@alma-harness/postgres 0.1.0 → 0.2.0

package/dist/index.js

@@ -1,11 +1,9 @@
 // src/session-store.ts
 import { assertWellFormed, scopePath as scopePath2 } from "@alma-harness/core";
 
-// src/scoped.ts
-import { scopePath } from "@alma-harness/core";
-
 // src/schema.ts
 var DEFAULT_RLS_ROLE = "alma_app";
+var DEFAULT_RETENTION_ROLE = "alma_retention";
 var IDENTIFIER = /^[a-z_][a-z0-9_]*$/;
 function assertRoleIdentifier(role) {
   if (!IDENTIFIER.test(role)) {
@@ -30,6 +28,29 @@ create policy ${name} on ${table}
   );
 `;
 }
+function retentionPolicySql(table, retentionRole, name) {
+  assertRoleIdentifier(table);
+  assertRoleIdentifier(retentionRole);
+  assertRoleIdentifier(name);
+  return `
+drop policy if exists ${name}_read on ${table};
+create policy ${name}_read on ${table}
+  for select
+  to ${retentionRole}
+  using (true);
+
+drop policy if exists ${name} on ${table};
+create policy ${name} on ${table}
+  for delete
+  to ${retentionRole}
+  using (true);`;
+}
+function assertIso8601(at, label = "timestamp") {
+  if (Number.isNaN(Date.parse(at))) {
+    throw new Error(`invalid ISO 8601 ${label}: ${JSON.stringify(at)}`);
+  }
+  return at;
+}
 function roleBootstrapSql(role) {
   assertRoleIdentifier(role);
   return `
@@ -38,16 +59,26 @@ begin
   if not exists (select from pg_roles where rolname = '${role}') then
     begin
       create role ${role} nologin;
-    exception when duplicate_object then
+    exception when duplicate_object or unique_violation then
       -- Another instance won the race between the existence check and the
       -- create (pg_roles is cluster-wide and CREATE ROLE has no IF NOT
       -- EXISTS); losing it must not roll back the rest of the migration.
+      -- Two creates that overlap surface as unique_violation on
+      -- pg_authid, not duplicate_object (review of 056\u2013058).
       null;
     end;
   end if;
 end $$;
 `;
 }
+function grantRoleSql(role, to) {
+  assertRoleIdentifier(role);
+  assertRoleIdentifier(to);
+  return `grant ${role} to ${to};`;
+}
+async function grantRole(pool, opts) {
+  await pool.query(grantRoleSql(opts.role ?? DEFAULT_RLS_ROLE, opts.to));
+}
 function sessionStoreMigrationSql(role = DEFAULT_RLS_ROLE) {
   assertRoleIdentifier(role);
   return `
@@ -84,6 +115,7 @@ async function migrateSessionStore(pool, opts = {}) {
 }
 
 // src/scoped.ts
+import { scopePath } from "@alma-harness/core";
 var DEFAULT_STATEMENT_TIMEOUT_MS = 3e4;
 function resolveRlsRole(opts) {
   const role = opts.role === void 0 ? DEFAULT_RLS_ROLE : opts.role;
@@ -97,19 +129,12 @@ function resolveStatementTimeout(opts) {
   }
   return ms;
 }
-async function inScope(pool, role, scope, fn, statementTimeoutMs = DEFAULT_STATEMENT_TIMEOUT_MS) {
-  scopePath(scope);
+async function inTransaction(pool, role, fn) {
   const client = await pool.connect();
   let rollbackFailed;
   try {
     await client.query("begin");
     if (role !== null) await client.query(`set local role ${role}`);
-    await client.query(
-      `select set_config('alma.org', $1, true),
-              set_config('alma.uid', $2, true),
-              set_config('statement_timeout', $3, true)`,
-      [scope.org, scope.uid, statementTimeoutMs === null ? "0" : String(statementTimeoutMs)]
-    );
     const result = await fn(client);
     await client.query("commit");
     return result;
@@ -122,6 +147,37 @@ async function inScope(pool, role, scope, fn, statementTimeoutMs = DEFAULT_STATE
     client.release(rollbackFailed === void 0 ? void 0 : rollbackFailed);
   }
 }
+async function sweepBefore(pool, opts) {
+  assertRoleIdentifier(opts.table);
+  assertRoleIdentifier(opts.column);
+  const batch = opts.batch ?? 5e3;
+  if (!Number.isInteger(batch) || batch < 1) throw new Error(`batch must be a positive integer, got ${batch}`);
+  let total = 0;
+  for (; ; ) {
+    const removed = await inTransaction(pool, opts.role, async (client) => {
+      const { rowCount } = await client.query(
+        `delete from ${opts.table}
+         where ctid = any(array(select ctid from ${opts.table} where ${opts.column} < $1::timestamptz limit $2))`,
+        [opts.before, batch]
+      );
+      return rowCount ?? 0;
+    });
+    total += removed;
+    if (removed < batch) return total;
+  }
+}
+async function inScope(pool, role, scope, fn, statementTimeoutMs = DEFAULT_STATEMENT_TIMEOUT_MS) {
+  scopePath(scope);
+  return inTransaction(pool, role, async (client) => {
+    await client.query(
+      `select set_config('alma.org', $1, true),
+              set_config('alma.uid', $2, true),
+              set_config('statement_timeout', $3, true)`,
+      [scope.org, scope.uid, statementTimeoutMs === null ? "0" : String(statementTimeoutMs)]
+    );
+    return fn(client);
+  });
+}
 
 // src/session-store.ts
 var PostgresSessionStore = class {
@@ -205,7 +261,7 @@ var PostgresSessionStore = class {
       const removals = [];
       for (const row of rows) {
         const survivors = row.msg.blocks.filter(
-          (b) => b.type !== "tool_call" && b.type !== "tool_result"
+          (b) => b.type !== "tool_call" && b.type !== "tool_result" && b.type !== "reasoning"
         );
         if (survivors.length === row.msg.blocks.length) continue;
         blocks += row.msg.blocks.length - survivors.length;
@@ -249,11 +305,7 @@ var PostgresSessionStore = class {
     return inScope(this.#pool, this.#role, scope, fn, this.#timeoutMs);
   }
 };
-function instant(at) {
-  const ms = Date.parse(at);
-  if (Number.isNaN(ms)) throw new Error(`invalid ISO 8601 timestamp: ${JSON.stringify(at)}`);
-  return ms;
-}
+var instant = (at) => Date.parse(assertIso8601(at));
 
 // src/memory-stores.ts
 import {
@@ -1075,7 +1127,6 @@ var AUDIT_ROUTING_TABLE = "alma_audit_routing";
 var AUDIT_COST_TABLE = "alma_audit_cost";
 var AUDIT_RECALL_TABLE = "alma_audit_recall";
 var AUDIT_CONTEXT_TABLE = "alma_audit_context";
-var DEFAULT_RETENTION_ROLE = "alma_retention";
 var AUDIT_TABLES = [
   AUDIT_ACCESS_TABLE,
   AUDIT_ROUTING_TABLE,
@@ -1225,25 +1276,11 @@ grant select, insert
 -- 039 review caught: a retention mechanism that silently retains forever, in
 -- exactly the deployments careful enough not to connect as a superuser.
 --
--- TWO policies, not one. A FOR DELETE policy alone still deleted nothing,
--- because a DELETE with a WHERE clause must SCAN the rows to filter them, and
--- the scope-keyed policy is FOR ALL -- which governs SELECT too. That second
--- step surfaced only by running the statement; it does not follow from reading
--- the first fix.
-${AUDIT_TABLES.map(
-    (t) => `
-drop policy if exists alma_audit_retention_read on ${t};
-create policy alma_audit_retention_read on ${t}
-  for select
-  to ${retentionRole}
-  using (true);
-
-drop policy if exists alma_audit_retention on ${t};
-create policy alma_audit_retention on ${t}
-  for delete
-  to ${retentionRole}
-  using (true);`
-  ).join("")}
+-- TWO policies, not one (see retentionPolicySql). A FOR DELETE policy alone
+-- still deleted nothing, because a DELETE with a WHERE clause must SCAN the
+-- rows to filter them, and the scope-keyed policy is FOR ALL -- which governs
+-- SELECT too. That second step surfaced only by running the statement.
+${AUDIT_TABLES.map((t) => retentionPolicySql(t, retentionRole, "alma_audit_retention")).join("")}
 
 grant select, delete
   on ${AUDIT_TABLES.join(", ")}
@@ -1258,32 +1295,15 @@ async function purgeAuditBefore(pool, windows, opts = {}) {
   assertRoleIdentifier(retentionRole);
   for (const table of AUDIT_TABLES) {
     const before = windows[table];
-    if (before !== void 0 && Number.isNaN(Date.parse(before))) {
-      throw new Error(`invalid ISO 8601 timestamp for ${table}: ${JSON.stringify(before)}`);
-    }
+    if (before !== void 0) assertIso8601(before, `timestamp for ${table}`);
   }
   const purged = {};
-  const client = await pool.connect();
-  try {
-    await client.query("begin");
-    await client.query(`set local role ${retentionRole}`);
-    for (const table of AUDIT_TABLES) {
-      const before = windows[table];
-      if (before === void 0) continue;
-      const { rowCount } = await client.query(
-        `delete from ${table} where at < $1::timestamptz`,
-        [before]
-      );
-      purged[table] = rowCount ?? 0;
-    }
-    await client.query("commit");
-    return purged;
-  } catch (err) {
-    await client.query("rollback").catch(() => void 0);
-    throw err;
-  } finally {
-    client.release();
+  for (const table of AUDIT_TABLES) {
+    const before = windows[table];
+    if (before === void 0) continue;
+    purged[table] = await sweepBefore(pool, { role: retentionRole, table, column: "at", before, ...opts.batch !== void 0 ? { batch: opts.batch } : {} });
   }
+  return purged;
 }
 
 // src/audit-store.ts
@@ -1439,12 +1459,7 @@ var PostgresAuditLog = class {
     }, this.#timeoutMs);
   }
 };
-function instant2(at) {
-  if (Number.isNaN(Date.parse(at))) {
-    throw new Error(`invalid ISO 8601 timestamp: ${JSON.stringify(at)}`);
-  }
-  return at;
-}
+var instant2 = (at) => assertIso8601(at);
 
 // src/turn-store.ts
 import {
@@ -1455,8 +1470,9 @@ import {
 // src/turn-schema.ts
 var TURN_LEASES_TABLE = "alma_turn_leases";
 var TURN_CLAIMS_TABLE = "alma_turn_claims";
-function turnStoreMigrationSql(role = DEFAULT_RLS_ROLE) {
+function turnStoreMigrationSql(role = DEFAULT_RLS_ROLE, retentionRole = DEFAULT_RETENTION_ROLE) {
   assertRoleIdentifier(role);
+  assertRoleIdentifier(retentionRole);
   return `
 create table if not exists ${TURN_LEASES_TABLE} (
   org        text        not null,
@@ -1476,15 +1492,30 @@ create table if not exists ${TURN_CLAIMS_TABLE} (
   created_at      timestamptz not null default now(),
   primary key (org, uid, session_id, idempotency_key)
 );
+
+create index if not exists alma_turn_claims_created
+  on ${TURN_CLAIMS_TABLE} (created_at);
 ${rlsPolicySql(TURN_LEASES_TABLE)}${rlsPolicySql(TURN_CLAIMS_TABLE)}
 ${roleBootstrapSql(role)}
+${roleBootstrapSql(retentionRole)}
 grant select, insert, update, delete
   on ${TURN_LEASES_TABLE}, ${TURN_CLAIMS_TABLE}
   to ${role};
+${retentionPolicySql(TURN_CLAIMS_TABLE, retentionRole, "alma_turn_claims_retention")}
+
+grant select, delete
+  on ${TURN_CLAIMS_TABLE}
+  to ${retentionRole};
 `;
 }
 async function migrateTurnStore(pool, opts = {}) {
-  await pool.query(turnStoreMigrationSql(opts.role));
+  await pool.query(turnStoreMigrationSql(opts.role, opts.retentionRole));
+}
+async function purgeTurnClaimsBefore(pool, before, opts = {}) {
+  const role = opts.retentionRole ?? DEFAULT_RETENTION_ROLE;
+  assertRoleIdentifier(role);
+  assertIso8601(before);
+  return sweepBefore(pool, { role, table: TURN_CLAIMS_TABLE, column: "created_at", before, ...opts.batch !== void 0 ? { batch: opts.batch } : {} });
 }
 
 // src/turn-store.ts
@@ -1607,12 +1638,10 @@ var PostgresTurnStore = class {
     await this.#inScope(scope, async (client) => {
       const params = sessionId === void 0 ? [scope.org, scope.uid] : [scope.org, scope.uid, sessionId];
       const bySession = sessionId === void 0 ? "" : " and session_id = $3";
-      for (const table of [TURN_CLAIMS_TABLE, TURN_LEASES_TABLE]) {
-        await client.query(
-          `delete from ${table} where org = $1 and uid = $2${bySession}`,
-          params
-        );
-      }
+      await client.query(
+        `delete from ${TURN_CLAIMS_TABLE} where org = $1 and uid = $2${bySession}`,
+        params
+      );
     });
   }
   /** Shared RLS binding — see `scoped.ts`. */
@@ -1630,6 +1659,165 @@ function assertLeaseOpts(opts) {
     }
   }
 }
+
+// src/routine-run-store.ts
+import { scopePath as scopePath5 } from "@alma-harness/core";
+
+// src/routine-schema.ts
+var ROUTINE_RUNS_TABLE = "alma_routine_runs";
+function routineRunStoreMigrationSql(role = DEFAULT_RLS_ROLE, retentionRole = DEFAULT_RETENTION_ROLE) {
+  assertRoleIdentifier(role);
+  assertRoleIdentifier(retentionRole);
+  return `
+create table if not exists ${ROUTINE_RUNS_TABLE} (
+  org           text             not null,
+  uid           text             not null,
+  routine_id    text             not null,
+  run_id        text             not null,
+  started_at    timestamptz      not null,
+  finished_at   timestamptz,
+  outcome       text             not null,
+  reason        text,
+  cost_usd      double precision not null,
+  session_id    text,
+  turn_id       text,
+  handle        jsonb,
+  delivery_hash text,
+  primary key (org, uid, routine_id, run_id),
+  constraint alma_routine_runs_outcome_check
+    check (outcome in ('delivered', 'duplicate', 'submitted', 'waiting', 'refused', 'failed'))
+);
+
+create index if not exists alma_routine_runs_recent
+  on ${ROUTINE_RUNS_TABLE} (org, uid, routine_id, started_at desc);
+${rlsPolicySql(ROUTINE_RUNS_TABLE)}
+${roleBootstrapSql(role)}
+${roleBootstrapSql(retentionRole)}
+grant select, insert, update
+  on ${ROUTINE_RUNS_TABLE}
+  to ${role};
+${retentionPolicySql(ROUTINE_RUNS_TABLE, retentionRole, "alma_routine_runs_retention")}
+
+grant select, delete
+  on ${ROUTINE_RUNS_TABLE}
+  to ${retentionRole};
+`;
+}
+async function migrateRoutineRunStore(pool, opts = {}) {
+  await pool.query(routineRunStoreMigrationSql(opts.role, opts.retentionRole));
+}
+async function purgeRoutineRunsBefore(pool, before, opts = {}) {
+  const role = opts.retentionRole ?? DEFAULT_RETENTION_ROLE;
+  assertRoleIdentifier(role);
+  assertIso8601(before);
+  return sweepBefore(pool, { role, table: ROUTINE_RUNS_TABLE, column: "started_at", before, ...opts.batch !== void 0 ? { batch: opts.batch } : {} });
+}
+
+// src/routine-run-store.ts
+var COLUMNS = "routine_id, run_id, started_at, finished_at, outcome, reason, cost_usd, session_id, turn_id, handle, delivery_hash";
+var PostgresRoutineRunStore = class {
+  #pool;
+  #role;
+  #timeoutMs;
+  constructor(pool, opts = {}) {
+    this.#pool = pool;
+    this.#role = resolveRlsRole(opts);
+    this.#timeoutMs = resolveStatementTimeout(opts);
+  }
+  async record(run) {
+    scopePath5(run.scope);
+    assertIso8601(run.startedAt, "startedAt");
+    if (run.finishedAt !== void 0) assertIso8601(run.finishedAt, "finishedAt");
+    await this.#inScope(run.scope, async (client) => {
+      await client.query(
+        `insert into ${ROUTINE_RUNS_TABLE}
+           (org, uid, routine_id, run_id, started_at, finished_at, outcome, reason, cost_usd,
+            session_id, turn_id, handle, delivery_hash)
+         values ($1, $2, $3, $4, $5::timestamptz, $6::timestamptz, $7, $8, $9, $10, $11, $12::jsonb, $13)
+         on conflict (org, uid, routine_id, run_id) do update set
+           started_at = excluded.started_at, finished_at = excluded.finished_at,
+           outcome = excluded.outcome, reason = excluded.reason, cost_usd = excluded.cost_usd,
+           session_id = excluded.session_id, turn_id = excluded.turn_id,
+           handle = excluded.handle, delivery_hash = excluded.delivery_hash`,
+        [
+          run.scope.org,
+          run.scope.uid,
+          run.routineId,
+          run.id,
+          run.startedAt,
+          run.finishedAt ?? null,
+          run.outcome,
+          run.reason ?? null,
+          run.costUsd,
+          run.sessionId ?? null,
+          run.turnId ?? null,
+          run.handle === void 0 ? null : JSON.stringify(run.handle),
+          run.deliveryHash ?? null
+        ]
+      );
+    });
+  }
+  async get(scope, routineId, runId) {
+    return this.#inScope(scope, async (client) => {
+      const { rows } = await client.query(
+        `select ${COLUMNS} from ${ROUTINE_RUNS_TABLE}
+         where org = $1 and uid = $2 and routine_id = $3 and run_id = $4`,
+        [scope.org, scope.uid, routineId, runId]
+      );
+      return rows[0] === void 0 ? null : toRun(scope, rows[0]);
+    });
+  }
+  async list(scope, routineId, opts = {}) {
+    scopePath5(scope);
+    if (opts.since !== void 0) assertIso8601(opts.since, "since");
+    if (opts.limit !== void 0 && opts.limit <= 0) return [];
+    return this.#inScope(scope, async (client) => {
+      const params = [scope.org, scope.uid, routineId];
+      const where = ["org = $1", "uid = $2", "routine_id = $3"];
+      if (opts.since !== void 0) {
+        params.push(opts.since);
+        where.push(`started_at >= $${params.length}::timestamptz`);
+      }
+      if (opts.outcome !== void 0) {
+        params.push(opts.outcome);
+        where.push(`outcome = $${params.length}`);
+      }
+      let limit = "";
+      if (opts.limit !== void 0) {
+        params.push(opts.limit);
+        limit = ` limit $${params.length}`;
+      }
+      const { rows } = await client.query(
+        `select ${COLUMNS} from ${ROUTINE_RUNS_TABLE}
+         where ${where.join(" and ")}
+         order by started_at desc, run_id asc${limit}`,
+        params
+      );
+      return rows.map((row) => toRun(scope, row));
+    });
+  }
+  /** Shared RLS binding — see `scoped.ts`. */
+  async #inScope(scope, fn) {
+    return inScope(this.#pool, this.#role, scope, fn, this.#timeoutMs);
+  }
+};
+function toRun(scope, row) {
+  const run = {
+    id: row.run_id,
+    routineId: row.routine_id,
+    scope: { org: scope.org, uid: scope.uid },
+    startedAt: row.started_at.toISOString(),
+    outcome: row.outcome,
+    costUsd: row.cost_usd
+  };
+  if (row.finished_at !== null) run.finishedAt = row.finished_at.toISOString();
+  if (row.reason !== null) run.reason = row.reason;
+  if (row.session_id !== null) run.sessionId = row.session_id;
+  if (row.turn_id !== null) run.turnId = row.turn_id;
+  if (row.handle !== null) run.handle = row.handle;
+  if (row.delivery_hash !== null) run.deliveryHash = row.delivery_hash;
+  return run;
+}
 export {
   AUDIT_ACCESS_TABLE,
   AUDIT_CONTEXT_TABLE,
@@ -1645,27 +1833,39 @@ export {
   PostgresEpisodeStore,
   PostgresErasureWatermarks,
   PostgresProfileStore,
+  PostgresRoutineRunStore,
   PostgresSessionStore,
   PostgresSpendStore,
   PostgresTurnStore,
+  ROUTINE_RUNS_TABLE,
   SCOPE_STATE_TABLE,
   SPEND_SESSIONS_TABLE,
   SPEND_TENANT_DAYS_TABLE,
   TURN_CLAIMS_TABLE,
   TURN_LEASES_TABLE,
+  assertIso8601,
   assertRoleIdentifier,
   auditLogMigrationSql,
+  grantRole,
+  grantRoleSql,
+  inTransaction,
   memoryStoreMigrationSql,
   migrateAuditLog,
   migrateMemoryStores,
+  migrateRoutineRunStore,
   migrateSessionStore,
   migrateSpendStore,
   migrateTurnStore,
   purgeAuditBefore,
+  purgeRoutineRunsBefore,
+  purgeTurnClaimsBefore,
+  retentionPolicySql,
   rlsPolicySql,
   roleBootstrapSql,
+  routineRunStoreMigrationSql,
   sessionStoreMigrationSql,
   spendStoreMigrationSql,
+  sweepBefore,
   turnStoreMigrationSql
 };
 //# sourceMappingURL=index.js.map