
+  crewToken        String?  @map("crew_token")
+  requestId        String   @map("request_id")
+  requestHash      String   @map("request_hash")
+  approvedAt       DateTime @map("approved_at") @db.Timestamptz(3)
+
+  @@id([fleetId, name])
+  @@unique([fleetId, clientId])
+  @@map("parties")
+}
+
+/// argo's repeatable marks: a tool of a party whose call may be handed again when it died unanswered (interop 5.2).
+model ToolMark {
+  fleetId String @map("fleet_id")
+  party   String
+  tool    String
+
+  @@id([fleetId, party, tool])
+  @@map("tool_marks")
+}
+
+/// The gateway's calls to outside MCP servers, by delivery: so a restart never calls again what may have run (interop 5.2).
+model Call {
+  deliveryId String @id @map("delivery_id")
+  fleetId    String @map("fleet_id")
+  party      String
+  state      String
+  /// The reply as JSON, kept from the server's answer until it is sent.
+  reply      Json?
+
+  @@index([fleetId])
+  @@map("calls")
+}
+
+/// MCP clients argo pre-registered; a confidential one's secret kept only as its hash.
+model OAuthClient {
+  clientId     String   @id @map("client_id")
+  fleetId      String   @map("fleet_id")
+  name         String
+  redirectUris String[] @map("redirect_uris")
+  secretHash   String?  @map("secret_hash")
+
+  @@index([fleetId])
+  @@map("oauth_clients")
+}
+
+/// The codes argo's approvals issued, kept only as hashes; each taken once.
+model AuthorizationCode {
+  codeHash      String    @id @map("code_hash")
+  fleetId       String    @map("fleet_id")
+  clientId      String    @map("client_id")
+  redirectUri   String    @map("redirect_uri")
+  codeChallenge String    @map("code_challenge")
+  resource      String
+  scope         String?
+  /// The party it stands for, or else the account grant (decision 0054): exactly one of the two.
+  party         String?
+  grantId       String?   @map("grant_id")
+  expiresAt     DateTime  @map("expires_at") @db.Timestamptz(3)
+  usedAt        DateTime? @map("used_at") @db.Timestamptz(3)
+
+  @@index([fleetId])
+  @@map("authorization_codes")
+}
+
+/// The access and refresh tokens the gateway issued, kept only as hashes, a pair per row.
+model IssuedToken {
+  accessHash       String   @id @map("access_hash")
+  refreshHash      String   @unique @map("refresh_hash")
+  familyId         String   @map("family_id")
+  codeHash         String   @map("code_hash")
+  fleetId          String   @map("fleet_id")
+  clientId         String   @map("client_id")
+  resource         String
+  scope            String?
+  /// The party it stands for, or else the account grant (decision 0054): exactly one of the two.
+  party            String?
+  grantId          String?  @map("grant_id")
+  accessExpiresAt  DateTime @map("access_expires_at") @db.Timestamptz(3)
+  refreshExpiresAt DateTime @map("refresh_expires_at") @db.Timestamptz(3)
+  state            String
+
+  @@index([fleetId])
+  @@index([familyId])
+  @@index([codeHash])
+  @@map("issued_tokens")
+}
+
+/// Outside MCP clients' calls: the message each proxy ship sent, and the handle its client reads it by.
+model ClientCall {
+  fleetId    String   @map("fleet_id")
+  messageId  String   @map("message_id")
+  party      String
+  handle     String
+  shipId     String   @map("ship_id")
+  capability        String
+  outputContentType String?  @map("output_content_type")
+  sentAt            DateTime @map("sent_at")
+  deadlineAt        DateTime? @map("deadline_at")
+
+  @@id([fleetId, messageId])
+  @@unique([fleetId, handle])
+  @@map("client_calls")
+}
+
+/// The replies naming an outside client's call, each kept once per delivery before it is acknowledged.
+model ClientCallReply {
+  deliveryId     String   @id @map("delivery_id")
+  fleetId        String   @map("fleet_id")
+  callMessageId  String   @map("call_message_id")
+  messageId      String   @map("message_id")
+  contentType    String   @map("content_type")
+  payload        String
+  receivedAt     DateTime @map("received_at")
+  /// The order kept in, as receivedAt may tie.
+  sequence       Int      @default(autoincrement())
+
+  @@index([fleetId, callMessageId])
+  @@map("client_call_replies")
+}
+
+/// A person's sign-in through pagasae, kept for their MCP client (decision 0054): the account in the fleet, and pagasae's tokens to act as it.
+model AccountGrant {
+  grantId               String   @id @map("grant_id")
+  fleetId               String   @map("fleet_id")
+  accountId             String   @map("account_id")
+  personShipId          String?  @map("person_ship_id")
+  /// The scopes its account token carries.
+  scopes                String[] @default([])
+  /// pagasae's refresh token, kept as crew tokens are.
+  refreshToken          String   @map("refresh_token")
+  accountToken          String   @map("account_token")
+  accountTokenExpiresAt DateTime @map("account_token_expires_at") @db.Timestamptz(3)
+
+  @@index([fleetId])
+  @@map("account_grants")
+}
+
+/// The crew token the gateway holds for a signed-in person's person ship (decision 0054): one crew, shared by every client of its person.
+model PersonCrew {
+  fleetId   String   @map("fleet_id")
+  shipId    String   @map("ship_id")
+  crewToken String   @map("crew_token")
+  crewedAt  DateTime @map("crewed_at") @db.Timestamptz(3)
+
+  @@id([fleetId, shipId])
+  @@map("person_crews")
+}
+
+/// A delivery a person opened, kept until they deal with it, so their answer finds its message and sender (Q28 (a)).
+model OpenedDelivery {
+  fleetId      String   @map("fleet_id")
+  shipId       String   @map("ship_id")
+  deliveryId   String   @map("delivery_id")
+  messageId    String   @map("message_id")
+  senderShipId String   @map("sender_ship_id")
+  from         String
+  title        String
+  openedAt     DateTime @map("opened_at") @db.Timestamptz(3)
+
+  @@id([fleetId, shipId, deliveryId])
+  @@map("opened_deliveries")
+}
+
+/// A pending request for an outside party (decision 0056): an outside MCP client's authorize request, or a person's request for an outside MCP server, kept 7 days.
+/// One open request per client or server in a fleet (partial unique index pending_requests_one_open, in its migration).
+model PendingRequest {
+  fleetId    String    @map("fleet_id")
+  requestId  String    @map("request_id")
+  /// client or server.
+  kind       String
+  /// What one open request is unique by: client:<client id> or server:<url>.
+  subjectKey String    @map("subject_key")
+  clientId   String?   @map("client_id")
+  clientName String?   @map("client_name")
+  url        String?
+  /// The accounts that asked, each with its person ship, as JSON.
+  requesters Json
+  askedAt    DateTime  @map("asked_at") @db.Timestamptz(3)
+  expiresAt  DateTime  @map("expires_at") @db.Timestamptz(3)
+  /// pending, approving, approved, denied or expired.
+  state      String
+  decidedBy  Json?     @map("decided_by")
+  decidedAt  DateTime? @map("decided_at") @db.Timestamptz(3)
+  /// The requesters told the request ended, by account id, as JSON, so their next try asks anew.
+  toldAccountIds Json  @default("[]") @map("told_account_ids")
+
+  @@id([fleetId, requestId])
+  @@index([fleetId, askedAt], map: "pending_requests_fleet_asked")
+  @@map("pending_requests")
+}
+
+/// The outcomes of requests for outside MCP servers still to tell, one per
+/// requester with a person ship, written with the decision or the expiry and
+/// ended once the fleet stored the message or refused it (decision 0056).
+model RequestOutcomeNotice {
+  fleetId      String    @map("fleet_id")
+  requestId    String    @map("request_id")
+  accountId    String    @map("account_id")
+  personShipId String    @map("person_ship_id")
+  url          String
+  /// approved, denied or expired.
+  outcome      String
+  partyName    String?   @map("party_name")
+  createdAt    DateTime  @map("created_at") @db.Timestamptz(3)
+  endedAt      DateTime? @map("ended_at") @db.Timestamptz(3)
+
+  @@id([fleetId, requestId, accountId])
+  @@index([endedAt, createdAt], map: "request_outcome_notices_unended")
+  @@map("request_outcome_notices")
+}
+
+/// The gateway's question to its owner about one request (decision 0056):
+/// kept with its uuid before it is first sent, so a question sent again is the
+/// same question; withdrawn once the request ended.
+model OwnerQuestion {
+  fleetId      String    @map("fleet_id")
+  requestId    String    @map("request_id")
+  questionId   String    @map("question_id")
+  /// The ship asked; null before it is asked, or when the fleet refused it.
+  askedShipId  String?   @map("asked_ship_id")
+  askedAt      DateTime? @map("asked_at") @db.Timestamptz(3)
+  withdrawnAt  DateTime? @map("withdrawn_at") @db.Timestamptz(3)
+
+  @@id([fleetId, requestId])
+  @@map("owner_questions")
+}