@byok-sdk/cloud-dataplane 0.6.0 → 0.7.0

package/dist/index.js

@@ -3,11 +3,11 @@ import { DEDUP_RING_CAPACITY, NONCE_TTL_MS, validateActivityAppend, projectTimel
 import { contentHash, ByokCoreError, assertCanonicalTimestamp, isContentHash, tenantObjectKey, objectKeyPrefix, CoreConflictError, isLegalBoardTransition, checkSkillPackManifest, checkSkillPackEntry, SKILL_PACK_ENTRY_PATH, tenantId, SKILL_PACK_MANIFEST_SCHEMA_ID } from '@byok-sdk/core';
 import { AwsClient } from 'aws4fetch';
 import { XMLParser } from 'fast-xml-parser';
+import { decodeEnvelope, isServerToDaemonType, EnvelopeSchema, encodeEnvelope, AgentEgressReliablePayloadSchema } from '@byok-sdk/protocol';
 import { createHash, randomUUID } from 'crypto';
 import { readdir, readFile } from 'fs/promises';
 import { join } from 'path';
 import { fileURLToPath } from 'url';
-import { decodeEnvelope, isServerToDaemonType, EnvelopeSchema, encodeEnvelope } from '@byok-sdk/protocol';
 
 // src/pool.ts
 var defaultTypeParser = pg.types.getTypeParser;
@@ -802,10 +802,11 @@ function toRecord(row) {
     devicePublicKey: row.device_public_key,
     proofKeyId: row.proof_key_id,
     proofKeyEpoch: row.proof_key_epoch,
-    revoked: row.revoked
+    revoked: row.revoked,
+    ...row.capabilities == null ? {} : { capabilities: Object.freeze([...row.capabilities]) }
   };
 }
-var SELECT_COLUMNS = "tenant_id, device_id, product_id, device_name, device_public_key, proof_key_id, proof_key_epoch, revoked";
+var SELECT_COLUMNS = "tenant_id, device_id, product_id, device_name, device_public_key, proof_key_id, proof_key_epoch, revoked, capabilities";
 var PostgresDeviceDirectory = class {
   #pool;
   #clock;
@@ -826,7 +827,8 @@ var PostgresDeviceDirectory = class {
              device_public_key = EXCLUDED.device_public_key,
              proof_key_id = EXCLUDED.proof_key_id,
              proof_key_epoch = EXCLUDED.proof_key_epoch,
-             revoked = false
+             revoked = false,
+             capabilities = NULL
        RETURNING ${SELECT_COLUMNS}`,
       [
         tenant,
@@ -854,6 +856,17 @@ var PostgresDeviceDirectory = class {
       deviceId
     ]);
   }
+  async recordCapabilities(tenant, input) {
+    const result = await this.#pool.query(
+      `UPDATE device
+          SET capabilities = $3::jsonb
+        WHERE tenant_id = $1 AND device_id = $2 AND revoked = false
+      RETURNING ${SELECT_COLUMNS}`,
+      [tenant, input.deviceId, JSON.stringify([...input.capabilities])]
+    );
+    const row = result.rows[0];
+    return row === void 0 ? void 0 : toRecord(row);
+  }
   async list(tenant) {
     const result = await this.#pool.query(
       `SELECT ${SELECT_COLUMNS} FROM device WHERE tenant_id = $1 ORDER BY device_id`,
@@ -1151,18 +1164,25 @@ var PostgresProofRequestReceiptStore = class {
 };
 
 // src/stores/task-attempts.ts
-var TASK_SELECT_COLUMNS = "tenant_id, task_id, device_id, owner_device_id, status, cancel_requested_at, cancel_reason, cancel_message_id, updated_at";
+var TASK_SELECT_COLUMNS = "tenant_id, task_id, device_id, agent_id, agent_profile_revision, owner_device_id, status, terminal_cause, cancel_requested_at, cancel_reason, cancel_message_id, updated_at";
 function taskRowToAttempt(row) {
   return {
     tenantId: row.tenant_id,
     taskId: row.task_id,
     deviceId: row.device_id,
+    ...row.agent_id == null || row.agent_profile_revision == null ? {} : {
+      agentRef: {
+        agentId: row.agent_id,
+        profileRevision: row.agent_profile_revision
+      }
+    },
     // `exactOptionalPropertyTypes` is off here, but an explicit absent key is
     // still what the in-memory reference produces for an unclaimed attempt, and
     // `toEqual` in the suite treats `undefined` and absent alike only for the
     // former.
     ...row.owner_device_id === null ? {} : { ownerDeviceId: row.owner_device_id },
     status: row.status,
+    ...row.terminal_cause == null ? {} : { terminalCause: row.terminal_cause },
     ...row.cancel_requested_at === null ? {} : {
       cancellation: {
         requestedAt: row.cancel_requested_at.toISOString(),
@@ -1181,11 +1201,21 @@ var PostgresTaskAttemptStore = class {
   }
   async open(tenant, input) {
     const inserted = await this.#pool.query(
-      `INSERT INTO task (tenant_id, task_id, device_id, owner_device_id, status, updated_at)
-       VALUES ($1, $2, $3, NULL, 'offered', $4)
+      `INSERT INTO task (
+         tenant_id, task_id, device_id, agent_id, agent_profile_revision,
+         owner_device_id, status, updated_at
+       )
+       VALUES ($1, $2, $3, $4, $5, NULL, 'offered', $6)
        ON CONFLICT (tenant_id, task_id) DO NOTHING
        RETURNING ${TASK_SELECT_COLUMNS}`,
-      [tenant, input.taskId, input.deviceId, this.#now()]
+      [
+        tenant,
+        input.taskId,
+        input.deviceId,
+        input.agentRef?.agentId ?? null,
+        input.agentRef?.profileRevision ?? null,
+        this.#now()
+      ]
     );
     const created = inserted.rows[0];
     if (created !== void 0) return taskRowToAttempt(created);
@@ -1193,6 +1223,23 @@ var PostgresTaskAttemptStore = class {
     if (existing === void 0) throw new Error(`task ${input.taskId} vanished during open`);
     return existing;
   }
+  async reserveAgentOffer(tenant, input) {
+    const inserted = await this.#pool.query(
+      `INSERT INTO task (
+         tenant_id, task_id, device_id, agent_id, agent_profile_revision,
+         owner_device_id, status, updated_at
+       )
+       VALUES ($1, $2, $3, $4, $5, NULL, 'offered', $6)
+       ON CONFLICT (tenant_id, task_id) DO NOTHING
+       RETURNING ${TASK_SELECT_COLUMNS}`,
+      [tenant, input.taskId, input.deviceId, input.agentRef.agentId, input.agentRef.profileRevision, this.#now()]
+    );
+    const created = inserted.rows[0];
+    if (created !== void 0) return { attempt: taskRowToAttempt(created), created: true };
+    const existing = await this.get(tenant, input.taskId);
+    if (existing === void 0) throw new Error(`task ${input.taskId} vanished during Agent offer reservation`);
+    return { attempt: existing, created: false };
+  }
   async get(tenant, taskId) {
     const result = await this.#pool.query(
       `SELECT ${TASK_SELECT_COLUMNS} FROM task WHERE tenant_id = $1 AND task_id = $2`,
@@ -1225,14 +1272,28 @@ var PostgresTaskAttemptStore = class {
   async recordStatus(tenant, input) {
     const result = await this.#pool.query(
       `UPDATE task
-          SET status = $3, updated_at = $4
+          SET status = $3,
+              terminal_cause = COALESCE($7, terminal_cause),
+              updated_at = $4
         WHERE tenant_id = $1 AND task_id = $2
+          AND (
+            (agent_id IS NULL AND agent_profile_revision IS NULL AND $5::text IS NULL AND $6::text IS NULL)
+            OR (agent_id = $5 AND agent_profile_revision = $6)
+          )
           AND (
             (cancel_requested_at IS NULL AND status NOT IN ('complete', 'failed', 'cancelled'))
             OR (cancel_requested_at IS NOT NULL AND $3 = 'cancelled' AND status <> 'cancelled')
           )
       RETURNING ${TASK_SELECT_COLUMNS}`,
-      [tenant, input.taskId, input.status, this.#now()]
+      [
+        tenant,
+        input.taskId,
+        input.status,
+        this.#now(),
+        input.agentRef?.agentId ?? null,
+        input.agentRef?.profileRevision ?? null,
+        input.terminalCause ?? null
+      ]
     );
     const row = result.rows[0];
     return row === void 0 ? this.get(tenant, input.taskId) : taskRowToAttempt(row);
@@ -1790,6 +1851,87 @@ var PostgresApprovalTimelineStore = class {
     return row === void 0 ? void 0 : toTail2(row);
   }
 };
+var SELECT_COLUMNS4 = [
+  "tenant_id",
+  "device_id",
+  "event_id",
+  "agent_id",
+  "agent_profile_revision",
+  "session_ref",
+  "policy_revision",
+  "cursor",
+  "payload_json",
+  "content_hash",
+  "byte_count",
+  "receipt_id",
+  "recorded_at"
+].join(", ");
+function toRecord2(row) {
+  const payload = AgentEgressReliablePayloadSchema.parse({
+    agentRef: { agentId: row.agent_id, profileRevision: row.agent_profile_revision },
+    sessionRef: row.session_ref,
+    policyRevision: row.policy_revision,
+    eventId: row.event_id,
+    cursor: Number(row.cursor),
+    payload: row.payload_json,
+    contentHash: row.content_hash,
+    byteCount: row.byte_count
+  });
+  return {
+    tenantId: row.tenant_id,
+    deviceId: row.device_id,
+    payload,
+    receiptId: row.receipt_id,
+    recordedAt: row.recorded_at.toISOString()
+  };
+}
+var PostgresAgentEgressStore = class {
+  constructor(pool, clock) {
+    this.pool = pool;
+    this.clock = clock;
+  }
+  pool;
+  clock;
+  async record(tenant, input) {
+    const payload = AgentEgressReliablePayloadSchema.parse(input.payload);
+    const inserted = await this.pool.query(
+      `INSERT INTO agent_egress_event (${SELECT_COLUMNS4})
+       VALUES ($1, $2, $3::uuid, $4, $5, $6, $7, $8::bigint, $9::jsonb, $10, $11::integer, $12::uuid, $13)
+       ON CONFLICT (tenant_id, device_id, event_id) DO NOTHING
+       RETURNING ${SELECT_COLUMNS4}`,
+      [
+        tenant,
+        input.deviceId,
+        payload.eventId,
+        payload.agentRef.agentId,
+        payload.agentRef.profileRevision,
+        payload.sessionRef,
+        payload.policyRevision,
+        payload.cursor,
+        JSON.stringify(payload.payload),
+        payload.contentHash,
+        payload.byteCount,
+        input.receiptId,
+        this.clock.now().toISOString()
+      ]
+    );
+    const row = inserted.rows[0];
+    if (row !== void 0) return { record: toRecord2(row), created: true };
+    const existing = await this.get(tenant, input.deviceId, payload.eventId);
+    if (existing === void 0) throw new Error(`Agent egress ${payload.eventId} vanished during first-write record.`);
+    return { record: existing, created: false };
+  }
+  async get(tenant, deviceId, eventId) {
+    const result = await this.pool.query(
+      `SELECT ${SELECT_COLUMNS4}
+         FROM agent_egress_event
+        WHERE tenant_id = $1 AND device_id = $2 AND event_id = $3::uuid`,
+      [tenant, deviceId, eventId]
+    );
+    const row = result.rows[0];
+    return row === void 0 ? void 0 : toRecord2(row);
+  }
+};
 
 // src/stores/device-assertion-replay.ts
 var PostgresDeviceAssertionReplayAuthority = class {
@@ -1853,6 +1995,7 @@ function createPostgresCloudStores(options) {
     tasks: new PostgresTaskAttemptStore(pool, clock),
     cancellations: new PostgresTaskCancellationStore(pool, clock),
     receipts: new PostgresRequestReceiptStore(pool, clock),
+    egress: new PostgresAgentEgressStore(pool, clock),
     proofReceipts: new PostgresProofRequestReceiptStore(pool, clock),
     // A second `PostgresObjectStore` instance, not a shared one: it is a
     // stateless wrapper over the pool, so the two read and write the same rows
@@ -2929,7 +3072,7 @@ var RECORD_COLUMNS = "tenant_id, kind, subject_id, rev, content_hash, byte_size,
 function toBody(row) {
   return row.body_kind === "inline" ? { kind: "inline", body: row.body_inline ?? "" } : { kind: "object", hash: row.body_object_hash ?? "" };
 }
-function toRecord2(row) {
+function toRecord3(row) {
   return {
     tenantId: row.tenant_id,
     kind: row.kind,
@@ -2974,7 +3117,7 @@ var PostgresTruthStore = class {
       ]
     );
     const row = inserted.rows[0];
-    if (row !== void 0) return toRecord2(row);
+    if (row !== void 0) return toRecord3(row);
     const existing = await this.getRecord(tenant, {
       kind: "task.terminal",
       recordKey: input.taskId
@@ -3040,7 +3183,7 @@ var PostgresTruthStore = class {
       ]
     );
     const row = written.rows[0];
-    if (row !== void 0) return toRecord2(row);
+    if (row !== void 0) return toRecord3(row);
     const current = await this.getRecord(tenant, {
       kind: input.kind,
       recordKey: input.recordKey
@@ -3059,7 +3202,7 @@ var PostgresTruthStore = class {
       [tenant, selector.kind, selector.recordKey]
     );
     const row = result.rows[0];
-    return row === void 0 ? void 0 : toRecord2(row);
+    return row === void 0 ? void 0 : toRecord3(row);
   }
   async listManifest(tenant, query) {
     const result = await this.#pool.query(
@@ -3107,7 +3250,7 @@ var RECEIPT_COLUMNS = "tenant_id, device_id, request_id, operation, resource, bo
 function toBody2(row) {
   return row.body_kind === "inline" ? { kind: "inline", body: row.body_inline ?? "" } : { kind: "object", hash: row.body_object_hash ?? "" };
 }
-function toRecord3(tenant, row) {
+function toRecord4(tenant, row) {
   return {
     tenantId: tenant,
     kind: row.kind,
@@ -3284,7 +3427,7 @@ var PostgresTruthCommitter = class {
       );
       current.set(
         writeKey(write),
-        result.rows[0] === void 0 ? void 0 : toRecord3(tenant, result.rows[0])
+        result.rows[0] === void 0 ? void 0 : toRecord4(tenant, result.rows[0])
       );
     }
     return current;
@@ -3497,7 +3640,7 @@ var PostgresTruthCommitter = class {
       applied.push({
         input: write,
         before,
-        record: toRecord3(tenant, result.rows[0]),
+        record: toRecord4(tenant, result.rows[0]),
         mutated: true
       });
     }
@@ -4761,6 +4904,7 @@ var TENANT_ERASURE_TABLES = [
   "board_item",
   "tenant_stream",
   "outbox",
+  "agent_egress_event",
   "device_request_receipts",
   "proof_request_receipt",
   "task",