@checkstack/script-packages-backend 0.2.0

package/drizzle/meta/0001_snapshot.json

@@ -0,0 +1,491 @@
+{
+  "id": "6c4865a1-d9ca-4b09-a63f-8119ddd39481",
+  "prevId": "033f32d0-38fc-4775-b1e3-ef2930de7493",
+  "version": "7",
+  "dialect": "postgresql",
+  "tables": {
+    "public.script_package_blob": {
+      "name": "script_package_blob",
+      "schema": "",
+      "columns": {
+        "integrity": {
+          "name": "integrity",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "version": {
+          "name": "version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "backend": {
+          "name": "backend",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "size_bytes": {
+          "name": "size_bytes",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "script_package_blob_backend_idx": {
+          "name": "script_package_blob_backend_idx",
+          "columns": [
+            {
+              "expression": "backend",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.script_package_blob_gc_state": {
+      "name": "script_package_blob_gc_state",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "'singleton'"
+        },
+        "last_run_at": {
+          "name": "last_run_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_deleted": {
+          "name": "last_deleted",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "last_bytes_reclaimed": {
+          "name": "last_bytes_reclaimed",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "total_bytes_reclaimed": {
+          "name": "total_bytes_reclaimed",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.script_package_install_state": {
+      "name": "script_package_install_state",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "'singleton'"
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'idle'"
+        },
+        "lockfile_hash": {
+          "name": "lockfile_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "manifest": {
+          "name": "manifest",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "total_size_bytes": {
+          "name": "total_size_bytes",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "last_installed_at": {
+          "name": "last_installed_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_message": {
+          "name": "error_message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.script_package_lockfile_history": {
+      "name": "script_package_lockfile_history",
+      "schema": "",
+      "columns": {
+        "lockfile_hash": {
+          "name": "lockfile_hash",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "manifest": {
+          "name": "manifest",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "recorded_at": {
+          "name": "recorded_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "script_package_lockfile_history_recorded_idx": {
+          "name": "script_package_lockfile_history_recorded_idx",
+          "columns": [
+            {
+              "expression": "recorded_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.script_package_registry_config": {
+      "name": "script_package_registry_config",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "'singleton'"
+        },
+        "registry_url": {
+          "name": "registry_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'https://registry.npmjs.org/'"
+        },
+        "scoped_registries": {
+          "name": "scoped_registries",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "auth_secret_ref": {
+          "name": "auth_secret_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "ignore_scripts": {
+          "name": "ignore_scripts",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.script_package_satellite_state": {
+      "name": "script_package_satellite_state",
+      "schema": "",
+      "columns": {
+        "satellite_id": {
+          "name": "satellite_id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "lockfile_hash": {
+          "name": "lockfile_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "error_message": {
+          "name": "error_message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "synced_at": {
+          "name": "synced_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.script_package_size_cap": {
+      "name": "script_package_size_cap",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "'singleton'"
+        },
+        "warn_bytes": {
+          "name": "warn_bytes",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 157286400
+        },
+        "block_bytes": {
+          "name": "block_bytes",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 314572800
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.script_package_storage_config": {
+      "name": "script_package_storage_config",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "'singleton'"
+        },
+        "active_backend": {
+          "name": "active_backend",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'postgres'"
+        },
+        "migration_status": {
+          "name": "migration_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'idle'"
+        },
+        "migration_target": {
+          "name": "migration_target",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "migrated_count": {
+          "name": "migrated_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "migration_error": {
+          "name": "migration_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.script_packages": {
+      "name": "script_packages",
+      "schema": "",
+      "columns": {
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "version": {
+          "name": "version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "added_by": {
+          "name": "added_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "added_at": {
+          "name": "added_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    }
+  },
+  "enums": {},
+  "schemas": {},
+  "sequences": {},
+  "roles": {},
+  "policies": {},
+  "views": {},
+  "_meta": {
+    "columns": {},
+    "schemas": {},
+    "tables": {}
+  }
+}

package/drizzle/meta/_journal.json

@@ -0,0 +1,20 @@
+{
+  "version": "7",
+  "dialect": "postgresql",
+  "entries": [
+    {
+      "idx": 0,
+      "version": "7",
+      "when": 1780147687896,
+      "tag": "0000_flashy_squadron_supreme",
+      "breakpoints": true
+    },
+    {
+      "idx": 1,
+      "version": "7",
+      "when": 1780172549655,
+      "tag": "0001_flawless_drax",
+      "breakpoints": true
+    }
+  ]
+}

package/drizzle.config.ts

@@ -0,0 +1,7 @@
+import { defineConfig } from "drizzle-kit";
+
+export default defineConfig({
+  schema: "./src/schema.ts",
+  out: "./drizzle",
+  dialect: "postgresql",
+});

package/package.json

@@ -0,0 +1,32 @@
+{
+  "name": "@checkstack/script-packages-backend",
+  "version": "0.2.0",
+  "license": "Elastic-2.0",
+  "type": "module",
+  "main": "src/index.ts",
+  "checkstack": {
+    "type": "backend"
+  },
+  "scripts": {
+    "typecheck": "tsgo -b",
+    "lint": "bun run lint:code",
+    "lint:code": "eslint . --max-warnings 0",
+    "test": "bun test"
+  },
+  "dependencies": {
+    "@checkstack/backend-api": "0.18.0",
+    "@checkstack/common": "0.12.0",
+    "@checkstack/script-packages-common": "0.1.0",
+    "@checkstack/secrets-common": "0.0.1",
+    "@checkstack/secrets-backend": "0.0.1",
+    "@orpc/server": "^1.13.2",
+    "drizzle-orm": "^0.45.0",
+    "zod": "^4.0.0"
+  },
+  "devDependencies": {
+    "@checkstack/scripts": "0.3.4",
+    "@checkstack/tsconfig": "0.0.7",
+    "drizzle-kit": "^0.31.10",
+    "typescript": "^5.7.2"
+  }
+}

package/src/atomic-symlink.test.ts

@@ -0,0 +1,47 @@
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { mkdtemp, mkdir, writeFile, readFile, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { atomicSymlinkSwap, readCurrentTarget } from "./atomic-symlink";
+
+describe("atomicSymlinkSwap", () => {
+  let work: string;
+  beforeEach(async () => {
+    work = await mkdtemp(path.join(tmpdir(), "cs-symlink-"));
+  });
+  afterEach(async () => {
+    await rm(work, { recursive: true, force: true });
+  });
+
+  test("points current at a tree and resolves files through it", async () => {
+    const treeA = path.join(work, "trees", "hashA");
+    await mkdir(treeA, { recursive: true });
+    await writeFile(path.join(treeA, "marker"), "A");
+    const current = path.join(work, "current");
+
+    await atomicSymlinkSwap({ linkPath: current, target: "trees/hashA" });
+    expect(await readCurrentTarget(current)).toBe("trees/hashA");
+    expect(await readFile(path.join(current, "marker"), "utf8")).toBe("A");
+  });
+
+  test("re-points an existing current to a new tree atomically", async () => {
+    const treeA = path.join(work, "trees", "hashA");
+    const treeB = path.join(work, "trees", "hashB");
+    await mkdir(treeA, { recursive: true });
+    await mkdir(treeB, { recursive: true });
+    await writeFile(path.join(treeA, "marker"), "A");
+    await writeFile(path.join(treeB, "marker"), "B");
+    const current = path.join(work, "current");
+
+    await atomicSymlinkSwap({ linkPath: current, target: "trees/hashA" });
+    await atomicSymlinkSwap({ linkPath: current, target: "trees/hashB" });
+    expect(await readCurrentTarget(current)).toBe("trees/hashB");
+    expect(await readFile(path.join(current, "marker"), "utf8")).toBe("B");
+  });
+
+  test("readCurrentTarget returns undefined when absent", async () => {
+    expect(
+      await readCurrentTarget(path.join(work, "nope")),
+    ).toBeUndefined();
+  });
+});

package/src/atomic-symlink.ts

@@ -0,0 +1,66 @@
+import { symlink, rename, rm, readlink } from "node:fs/promises";
+import path from "node:path";
+import { randomUUID } from "node:crypto";
+import { markTreeRetired } from "./tree-retirement";
+
+/**
+ * Atomically point `linkPath` at `target`.
+ *
+ * Creates a uniquely-named temp symlink in the same directory, then
+ * `rename()`s it over `linkPath` - `rename` is atomic on POSIX, so a
+ * concurrent reader sees either the old target or the new one, never a
+ * half-written link. New runs follow the new symlink; in-flight runs keep
+ * resolving against the dir they started on (the old tree is untouched).
+ *
+ * Records the **retirement time** of the tree being superseded: right at the
+ * flip we stamp a `.retired-at` marker into the OLD target's dir (when it
+ * differs from the new target). Tree GC keys its grace window on that
+ * timestamp rather than the tree dir's mtime, so a long-current tree (ancient
+ * mtime) is NOT instantly eligible for deletion the moment it is superseded -
+ * which would otherwise yank the rug from under an in-flight run still pinned
+ * to it. See {@link import("./tree-retirement")}.
+ */
+export async function atomicSymlinkSwap({
+  linkPath,
+  target,
+  now = Date.now(),
+}: {
+  linkPath: string;
+  target: string;
+  /** Injectable clock for the retirement timestamp (deterministic tests). */
+  now?: number;
+}): Promise<void> {
+  const dir = path.dirname(linkPath);
+
+  // Stamp the tree that is about to stop being current with its retirement
+  // time, BEFORE the flip. Resolved relative to the link's dir (targets are
+  // stored relative, e.g. `trees/<hash>`). Best-effort: a read/write failure
+  // degrades to the "no marker" path in tree-GC, which RETAINS the tree.
+  const oldTarget = await readCurrentTarget(linkPath);
+  if (oldTarget && oldTarget !== target) {
+    const oldTreeDir = path.isAbsolute(oldTarget)
+      ? oldTarget
+      : path.join(dir, oldTarget);
+    await markTreeRetired({ treeDir: oldTreeDir, at: now });
+  }
+
+  const tmpLink = path.join(dir, `.current-${randomUUID()}`);
+  await symlink(target, tmpLink);
+  try {
+    await rename(tmpLink, linkPath);
+  } catch (error) {
+    await rm(tmpLink, { force: true }).catch(() => {});
+    throw error;
+  }
+}
+
+/** Resolve the current symlink target, or undefined if it doesn't exist. */
+export async function readCurrentTarget(
+  linkPath: string,
+): Promise<string | undefined> {
+  try {
+    return await readlink(linkPath);
+  } catch {
+    return;
+  }
+}