@devosurf/tesser-server 0.1.0-alpha.0

package/src/db/db.ts

@@ -0,0 +1,114 @@
+// One thin Db seam over plain Postgres (ADR-0003): pg.Pool in production, embedded
+// PGlite for `tesser dev` and tests — same SQL, same semantics (PGlite is real Postgres
+// compiled to wasm; it is single-connection, so SKIP LOCKED contention is simply absent).
+
+export interface QueryResult<R> {
+  rows: R[];
+  rowCount: number;
+}
+
+export interface DbClient {
+  query<R = Record<string, unknown>>(text: string, params?: unknown[]): Promise<QueryResult<R>>;
+}
+
+export interface Db extends DbClient {
+  readonly kind: "pg" | "pglite";
+  tx<T>(fn: (client: DbClient) => Promise<T>): Promise<T>;
+  close(): Promise<void>;
+}
+
+export interface DbConfig {
+  /** postgres:// URL → pg; absent → PGlite at dataDir (or in-memory). */
+  databaseUrl?: string | undefined;
+  /** PGlite data directory; "memory://" or undefined = ephemeral in-memory. */
+  dataDir?: string | undefined;
+}
+
+export async function createDb(config: DbConfig): Promise<Db> {
+  if (config.databaseUrl) {
+    const { default: pg } = await import("pg");
+    const pool = new pg.Pool({ connectionString: config.databaseUrl, max: 10 });
+    // Multi-statement simple-protocol queries yield an array of results — take the last.
+    const normalize = <R>(res: unknown): QueryResult<R> => {
+      const r = (Array.isArray(res) ? res[res.length - 1] : res) as {
+        rows?: R[];
+        rowCount?: number | null;
+      };
+      const rows = r?.rows ?? [];
+      return { rows, rowCount: r?.rowCount ?? rows.length };
+    };
+    return {
+      kind: "pg",
+      async query(text, params) {
+        return normalize(await pool.query(text, params as never[]));
+      },
+      async tx(fn) {
+        const client = await pool.connect();
+        try {
+          await client.query("BEGIN");
+          const result = await fn({
+            async query(text, params) {
+              return normalize(await client.query(text, params as never[]));
+            },
+          });
+          await client.query("COMMIT");
+          return result;
+        } catch (err) {
+          await client.query("ROLLBACK").catch(() => {});
+          throw err;
+        } finally {
+          client.release();
+        }
+      },
+      async close() {
+        await pool.end();
+      },
+    };
+  }
+
+  const { PGlite } = await import("@electric-sql/pglite");
+  let pglite: InstanceType<typeof PGlite>;
+  if (config.dataDir && config.dataDir !== "memory://") {
+    const { mkdirSync } = await import("node:fs");
+    mkdirSync(config.dataDir, { recursive: true });
+    pglite = new PGlite(config.dataDir);
+  } else {
+    pglite = new PGlite();
+  }
+  await pglite.waitReady;
+
+  // PGlite is one connection: serialize interactive transactions behind a mutex so a
+  // worker tx and an API tx never interleave statements.
+  let mutex: Promise<unknown> = Promise.resolve();
+  const withMutex = <T>(fn: () => Promise<T>): Promise<T> => {
+    const next = mutex.then(fn, fn);
+    mutex = next.catch(() => {});
+    return next;
+  };
+
+  return {
+    kind: "pglite",
+    async query(text, params) {
+      const res = await withMutex(() => pglite.query(text, params as never[]));
+      return { rows: res.rows as never[], rowCount: (res as { affectedRows?: number }).affectedRows ?? res.rows.length };
+    },
+    async tx(fn) {
+      return withMutex(() =>
+        pglite.transaction(async (t) => {
+          return fn({
+            async query(text, params) {
+              const res = await t.query(text, params as never[]);
+              return {
+                rows: res.rows as never[],
+                rowCount: (res as { affectedRows?: number }).affectedRows ?? res.rows.length,
+              };
+            },
+          });
+        }),
+      ) as Promise<never>;
+    },
+    async close() {
+      await pglite.close();
+    },
+  };
+}

package/src/db/migrate.ts

@@ -0,0 +1,35 @@
+import type { Db } from "./db.js";
+import { migrations } from "./migrations.js";
+
+export async function migrate(db: Db): Promise<string[]> {
+  await db.query(
+    `CREATE TABLE IF NOT EXISTS schema_migrations (
+       id text PRIMARY KEY,
+       applied_at timestamptz NOT NULL DEFAULT now()
+     )`,
+  );
+  const { rows } = await db.query<{ id: string }>(`SELECT id FROM schema_migrations`);
+  const applied = new Set(rows.map((r) => r.id));
+  const ran: string[] = [];
+  for (const m of migrations) {
+    if (applied.has(m.id)) continue;
+    await db.tx(async (c) => {
+      // PGlite/pg both accept multi-statement strings via simple query protocol — but the
+      // pg extended protocol (with params) does not; migrations carry no params.
+      for (const statement of splitStatements(m.sql)) {
+        await c.query(statement);
+      }
+      await c.query(`INSERT INTO schema_migrations (id) VALUES ($1)`, [m.id]);
+    });
+    ran.push(m.id);
+  }
+  return ran;
+}
+
+/** Split on top-level semicolons (none of our DDL contains procedural bodies). */
+function splitStatements(sql: string): string[] {
+  return sql
+    .split(/;\s*(?=\n|$)/)
+    .map((s) => s.trim())
+    .filter((s) => s.length > 0 && !s.startsWith("--"));
+}

package/src/db/migrations.ts

@@ -0,0 +1,302 @@
+// Schema migrations — applied in order, recorded in schema_migrations. Postgres is the
+// single stateful dependency (ADR-0003): metadata, queue, journal, encrypted secrets.
+
+export interface Migration {
+  id: string;
+  sql: string;
+}
+
+export const migrations: Migration[] = [
+  {
+    id: "0001-core",
+    sql: /* sql */ `
+CREATE TABLE workspaces (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  name text NOT NULL,
+  data_key_cipher text NOT NULL,
+  created_at timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE TABLE api_tokens (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  workspace_id uuid NOT NULL REFERENCES workspaces(id) ON DELETE CASCADE,
+  name text NOT NULL,
+  token_hash text NOT NULL UNIQUE,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  last_used_at timestamptz
+);
+
+CREATE TABLE projects (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  workspace_id uuid NOT NULL REFERENCES workspaces(id) ON DELETE CASCADE,
+  name text NOT NULL,
+  repo_url text,
+  deploy_key_public text,
+  deploy_key_private_cipher text,
+  prod_branch text NOT NULL DEFAULT 'main',
+  push_webhook_secret text,
+  poll_interval_s integer,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  UNIQUE (workspace_id, name)
+);
+
+CREATE TABLE repo_state (
+  project_id uuid PRIMARY KEY REFERENCES projects(id) ON DELETE CASCADE,
+  branch text NOT NULL DEFAULT 'main',
+  last_sha text,
+  status text NOT NULL DEFAULT 'idle', -- idle|syncing|synced|halted-credentials|failed
+  error text,
+  report jsonb,
+  last_synced_at timestamptz
+);
+
+CREATE TABLE automation_versions (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+  automation_id text NOT NULL,
+  version integer NOT NULL,
+  content_hash text NOT NULL,
+  bundle_path text NOT NULL,
+  manifest jsonb NOT NULL,
+  git_sha text,
+  branch text NOT NULL DEFAULT 'main',
+  status text NOT NULL DEFAULT 'staged', -- staged|live|superseded|failed
+  test_report jsonb,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  UNIQUE (project_id, automation_id, version)
+);
+
+CREATE TABLE aliases (
+  project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+  automation_id text NOT NULL,
+  env text NOT NULL, -- 'production' | 'preview:<branch>'
+  version_id uuid NOT NULL REFERENCES automation_versions(id),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (project_id, automation_id, env)
+);
+
+CREATE TABLE runs (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+  automation_id text NOT NULL,
+  version_id uuid REFERENCES automation_versions(id) ON DELETE SET NULL,
+  env text NOT NULL DEFAULT 'production',
+  status text NOT NULL DEFAULT 'queued', -- queued|running|suspended|completed|failed|cancelled
+  trigger jsonb NOT NULL,
+  input jsonb,
+  output jsonb,
+  error jsonb,
+  attempt integer NOT NULL DEFAULT 0,
+  concurrency_key text,
+  wake_at timestamptz,
+  waiting_signal text,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  started_at timestamptz,
+  finished_at timestamptz
+);
+CREATE INDEX runs_by_automation ON runs (project_id, automation_id, created_at DESC);
+CREATE INDEX runs_by_status ON runs (status) WHERE status IN ('queued','running','suspended');
+CREATE INDEX runs_concurrency ON runs (project_id, automation_id, concurrency_key)
+  WHERE status IN ('queued','running','suspended');
+
+CREATE TABLE run_steps (
+  run_id uuid NOT NULL REFERENCES runs(id) ON DELETE CASCADE,
+  name text NOT NULL,
+  occurrence integer NOT NULL,
+  status text NOT NULL, -- running|completed|failed
+  attempts integer NOT NULL DEFAULT 0,
+  result jsonb,
+  error jsonb,
+  has_undo boolean NOT NULL DEFAULT false,
+  undone boolean NOT NULL DEFAULT false,
+  started_at timestamptz NOT NULL DEFAULT now(),
+  finished_at timestamptz,
+  PRIMARY KEY (run_id, name, occurrence)
+);
+
+CREATE TABLE queue_jobs (
+  id bigint GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
+  kind text NOT NULL,
+  payload jsonb NOT NULL,
+  status text NOT NULL DEFAULT 'ready', -- ready|dead
+  run_at timestamptz NOT NULL DEFAULT now(),
+  priority integer NOT NULL DEFAULT 0,
+  lease_until timestamptz,
+  attempts integer NOT NULL DEFAULT 0,
+  max_attempts integer NOT NULL DEFAULT 10,
+  tag text,
+  dedupe_key text,
+  last_error text,
+  created_at timestamptz NOT NULL DEFAULT now()
+);
+CREATE INDEX queue_ready ON queue_jobs (run_at, priority DESC) WHERE status = 'ready';
+CREATE UNIQUE INDEX queue_dedupe ON queue_jobs (dedupe_key) WHERE dedupe_key IS NOT NULL;
+
+CREATE TABLE schedules (
+  project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+  automation_id text NOT NULL,
+  env text NOT NULL,
+  cron text NOT NULL,
+  tz text,
+  enabled boolean NOT NULL DEFAULT true,
+  next_fire timestamptz,
+  PRIMARY KEY (project_id, automation_id, env)
+);
+
+CREATE TABLE events (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+  env text NOT NULL DEFAULT 'production',
+  name text NOT NULL,
+  payload jsonb,
+  emitted_by_run uuid,
+  created_at timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE TABLE event_subscriptions (
+  project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+  env text NOT NULL,
+  event_name text NOT NULL,
+  automation_id text NOT NULL,
+  PRIMARY KEY (project_id, env, event_name, automation_id)
+);
+
+CREATE TABLE signals (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  run_id uuid NOT NULL REFERENCES runs(id) ON DELETE CASCADE,
+  name text NOT NULL,
+  payload jsonb,
+  consumed boolean NOT NULL DEFAULT false,
+  created_at timestamptz NOT NULL DEFAULT now()
+);
+CREATE INDEX signals_by_run ON signals (run_id, name) WHERE NOT consumed;
+
+CREATE TABLE connections (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  workspace_id uuid NOT NULL REFERENCES workspaces(id) ON DELETE CASCADE,
+  connector_id text NOT NULL,
+  provider text,
+  auth_mode text NOT NULL DEFAULT 'default',
+  scope text NOT NULL DEFAULT 'workspace', -- workspace|per_user
+  end_user_id text,
+  label text,
+  credential_cipher text,
+  credential_meta jsonb NOT NULL DEFAULT '{}',
+  status text NOT NULL DEFAULT 'pending', -- pending|ready|error
+  error text,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now()
+);
+CREATE INDEX connections_lookup ON connections (workspace_id, connector_id, status);
+
+CREATE TABLE requirement_bindings (
+  project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+  automation_id text NOT NULL,
+  env text NOT NULL,
+  req_key text NOT NULL,
+  connection_id uuid NOT NULL REFERENCES connections(id) ON DELETE CASCADE,
+  PRIMARY KEY (project_id, automation_id, env, req_key)
+);
+
+CREATE TABLE secrets (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  workspace_id uuid NOT NULL REFERENCES workspaces(id) ON DELETE CASCADE,
+  name text NOT NULL,
+  value_cipher text NOT NULL,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  UNIQUE (workspace_id, name)
+);
+
+CREATE TABLE connect_links (
+  token text PRIMARY KEY,
+  workspace_id uuid NOT NULL REFERENCES workspaces(id) ON DELETE CASCADE,
+  project_id uuid REFERENCES projects(id) ON DELETE CASCADE,
+  requirements jsonb NOT NULL,
+  status text NOT NULL DEFAULT 'pending', -- pending|completed|expired
+  expires_at timestamptz NOT NULL,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  completed_at timestamptz
+);
+
+CREATE TABLE oauth_apps (
+  workspace_id uuid NOT NULL REFERENCES workspaces(id) ON DELETE CASCADE,
+  provider text NOT NULL,
+  client_id text NOT NULL,
+  client_secret_cipher text NOT NULL,
+  PRIMARY KEY (workspace_id, provider)
+);
+
+CREATE TABLE oauth_states (
+  state text PRIMARY KEY,
+  connect_token text REFERENCES connect_links(token) ON DELETE CASCADE,
+  connection_id uuid REFERENCES connections(id) ON DELETE CASCADE,
+  provider text NOT NULL,
+  code_verifier text,
+  redirect_uri text NOT NULL,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  expires_at timestamptz NOT NULL
+);
+
+CREATE TABLE webhook_registrations (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+  automation_id text NOT NULL,
+  trigger_id text NOT NULL,
+  connector_id text NOT NULL,
+  connection_id uuid REFERENCES connections(id) ON DELETE SET NULL,
+  env text NOT NULL,
+  config_hash text NOT NULL,
+  ingress_token text NOT NULL UNIQUE,
+  signing_secret_cipher text,
+  external_id text,
+  state jsonb,
+  status text NOT NULL DEFAULT 'pending', -- pending|registered|manual-pending|failed|removed
+  error text,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  UNIQUE (project_id, automation_id, trigger_id, connection_id, env)
+);
+
+CREATE TABLE trigger_state (
+  project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+  automation_id text NOT NULL,
+  trigger_id text NOT NULL,
+  connection_id uuid NOT NULL,
+  kind text NOT NULL, -- poll|webhook
+  seen jsonb NOT NULL DEFAULT '[]',
+  cursor jsonb,
+  seeded boolean NOT NULL DEFAULT false,
+  last_poll_at timestamptz,
+  last_delivery_at timestamptz,
+  PRIMARY KEY (project_id, automation_id, trigger_id, connection_id)
+);
+
+CREATE TABLE run_logs (
+  id bigint GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
+  run_id uuid NOT NULL REFERENCES runs(id) ON DELETE CASCADE,
+  step text,
+  level text NOT NULL,
+  msg text NOT NULL,
+  meta jsonb,
+  created_at timestamptz NOT NULL DEFAULT now()
+);
+CREATE INDEX run_logs_by_run ON run_logs (run_id, id);
+`,
+  },
+  {
+    id: "0002-project-webhook-bootstrap",
+    sql: /* sql */ `
+ALTER TABLE projects ADD COLUMN IF NOT EXISTS push_webhook_secret_cipher text;
+ALTER TABLE projects ADD COLUMN IF NOT EXISTS push_webhook_setup_token_hash text;
+`,
+  },
+  {
+    id: "0003-run-version-delete-policy",
+    sql: /* sql */ `
+ALTER TABLE runs DROP CONSTRAINT IF EXISTS runs_version_id_fkey;
+ALTER TABLE runs ADD CONSTRAINT runs_version_id_fkey
+  FOREIGN KEY (version_id) REFERENCES automation_versions(id) ON DELETE SET NULL;
+`,
+  },
+];