@intx/db 0.1.2 → 0.3.0

package/dist/schema/git-tokens.d.ts

@@ -0,0 +1,256 @@
+export declare const gitToken: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "git_token";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "git_token";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        tenantId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "tenant_id";
+            tableName: "git_token";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        userId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "user_id";
+            tableName: "git_token";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        principalId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "principal_id";
+            tableName: "git_token";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        name: import("drizzle-orm/pg-core").PgColumn<{
+            name: "name";
+            tableName: "git_token";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        kind: import("drizzle-orm/pg-core").PgColumn<{
+            name: "kind";
+            tableName: "git_token";
+            dataType: "string";
+            columnType: "PgText";
+            data: "pat" | "svc";
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["pat", "svc"];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        tokenHashSha256: import("drizzle-orm/pg-core").PgColumn<{
+            name: "token_hash_sha256";
+            tableName: "git_token";
+            dataType: "custom";
+            columnType: "PgCustomColumn";
+            data: Uint8Array<ArrayBufferLike>;
+            driverParam: Uint8Array<ArrayBufferLike>;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            pgColumnBuilderBrand: "PgCustomColumnBuilderBrand";
+        }>;
+        resource: import("drizzle-orm/pg-core").PgColumn<{
+            name: "resource";
+            tableName: "git_token";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        refPattern: import("drizzle-orm/pg-core").PgColumn<{
+            name: "ref_pattern";
+            tableName: "git_token";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        actions: import("drizzle-orm/pg-core").PgColumn<{
+            name: "actions";
+            tableName: "git_token";
+            dataType: "array";
+            columnType: "PgArray";
+            data: string[];
+            driverParam: string | string[];
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: import("drizzle-orm").Column<{
+                name: "actions";
+                tableName: "git_token";
+                dataType: "string";
+                columnType: "PgText";
+                data: string;
+                driverParam: string;
+                notNull: false;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: [string, ...string[]];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            baseBuilder: import("drizzle-orm/pg-core").PgColumnBuilder<{
+                name: "actions";
+                dataType: "string";
+                columnType: "PgText";
+                data: string;
+                enumValues: [string, ...string[]];
+                driverParam: string;
+            }, {}, {}, import("drizzle-orm").ColumnBuilderExtraConfig>;
+            size: undefined;
+        }>;
+        expiresAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "expires_at";
+            tableName: "git_token";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        revokedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "revoked_at";
+            tableName: "git_token";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_at";
+            tableName: "git_token";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;

package/{src/schema/git-tokens.ts → dist/schema/git-tokens.js}

@@ -1,28 +1,9 @@
 import { sql } from "drizzle-orm";
-import {
-  customType,
-  pgTable,
-  text,
-  timestamp,
-  uniqueIndex,
-} from "drizzle-orm/pg-core";
-
-import { user } from "./auth";
-import { principal } from "./principals";
-import { tenant } from "./tenants";
-
-const bytea = customType<{ data: Uint8Array; driverData: Buffer }>({
-  dataType() {
-    return "bytea";
-  },
-  toDriver(value) {
-    return Buffer.from(value);
-  },
-  fromDriver(value) {
-    return new Uint8Array(value);
-  },
-});
-
+import { pgTable, text, timestamp, uniqueIndex } from "drizzle-orm/pg-core";
+import { user } from "./auth.js";
+import { bytea } from "./column-types.js";
+import { principal } from "./principals.js";
+import { tenant } from "./tenants.js";
 // Hub-issued bearer tokens for the smart-HTTP git endpoints. Opaque
 // tokens of the form `itx_pat_<base64>` or `itx_svc_<base64>` whose
 // SHA-256 digest is stored as `tokenHashSha256` (the raw secret is
@@ -43,7 +24,7 @@ const bytea = customType<{ data: Uint8Array; driverData: Buffer }>({
 // (`receivePack`, `createPack`, `resolveRef`, ...). The mint API
 // translates user-facing aliases to canonical names before insert.
 // `resource` is the single substrate authz resource string
-// (e.g. `agent-state:ins_xxx`, `asset:def_yyy`) that the token grants
+// (e.g. `agent-state:run_xxx`, `asset:def_yyy`) that the token grants
 // access to. `refPattern` is a glob restricting which refs within the
 // resource the token may read or write.
 //
@@ -52,16 +33,14 @@ const bytea = customType<{ data: Uint8Array; driverData: Buffer }>({
 // `(user_id, name)` filtered by `revoked_at is null` lets a user
 // reuse a friendly name (e.g. "laptop") after revoking the old
 // token bearing that name.
-export const gitToken = pgTable(
-  "git_token",
-  {
+export const gitToken = pgTable("git_token", {
     id: text("id").primaryKey(),
     tenantId: text("tenant_id").references(() => tenant.id),
     userId: text("user_id")
-      .notNull()
-      .references(() => user.id, { onDelete: "cascade" }),
+        .notNull()
+        .references(() => user.id, { onDelete: "cascade" }),
     principalId: text("principal_id").references(() => principal.id, {
-      onDelete: "cascade",
+        onDelete: "cascade",
     }),
     name: text("name").notNull(),
     kind: text("kind", { enum: ["pat", "svc"] }).notNull(),
@@ -72,12 +51,10 @@ export const gitToken = pgTable(
     expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
     revokedAt: timestamp("revoked_at", { withTimezone: true }),
     createdAt: timestamp("created_at", { withTimezone: true })
-      .notNull()
-      .defaultNow(),
-  },
-  (t) => [
+        .notNull()
+        .defaultNow(),
+}, (t) => [
     uniqueIndex("git_token_user_id_name_active_idx")
-      .on(t.userId, t.name)
-      .where(sql`${t.revokedAt} is null`),
-  ],
-);
+        .on(t.userId, t.name)
+        .where(sql `${t.revokedAt} is null`),
+]);

package/dist/schema/grants.d.ts

@@ -0,0 +1,211 @@
+export declare const grant: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "grant";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "grant";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        tenantId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "tenant_id";
+            tableName: "grant";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        roleId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "role_id";
+            tableName: "grant";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        principalId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "principal_id";
+            tableName: "grant";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        resource: import("drizzle-orm/pg-core").PgColumn<{
+            name: "resource";
+            tableName: "grant";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        action: import("drizzle-orm/pg-core").PgColumn<{
+            name: "action";
+            tableName: "grant";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        effect: import("drizzle-orm/pg-core").PgColumn<{
+            name: "effect";
+            tableName: "grant";
+            dataType: "string";
+            columnType: "PgText";
+            data: "allow" | "deny" | "ask";
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["allow", "deny", "ask"];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        conditions: import("drizzle-orm/pg-core").PgColumn<{
+            name: "conditions";
+            tableName: "grant";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: unknown;
+            driverParam: unknown;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        origin: import("drizzle-orm/pg-core").PgColumn<{
+            name: "origin";
+            tableName: "grant";
+            dataType: "string";
+            columnType: "PgText";
+            data: "role" | "system" | "creator" | "invoker";
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["system", "role", "creator", "invoker"];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        expiresAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "expires_at";
+            tableName: "grant";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_at";
+            tableName: "grant";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        updatedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "updated_at";
+            tableName: "grant";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;

package/dist/schema/grants.js

@@ -0,0 +1,30 @@
+import { check, jsonb, pgTable, text, timestamp } from "drizzle-orm/pg-core";
+import { sql } from "drizzle-orm";
+import { principal } from "./principals.js";
+import { role } from "./roles.js";
+import { tenant } from "./tenants.js";
+export const grant = pgTable("grant", {
+    id: text("id").primaryKey(),
+    tenantId: text("tenant_id")
+        .notNull()
+        .references(() => tenant.id, { onDelete: "cascade" }),
+    roleId: text("role_id").references(() => role.id, { onDelete: "cascade" }),
+    principalId: text("principal_id").references(() => principal.id, {
+        onDelete: "cascade",
+    }),
+    resource: text("resource").notNull(),
+    action: text("action").notNull(),
+    effect: text("effect", { enum: ["allow", "deny", "ask"] }).notNull(),
+    conditions: jsonb("conditions"),
+    origin: text("origin", {
+        enum: ["system", "role", "creator", "invoker"],
+    }).notNull(),
+    expiresAt: timestamp("expires_at"),
+    createdAt: timestamp("created_at").notNull().defaultNow(),
+    updatedAt: timestamp("updated_at").notNull().defaultNow(),
+}, (t) => [
+    // Exactly one target: a grant hangs off a role OR a principal, never both
+    // and never neither. Documented in AUTH.md; enforced in the DB so a
+    // malformed row is rejected at write rather than silently mis-targeted.
+    check("grant_target_exactly_one", sql `num_nonnulls(${t.principalId}, ${t.roleId}) = 1`),
+]);

package/dist/schema/index.d.ts

@@ -0,0 +1,25 @@
+export * from "./auth.js";
+export * from "./tenants.js";
+export * from "./principals.js";
+export * from "./roles.js";
+export * from "./grants.js";
+export * from "./approvals.js";
+export * from "./signal-correlations.js";
+export * from "./providers.js";
+export * from "./oauth-clients.js";
+export * from "./credentials.js";
+export * from "./assets.js";
+export * from "./wallets.js";
+export * from "./offerings.js";
+export * from "./catalog.js";
+export * from "./sidecar.js";
+export * from "./sidecar-allocation.js";
+export * from "./sessions.js";
+export * from "./session-assets.js";
+export * from "./messages.js";
+export * from "./git-tokens.js";
+export * from "./workflow-definitions.js";
+export * from "./workflow-run.js";
+export * from "./workflow-run-dispatch.js";
+export * from "./workflow-run-launch-spec.js";
+export * from "./workflow-run-execution.js";

package/dist/schema/index.js

@@ -0,0 +1,25 @@
+export * from "./auth.js";
+export * from "./tenants.js";
+export * from "./principals.js";
+export * from "./roles.js";
+export * from "./grants.js";
+export * from "./approvals.js";
+export * from "./signal-correlations.js";
+export * from "./providers.js";
+export * from "./oauth-clients.js";
+export * from "./credentials.js";
+export * from "./assets.js";
+export * from "./wallets.js";
+export * from "./offerings.js";
+export * from "./catalog.js";
+export * from "./sidecar.js";
+export * from "./sidecar-allocation.js";
+export * from "./sessions.js";
+export * from "./session-assets.js";
+export * from "./messages.js";
+export * from "./git-tokens.js";
+export * from "./workflow-definitions.js";
+export * from "./workflow-run.js";
+export * from "./workflow-run-dispatch.js";
+export * from "./workflow-run-launch-spec.js";
+export * from "./workflow-run-execution.js";