@intx/db 0.1.2 → 0.3.0

package/src/parse-row.test.ts

@@ -1,113 +0,0 @@
-import { describe, expect, test } from "bun:test";
-
-import { RepoAction } from "@intx/types/sidecar";
-
-import { GitTokenKindValidator, parseGitTokenRow } from "./parse-row";
-import type { gitToken } from "./schema";
-
-type GitTokenRow = typeof gitToken.$inferSelect;
-
-function makeRow(overrides: Partial<GitTokenRow> = {}): GitTokenRow {
-  const now = new Date();
-  return {
-    id: "gtk_0123456789abcdef0123456789abcdef",
-    tenantId: null,
-    userId: "user_alice",
-    principalId: null,
-    name: "laptop",
-    kind: "pat",
-    tokenHashSha256: new Uint8Array(32),
-    resource: "agent-state:ins_test",
-    refPattern: "refs/heads/*",
-    actions: ["receivePack", "createPack", "resolveRef"],
-    expiresAt: new Date("2027-01-01T00:00:00Z"),
-    revokedAt: null,
-    createdAt: now,
-    ...overrides,
-  };
-}
-
-describe("parseGitTokenRow", () => {
-  test("round-trips a personal pat with concrete repo scope", () => {
-    const row = makeRow();
-    const parsed = parseGitTokenRow(row);
-
-    expect(parsed.id).toBe(row.id);
-    expect(parsed.tenantId).toBeNull();
-    expect(parsed.userId).toBe(row.userId);
-    expect(parsed.principalId).toBeNull();
-    expect(parsed.name).toBe(row.name);
-    expect(parsed.kind).toBe("pat");
-    expect(parsed.tokenHashSha256).toBe(row.tokenHashSha256);
-    expect(parsed.actions).toEqual(["receivePack", "createPack", "resolveRef"]);
-    expect(parsed.resource).toBe("agent-state:ins_test");
-    expect(parsed.refPattern).toBe("refs/heads/*");
-    expect(parsed.expiresAt).toBe(row.expiresAt);
-    expect(parsed.revokedAt).toBeNull();
-    expect(parsed.createdAt).toBe(row.createdAt);
-  });
-
-  test("round-trips a tenant-restricted pat", () => {
-    const row = makeRow({
-      tenantId: "tnt_acme",
-      name: "acme-only",
-    });
-    const parsed = parseGitTokenRow(row);
-
-    expect(parsed.kind).toBe("pat");
-    expect(parsed.tenantId).toBe("tnt_acme");
-    expect(parsed.principalId).toBeNull();
-  });
-
-  test("round-trips a tenant-bound svc token", () => {
-    const row = makeRow({
-      kind: "svc",
-      tenantId: "tnt_acme",
-      principalId: "prn_tenant_user",
-      name: "ci-runner",
-      actions: ["createPack", "resolveRef"],
-      resource: "asset:def_skill_xyz",
-      refPattern: "refs/tags/v*",
-    });
-    const parsed = parseGitTokenRow(row);
-
-    expect(parsed.kind).toBe("svc");
-    expect(parsed.tenantId).toBe("tnt_acme");
-    expect(parsed.principalId).toBe("prn_tenant_user");
-    expect(parsed.actions).toEqual(["createPack", "resolveRef"]);
-    expect(parsed.resource).toBe("asset:def_skill_xyz");
-    expect(parsed.refPattern).toBe("refs/tags/v*");
-  });
-
-  test("preserves revokedAt for soft-revoked rows", () => {
-    const revoked = new Date("2026-01-15T00:00:00Z");
-    const row = makeRow({ revokedAt: revoked });
-    const parsed = parseGitTokenRow(row);
-
-    expect(parsed.revokedAt).toBe(revoked);
-  });
-
-  test("preserves expiresAt", () => {
-    const expires = new Date("2027-01-01T00:00:00Z");
-    const row = makeRow({ expiresAt: expires });
-    const parsed = parseGitTokenRow(row);
-
-    expect(parsed.expiresAt).toBe(expires);
-  });
-
-  test("rejects an unknown kind", () => {
-    expect(() => GitTokenKindValidator.assert("rogue")).toThrow();
-  });
-
-  test("rejects an unknown action in the actions array", () => {
-    expect(() =>
-      RepoAction.array().assert(["receivePack", "fly-the-helicopter"]),
-    ).toThrow();
-  });
-
-  test("accepts an empty actions array", () => {
-    const row = makeRow({ actions: [] });
-    const parsed = parseGitTokenRow(row);
-    expect(parsed.actions).toEqual([]);
-  });
-});

package/src/parse-row.ts

@@ -1,185 +0,0 @@
-import { type } from "arktype";
-
-import {
-  CredentialRequirement,
-  GrantRequirement,
-  grantEffects,
-  grantOrigins,
-  sidecarStatuses,
-} from "@intx/types";
-import { RepoAction } from "@intx/types/sidecar";
-
-import type {
-  agent,
-  agentVersion,
-  credential,
-  gitToken,
-  grant,
-  oauthClient,
-  offering,
-  provider,
-  tenant,
-  transaction,
-  turnPart,
-  wallet,
-} from "./schema";
-
-const JSONObject = type("Record<string, unknown>");
-
-const GrantEffectValidator = type.enumerated(...grantEffects);
-const GrantOriginValidator = type.enumerated(...grantOrigins);
-
-const agentVersionStatuses = ["active", "inactive", "failed"] as const;
-const AgentVersionStatusValidator = type.enumerated(...agentVersionStatuses);
-
-const credentialTypes = [
-  "api_key",
-  "oauth_token",
-  "certificate",
-  "other",
-] as const;
-const CredentialTypeValidator = type.enumerated(...credentialTypes);
-
-const credentialStatuses = ["active", "expired", "revoked", "error"] as const;
-const CredentialStatusValidator = type.enumerated(...credentialStatuses);
-
-const walletBackendTypes = ["crypto", "fiat", "credits"] as const;
-const WalletBackendTypeValidator = type.enumerated(...walletBackendTypes);
-
-const transactionDirections = ["inbound", "outbound"] as const;
-const TransactionDirectionValidator = type.enumerated(...transactionDirections);
-
-const transactionStatuses = ["pending", "completed", "failed"] as const;
-const TransactionStatusValidator = type.enumerated(...transactionStatuses);
-
-const SidecarStatusValidator = type.enumerated(...sidecarStatuses);
-
-const gitTokenKinds = ["pat", "svc"] as const;
-export const GitTokenKindValidator = type.enumerated(...gitTokenKinds);
-
-const turnPartTypes = [
-  "text",
-  "reasoning",
-  "tool",
-  "file",
-  "error",
-  "refusal",
-  "step-start",
-  "step-finish",
-  "snapshot",
-  "patch",
-] as const;
-const TurnPartTypeValidator = type.enumerated(...turnPartTypes);
-
-export function parseAgentRow(row: typeof agent.$inferSelect) {
-  return {
-    ...row,
-    contextConfig:
-      row.contextConfig !== null ? JSONObject.assert(row.contextConfig) : null,
-    initialState:
-      row.initialState !== null ? JSONObject.assert(row.initialState) : null,
-    modelConfig:
-      row.modelConfig !== null ? JSONObject.assert(row.modelConfig) : null,
-    capabilities:
-      row.capabilities !== null ? JSONObject.assert(row.capabilities) : null,
-    credentialRequirements:
-      row.credentialRequirements !== null
-        ? CredentialRequirement.array().assert(row.credentialRequirements)
-        : null,
-    grantRequirements:
-      row.grantRequirements !== null
-        ? GrantRequirement.array().assert(row.grantRequirements)
-        : null,
-  };
-}
-
-export function parseAgentVersionRow(row: typeof agentVersion.$inferSelect) {
-  return {
-    ...row,
-    status: AgentVersionStatusValidator.assert(row.status),
-  };
-}
-
-export function parseGrantRow(row: typeof grant.$inferSelect) {
-  return {
-    ...row,
-    effect: GrantEffectValidator.assert(row.effect),
-    origin: GrantOriginValidator.assert(row.origin),
-    conditions:
-      row.conditions !== null ? JSONObject.assert(row.conditions) : null,
-  };
-}
-
-export function parseOfferingRow(row: typeof offering.$inferSelect) {
-  return {
-    ...row,
-    pricing: row.pricing !== null ? JSONObject.assert(row.pricing) : null,
-    schema: row.schema !== null ? JSONObject.assert(row.schema) : null,
-  };
-}
-
-export function parseCredentialRow(row: typeof credential.$inferSelect) {
-  return {
-    ...row,
-    type: CredentialTypeValidator.assert(row.type),
-    status: CredentialStatusValidator.assert(row.status),
-    metadata: row.metadata !== null ? JSONObject.assert(row.metadata) : null,
-  };
-}
-
-export function parseProviderRow(row: typeof provider.$inferSelect) {
-  return {
-    ...row,
-    metadata: row.metadata !== null ? JSONObject.assert(row.metadata) : null,
-  };
-}
-
-export function parseTenantRow(row: typeof tenant.$inferSelect) {
-  return {
-    ...row,
-    config: row.config !== null ? JSONObject.assert(row.config) : null,
-  };
-}
-
-export function parseWalletRow(row: typeof wallet.$inferSelect) {
-  return {
-    ...row,
-    backendType: WalletBackendTypeValidator.assert(row.backendType),
-    config: row.config !== null ? JSONObject.assert(row.config) : null,
-  };
-}
-
-export function parseTransactionRow(row: typeof transaction.$inferSelect) {
-  return {
-    ...row,
-    direction: TransactionDirectionValidator.assert(row.direction),
-    status: TransactionStatusValidator.assert(row.status),
-  };
-}
-
-export function parseOAuthClientRow(row: typeof oauthClient.$inferSelect) {
-  return {
-    ...row,
-    metadata: row.metadata !== null ? JSONObject.assert(row.metadata) : null,
-  };
-}
-
-export function parseGitTokenRow(row: typeof gitToken.$inferSelect) {
-  return {
-    ...row,
-    kind: GitTokenKindValidator.assert(row.kind),
-    actions: RepoAction.array().assert(row.actions),
-  };
-}
-
-export function parseSidecarStatus(
-  status: string,
-): "online" | "offline" | "error" {
-  return SidecarStatusValidator.assert(status);
-}
-
-export function parseTurnPartType(
-  partType: string,
-): (typeof turnPart.$inferInsert)["type"] {
-  return TurnPartTypeValidator.assert(partType);
-}

package/src/schema/agent-assets.ts

@@ -1,21 +0,0 @@
-import { pgTable, text, timestamp, unique } from "drizzle-orm/pg-core";
-
-import { agent } from "./agents";
-import { asset } from "./assets";
-
-export const agentAsset = pgTable(
-  "agent_asset",
-  {
-    id: text("id").primaryKey(),
-    agentId: text("agent_id")
-      .notNull()
-      .references(() => agent.id, { onDelete: "cascade" }),
-    assetId: text("asset_id")
-      .notNull()
-      .references(() => asset.id, { onDelete: "cascade" }),
-    ref: text("ref").notNull(),
-    accessMode: text("access_mode").notNull().default("read-only"),
-    createdAt: timestamp("created_at").notNull().defaultNow(),
-  },
-  (t) => [unique("agent_asset_agent_asset").on(t.agentId, t.assetId)],
-);

package/src/schema/agents.ts

@@ -1,49 +0,0 @@
-import { jsonb, pgTable, text, timestamp } from "drizzle-orm/pg-core";
-
-import { principal } from "./principals";
-import { tenant } from "./tenants";
-
-export const agent = pgTable("agent", {
-  id: text("id").primaryKey(),
-  tenantId: text("tenant_id")
-    .notNull()
-    .references(() => tenant.id, { onDelete: "cascade" }),
-  // Tracks the definition author's principal for resolving source:"creator"
-  // grant requirements at launch. See AUTH.md § Grant Requirements on Definitions.
-  creatorPrincipalId: text("creator_principal_id")
-    .notNull()
-    .references(() => principal.id),
-  name: text("name").notNull(),
-  description: text("description"),
-  systemPrompt: text("system_prompt"),
-  contextConfig: jsonb("context_config"),
-  initialState: jsonb("initial_state"),
-  modelConfig: jsonb("model_config"),
-  capabilities: jsonb("capabilities"),
-  credentialRequirements: jsonb("credential_requirements"),
-  // Grant requirements manifest — resolved at launch into materialized grants
-  // on the instance principal. See AUTH.md § Grant Requirements on Definitions.
-  grantRequirements: jsonb("grant_requirements"),
-  currentVersion: text("current_version").notNull().default("1"),
-  status: text("status", {
-    enum: ["deployed", "stopped"],
-  })
-    .notNull()
-    .default("deployed"),
-  createdAt: timestamp("created_at").notNull().defaultNow(),
-  updatedAt: timestamp("updated_at").notNull().defaultNow(),
-});
-
-export const agentVersion = pgTable("agent_version", {
-  id: text("id").primaryKey(),
-  agentId: text("agent_id")
-    .notNull()
-    .references(() => agent.id, { onDelete: "cascade" }),
-  version: text("version").notNull(),
-  status: text("status", {
-    enum: ["active", "inactive", "failed"],
-  })
-    .notNull()
-    .default("active"),
-  createdAt: timestamp("created_at").notNull().defaultNow(),
-});

package/src/schema/auth.ts

@@ -1,51 +0,0 @@
-import { boolean, pgTable, text, timestamp } from "drizzle-orm/pg-core";
-
-export const user = pgTable("user", {
-  id: text("id").primaryKey(),
-  name: text("name").notNull(),
-  email: text("email").notNull().unique(),
-  emailVerified: boolean("email_verified").notNull().default(false),
-  image: text("image"),
-  createdAt: timestamp("created_at").notNull().defaultNow(),
-  updatedAt: timestamp("updated_at").notNull().defaultNow(),
-});
-
-export const session = pgTable("session", {
-  id: text("id").primaryKey(),
-  userId: text("user_id")
-    .notNull()
-    .references(() => user.id, { onDelete: "cascade" }),
-  token: text("token").notNull().unique(),
-  expiresAt: timestamp("expires_at").notNull(),
-  ipAddress: text("ip_address"),
-  userAgent: text("user_agent"),
-  createdAt: timestamp("created_at").notNull().defaultNow(),
-  updatedAt: timestamp("updated_at").notNull().defaultNow(),
-});
-
-export const account = pgTable("account", {
-  id: text("id").primaryKey(),
-  userId: text("user_id")
-    .notNull()
-    .references(() => user.id, { onDelete: "cascade" }),
-  accountId: text("account_id").notNull(),
-  providerId: text("provider_id").notNull(),
-  accessToken: text("access_token"),
-  refreshToken: text("refresh_token"),
-  accessTokenExpiresAt: timestamp("access_token_expires_at"),
-  refreshTokenExpiresAt: timestamp("refresh_token_expires_at"),
-  scope: text("scope"),
-  idToken: text("id_token"),
-  password: text("password"),
-  createdAt: timestamp("created_at").notNull().defaultNow(),
-  updatedAt: timestamp("updated_at").notNull().defaultNow(),
-});
-
-export const verification = pgTable("verification", {
-  id: text("id").primaryKey(),
-  identifier: text("identifier").notNull(),
-  value: text("value").notNull(),
-  expiresAt: timestamp("expires_at").notNull(),
-  createdAt: timestamp("created_at").notNull().defaultNow(),
-  updatedAt: timestamp("updated_at").notNull().defaultNow(),
-});

package/src/schema/grants.ts

@@ -1,26 +0,0 @@
-import { jsonb, pgTable, text, timestamp } from "drizzle-orm/pg-core";
-
-import { principal } from "./principals";
-import { role } from "./roles";
-import { tenant } from "./tenants";
-
-export const grant = pgTable("grant", {
-  id: text("id").primaryKey(),
-  tenantId: text("tenant_id")
-    .notNull()
-    .references(() => tenant.id, { onDelete: "cascade" }),
-  roleId: text("role_id").references(() => role.id, { onDelete: "cascade" }),
-  principalId: text("principal_id").references(() => principal.id, {
-    onDelete: "cascade",
-  }),
-  resource: text("resource").notNull(),
-  action: text("action").notNull(),
-  effect: text("effect", { enum: ["allow", "deny", "ask"] }).notNull(),
-  conditions: jsonb("conditions"),
-  origin: text("origin", {
-    enum: ["system", "role", "creator", "invoker"],
-  }).notNull(),
-  expiresAt: timestamp("expires_at"),
-  createdAt: timestamp("created_at").notNull().defaultNow(),
-  updatedAt: timestamp("updated_at").notNull().defaultNow(),
-});

package/src/schema/index.ts

@@ -1,19 +0,0 @@
-export * from "./auth";
-export * from "./tenants";
-export * from "./principals";
-export * from "./roles";
-export * from "./grants";
-export * from "./agents";
-export * from "./providers";
-export * from "./oauth-clients";
-export * from "./credentials";
-export * from "./assets";
-export * from "./agent-assets";
-export * from "./wallets";
-export * from "./offerings";
-export * from "./sidecar";
-export * from "./sessions";
-export * from "./instances";
-export * from "./session-assets";
-export * from "./messages";
-export * from "./git-tokens";

package/src/schema/instances.ts

@@ -1,36 +0,0 @@
-import { pgTable, text, timestamp } from "drizzle-orm/pg-core";
-
-import { agent, agentVersion } from "./agents";
-import { agentSession } from "./sessions";
-import { principal } from "./principals";
-import { sidecar } from "./sidecar";
-import { tenant } from "./tenants";
-
-export const agentInstance = pgTable("agent_instance", {
-  id: text("id").primaryKey(),
-  agentId: text("agent_id")
-    .notNull()
-    .references(() => agent.id, { onDelete: "cascade" }),
-  tenantId: text("tenant_id")
-    .notNull()
-    .references(() => tenant.id, { onDelete: "cascade" }),
-  principalId: text("principal_id")
-    .notNull()
-    .references(() => principal.id),
-  address: text("address").notNull().unique(),
-  versionId: text("version_id").references(() => agentVersion.id),
-  sessionId: text("session_id").references(() => agentSession.id),
-  status: text("status", {
-    enum: ["deployed", "running", "updating", "error", "stopped"],
-  })
-    .notNull()
-    .default("deployed"),
-  sidecarId: text("sidecar_id").references(() => sidecar.id, {
-    onDelete: "set null",
-  }),
-  publicKey: text("public_key"),
-  kernelId: text("kernel_id"),
-  createdAt: timestamp("created_at").notNull().defaultNow(),
-  updatedAt: timestamp("updated_at").notNull().defaultNow(),
-  endedAt: timestamp("ended_at"),
-});

package/src/schema/messages.ts

@@ -1,108 +0,0 @@
-import {
-  customType,
-  index,
-  integer,
-  jsonb,
-  pgTable,
-  text,
-  timestamp,
-} from "drizzle-orm/pg-core";
-
-import { agentInstance } from "./instances";
-import { agentSession } from "./sessions";
-import { tenant } from "./tenants";
-
-const bytea = customType<{ data: Uint8Array; driverData: Buffer }>({
-  dataType() {
-    return "bytea";
-  },
-  toDriver(value) {
-    return Buffer.from(value);
-  },
-  fromDriver(value) {
-    return new Uint8Array(value);
-  },
-});
-
-export const inferenceTurn = pgTable(
-  "inference_turn",
-  {
-    id: text("id").primaryKey(),
-    sessionId: text("session_id")
-      .notNull()
-      .references(() => agentSession.id, { onDelete: "cascade" }),
-    instanceId: text("instance_id")
-      .notNull()
-      .references(() => agentInstance.id, { onDelete: "cascade" }),
-    tenantId: text("tenant_id")
-      .notNull()
-      .references(() => tenant.id, { onDelete: "cascade" }),
-    model: text("model").notNull(),
-    status: text("status", { enum: ["running", "completed", "failed"] })
-      .notNull()
-      .default("running"),
-    startedAt: timestamp("started_at").notNull(),
-    endedAt: timestamp("ended_at"),
-  },
-  (t) => [
-    index("inference_turn_instance_id_started_at_idx").on(
-      t.instanceId,
-      t.startedAt,
-    ),
-  ],
-);
-
-export const turnPart = pgTable("turn_part", {
-  id: text("id").primaryKey(),
-  turnId: text("turn_id")
-    .notNull()
-    .references(() => inferenceTurn.id, { onDelete: "cascade" }),
-  sessionId: text("session_id")
-    .notNull()
-    .references(() => agentSession.id, { onDelete: "cascade" }),
-  type: text("type", {
-    enum: [
-      "text",
-      "reasoning",
-      "tool",
-      "file",
-      "error",
-      "refusal",
-      "step-start",
-      "step-finish",
-      "snapshot",
-      "patch",
-    ],
-  }).notNull(),
-  content: text("content"),
-  metadata: jsonb("metadata"),
-  ordinal: integer("ordinal").notNull(),
-});
-
-export const sessionMail = pgTable(
-  "session_mail",
-  {
-    id: text("id").primaryKey(),
-    sessionId: text("session_id")
-      .notNull()
-      .references(() => agentSession.id, { onDelete: "cascade" }),
-    instanceId: text("instance_id").references(() => agentInstance.id, {
-      onDelete: "set null",
-    }),
-    tenantId: text("tenant_id")
-      .notNull()
-      .references(() => tenant.id, { onDelete: "cascade" }),
-    direction: text("direction", { enum: ["inbound", "outbound"] }).notNull(),
-    status: text("status", { enum: ["pending", "delivered"] })
-      .notNull()
-      .default("pending"),
-    raw: bytea("raw").notNull(),
-    createdAt: timestamp("created_at").notNull().defaultNow(),
-  },
-  (t) => [
-    index("session_mail_instance_id_created_at_idx").on(
-      t.instanceId,
-      t.createdAt,
-    ),
-  ],
-);

package/src/schema/offerings.ts

@@ -1,20 +0,0 @@
-import { jsonb, pgTable, text, timestamp } from "drizzle-orm/pg-core";
-
-import { agent } from "./agents";
-import { tenant } from "./tenants";
-
-export const offering = pgTable("offering", {
-  id: text("id").primaryKey(),
-  agentId: text("agent_id")
-    .notNull()
-    .references(() => agent.id, { onDelete: "cascade" }),
-  tenantId: text("tenant_id")
-    .notNull()
-    .references(() => tenant.id, { onDelete: "cascade" }),
-  name: text("name").notNull(),
-  description: text("description"),
-  pricing: jsonb("pricing"),
-  schema: jsonb("schema"),
-  createdAt: timestamp("created_at").notNull().defaultNow(),
-  updatedAt: timestamp("updated_at").notNull().defaultNow(),
-});

package/src/schema/principals.ts

@@ -1,28 +0,0 @@
-import { pgTable, text, timestamp, unique } from "drizzle-orm/pg-core";
-
-import { user } from "./auth";
-import { tenant } from "./tenants";
-
-export const principal = pgTable(
-  "principal",
-  {
-    id: text("id").primaryKey(),
-    tenantId: text("tenant_id")
-      .notNull()
-      .references(() => tenant.id, { onDelete: "cascade" }),
-    kind: text("kind", { enum: ["user", "agent"] }).notNull(),
-    refId: text("ref_id").notNull(),
-    status: text("status", {
-      enum: ["active", "suspended", "invited", "deactivated"],
-    }).notNull(),
-    createdAt: timestamp("created_at").notNull().defaultNow(),
-    updatedAt: timestamp("updated_at").notNull().defaultNow(),
-  },
-  (t) => [unique().on(t.tenantId, t.kind, t.refId)],
-);
-
-// The refId on a user principal points to the auth user table.
-// We don't add a FK constraint because refId also points to agent.id
-// when kind='agent', and Postgres can't do conditional FKs.
-// The application layer enforces referential integrity.
-export { user };

package/src/schema/providers.ts

@@ -1,23 +0,0 @@
-import { jsonb, pgTable, text, timestamp, unique } from "drizzle-orm/pg-core";
-
-import { tenant } from "./tenants";
-
-export const provider = pgTable(
-  "provider",
-  {
-    id: text("id").primaryKey(),
-    tenantId: text("tenant_id")
-      .notNull()
-      .references(() => tenant.id, { onDelete: "cascade" }),
-    name: text("name").notNull(),
-    plugin: text("plugin").notNull(),
-    authorizationUrl: text("authorization_url"),
-    tokenUrl: text("token_url"),
-    userInfoUrl: text("user_info_url"),
-    scopes: text("scopes").array(),
-    metadata: jsonb("metadata"),
-    createdAt: timestamp("created_at").notNull().defaultNow(),
-    updatedAt: timestamp("updated_at").notNull().defaultNow(),
-  },
-  (t) => [unique("provider_tenant_name").on(t.tenantId, t.name)],
-);