@cat-factory/worker 0.141.1 → 0.143.0

package/dist/infrastructure/workflows/retention.js.map

@@ -1 +1 @@
-{"version":3,"file":"retention.js","sourceRoot":"","sources":["../../../src/infrastructure/workflows/retention.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAEhE,+EAA+E;AAC/E,MAAM,yBAAyB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAEzD;;;;;GAKG;AACH,MAAM,qCAAqC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAwEtE;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EACnC,oBAAoB,EACpB,mBAAmB,EACnB,gBAAgB,EAChB,uBAAuB,EACvB,8BAA8B,EAC9B,0BAA0B,EAC1B,gCAAgC,EAChC,0BAA0B,EAC1B,yBAAyB,EACzB,4BAA4B,EAC5B,sBAAsB,EACtB,KAAK,EACL,MAAM,EACN,MAAM,GACQ;IACd,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,CAAA;IACvB,MAAM,IAAI,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAA;IACxC,OAAO;QACL,UAAU,EAAE,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,MAAM,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAC1E,oBAAoB,CAAC,eAAe,CAAC,CAAC,CAAC,CACxC;QACD,UAAU,EAAE,MAAM,IAAI,CAAC,KAAK,CAAC,oBAAoB,EAAE,MAAM,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAChF,mBAAmB,CAAC,eAAe,CAAC,CAAC,CAAC,CACvC;QACD,OAAO,EAAE,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CACtE,gBAAgB,CAAC,eAAe,CAAC,CAAC,CAAC,CACpC;QACD,cAAc,EAAE,MAAM,IAAI,CAAC,KAAK,CAAC,kBAAkB,EAAE,MAAM,CAAC,gBAAgB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CACvF,uBAAuB,CAAC,eAAe,CAAC,CAAC,CAAC,CAC3C;QACD,+EAA+E;QAC/E,qBAAqB,EAAE,MAAM,IAAI,CAAC,KAAK,CACrC,yBAAyB,EACzB,MAAM,CAAC,gBAAgB,EACvB,GAAG,EACH,CAAC,CAAC,EAAE,EAAE,CAAC,8BAA8B,CAAC,eAAe,CAAC,CAAC,CAAC,CACzD;QACD,wEAAwE;QACxE,kBAAkB,EAAE,MAAM,IAAI,CAAC,KAAK,CAClC,sBAAsB,EACtB,MAAM,CAAC,gBAAgB,EACvB,GAAG,EACH,CAAC,CAAC,EAAE,EAAE,CAAC,0BAA0B,CAAC,eAAe,CAAC,CAAC,CAAC,CACrD;QACD,+EAA+E;QAC/E,uBAAuB,EAAE,MAAM,IAAI,CAAC,KAAK,CACvC,2BAA2B,EAC3B,qCAAqC,EACrC,GAAG,EACH,CAAC,CAAC,EAAE,EAAE,CAAC,gCAAgC,CAAC,eAAe,CAAC,CAAC,CAAC,CAC3D;QACD,YAAY,EAAE,0BAA0B;YACtC,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,wBAAwB,EAAE,yBAAyB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAC/E,0BAA0B,CAAC,eAAe,CAAC,CAAC,CAAC,CAC9C;YACH,CAAC,CAAC,CAAC;QACL,eAAe,EAAE,yBAAyB;YACxC,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,kBAAkB,EAAE,MAAM,CAAC,iBAAiB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CACxE,yBAAyB,CAAC,eAAe,CAAC,CAAC,CAAC,CAC7C;YACH,CAAC,CAAC,CAAC;QACL,4DAA4D;QAC5D,mBAAmB,EAAE,4BAA4B;YAC/C,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAC9C,4BAA4B,CAAC,aAAa,CAAC,GAAG,CAAC,CAChD;YACH,CAAC,CAAC,CAAC;QACL,kFAAkF;QAClF,aAAa,EAAE,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAClF,sBAAsB,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAClD;QACD,YAAY,EAAE,IAAI,CAAC,MAAM;KAC1B,CAAA;AACH,CAAC"}
+{"version":3,"file":"retention.js","sourceRoot":"","sources":["../../../src/infrastructure/workflows/retention.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAE,0BAA0B,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAE5F,+EAA+E;AAC/E,MAAM,yBAAyB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAEzD,8FAA8F;AAC9F,+FAA+F;AAC/F,iGAAiG;AACjG,iGAAiG;AACjG,8DAA8D;AAC9D,MAAM,yBAAyB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAEhD;;;;;GAKG;AACH,MAAM,qCAAqC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAmGtE;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EACnC,oBAAoB,EACpB,mBAAmB,EACnB,gBAAgB,EAChB,uBAAuB,EACvB,8BAA8B,EAC9B,0BAA0B,EAC1B,gCAAgC,EAChC,0BAA0B,EAC1B,yBAAyB,EACzB,4BAA4B,EAC5B,qBAAqB,EACrB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,yBAAyB,EACzB,KAAK,EACL,MAAM,EACN,MAAM,GACQ;IACd,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,CAAA;IACvB,MAAM,IAAI,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAA;IACxC,OAAO;QACL,UAAU,EAAE,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,MAAM,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAC1E,oBAAoB,CAAC,eAAe,CAAC,CAAC,CAAC,CACxC;QACD,UAAU,EAAE,MAAM,IAAI,CAAC,KAAK,CAAC,oBAAoB,EAAE,MAAM,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAChF,mBAAmB,CAAC,eAAe,CAAC,CAAC,CAAC,CACvC;QACD,OAAO,EAAE,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CACtE,gBAAgB,CAAC,eAAe,CAAC,CAAC,CAAC,CACpC;QACD,cAAc,EAAE,MAAM,IAAI,CAAC,KAAK,CAAC,kBAAkB,EAAE,MAAM,CAAC,gBAAgB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CACvF,uBAAuB,CAAC,eAAe,CAAC,CAAC,CAAC,CAC3C;QACD,+EAA+E;QAC/E,qBAAqB,EAAE,MAAM,IAAI,CAAC,KAAK,CACrC,yBAAyB,EACzB,MAAM,CAAC,gBAAgB,EACvB,GAAG,EACH,CAAC,CAAC,EAAE,EAAE,CAAC,8BAA8B,CAAC,eAAe,CAAC,CAAC,CAAC,CACzD;QACD,wEAAwE;QACxE,kBAAkB,EAAE,MAAM,IAAI,CAAC,KAAK,CAClC,sBAAsB,EACtB,MAAM,CAAC,gBAAgB,EACvB,GAAG,EACH,CAAC,CAAC,EAAE,EAAE,CAAC,0BAA0B,CAAC,eAAe,CAAC,CAAC,CAAC,CACrD;QACD,+EAA+E;QAC/E,uBAAuB,EAAE,MAAM,IAAI,CAAC,KAAK,CACvC,2BAA2B,EAC3B,qCAAqC,EACrC,GAAG,EACH,CAAC,CAAC,EAAE,EAAE,CAAC,gCAAgC,CAAC,eAAe,CAAC,CAAC,CAAC,CAC3D;QACD,YAAY,EAAE,0BAA0B;YACtC,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,wBAAwB,EAAE,yBAAyB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAC/E,0BAA0B,CAAC,eAAe,CAAC,CAAC,CAAC,CAC9C;YACH,CAAC,CAAC,CAAC;QACL,eAAe,EAAE,yBAAyB;YACxC,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,kBAAkB,EAAE,MAAM,CAAC,iBAAiB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CACxE,yBAAyB,CAAC,eAAe,CAAC,CAAC,CAAC,CAC7C;YACH,CAAC,CAAC,CAAC;QACL,4DAA4D;QAC5D,mBAAmB,EAAE,4BAA4B;YAC/C,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAC9C,4BAA4B,CAAC,aAAa,CAAC,GAAG,CAAC,CAChD;YACH,CAAC,CAAC,CAAC;QACL,8EAA8E;QAC9E,YAAY,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,GAAG,EAAE,CACpD,qBAAqB,CAAC,aAAa,CAAC,GAAG,CAAC,CACzC;QACD,mEAAmE;QACnE,YAAY,EAAE,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,yBAAyB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CACpF,qBAAqB,CAAC,eAAe,CAAC,CAAC,CAAC,CACzC;QACD,kFAAkF;QAClF,aAAa,EAAE,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAClF,sBAAsB,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAClD;QACD,2DAA2D;QAC3D,YAAY,EAAE,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,MAAM,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAChF,qBAAqB,CAAC,eAAe,CAAC,CAAC,CAAC,CACzC;QACD,wFAAwF;QACxF,wFAAwF;QACxF,sDAAsD;QACtD,eAAe,EAAE,MAAM,IAAI,CAAC,WAAW,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAChE,yBAAyB,CAAC,aAAa,CAAC,GAAG,GAAG,0BAA0B,EAAE,GAAG,CAAC,CAC/E;QACD,OAAO,EAAE,MAAM,IAAI,CAAC,KAAK,CAAC,mBAAmB,EAAE,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAC1E,yBAAyB,CAAC,sBAAsB,CAAC,CAAC,CAAC,CACpD;QACD,YAAY,EAAE,IAAI,CAAC,MAAM;KAC1B,CAAA;AACH,CAAC"}

package/migrations/0077_machine_nodes.sql

@@ -0,0 +1,20 @@
+-- The machine-node roster + revocation tombstones (SEC-5 / security-hardening item 8).
+-- One row per nodeId a mothership has minted a machine token for: recording the mint is
+-- what makes "revoke MY node" checkable (without a roster a revoke endpoint either trusts
+-- a caller-supplied nodeId or cannot exist). `revoked_at` is a tombstone consulted by the
+-- shared machine gate on every /internal/* call; it is never cleared, and a revoked
+-- node_id can never be re-minted. Rows past `expires_at` (the latest signed exp, which no
+-- token for the node can outlive) are pruned by the retention sweep.
+-- Mirrors the Node Drizzle `machineNodes` table (db/tables/identity.ts); keep in step.
+CREATE TABLE machine_nodes (
+  node_id TEXT PRIMARY KEY,
+  user_id TEXT NOT NULL,
+  account_ids TEXT NOT NULL,
+  created_at INTEGER NOT NULL,
+  last_minted_at INTEGER NOT NULL,
+  expires_at INTEGER NOT NULL,
+  revoked_at INTEGER,
+  revoked_by TEXT
+);
+CREATE INDEX idx_machine_nodes_user ON machine_nodes (user_id);
+CREATE INDEX idx_machine_nodes_expiry ON machine_nodes (expires_at);

package/migrations/0078_auth_attempts.sql

@@ -0,0 +1,16 @@
+-- The durable auth-attempt ledger behind the password-endpoint throttle (SEC-4 /
+-- durable-auth-rate-limiting.md). The in-process Map it replaces was per isolate, so the
+-- effective brute-force cap was `MAX_ATTEMPTS x isolates`; this table is the
+-- cross-replica window. One row per attempt, counted per bucket key (`<ip>:<email>`) AND
+-- per client IP (the cross-email credential-stuffing aggregate), pruned aggressively by
+-- the retention sweep (rows are junk minutes after the window closes).
+-- Mirrors the Node Drizzle `authAttempts` table (db/tables/identity.ts); keep in step.
+CREATE TABLE auth_attempts (
+  id TEXT PRIMARY KEY,
+  key TEXT NOT NULL,
+  ip TEXT NOT NULL,
+  at INTEGER NOT NULL
+);
+CREATE INDEX idx_auth_attempts_key ON auth_attempts (key, at);
+CREATE INDEX idx_auth_attempts_ip ON auth_attempts (ip, at);
+CREATE INDEX idx_auth_attempts_at ON auth_attempts (at);

package/migrations/0079_gate_outcomes_and_run_days.sql

@@ -0,0 +1,82 @@
+-- Two queryable projections behind the operator dashboard
+-- (docs/initiatives/platform-operator-observability.md, slices 4b and 7).
+--
+-- `gate_outcomes`: one flat row per SETTLED polling gate. The live gate state (`attempts`,
+-- `attemptLog`, the escalation phase) lives inside the per-run `detail` JSON blob as
+-- `steps[].gate.*`, which is right for the run window and unusable for a rollup: aggregating it
+-- would mean `json_each` here and `jsonb_array_elements` on Postgres, both reaching into the
+-- engine's internal step-serialization shape, and neither expressible as one GROUP BY. So the
+-- engine writes the terminal verdict as columns and the rollup is an ordinary aggregate.
+--
+-- The id is DERIVED by the writer as `<runId>:<stepIndex>:<outcome>` rather than minted, so the
+-- durable drivers' replays collapse onto one row instead of inflating every statistic the table
+-- exists to report; a step re-run that ends DIFFERENTLY still records its own row.
+CREATE TABLE gate_outcomes (
+  id              TEXT    NOT NULL,
+  workspace_id    TEXT    NOT NULL,
+  execution_id    TEXT    NOT NULL,
+  block_id        TEXT    NOT NULL,
+  gate_kind       TEXT    NOT NULL,            -- the gate step's agent kind (`ci`, `conflicts`, …)
+  helper_kind     TEXT,                        -- the escalation agent (`ci-fixer`, …), or NULL
+  outcome         TEXT    NOT NULL,            -- 'passed' | 'exhausted'
+  attempts        INTEGER NOT NULL DEFAULT 0,  -- helper dispatches spent (0 = precheck-clean)
+  max_attempts    INTEGER NOT NULL DEFAULT 0,
+  helper_failures INTEGER NOT NULL DEFAULT 0,  -- helper jobs that themselves failed
+  duration_ms     INTEGER,                     -- gate entry → verdict, NULL when unknown
+  created_at      INTEGER NOT NULL,
+  PRIMARY KEY (id)
+);
+
+-- The rollup's access path: every read is "this account's workspaces, settled since T".
+CREATE INDEX idx_gate_outcomes_workspace_created ON gate_outcomes (workspace_id, created_at);
+-- The retention prune's access path (a global range delete, not workspace-scoped).
+CREATE INDEX idx_gate_outcomes_created ON gate_outcomes (created_at);
+
+-- `platform_run_days`: the daily rollup of `agent_runs` that serves the dashboard's `30d` and
+-- `90d` windows. Those windows exist BECAUSE of this table: scanning a quarter of every run the
+-- deployment ever made, on each dashboard load and each alert sweep, is the cost the rollup
+-- removes, and it produces a series nobody can read at finer resolution anyway.
+--
+-- `failure_kind` uses '' (never NULL) for a non-failed status, because it is part of the primary
+-- key: SQLite permits NULLs in a PK and does NOT treat two of them as equal, so a nullable column
+-- here would let the same bucket be inserted repeatedly and silently double-count the day. The
+-- repository maps '' back to NULL at the read boundary, so the port's shape is unaffected.
+--
+-- Rewritten in place by the sweep (DELETE the recomputed window, then INSERT it), never appended:
+-- a day's counts are not final until the day is over, so the current day must be CORRECTED on
+-- each pass. The DELETE is what makes it a rewrite: a run's `status` mutates in place while its
+-- `created_at` stays put, so an upsert alone would leave the `(day, 'running')` bucket of a run
+-- that has since settled standing beside its new `(day, 'done')` one, and count it twice forever.
+CREATE TABLE platform_run_days (
+  workspace_id TEXT    NOT NULL,
+  day_start    INTEGER NOT NULL,           -- UTC-midnight epoch ms
+  status       TEXT    NOT NULL,
+  failure_kind TEXT    NOT NULL DEFAULT '', -- '' for every status but 'failed' (see above)
+  run_count    INTEGER NOT NULL,
+  PRIMARY KEY (workspace_id, day_start, status, failure_kind)
+);
+
+-- The prune's access path; the account-scoped read rides the primary key's leading columns.
+CREATE INDEX idx_platform_run_days_day ON platform_run_days (day_start);
+
+-- `platform_rollup_state`: how far the SWEEP has covered, which is a fact about the sweep and
+-- therefore cannot be derived from the rolled-up rows.
+--
+-- `MAX(day_start)` over `platform_run_days` was the obvious-looking answer and is ambiguous in
+-- both directions: for an account, an idle fortnight and a wedged sweep return the same value,
+-- and NO rows at all describes a brand-new account exactly as well as a rollup that has never
+-- run. Both readings call for opposite operator responses, so the dashboard must not be left to
+-- guess between them (an un-materialised rollup and an idle quarter are the "absent is not zero"
+-- pair this whole projection exists to keep apart).
+--
+-- One row per rollup, DEPLOYMENT-scoped rather than per account: the pass covers every workspace
+-- at once, so its coverage has no tenant dimension, and it carries no tenant data (a day
+-- boundary and a timestamp). Written in the SAME transaction as the rewrite it describes, so it
+-- can never claim coverage the rows do not have. NOT workspace-scoped, so deliberately absent
+-- from the delete cascade and from the retention prune.
+CREATE TABLE platform_rollup_state (
+  rollup       TEXT    NOT NULL,  -- 'run_days'
+  through_day  INTEGER NOT NULL,  -- newest UTC-midnight day boundary the pass covered
+  updated_at   INTEGER NOT NULL,
+  PRIMARY KEY (rollup)
+);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/worker",
-  "version": "0.141.1",
+  "version": "0.143.0",
   "description": "Reusable Cloudflare Worker library (Hono + D1) exposing the Agent Architecture Board core: the `createApp()` Hono factory, the default fetch/scheduled/queue handler, and the Durable Object + Workflow classes. Deployments (see deploy/backend) supply the wrangler.toml + config and re-export these.",
   "repository": {
     "type": "git",
@@ -42,22 +42,22 @@
     "pino": "^10.3.1",
     "valibot": "^1.4.2",
     "workers-ai-provider": "^4.0.0",
-    "@cat-factory/agents": "0.106.6",
-    "@cat-factory/caching": "0.13.7",
-    "@cat-factory/consensus": "0.13.33",
-    "@cat-factory/contracts": "0.219.0",
-    "@cat-factory/eks": "0.1.207",
-    "@cat-factory/gates": "0.8.53",
-    "@cat-factory/gitlab": "0.15.12",
-    "@cat-factory/integrations": "0.120.1",
-    "@cat-factory/observability-langfuse": "0.9.50",
-    "@cat-factory/observability-otel": "0.5.7",
-    "@cat-factory/kernel": "0.221.1",
-    "@cat-factory/orchestration": "0.190.0",
-    "@cat-factory/prompt-fragments": "0.15.44",
-    "@cat-factory/provider-cloudflare": "0.7.359",
-    "@cat-factory/server": "0.202.0",
-    "@cat-factory/spend": "0.13.9"
+    "@cat-factory/agents": "0.106.8",
+    "@cat-factory/caching": "0.13.9",
+    "@cat-factory/contracts": "0.221.0",
+    "@cat-factory/consensus": "0.13.35",
+    "@cat-factory/eks": "0.1.209",
+    "@cat-factory/integrations": "0.121.1",
+    "@cat-factory/kernel": "0.223.0",
+    "@cat-factory/gitlab": "0.15.14",
+    "@cat-factory/observability-langfuse": "0.9.52",
+    "@cat-factory/observability-otel": "0.7.0",
+    "@cat-factory/prompt-fragments": "0.15.46",
+    "@cat-factory/server": "0.204.0",
+    "@cat-factory/orchestration": "0.192.0",
+    "@cat-factory/provider-cloudflare": "0.7.361",
+    "@cat-factory/spend": "0.13.11",
+    "@cat-factory/gates": "0.8.55"
   },
   "devDependencies": {
     "@cloudflare/vitest-pool-workers": "^0.20.1",
@@ -65,7 +65,7 @@
     "typescript": "7.0.2",
     "vitest": "^4.1.10",
     "wrangler": "^4.118.0",
-    "@cat-factory/conformance": "0.20.18"
+    "@cat-factory/conformance": "0.21.0"
   },
   "scripts": {
     "build": "tsc -b tsconfig.build.json",