@checkstack/automation-backend 0.2.0 → 0.3.0

package/drizzle/meta/_journal.json

@@ -22,6 +22,62 @@
       "when": 1780046001689,
       "tag": "0002_silky_omega_red",
       "breakpoints": true
+    },
+    {
+      "idx": 3,
+      "version": "7",
+      "when": 1780147180582,
+      "tag": "0003_sparkling_xorn",
+      "breakpoints": true
+    },
+    {
+      "idx": 4,
+      "version": "7",
+      "when": 1780149946844,
+      "tag": "0004_cultured_spyke",
+      "breakpoints": true
+    },
+    {
+      "idx": 5,
+      "version": "7",
+      "when": 1780189837825,
+      "tag": "0005_classy_the_hand",
+      "breakpoints": true
+    },
+    {
+      "idx": 6,
+      "version": "7",
+      "when": 1780192006216,
+      "tag": "0006_burly_wallop",
+      "breakpoints": true
+    },
+    {
+      "idx": 7,
+      "version": "7",
+      "when": 1780216684007,
+      "tag": "0007_nappy_jackal",
+      "breakpoints": true
+    },
+    {
+      "idx": 8,
+      "version": "7",
+      "when": 1780246726759,
+      "tag": "0008_remove_seeded_auto_incident_automations",
+      "breakpoints": true
+    },
+    {
+      "idx": 9,
+      "version": "7",
+      "when": 1780248673895,
+      "tag": "0009_steady_liz_osborn",
+      "breakpoints": true
+    },
+    {
+      "idx": 10,
+      "version": "7",
+      "when": 1780250068979,
+      "tag": "0010_chunky_changeling",
+      "breakpoints": true
     }
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/automation-backend",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "license": "Elastic-2.0",
   "type": "module",
   "main": "src/index.ts",
@@ -15,27 +15,38 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@checkstack/automation-common": "0.1.0",
-    "@checkstack/backend-api": "0.17.1",
-    "@checkstack/command-backend": "0.1.30",
-    "@checkstack/integration-common": "0.5.0",
-    "@checkstack/notification-common": "1.2.0",
-    "@checkstack/common": "0.11.0",
-    "@checkstack/queue-api": "0.3.5",
-    "@checkstack/signal-common": "0.2.4",
-    "@checkstack/template-engine": "0.1.0",
+    "@checkstack/automation-common": "0.2.0",
+    "@checkstack/backend-api": "0.18.0",
+    "@checkstack/command-backend": "0.1.31",
+    "@checkstack/secrets-common": "0.0.1",
+    "@checkstack/gitops-backend": "0.3.7",
+    "@checkstack/gitops-common": "0.4.2",
+    "@checkstack/healthcheck-common": "1.3.0",
+    "@checkstack/integration-common": "0.6.0",
+    "@checkstack/notification-common": "1.2.1",
+    "@checkstack/script-packages-backend": "0.1.0",
+    "@checkstack/common": "0.12.0",
+    "@checkstack/queue-api": "0.3.6",
+    "@checkstack/signal-common": "0.2.5",
+    "@checkstack/template-engine": "0.2.0",
     "@orpc/server": "^1.13.2",
     "drizzle-orm": "^0.45.0",
     "yaml": "^2.6.1",
     "zod": "^4.2.1"
   },
   "devDependencies": {
+    "@checkstack/backend": "0.11.0",
     "@checkstack/drizzle-helper": "0.0.5",
-    "@checkstack/scripts": "0.3.3",
-    "@checkstack/test-utils-backend": "0.1.30",
+    "@checkstack/integration-backend": "0.2.0",
+    "@checkstack/scripts": "0.3.4",
+    "@checkstack/secrets-backend": "0.0.1",
+    "@checkstack/test-utils-backend": "0.1.31",
     "@checkstack/tsconfig": "0.0.7",
     "@types/node": "^20.0.0",
+    "@types/pg": "^8.20.0",
+    "bullmq": "^5.66.4",
     "drizzle-kit": "^0.31.10",
+    "pg": "^8.21.0",
     "typescript": "^5.0.0"
   }
 }

package/src/action-types.ts

@@ -133,10 +133,33 @@ export interface TriggerDefinition<
    */
   contextKey?: (payload: TPayload) => string | undefined;
 
+  /**
+   * Human label for the dimension `contextKey` extracts (e.g. `"system"` for
+   * a `systemId` key). Purely a UI hint — surfaced to the editor (via
+   * `TriggerInfo.contextKeyLabel`) so the window gate's "Partition by" field
+   * can show the default partition ("Leave blank to count per system"). No
+   * runtime behaviour. Omit when the trigger has no `contextKey` (the UI then
+   * shows "per automation").
+   */
+  contextKeyLabel?: string;
+
   /** Hook-backed flavour. */
   hook?: Hook<TPayload>;
   /** Setup-backed flavour. */
   setup?: TriggerSetupFn<TPayload, TConfig>;
+
+  /**
+   * Optional structured config gate for hook-backed triggers. When set,
+   * the trigger fan-in calls this with the incoming payload + the
+   * per-automation trigger `config` BEFORE starting a run; a `false`
+   * result skips the firing for that automation (in addition to, and
+   * before, the operator's template `filter`).
+   *
+   * Used by structured triggers like `numeric_state` whose firing depends
+   * on typed config (`field` / `above` / `below`) rather than a
+   * hand-written filter expression. Pure + synchronous — no I/O.
+   */
+  evaluateConfig?: (payload: TPayload, config: TConfig) => boolean;
 }
 
 export interface RegisteredTrigger<TPayload = unknown, TConfig = unknown>

package/src/artifact-store.ts

@@ -1,6 +1,7 @@
 import { and, desc, eq, isNull } from "drizzle-orm";
 import type { SafeDatabase } from "@checkstack/backend-api";
 import { automationArtifacts } from "./schema";
+import type { RunSecretRegistry } from "./dispatch/run-secret-registry";
 
 /**
  * Inputs for recording a new artifact.
@@ -62,6 +63,15 @@ export interface ArtifactStore {
 
 export function createArtifactStore(
   db: SafeDatabase<{ automationArtifacts: typeof automationArtifacts }>,
+  /**
+   * Run-scoped secret values accumulated during dispatch. When provided,
+   * an artifact's `data` is masked (Jenkins-style, by-value) BEFORE
+   * insert — so a resolved connection credential surfaced into a produced
+   * artifact can't reach a replay / run-detail reader unmasked. Same
+   * persist-time choke-point pattern as the run-state + run stores.
+   * Optional so tests / older boots degrade to no masking.
+   */
+  secretRegistry?: RunSecretRegistry,
 ): ArtifactStore {
   const mapRow = (
     row: typeof automationArtifacts.$inferSelect,
@@ -80,6 +90,11 @@ export function createArtifactStore(
 
   return {
     async record(input) {
+      // Mask resolved secret values out of the artifact data BEFORE insert
+      // — the persistence choke point, so a credential surfaced into a
+      // produced artifact never reaches a replay / run-detail reader.
+      const maskedData = (secretRegistry?.maskDeep(input.runId, input.data) ??
+        input.data) as Record<string, unknown>;
       const [row] = await db
         .insert(automationArtifacts)
         .values({
@@ -88,7 +103,7 @@ export function createArtifactStore(
           stepId: input.stepId,
           actionId: input.actionId,
           artifactType: input.artifactType,
-          data: input.data,
+          data: maskedData,
           contextKey: input.contextKey,
         })
         .returning();

package/src/automation-store.test.ts

@@ -0,0 +1,143 @@
+import { describe, it, expect, mock } from "bun:test";
+import { createAutomationStore } from "./automation-store";
+
+/**
+ * Minimal valid definition JSON for rows returned by mocked queries
+ * (`mapToAutomation` parses it).
+ */
+const DEFINITION = {
+  name: "n",
+  triggers: [{ event: "incident.incident.created" }],
+  conditions: [],
+  actions: [],
+  mode: "single",
+  concurrency_scope: "automation",
+  max_runs: 10,
+};
+
+function row(overrides: Record<string, unknown>) {
+  return {
+    id: "a1",
+    name: "A1",
+    description: null,
+    group: null,
+    status: "enabled",
+    definition: DEFINITION,
+    managedBy: null,
+    createdAt: new Date("2026-01-01T00:00:00Z"),
+    updatedAt: new Date("2026-01-01T00:00:00Z"),
+    ...overrides,
+  };
+}
+
+describe("automation-store create", () => {
+  it("persists the group column from the input", async () => {
+    const values = mock((_v: Record<string, unknown>) => ({
+      returning: mock(() => Promise.resolve([row({ group: "Alerting" })])),
+    }));
+    const db = { insert: mock(() => ({ values })) };
+    const store = createAutomationStore(db as never);
+
+    const result = await store.create({
+      name: "A1",
+      group: "Alerting",
+      status: "enabled",
+      definition: DEFINITION as never,
+    });
+
+    const inserted = values.mock.calls[0]?.[0] as { group: string | null };
+    expect(inserted.group).toBe("Alerting");
+    expect(result.group).toBe("Alerting");
+  });
+
+  it("inserts null group when none is provided", async () => {
+    const values = mock((_v: Record<string, unknown>) => ({
+      returning: mock(() => Promise.resolve([row({ group: null })])),
+    }));
+    const db = { insert: mock(() => ({ values })) };
+    const store = createAutomationStore(db as never);
+
+    await store.create({
+      name: "A1",
+      status: "enabled",
+      definition: DEFINITION as never,
+    });
+
+    const inserted = values.mock.calls[0]?.[0] as { group: string | null };
+    expect(inserted.group).toBeNull();
+  });
+});
+
+describe("automation-store update set-builder", () => {
+  function updateDb(returned: Record<string, unknown>) {
+    // getById (select…limit) then update (set…where…returning).
+    const select = mock(() => ({
+      from: mock(() => ({
+        where: mock(() => ({
+          limit: mock(() => Promise.resolve([row({})])),
+        })),
+      })),
+    }));
+    const set = mock((_v: Record<string, unknown>) => ({
+      where: mock(() => ({
+        returning: mock(() => Promise.resolve([row(returned)])),
+      })),
+    }));
+    const db = { select, update: mock(() => ({ set })) };
+    return { db, set };
+  }
+
+  it("sets the group when a string is given", async () => {
+    const { db, set } = updateDb({ group: "Networking" });
+    const store = createAutomationStore(db as never);
+    await store.update({ id: "a1", group: "Networking" });
+    const patch = set.mock.calls[0]?.[0] as { group?: string | null };
+    expect(patch.group).toBe("Networking");
+  });
+
+  it("clears the group when null is given", async () => {
+    const { db, set } = updateDb({ group: null });
+    const store = createAutomationStore(db as never);
+    await store.update({ id: "a1", group: null });
+    const patch = set.mock.calls[0]?.[0] as { group?: string | null };
+    expect(patch.group).toBeNull();
+  });
+
+  it("leaves the group untouched when omitted", async () => {
+    const { db, set } = updateDb({ group: "Existing" });
+    const store = createAutomationStore(db as never);
+    await store.update({ id: "a1", name: "renamed" });
+    const patch = set.mock.calls[0]?.[0] as { group?: string | null };
+    expect("group" in patch).toBe(false);
+  });
+});
+
+describe("automation-store listGroups", () => {
+  it("returns the distinct non-null group values produced by the query", async () => {
+    const where = mock(() => ({
+      orderBy: mock(() =>
+        Promise.resolve([{ group: "Alerting" }, { group: "Networking" }]),
+      ),
+    }));
+    const db = {
+      selectDistinct: mock(() => ({ from: mock(() => ({ where })) })),
+    };
+    const store = createAutomationStore(db as never);
+    const groups = await store.listGroups();
+    expect(groups).toEqual(["Alerting", "Networking"]);
+  });
+
+  it("filters out any null group that slips through", async () => {
+    const where = mock(() => ({
+      orderBy: mock(() =>
+        Promise.resolve([{ group: "Alerting" }, { group: null }]),
+      ),
+    }));
+    const db = {
+      selectDistinct: mock(() => ({ from: mock(() => ({ where })) })),
+    };
+    const store = createAutomationStore(db as never);
+    const groups = await store.listGroups();
+    expect(groups).toEqual(["Alerting"]);
+  });
+});

package/src/automation-store.ts

@@ -5,7 +5,7 @@
  * Returns are typed against the public `Automation` shape from
  * `@checkstack/automation-common`, with parsed `definition`.
  */
-import { and, eq, sql } from "drizzle-orm";
+import { and, eq, isNotNull, sql } from "drizzle-orm";
 import type { SafeDatabase } from "@checkstack/backend-api";
 import {
   AutomationDefinitionSchema,
@@ -29,10 +29,17 @@ export interface AutomationStore {
   getById(id: string): Promise<Automation | undefined>;
   list(filter?: {
     status?: AutomationStatus;
+    group?: string;
     limit?: number;
     offset?: number;
   }): Promise<{ items: Automation[]; total: number }>;
 
+  /**
+   * Distinct, non-null group values across all automations, sorted
+   * alphabetically. Powers the edit-page group picker suggestions.
+   */
+  listGroups(): Promise<string[]>;
+
   /**
    * Enabled automations that reference the given trigger event id in one
    * of their trigger declarations. Used by the trigger fan-in to fan an
@@ -55,6 +62,7 @@ function mapToAutomation(
     id: row.id,
     name: row.name,
     description: row.description ?? undefined,
+    group: row.group ?? undefined,
     status: row.status === "disabled" ? "disabled" : "enabled",
     definition,
     managedBy: row.managedBy ?? undefined,
@@ -87,6 +95,7 @@ export function createAutomationStore(
         .values({
           name: input.name,
           description: input.description ?? null,
+          group: input.group ?? null,
           status: input.status,
           definition: parsedDefinition as unknown as Record<string, unknown>,
         })
@@ -103,6 +112,8 @@ export function createAutomationStore(
       if (input.name !== undefined) set.name = input.name;
       if (input.description !== undefined)
         set.description = input.description ?? null;
+      // `null` clears the group, a string sets it; `undefined` leaves it.
+      if (input.group !== undefined) set.group = input.group ?? null;
       if (input.status !== undefined) set.status = input.status;
       if (input.definition !== undefined) {
         const parsed = AutomationDefinitionSchema.parse(input.definition);
@@ -146,9 +157,12 @@ export function createAutomationStore(
     async list(filter = {}) {
       const limit = filter.limit ?? 50;
       const offset = filter.offset ?? 0;
-      const whereExpr = filter.status
-        ? eq(automations.status, filter.status)
-        : undefined;
+
+      const conditions = [];
+      if (filter.status) conditions.push(eq(automations.status, filter.status));
+      if (filter.group) conditions.push(eq(automations.group, filter.group));
+      const whereExpr =
+        conditions.length > 0 ? and(...conditions) : undefined;
 
       const rows = whereExpr
         ? await db
@@ -178,6 +192,18 @@ export function createAutomationStore(
       };
     },
 
+    async listGroups() {
+      const rows = await db
+        .selectDistinct({ group: automations.group })
+        .from(automations)
+        .where(isNotNull(automations.group))
+        .orderBy(automations.group);
+      // `isNotNull` already filters NULLs; the guard narrows the type.
+      return rows
+        .map((r) => r.group)
+        .filter((g): g is string => g !== null);
+    },
+
     async findEnabledByTriggerEvent(eventId) {
       // The `definition.triggers` array is queried via JSONB containment.
       // We can't index the inner JSON cheaply without a generated column;
@@ -221,7 +247,3 @@ export function createAutomationStore(
     },
   };
 }
-
-// Silence unused-imports for the second `and` symbol (kept around for the
-// inevitable future "filter by enabled AND something" query).
-void and;

package/src/builtin-triggers.test.ts

@@ -1,12 +1,10 @@
 /**
- * Behaviour tests for the built-in `time.cron`, `time.interval`, and
- * `template` triggers.
+ * Behaviour tests for the built-in `time.cron` and `time.interval` triggers.
  *
- * Each test exercises one factory, fakes out the queue, runs setup()
- * to register a fire-callback in the module-scoped tick map, and then
- * either (a) inspects the queue arguments, or (b) plays a tick through
- * the recorded callback to verify the fire behaviour (including the
- * template trigger's false → true edge detection).
+ * Each test exercises one factory, fakes out the queue, runs setup() to
+ * register a fire-callback in the module-scoped tick map, and then either
+ * (a) inspects the queue arguments, or (b) plays a tick through the recorded
+ * callback to verify the fire behaviour.
  */
 import { beforeEach, describe, expect, it, mock } from "bun:test";
 import type { Logger } from "@checkstack/backend-api";
@@ -16,7 +14,7 @@ import { createMockLogger } from "@checkstack/test-utils-backend";
 import {
   _resetBuiltinTriggerTickHandlersForTests,
   BUILTIN_TRIGGER_QUEUE,
-  createTemplateTrigger,
+  createNumericStateTrigger,
   createTimeCronTrigger,
   createTimeIntervalTrigger,
   registerBuiltinTriggerConsumer,
@@ -178,87 +176,92 @@ describe("automation.interval", () => {
   });
 });
 
-describe("automation.template", () => {
-  it("fires only on the false → true edge", async () => {
-    const fx = makeQueueFixture();
-    await registerBuiltinTriggerConsumer({
-      queueManager: fx.queueManager,
-      logger,
-    });
-    const fire = mock(async (_payload: unknown) => {});
-
-    // Use a template that toggles based on a flag in the closure.
-    // Since the trigger only has access to `{ now }`, we simulate the
-    // edge by switching the template via two separate setup calls.
-    const trigger = createTemplateTrigger({ queueManager: fx.queueManager });
-    const teardown = await trigger.setup!({
-      // Truthy from the start. We expect:
-      //  tick 1 → previousTruthy was false → fire.
-      //  tick 2 → previousTruthy is now true → no fire.
-      config: { value_template: "true", intervalSeconds: 5 },
-      identity: { automationId: "auto-1", triggerId: "t-1" },
-      fire,
-      logger,
-    });
-
-    await fx.consumer!(tick("builtin:template:auto-1:t-1"));
-    await fx.consumer!(tick("builtin:template:auto-1:t-1"));
-    expect(fire).toHaveBeenCalledTimes(1);
+// The polling `template` trigger was removed in the reactive engine
+// (reactive automation engine §7); its cases are covered reactively by the
+// numeric_state / state triggers + conditions. Its behaviour tests were
+// removed with it.
 
-    await teardown();
-  });
-
-  it("does not fire when the template is always falsy", async () => {
+describe("builtin trigger consumer", () => {
+  it("logs but does not throw when a tick arrives without a registered handler", async () => {
     const fx = makeQueueFixture();
     await registerBuiltinTriggerConsumer({
       queueManager: fx.queueManager,
       logger,
     });
-    const fire = mock(async (_payload: unknown) => {});
+    await expect(
+      fx.consumer!(tick("builtin:cron:unregistered:nope")),
+    ).resolves.toBeUndefined();
+  });
 
-    const trigger = createTemplateTrigger({ queueManager: fx.queueManager });
-    const teardown = await trigger.setup!({
-      config: { value_template: "false", intervalSeconds: 5 },
-      identity: { automationId: "auto-1", triggerId: "t-1" },
-      fire,
-      logger,
-    });
+  it("uses the shared queue name", () => {
+    expect(BUILTIN_TRIGGER_QUEUE).toBe("automation-builtin-triggers");
+  });
+});
 
-    await fx.consumer!(tick("builtin:template:auto-1:t-1"));
-    await fx.consumer!(tick("builtin:template:auto-1:t-1"));
-    expect(fire).not.toHaveBeenCalled();
+describe("numeric_state trigger", () => {
+  const trigger = createNumericStateTrigger();
 
-    await teardown();
+  it("is hook-backed on healthcheck.check.completed", () => {
+    expect(trigger.hook?.id).toBe("healthcheck.check.completed");
+    expect(trigger.setup).toBeUndefined();
   });
 
-  it("rejects an invalid template at setup time", async () => {
-    const fx = makeQueueFixture();
-    const trigger = createTemplateTrigger({ queueManager: fx.queueManager });
-    await expect(
-      trigger.setup!({
-        config: { value_template: "((((", intervalSeconds: 5 },
-        identity: { automationId: "auto-1", triggerId: "t-1" },
-        fire: mock(async () => {}),
-        logger,
+  it("extracts systemId as the context key", () => {
+    expect(
+      trigger.contextKey?.({
+        systemId: "sys-1",
+        configurationId: "c",
+        status: "unhealthy",
+        field: "latencyMs",
+        value: 1,
       }),
-    ).rejects.toThrow(/invalid value_template/);
-    expect(fx.scheduleMock).not.toHaveBeenCalled();
+    ).toBe("sys-1");
   });
-});
 
-describe("builtin trigger consumer", () => {
-  it("logs but does not throw when a tick arrives without a registered handler", async () => {
-    const fx = makeQueueFixture();
-    await registerBuiltinTriggerConsumer({
-      queueManager: fx.queueManager,
-      logger,
-    });
-    await expect(
-      fx.consumer!(tick("builtin:cron:unregistered:nope")),
-    ).resolves.toBeUndefined();
+  it("evaluateConfig fires when top-level latencyMs is above the bound", () => {
+    const payload = {
+      systemId: "sys-1",
+      configurationId: "c",
+      status: "degraded",
+      latencyMs: 600,
+    } as unknown as Parameters<NonNullable<typeof trigger.evaluateConfig>>[0];
+    expect(
+      trigger.evaluateConfig!(payload, { field: "latencyMs", above: 500 }),
+    ).toBe(true);
+    expect(
+      trigger.evaluateConfig!(payload, { field: "latencyMs", above: 700 }),
+    ).toBe(false);
   });
 
-  it("uses the shared queue name", () => {
-    expect(BUILTIN_TRIGGER_QUEUE).toBe("automation-builtin-triggers");
+  it("evaluateConfig reads a collector field under result (collectors map)", () => {
+    const payload = {
+      systemId: "sys-1",
+      configurationId: "c",
+      status: "healthy",
+      result: { http: { responseTimeMs: 120 } },
+    } as unknown as Parameters<NonNullable<typeof trigger.evaluateConfig>>[0];
+    expect(
+      trigger.evaluateConfig!(payload, {
+        field: "collectors.http.responseTimeMs",
+        below: 200,
+      }),
+    ).toBe(true);
+    expect(
+      trigger.evaluateConfig!(payload, {
+        field: "collectors.http.responseTimeMs",
+        below: 100,
+      }),
+    ).toBe(false);
+  });
+
+  it("evaluateConfig is false when the field is missing", () => {
+    const payload = {
+      systemId: "sys-1",
+      configurationId: "c",
+      status: "healthy",
+    } as unknown as Parameters<NonNullable<typeof trigger.evaluateConfig>>[0];
+    expect(
+      trigger.evaluateConfig!(payload, { field: "latencyMs", above: 1 }),
+    ).toBe(false);
   });
 });