@cat-factory/node-server 0.87.9 → 0.88.0

package/dist/repositories/drizzle.js

@@ -2,7 +2,7 @@ import { LLM_WARNING_FINISH_REASONS } from '@cat-factory/kernel';
 import { agentRunKindSchema, decodeInitiativeRow, isWebSearchProvider, } from '@cat-factory/contracts';
 import { decodeEnum, tryDecodeRows, blockInsertValues, blockPatchToColumns, parseIssueIntakeColumn, serializeIssueIntakeColumn, rowToBlock, rowToExecution, executionToDetail, rowToPipeline, rowToSandboxExperiment, rowToSandboxFixture, rowToSandboxGrade, rowToSandboxPromptVersion, rowToSandboxRun, rowToWorkspace, } from '@cat-factory/server';
 import { and, asc, count, desc, eq, gte, inArray, isNull, lt, ne, notInArray, or, sql, } from 'drizzle-orm';
-import { accountInvitations, passwordResetTokens, accountSettings, localSettings, accounts, agentContextSnapshots, agentSearchQueries, agentRuns, blocks, consensusSessions, incidentEnrichmentConnections, observabilityConnections, packageRegistryConnections, emailConnections, llmCallMetrics, provisioningLog, sharedStacks, memberships, mergeThresholdPresets, releaseHealthConfigs, pipelineScheduleRuns, pipelineSchedules, pipelines, requirementReviews, docInterviewSessions, kaizenGradings, kaizenVerifiedCombos, clarityReviews, binaryArtifacts, brainstormSessions, initiatives, sandboxPromptVersions, sandboxFixtures, sandboxExperiments, sandboxRuns, sandboxGrades, services, tokenUsage, trackerSettings, modelPresets, userIdentities, users, userSettings, workspaceFragmentDefaults, workspaceServices, workspaceSettings, workspaces, } from '../db/schema.js';
+import { accountInvitations, passwordResetTokens, accountSettings, localSettings, accounts, agentContextSnapshots, agentSearchQueries, agentRuns, blocks, consensusSessions, incidentEnrichmentConnections, observabilityConnections, packageRegistryConnections, emailConnections, llmCallMetrics, provisioningLog, sharedStacks, memberships, mergeThresholdPresets, releaseHealthConfigs, testSecrets, pipelineScheduleRuns, pipelineSchedules, pipelines, requirementReviews, docInterviewSessions, kaizenGradings, kaizenVerifiedCombos, clarityReviews, binaryArtifacts, brainstormSessions, initiatives, sandboxPromptVersions, sandboxFixtures, sandboxExperiments, sandboxRuns, sandboxGrades, services, tokenUsage, trackerSettings, modelPresets, userIdentities, users, userSettings, workspaceFragmentDefaults, workspaceServices, workspaceSettings, workspaces, } from '../db/schema.js';
 // Drizzle/Postgres implementations of the core kernel repository ports. The
 // row<->domain mapping is the SAME shared mapping the Cloudflare D1 repos use
 // (@cat-factory/server), so behaviour matches across stores; this layer only owns
@@ -3825,6 +3825,77 @@ class DrizzleReleaseHealthConfigRepository {
             .where(and(eq(releaseHealthConfigs.workspace_id, workspaceId), eq(releaseHealthConfigs.block_id, blockId)));
     }
 }
+/**
+ * A service frame's sensitive test credentials over Postgres (the Drizzle mirror of the
+ * Worker's `D1TestSecretsRepository`, migration 0044). At most one row per (workspace, block);
+ * `credentials` is a sealed envelope of the `TestSecretEntry[]` JSON, `summary` a non-secret
+ * `TestSecretRef[]` display blob.
+ */
+export class DrizzleTestSecretsRepository {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    async getByBlock(workspaceId, blockId) {
+        const rows = await this.db
+            .select()
+            .from(testSecrets)
+            .where(and(eq(testSecrets.workspace_id, workspaceId), eq(testSecrets.block_id, blockId)))
+            .limit(1);
+        const row = rows[0];
+        if (!row)
+            return null;
+        return {
+            workspaceId: row.workspace_id,
+            blockId: row.block_id,
+            credentials: row.credentials,
+            summary: row.summary,
+            createdAt: row.created_at,
+            updatedAt: row.updated_at,
+        };
+    }
+    async listByWorkspace(workspaceId) {
+        const rows = await this.db
+            .select()
+            .from(testSecrets)
+            .where(eq(testSecrets.workspace_id, workspaceId))
+            .orderBy(testSecrets.block_id);
+        return rows.map((row) => ({
+            workspaceId: row.workspace_id,
+            blockId: row.block_id,
+            credentials: row.credentials,
+            summary: row.summary,
+            createdAt: row.created_at,
+            updatedAt: row.updated_at,
+        }));
+    }
+    async upsert(record) {
+        const values = {
+            workspace_id: record.workspaceId,
+            block_id: record.blockId,
+            credentials: record.credentials,
+            summary: record.summary,
+            created_at: record.createdAt,
+            updated_at: record.updatedAt,
+        };
+        await this.db
+            .insert(testSecrets)
+            .values(values)
+            .onConflictDoUpdate({
+            target: [testSecrets.workspace_id, testSecrets.block_id],
+            set: {
+                credentials: values.credentials,
+                summary: values.summary,
+                updated_at: values.updated_at,
+            },
+        });
+    }
+    async deleteByBlock(workspaceId, blockId) {
+        await this.db
+            .delete(testSecrets)
+            .where(and(eq(testSecrets.workspace_id, workspaceId), eq(testSecrets.block_id, blockId)));
+    }
+}
 /** Build the Drizzle/Postgres-backed core repositories. */
 export function createDrizzleRepositories(db, clock) {
     return {
@@ -3867,6 +3938,7 @@ export function createDrizzleRepositories(db, clock) {
         incidentEnrichmentConnectionRepository: new DrizzleIncidentEnrichmentConnectionRepository(db),
         accountSettingsRepository: new DrizzleAccountSettingsRepository(db),
         releaseHealthConfigRepository: new DrizzleReleaseHealthConfigRepository(db),
+        testSecretsRepository: new DrizzleTestSecretsRepository(db),
         provisioningLogRepository: new DrizzleProvisioningLogRepository(db),
     };
 }