@anchrd/intel-api 0.2.0

package/dist/adapters/db/db-tools.js

@@ -0,0 +1,200 @@
+import { ToolAnnotations, ToolCapability, ToolSource, } from "@anchrd/intel-contract";
+const sourceColumns = `source.id, source.name, source.url, source.connection_handle,
+  source.enabled, source.created_by, source.created_at, source.updated_at,
+  source.last_discovered_at`;
+const catalogColumns = `${sourceColumns}, tool.name AS tool_name, tool.title AS tool_title,
+  tool.description AS tool_description, tool.input_schema_json, tool.output_schema_json,
+  tool.annotations_json, tool.fingerprint, tool.discovered_at`;
+// Predicate and bindings are produced together: the placeholder count depends on the roles filter,
+// so returning them separately would let a caller shift every binding without the compiler noticing.
+// An empty roles array means "any role", because `IN ()` is invalid SQL.
+function access(actor, now, roles = []) {
+    const role = roles.length ? `AND grant_row.role IN (${roles.map(() => "?").join(", ")})` : "";
+    return {
+        sql: `(source.created_by = ? OR EXISTS (
+    SELECT 1 FROM resource_grants grant_row
+    WHERE grant_row.resource_type = 'tool-source' AND grant_row.resource_id = source.id
+      AND (
+        (grant_row.principal_type = 'user' AND grant_row.principal_id = ?)
+        OR (grant_row.principal_type = 'email' AND lower(grant_row.principal_id) = lower(?))
+        OR (grant_row.principal_type = 'organization' AND grant_row.principal_id = '*')
+      )
+      ${role}
+      AND (grant_row.expires_at IS NULL OR grant_row.expires_at > ?)
+  ))`,
+        bindings: [actor.id, actor.id, actor.email, ...roles, now],
+    };
+}
+function mapSource(row) {
+    return ToolSource.parse({
+        id: row.id,
+        name: row.name,
+        url: row.url,
+        connectionHandle: row.connection_handle,
+        enabled: row.enabled === 1,
+        createdBy: row.created_by,
+        createdAt: row.created_at,
+        updatedAt: row.updated_at,
+        lastDiscoveredAt: row.last_discovered_at,
+    });
+}
+function mapCapability(row) {
+    return ToolCapability.parse({
+        sourceId: row.id,
+        name: row.tool_name,
+        title: row.tool_title,
+        description: row.tool_description,
+        inputSchema: JSON.parse(row.input_schema_json),
+        outputSchema: row.output_schema_json ? JSON.parse(row.output_schema_json) : null,
+        annotations: ToolAnnotations.parse(JSON.parse(row.annotations_json)),
+        fingerprint: row.fingerprint,
+        discoveredAt: row.discovered_at,
+    });
+}
+export function createToolRepository(deps) {
+    const db = deps.db;
+    return {
+        async listVisible(actor) {
+            const allowed = access(actor, deps.now().toISOString());
+            const result = await db
+                .prepare(`SELECT ${sourceColumns} FROM tool_sources source
+          WHERE ${allowed.sql} ORDER BY lower(source.name), source.id`)
+                .bind(...allowed.bindings)
+                .all();
+            return (result.results ?? []).map(mapSource);
+        },
+        async getVisible(actor, sourceId) {
+            const allowed = access(actor, deps.now().toISOString());
+            const row = await db
+                .prepare(`SELECT ${sourceColumns} FROM tool_sources source
+          WHERE source.id = ? AND ${allowed.sql}`)
+                .bind(sourceId, ...allowed.bindings)
+                .first();
+            return row ? mapSource(row) : null;
+        },
+        async canManage(actor, sourceId) {
+            const permitted = access(actor, deps.now().toISOString(), ["manager"]);
+            const row = await db
+                .prepare(`SELECT 1 AS allowed FROM tool_sources source
+          WHERE source.id = ? AND ${permitted.sql}`)
+                .bind(sourceId, ...permitted.bindings)
+                .first();
+            return row?.allowed === 1;
+        },
+        async findIdempotent(actorId, operation, key) {
+            const row = await db
+                .prepare(`SELECT resource_id FROM idempotency_keys
+          WHERE actor_id = ? AND operation = ? AND idempotency_key = ?`)
+                .bind(actorId, operation, key)
+                .first();
+            return row?.resource_id ?? null;
+        },
+        async insertSource(input) {
+            const source = input.source;
+            try {
+                await db.batch([
+                    db
+                        .prepare(`INSERT INTO tool_sources (
+              id, name, url, connection_handle, enabled, created_by,
+              created_at, updated_at, last_discovered_at
+            ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+                        .bind(source.id, source.name, source.url, source.connectionHandle, source.enabled ? 1 : 0, source.createdBy, source.createdAt, source.updatedAt, source.lastDiscoveredAt),
+                    db
+                        .prepare(`INSERT INTO resource_grants (
+              id, resource_type, resource_id, principal_type, principal_id, role,
+              expires_at, created_by, created_at
+            ) VALUES (?, 'tool-source', ?, 'organization', '*', 'viewer', NULL, ?, ?)`)
+                        .bind(input.grantId, source.id, source.createdBy, source.createdAt),
+                    db
+                        .prepare(`INSERT INTO idempotency_keys (
+              actor_id, operation, idempotency_key, resource_id, created_at
+            ) VALUES (?, 'tools.create', ?, ?, ?)`)
+                        .bind(source.createdBy, input.idempotencyKey, source.id, source.createdAt),
+                    db
+                        .prepare(`INSERT INTO audit_events (
+              id, actor_id, action, resource_type, resource_id, metadata_json, occurred_at
+            ) VALUES (?, ?, 'tools.create', 'tool-source', ?, ?, ?)`)
+                        .bind(input.auditId, source.createdBy, source.id, JSON.stringify({ name: source.name, url: source.url }), source.createdAt),
+                ]);
+                return source;
+            }
+            catch (error) {
+                const replayedId = await this.findIdempotent(source.createdBy, "tools.create", input.idempotencyKey);
+                const replayed = replayedId
+                    ? await db
+                        .prepare(`SELECT ${sourceColumns} FROM tool_sources source WHERE source.id = ?`)
+                        .bind(replayedId)
+                        .first()
+                    : null;
+                if (replayed)
+                    return mapSource(replayed);
+                throw error;
+            }
+        },
+        async replaceCatalog(input) {
+            const replayed = await this.findIdempotent(input.actorId, "tools.discover", input.idempotencyKey);
+            if (replayed)
+                return;
+            const statements = [
+                db.prepare("DELETE FROM tool_catalog WHERE source_id = ?").bind(input.sourceId),
+                ...input.capabilities.map((capability) => db
+                    .prepare(`INSERT INTO tool_catalog (
+              source_id, name, title, description, input_schema_json, output_schema_json,
+              annotations_json, fingerprint, discovered_at
+            ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+                    .bind(capability.sourceId, capability.name, capability.title, capability.description, JSON.stringify(capability.inputSchema), capability.outputSchema ? JSON.stringify(capability.outputSchema) : null, JSON.stringify(capability.annotations), capability.fingerprint, capability.discoveredAt)),
+                db
+                    .prepare(`UPDATE tool_sources
+            SET last_discovered_at = ?, updated_at = ?
+            WHERE id = ?`)
+                    .bind(input.discoveredAt, input.discoveredAt, input.sourceId),
+                db
+                    .prepare(`INSERT INTO idempotency_keys (
+            actor_id, operation, idempotency_key, resource_id, created_at
+          ) VALUES (?, 'tools.discover', ?, ?, ?)`)
+                    .bind(input.actorId, input.idempotencyKey, input.sourceId, input.discoveredAt),
+                db
+                    .prepare(`INSERT INTO audit_events (
+            id, actor_id, action, resource_type, resource_id, metadata_json, occurred_at
+          ) VALUES (?, ?, 'tools.discover', 'tool-source', ?, ?, ?)`)
+                    .bind(input.auditId, input.actorId, input.sourceId, JSON.stringify({ toolCount: input.capabilities.length }), input.discoveredAt),
+            ];
+            try {
+                await db.batch(statements);
+            }
+            catch (error) {
+                const concurrentReplay = await this.findIdempotent(input.actorId, "tools.discover", input.idempotencyKey);
+                if (concurrentReplay === input.sourceId)
+                    return;
+                throw error;
+            }
+        },
+        async listCatalogVisible(actor) {
+            const allowed = access(actor, deps.now().toISOString());
+            const result = await db
+                .prepare(`SELECT ${catalogColumns}
+        FROM tool_catalog tool
+        JOIN tool_sources source ON source.id = tool.source_id
+        WHERE source.enabled = 1 AND ${allowed.sql}
+        ORDER BY lower(source.name), lower(coalesce(tool.title, tool.name)), tool.name`)
+                .bind(...allowed.bindings)
+                .all();
+            return (result.results ?? []).map((row) => ({
+                source: mapSource(row),
+                capability: mapCapability(row),
+            }));
+        },
+        async getCapabilityVisible(actor, sourceId, name) {
+            const allowed = access(actor, deps.now().toISOString());
+            const row = await db
+                .prepare(`SELECT ${catalogColumns}
+        FROM tool_catalog tool
+        JOIN tool_sources source ON source.id = tool.source_id
+        WHERE source.id = ? AND tool.name = ? AND source.enabled = 1
+          AND ${allowed.sql}`)
+                .bind(sourceId, name, ...allowed.bindings)
+                .first();
+            return row ? mapCapability(row) : null;
+        },
+    };
+}

package/dist/adapters/db/db.d.ts

@@ -0,0 +1,6 @@
+import type { KnowledgeRepository } from "../../knowledge/knowledge.types.js";
+import type { D1Database } from "./db.types.js";
+export declare function createKnowledgeRepository(deps: {
+    db: D1Database;
+    now(): Date;
+}): KnowledgeRepository;