@defrex/autobuild-postgres-store 0.12.0 → 0.14.0

package/README.md

@@ -119,9 +119,9 @@ Only an object-store 404 is treated as absent; authorization and service errors
 are propagated. Vercel supports either a Blob read-write token or a Vercel OIDC
 token paired with its Blob store ID.
 
-`PostgresTicketDatabase.source({ teamKey, claimedState?, createState? })` creates
-a request-bound TicketSource view. The deployment supplies four distinct
-lifecycle names; the defaults are Triage, Ready, Doing, and Done. Ticket bodies
+`PostgresTicketDatabase.source({ repo, teamKey, lifecycle, claimedState?, createState? })`
+creates a request-bound TicketSource view. The deployment supplies the project
+identity, readable-id prefix, and lifecycle names. Ticket bodies
 are stored as PostgreSQL `text` and returned unchanged.
 
 For an authenticated HTTP deployment of this adapter, see the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@defrex/autobuild-postgres-store",
-  "version": "0.12.0",
+  "version": "0.14.0",
   "type": "module",
   "license": "Apache-2.0",
   "engines": {
@@ -34,6 +34,14 @@
     "./connections": {
       "types": "./src/connections.ts",
       "import": "./src/connections.ts"
+    },
+    "./ticket-policy": {
+      "types": "./src/ticket-policy.ts",
+      "import": "./src/ticket-policy.ts"
+    },
+    "./ticket-grants": {
+      "types": "./src/ticket-grants.ts",
+      "import": "./src/ticket-grants.ts"
     }
   },
   "bin": {

package/src/schema.ts

@@ -1,7 +1,11 @@
 import { PostgresProjectRegistry } from './projects'
 import type { PostgresEnv } from './env'
 import type { BlobStore } from '@defrex/autobuild/plugin-sdk'
-import { migrateLegacyTickets } from './ticket-migration'
+import {
+  migrateLegacyTickets,
+  migrateReadableTickets,
+  READABLE_TICKET_CONSTRAINTS,
+} from './ticket-migration'
 import { SQL } from 'bun'
 import {
   AUTH_SCHEMA_CHECKSUM,
@@ -12,7 +16,7 @@ import {
   assertAuthSchema,
 } from './auth-schema'
 
-export const SCHEMA_VERSION = 12
+export const SCHEMA_VERSION = 14
 export const MIGRATE_COMMAND = 'bun run postgres:migrate (from a pinned Autobuild release checkout)'
 
 /** The frozen v3 DDL, kept verbatim so a deployed v3 marker's checksum can be
@@ -817,12 +821,31 @@ CREATE TABLE IF NOT EXISTS project_connections (
 CREATE TABLE IF NOT EXISTS connection_lookup_limits (
   actor text PRIMARY KEY, started_at timestamptz NOT NULL, attempts integer NOT NULL
 );`.trim()
-export const SCHEMA_DDL = `${SCHEMA_V11_DDL}\n${CONNECTION_SCHEMA_DDL}`
+export const SCHEMA_V12_DDL = `${SCHEMA_V11_DDL}\n${CONNECTION_SCHEMA_DDL}`
+export const SCHEMA_V12_CHECKSUM = new Bun.CryptoHasher('sha256')
+  .update(SCHEMA_V12_DDL)
+  .digest('hex')
+export const TICKET_POLICY_SCHEMA_DDL = `
+CREATE TABLE IF NOT EXISTS project_ticket_policy (
+  repo text PRIMARY KEY, registration bigint NOT NULL, policy jsonb NOT NULL,
+  writer text NOT NULL, updated_at timestamptz NOT NULL
+);`
+export const TICKET_GRANT_SCHEMA_DDL = `
+CREATE TABLE IF NOT EXISTS ticket_grants (
+ id text PRIMARY KEY, digest text NOT NULL UNIQUE, repo text NOT NULL, registration bigint NOT NULL,
+ execution text NOT NULL, kind text NOT NULL CHECK (kind IN ('runner','phase')),
+ parent text REFERENCES ticket_grants(id), expires_at timestamptz NOT NULL, revoked_at timestamptz
+);`
+export const SCHEMA_V13_DDL = `${SCHEMA_V12_DDL}\n${TICKET_POLICY_SCHEMA_DDL}\n${TICKET_GRANT_SCHEMA_DDL}`
+export const SCHEMA_V13_CHECKSUM = new Bun.CryptoHasher('sha256')
+  .update(SCHEMA_V13_DDL)
+  .digest('hex')
+export const SCHEMA_DDL = `${SCHEMA_V13_DDL}\nALTER TABLE repo_streams ADD COLUMN IF NOT EXISTS tick jsonb;`
 export const SCHEMA_CHECKSUM = new Bun.CryptoHasher('sha256').update(SCHEMA_DDL).digest('hex')
 
 /** Ticket persistence evolves independently so deployed v1 BuildStore markers
  * remain valid while the hosted ticket tables are added. */
-export const TICKET_SCHEMA_VERSION = 2
+export const TICKET_SCHEMA_VERSION = 5
 export const TICKET_SCHEMA_V1_DDL = `
 CREATE TABLE IF NOT EXISTS ab_ticket_schema_migrations (
   singleton boolean PRIMARY KEY DEFAULT true CHECK (singleton),
@@ -851,7 +874,35 @@ CREATE TABLE IF NOT EXISTS ab_ticket_blockers (
 export const TICKET_SCHEMA_V1_CHECKSUM = new Bun.CryptoHasher('sha256')
   .update(TICKET_SCHEMA_V1_DDL)
   .digest('hex')
-export const TICKET_SCHEMA_DDL = TICKET_SCHEMA_V1_DDL.replaceAll('team', 'repo')
+export const TICKET_SCHEMA_V2_DDL = TICKET_SCHEMA_V1_DDL.replaceAll('team', 'repo')
+export const TICKET_SCHEMA_V2_CHECKSUM = new Bun.CryptoHasher('sha256')
+  .update(TICKET_SCHEMA_V2_DDL)
+  .digest('hex')
+export const TICKET_SCHEMA_V3_DDL = TICKET_SCHEMA_V2_DDL.replace(
+  'updated_at timestamptz NOT NULL,',
+  'updated_at timestamptz NOT NULL, revision bigint NOT NULL DEFAULT 1,',
+)
+export const TICKET_SCHEMA_V3_CHECKSUM = new Bun.CryptoHasher('sha256')
+  .update(TICKET_SCHEMA_V3_DDL)
+  .digest('hex')
+export const TICKET_STATES_DDL = `CREATE TABLE IF NOT EXISTS ab_ticket_states (
+  repo text NOT NULL, name text NOT NULL, about text,
+  PRIMARY KEY (repo, name),
+  CHECK (length(btrim(name)) > 0),
+  CHECK (about IS NULL OR (length(btrim(about)) > 0 AND position(chr(10) in about) = 0 AND position(chr(13) in about) = 0))
+);`
+export const TICKET_SCHEMA_V4_DDL = `${TICKET_SCHEMA_V3_DDL}\n${TICKET_STATES_DDL}`
+export const TICKET_SCHEMA_V4_CHECKSUM = new Bun.CryptoHasher('sha256')
+  .update(TICKET_SCHEMA_V4_DDL)
+  .digest('hex')
+export const TICKET_SCHEMA_DDL =
+  TICKET_SCHEMA_V4_DDL +
+  `
+ALTER TABLE ab_tickets ADD COLUMN IF NOT EXISTS readable_id text;
+ALTER TABLE ab_tickets ADD COLUMN IF NOT EXISTS ticket_number bigint;
+CREATE TABLE IF NOT EXISTS ab_ticket_counters (repo text PRIMARY KEY, last_number bigint NOT NULL CHECK (last_number >= 0));
+` +
+  READABLE_TICKET_CONSTRAINTS.trim()
 export const TICKET_SCHEMA_CHECKSUM = new Bun.CryptoHasher('sha256')
   .update(TICKET_SCHEMA_DDL)
   .digest('hex')
@@ -893,6 +944,24 @@ const EXPECTED_COLUMNS: Record<string, readonly ExpectedColumn[]> = {
     ['started_at', 'timestamp with time zone', true],
     ['attempts', 'integer', true],
   ],
+  project_ticket_policy: [
+    ['repo', 'text', true],
+    ['registration', 'bigint', true],
+    ['policy', 'jsonb', true],
+    ['writer', 'text', true],
+    ['updated_at', 'timestamp with time zone', true],
+  ],
+  ticket_grants: [
+    ['id', 'text', true],
+    ['digest', 'text', true],
+    ['repo', 'text', true],
+    ['registration', 'bigint', true],
+    ['execution', 'text', true],
+    ['kind', 'text', true],
+    ['parent', 'text', false],
+    ['expires_at', 'timestamp with time zone', true],
+    ['revoked_at', 'timestamp with time zone', false],
+  ],
   project_credentials: [
     ['id', 'text', true],
     ['digest', 'text', true],
@@ -973,6 +1042,7 @@ const EXPECTED_COLUMNS: Record<string, readonly ExpectedColumn[]> = {
     ['lease_expires_at', 'timestamp with time zone', false],
     ['lease_ttl_ms', 'bigint', false],
     ['heartbeat_at', 'timestamp with time zone', false],
+    ['tick', 'jsonb', false],
   ],
   repo_events: [
     ['repo', 'text', true],
@@ -1048,6 +1118,10 @@ const EXPECTED_COLUMNS: Record<string, readonly ExpectedColumn[]> = {
 }
 
 const EXPECTED_CONSTRAINTS = [
+  'project_ticket_policy|p|repo||||',
+  'ticket_grants|p|id||||',
+  'ticket_grants|c|||||',
+  'ticket_grants|f|parent|ticket_grants|id|a|',
   'project_connections|p|id||||',
   'project_connections|c|||||',
   'connection_lookup_limits|p|actor||||',
@@ -1279,6 +1353,18 @@ export async function assertTicketSchema(sql: SQL): Promise<void> {
       ['labels', 'text[]', true],
       ['created_at', 'timestamp with time zone', true],
       ['updated_at', 'timestamp with time zone', true],
+      ['revision', 'bigint', true],
+      ['readable_id', 'text', true],
+      ['ticket_number', 'bigint', true],
+    ],
+    ab_ticket_counters: [
+      ['repo', 'text', true],
+      ['last_number', 'bigint', true],
+    ],
+    ab_ticket_states: [
+      ['repo', 'text', true],
+      ['name', 'text', true],
+      ['about', 'text', false],
     ],
     ab_ticket_comments: [
       ['repo', 'text', true],
@@ -1303,7 +1389,7 @@ export async function assertTicketSchema(sql: SQL): Promise<void> {
     WHERE n.nspname = current_schema() AND c.relkind IN ('r', 'p')
       AND a.attnum > 0 AND NOT a.attisdropped
       AND c.relname = ANY(ARRAY['ab_ticket_schema_migrations', 'ab_tickets',
-        'ab_ticket_comments', 'ab_ticket_blockers'])
+        'ab_ticket_comments', 'ab_ticket_blockers', 'ab_ticket_counters', 'ab_ticket_states'])
     ORDER BY c.relname, a.attnum`
   for (const [table, shape] of Object.entries(expected)) {
     const actual = columns
@@ -1313,13 +1399,32 @@ export async function assertTicketSchema(sql: SQL): Promise<void> {
       throw schemaError(`ticket table ${table} is missing or mismatched`)
     }
   }
+  const indexes =
+    await sql`SELECT indexdef FROM pg_indexes WHERE schemaname = current_schema() AND tablename = 'ab_tickets' AND indexname = 'ab_tickets_readable_id_key'`
+  if (
+    !indexes[0] ||
+    !String(indexes[0].indexdef).includes('UNIQUE INDEX') ||
+    !String(indexes[0].indexdef).endsWith('(repo, lower(readable_id))')
+  )
+    throw schemaError('ticket readable id unique index is missing or mismatched')
   const constraints: { table_name: string; definition: string }[] = await sql`
     SELECT c.relname AS table_name, pg_get_constraintdef(k.oid) AS definition
     FROM pg_constraint k JOIN pg_class c ON c.oid = k.conrelid
     JOIN pg_namespace n ON n.oid = c.relnamespace
-    WHERE n.nspname = current_schema() AND k.contype IN ('p', 'u', 'f', 'c') AND c.relname IN ('ab_tickets', 'ab_ticket_comments', 'ab_ticket_blockers')`
+    WHERE n.nspname = current_schema() AND k.contype IN ('p', 'u', 'f', 'c') AND c.relname IN ('ab_tickets', 'ab_ticket_comments', 'ab_ticket_blockers', 'ab_ticket_counters', 'ab_ticket_states')`
   const expectedConstraints: Record<string, string[]> = {
-    ab_tickets: ['PRIMARY KEY (repo, id)', 'UNIQUE (repo, creation_key)'],
+    ab_ticket_states: [
+      'PRIMARY KEY (repo, name)',
+      'CHECK ((length(btrim(name)) > 0))',
+      'CHECK (((about IS NULL) OR ((length(btrim(about)) > 0) AND (POSITION((chr(10)) IN (about)) = 0) AND (POSITION((chr(13)) IN (about)) = 0))))',
+    ],
+    ab_tickets: [
+      'PRIMARY KEY (repo, id)',
+      'UNIQUE (repo, creation_key)',
+      'UNIQUE (repo, ticket_number)',
+      'CHECK ((ticket_number > 0))',
+    ],
+    ab_ticket_counters: ['PRIMARY KEY (repo)', 'CHECK ((last_number >= 0))'],
     ab_ticket_comments: [
       'PRIMARY KEY (repo, ticket_id, seq)',
       'FOREIGN KEY (repo, ticket_id) REFERENCES ab_tickets(repo, id) ON DELETE CASCADE',
@@ -1381,7 +1486,8 @@ export async function migratePostgres(
     await sql.begin(async (tx) => {
       await tx`SELECT pg_advisory_xact_lock(470281941)`
       await tx.unsafe(SCHEMA_DDL)
-      await tx.unsafe(TICKET_SCHEMA_DDL)
+      await tx.unsafe(TICKET_SCHEMA_V2_DDL)
+      await tx.unsafe(TICKET_STATES_DDL)
       await tx.unsafe(SNAPSHOT_SCHEMA_DDL)
       await tx.unsafe(AUTH_SCHEMA_DDL)
       const rows: { version: number; checksum: string }[] =
@@ -1559,6 +1665,11 @@ export async function migratePostgres(
             SET version = ${SCHEMA_VERSION}, checksum = ${SCHEMA_CHECKSUM},
               applied_at = ${new Date().toISOString()}
             WHERE singleton = true`
+        } else if (version === 13 && marker.checksum === SCHEMA_V13_CHECKSUM) {
+          await tx`UPDATE ab_schema_migrations SET version = ${SCHEMA_VERSION}, checksum = ${SCHEMA_CHECKSUM}, applied_at = ${new Date().toISOString()} WHERE singleton = true`
+        } else if (version === 12 && marker.checksum === SCHEMA_V12_CHECKSUM) {
+          await tx`UPDATE ab_schema_migrations SET version = ${SCHEMA_VERSION}, checksum = ${SCHEMA_CHECKSUM},
+            applied_at = ${new Date().toISOString()} WHERE singleton = true`
         } else if (version === 11 && marker.checksum === SCHEMA_V11_CHECKSUM) {
           await tx`UPDATE ab_schema_migrations SET version = ${SCHEMA_VERSION}, checksum = ${SCHEMA_CHECKSUM},
             applied_at = ${new Date().toISOString()} WHERE singleton = true`
@@ -1600,8 +1711,32 @@ export async function migratePostgres(
         ticketMarker.checksum === TICKET_SCHEMA_V1_CHECKSUM
       ) {
         await migrateLegacyTickets(tx as SQL, options.openBlobs)
+        await tx`ALTER TABLE ab_tickets ADD COLUMN IF NOT EXISTS revision bigint NOT NULL DEFAULT 1`
+        await migrateReadableTickets(tx as SQL, options.openBlobs)
         await tx`UPDATE ab_ticket_schema_migrations SET version = ${TICKET_SCHEMA_VERSION},
           checksum = ${TICKET_SCHEMA_CHECKSUM}, applied_at = ${new Date().toISOString()} WHERE singleton = true`
+      } else if (
+        ticketMarker &&
+        Number(ticketMarker.version) === 2 &&
+        ticketMarker.checksum === TICKET_SCHEMA_V2_CHECKSUM
+      ) {
+        await tx`ALTER TABLE ab_tickets ADD COLUMN revision bigint NOT NULL DEFAULT 1`
+        await migrateReadableTickets(tx as SQL, options.openBlobs)
+        await tx`UPDATE ab_ticket_schema_migrations SET version = ${TICKET_SCHEMA_VERSION}, checksum = ${TICKET_SCHEMA_CHECKSUM}, applied_at = ${new Date().toISOString()} WHERE singleton = true`
+      } else if (
+        ticketMarker &&
+        Number(ticketMarker.version) === 3 &&
+        ticketMarker.checksum === TICKET_SCHEMA_V3_CHECKSUM
+      ) {
+        await migrateReadableTickets(tx as SQL, options.openBlobs)
+        await tx`UPDATE ab_ticket_schema_migrations SET version = ${TICKET_SCHEMA_VERSION}, checksum = ${TICKET_SCHEMA_CHECKSUM}, applied_at = ${new Date().toISOString()} WHERE singleton = true`
+      } else if (
+        ticketMarker &&
+        Number(ticketMarker.version) === 4 &&
+        ticketMarker.checksum === TICKET_SCHEMA_V4_CHECKSUM
+      ) {
+        await migrateReadableTickets(tx as SQL, options.openBlobs)
+        await tx`UPDATE ab_ticket_schema_migrations SET version = ${TICKET_SCHEMA_VERSION}, checksum = ${TICKET_SCHEMA_CHECKSUM}, applied_at = ${new Date().toISOString()} WHERE singleton = true`
       } else if (ticketMarker) {
         if (Number(ticketMarker.version) !== TICKET_SCHEMA_VERSION) {
           throw schemaError(
@@ -1615,10 +1750,19 @@ export async function migratePostgres(
           )
         }
       } else {
+        await tx`ALTER TABLE ab_tickets ADD COLUMN IF NOT EXISTS revision bigint NOT NULL DEFAULT 1`
+        await migrateReadableTickets(tx as SQL, options.openBlobs)
         await tx`INSERT INTO ab_ticket_schema_migrations
           (singleton, version, checksum, applied_at)
           VALUES (true, ${TICKET_SCHEMA_VERSION}, ${TICKET_SCHEMA_CHECKSUM}, ${new Date().toISOString()})`
       }
+      await tx`INSERT INTO ab_ticket_states (repo, name)
+        SELECT DISTINCT repo, state FROM ab_tickets ON CONFLICT DO NOTHING`
+      await tx`INSERT INTO ab_ticket_states (repo, name)
+        SELECT p.repo, value FROM project_ticket_policy p,
+          LATERAL jsonb_each_text(p.policy->'tickets') AS field(key, value)
+        WHERE key IN ('triageState', 'readyState', 'claimedState', 'doneState', 'createState', 'proposalState')
+        ON CONFLICT DO NOTHING`
       const authRows: { version: number; checksum: string }[] =
         await tx`SELECT version, checksum FROM ab_auth_schema_migrations WHERE singleton = true FOR UPDATE`
       const authMarker = authRows[0]