@intx/db 0.2.2 → 0.3.0

package/dist/schema/workflow-definitions.js

@@ -0,0 +1,97 @@
+import { index, jsonb, pgTable, text, timestamp, unique, uniqueIndex, } from "drizzle-orm/pg-core";
+import { asset } from "./assets.js";
+import { principal } from "./principals.js";
+import { tenant } from "./tenants.js";
+// workflow_definition is the first-class definition entity for the workflow
+// model: one row per deployable definition, with a version table alongside it.
+//
+// The definition body (system prompt, context/model config, tool packages) is
+// not stored on this row -- it lives in the `workflow`-kind asset the row
+// points at, and the run reads it back from there. `asset_id` is nullable at
+// the schema level, but a runnable definition points at a materialized asset.
+//
+// Identity is selector-keyed on the wire-projection hash, not one definition
+// per asset: a single asset (e.g. a monorepo package) backs many definitions
+// distinguished by the content hash of their wire projection. `wire_hash` is
+// that content handle; the unique index over `(asset_id, wire_hash)` keys
+// identity so definitions sharing an asset but carrying different wire hashes
+// resolve independently. `wire_hash` is nullable so definitions predating this
+// key carry none; Postgres treats those NULLs as distinct.
+export const workflowDefinition = pgTable("workflow_definition", {
+    id: text("id").primaryKey(),
+    tenantId: text("tenant_id")
+        .notNull()
+        .references(() => tenant.id, { onDelete: "cascade" }),
+    // Nullable to match the weaker of the two definition sources: `asset`'s
+    // creator principal is `onDelete: "set null"`, so a workflow asset whose
+    // creator principal was removed carries no creator onto the definition.
+    creatorPrincipalId: text("creator_principal_id").references(() => principal.id),
+    // The asset holding this definition's body. `restrict`: the definition is
+    // the first-class entity, so deleting the asset must not cascade into
+    // deleting it.
+    assetId: text("asset_id").references(() => asset.id, {
+        onDelete: "restrict",
+    }),
+    // Content hash of this definition's wire projection: the selector that
+    // keys identity within an asset. Nullable so definitions predating the
+    // selector-keyed key carry none.
+    wireHash: text("wire_hash"),
+    name: text("name").notNull(),
+    description: text("description"),
+    // Grant requirements manifest, resolved at launch into materialized grants.
+    // Validated as GrantRequirement[] at parse time.
+    grantRequirements: jsonb("grant_requirements"),
+    // Model requirements manifest: the canonical model names + provider
+    // preferences a definition launched as a single interactive run resolves
+    // against the live tenant catalog into credential-bearing inference
+    // sources, fresh each launch. Non-null marks such a definition and gates
+    // the interactive-launch path; null for a definition deployed as a workflow,
+    // which supplies its sources at deploy time. Validated as ModelRequirements
+    // at parse time.
+    modelRequirements: jsonb("model_requirements"),
+    // Credential bindings manifest: maps a tool package's declared credential
+    // handle (package, handle) to a concrete credential resolved fresh at
+    // launch (by locator + provider + name against the tenant walk-up).
+    // Validated as CredentialBinding[] at parse time. A binding is a request
+    // the launch-time grant gate authorizes; it consents to nothing on its own.
+    credentialBindings: jsonb("credential_bindings"),
+    currentVersion: text("current_version").notNull().default("1"),
+    status: text("status", {
+        enum: ["deployed", "stopped"],
+    })
+        .notNull()
+        .default("deployed"),
+    createdAt: timestamp("created_at").notNull().defaultNow(),
+    updatedAt: timestamp("updated_at").notNull().defaultNow(),
+}, (t) => [
+    index("workflow_definition_tenant_idx").on(t.tenantId, t.createdAt),
+    uniqueIndex("workflow_definition_asset_wire_hash_idx").on(t.assetId, t.wireHash),
+]);
+export const workflowDefinitionVersion = pgTable("workflow_definition_version", {
+    id: text("id").primaryKey(),
+    definitionId: text("definition_id")
+        .notNull()
+        .references(() => workflowDefinition.id, { onDelete: "cascade" }),
+    version: text("version").notNull(),
+    status: text("status", {
+        enum: ["active", "inactive", "failed"],
+    })
+        .notNull()
+        .default("active"),
+    // Hash of the wire bytes approved for this version, recorded at approval
+    // and read back during re-verify to detect drift. Null before approval is
+    // a legitimate state, so the column takes no NOT NULL constraint.
+    approvedWireHash: text("approved_wire_hash"),
+    // Serializable projection of the deploy-time capability walk, recorded
+    // at approval so a run materializes grants from it instead of re-reading
+    // and re-walking a workflow.json blob. Validated as GrantWalkSnapshot at
+    // parse time. Null before approval is a legitimate state, so the column
+    // takes no NOT NULL constraint.
+    grantSnapshot: jsonb("grant_snapshot"),
+    createdAt: timestamp("created_at").notNull().defaultNow(),
+}, (t) => [
+    // Unique per definition so rollback-by-version resolves to one row. The
+    // mirror source `agent_version` omits this; the fresh table constrains it.
+    unique("workflow_definition_version_definition_version").on(t.definitionId, t.version),
+    index("workflow_definition_version_definition_idx").on(t.definitionId),
+]);

package/dist/schema/workflow-run-dispatch.d.ts

@@ -0,0 +1,328 @@
+export declare const workflowRunDispatchStatuses: readonly ["pending", "acknowledged", "settled", "failed"];
+export type WorkflowRunDispatchStatus = (typeof workflowRunDispatchStatuses)[number];
+export declare const workflowRunDispatchKinds: readonly ["mail", "signal"];
+export type WorkflowRunDispatchKind = (typeof workflowRunDispatchKinds)[number];
+/**
+ * Hub-owned delivery state for one inbound workflow message. The raw payload
+ * remains durable until the workflow-run Git claim-check reaches `consumed`;
+ * a sidecar-local enqueue acknowledgement alone does not settle the row.
+ */
+export declare const workflowRunDispatch: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "workflow_run_dispatch";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "workflow_run_dispatch";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        anchorRunId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "anchor_run_id";
+            tableName: "workflow_run_dispatch";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        messageId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "message_id";
+            tableName: "workflow_run_dispatch";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        kind: import("drizzle-orm/pg-core").PgColumn<{
+            name: "kind";
+            tableName: "workflow_run_dispatch";
+            dataType: "string";
+            columnType: "PgText";
+            data: "signal" | "mail";
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: "signal" | "mail";
+        }>;
+        rawMessage: import("drizzle-orm/pg-core").PgColumn<{
+            name: "raw_message";
+            tableName: "workflow_run_dispatch";
+            dataType: "custom";
+            columnType: "PgCustomColumn";
+            data: Uint8Array<ArrayBufferLike>;
+            driverParam: Uint8Array<ArrayBufferLike>;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            pgColumnBuilderBrand: "PgCustomColumnBuilderBrand";
+        }>;
+        stepGrants: import("drizzle-orm/pg-core").PgColumn<{
+            name: "step_grants";
+            tableName: "workflow_run_dispatch";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: unknown;
+            driverParam: unknown;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        status: import("drizzle-orm/pg-core").PgColumn<{
+            name: "status";
+            tableName: "workflow_run_dispatch";
+            dataType: "string";
+            columnType: "PgText";
+            data: "failed" | "pending" | "acknowledged" | "settled";
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: "failed" | "pending" | "acknowledged" | "settled";
+        }>;
+        acknowledgedGeneration: import("drizzle-orm/pg-core").PgColumn<{
+            name: "acknowledged_generation";
+            tableName: "workflow_run_dispatch";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        attemptCount: import("drizzle-orm/pg-core").PgColumn<{
+            name: "attempt_count";
+            tableName: "workflow_run_dispatch";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        nextAttemptAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "next_attempt_at";
+            tableName: "workflow_run_dispatch";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        deliveryLeaseId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "delivery_lease_id";
+            tableName: "workflow_run_dispatch";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        deliveryLeaseExpiresAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "delivery_lease_expires_at";
+            tableName: "workflow_run_dispatch";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        failureCode: import("drizzle-orm/pg-core").PgColumn<{
+            name: "failure_code";
+            tableName: "workflow_run_dispatch";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        failureMessage: import("drizzle-orm/pg-core").PgColumn<{
+            name: "failure_message";
+            tableName: "workflow_run_dispatch";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_at";
+            tableName: "workflow_run_dispatch";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        updatedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "updated_at";
+            tableName: "workflow_run_dispatch";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        acknowledgedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "acknowledged_at";
+            tableName: "workflow_run_dispatch";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        settledAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "settled_at";
+            tableName: "workflow_run_dispatch";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;

package/dist/schema/workflow-run-dispatch.js

@@ -0,0 +1,56 @@
+import { sql } from "drizzle-orm";
+import { check, index, integer, jsonb, pgTable, text, timestamp, uniqueIndex, } from "drizzle-orm/pg-core";
+import { bytea } from "./column-types.js";
+import { workflowRun } from "./workflow-run.js";
+export const workflowRunDispatchStatuses = [
+    "pending",
+    "acknowledged",
+    "settled",
+    "failed",
+];
+export const workflowRunDispatchKinds = ["mail", "signal"];
+/**
+ * Hub-owned delivery state for one inbound workflow message. The raw payload
+ * remains durable until the workflow-run Git claim-check reaches `consumed`;
+ * a sidecar-local enqueue acknowledgement alone does not settle the row.
+ */
+export const workflowRunDispatch = pgTable("workflow_run_dispatch", {
+    id: text("id").primaryKey(),
+    anchorRunId: text("anchor_run_id")
+        .notNull()
+        .references(() => workflowRun.id, { onDelete: "cascade" }),
+    messageId: text("message_id").notNull(),
+    kind: text("kind")
+        .$type()
+        .notNull()
+        .default("mail"),
+    rawMessage: bytea("raw_message").notNull(),
+    stepGrants: jsonb("step_grants").notNull(),
+    status: text("status")
+        .$type()
+        .notNull()
+        .default("pending"),
+    acknowledgedGeneration: integer("acknowledged_generation"),
+    attemptCount: integer("attempt_count").notNull().default(0),
+    nextAttemptAt: timestamp("next_attempt_at").defaultNow(),
+    deliveryLeaseId: text("delivery_lease_id"),
+    deliveryLeaseExpiresAt: timestamp("delivery_lease_expires_at"),
+    failureCode: text("failure_code"),
+    failureMessage: text("failure_message"),
+    createdAt: timestamp("created_at").notNull().defaultNow(),
+    updatedAt: timestamp("updated_at").notNull().defaultNow(),
+    acknowledgedAt: timestamp("acknowledged_at"),
+    settledAt: timestamp("settled_at"),
+}, (t) => [
+    uniqueIndex("workflow_run_dispatch_anchor_message_idx").on(t.anchorRunId, t.messageId),
+    index("workflow_run_dispatch_delivery_idx")
+        .on(t.nextAttemptAt, t.createdAt)
+        .where(sql `${t.status} = 'pending'`),
+    index("workflow_run_dispatch_anchor_status_idx").on(t.anchorRunId, t.status),
+    check("workflow_run_dispatch_status_check", sql `${t.status} in ('pending', 'acknowledged', 'settled', 'failed')`),
+    check("workflow_run_dispatch_kind_check", sql `${t.kind} in ('mail', 'signal')`),
+    check("workflow_run_dispatch_attempt_count_check", sql `${t.attemptCount} >= 0`),
+    check("workflow_run_dispatch_acknowledged_generation_check", sql `${t.acknowledgedGeneration} is null or ${t.acknowledgedGeneration} >= 0`),
+    check("workflow_run_dispatch_acknowledged_state_check", sql `${t.status} <> 'acknowledged' or ${t.acknowledgedGeneration} is not null`),
+    check("workflow_run_dispatch_pending_schedule_check", sql `${t.status} <> 'pending' or ${t.nextAttemptAt} is not null`),
+]);

package/dist/schema/{workflow-deployments.d.ts → workflow-run-execution.d.ts}

@@ -1,11 +1,10 @@
-export type WorkflowDeploymentStatus = "deployed" | "error";
-export declare const workflowDeployment: import("drizzle-orm/pg-core").PgTableWithColumns<{
-    name: "workflow_deployment";
+export declare const workflowRunExecution: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "workflow_run_execution";
     schema: undefined;
     columns: {
         id: import("drizzle-orm/pg-core").PgColumn<{
             name: "id";
-            tableName: "workflow_deployment";
+            tableName: "workflow_run_execution";
             dataType: "string";
             columnType: "PgText";
             data: string;
@@ -20,9 +19,9 @@ export declare const workflowDeployment: import("drizzle-orm/pg-core").PgTableWi
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        tenantId: import("drizzle-orm/pg-core").PgColumn<{
-            name: "tenant_id";
-            tableName: "workflow_deployment";
+        runId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "run_id";
+            tableName: "workflow_run_execution";
             dataType: "string";
             columnType: "PgText";
             data: string;
@@ -37,9 +36,9 @@ export declare const workflowDeployment: import("drizzle-orm/pg-core").PgTableWi
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        definitionAssetId: import("drizzle-orm/pg-core").PgColumn<{
-            name: "definition_asset_id";
-            tableName: "workflow_deployment";
+        messageId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "message_id";
+            tableName: "workflow_run_execution";
             dataType: "string";
             columnType: "PgText";
             data: string;
@@ -54,72 +53,70 @@ export declare const workflowDeployment: import("drizzle-orm/pg-core").PgTableWi
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        address: import("drizzle-orm/pg-core").PgColumn<{
-            name: "address";
-            tableName: "workflow_deployment";
+        status: import("drizzle-orm/pg-core").PgColumn<{
+            name: "status";
+            tableName: "workflow_run_execution";
             dataType: "string";
             columnType: "PgText";
-            data: string;
+            data: "failed" | "running" | "completed";
             driverParam: string;
             notNull: true;
-            hasDefault: false;
+            hasDefault: true;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
+            enumValues: ["running", "completed", "failed"];
             baseColumn: never;
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        publicKey: import("drizzle-orm/pg-core").PgColumn<{
-            name: "public_key";
-            tableName: "workflow_deployment";
-            dataType: "string";
-            columnType: "PgText";
-            data: string;
+        startedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "started_at";
+            tableName: "workflow_run_execution";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
             driverParam: string;
-            notNull: false;
-            hasDefault: false;
+            notNull: true;
+            hasDefault: true;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
+            enumValues: undefined;
             baseColumn: never;
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        status: import("drizzle-orm/pg-core").PgColumn<{
-            name: "status";
-            tableName: "workflow_deployment";
-            dataType: "string";
-            columnType: "PgText";
-            data: WorkflowDeploymentStatus;
+        endedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "ended_at";
+            tableName: "workflow_run_execution";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
             driverParam: string;
-            notNull: true;
-            hasDefault: true;
+            notNull: false;
+            hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
+            enumValues: undefined;
             baseColumn: never;
             identity: undefined;
             generated: undefined;
-        }, {}, {
-            $type: WorkflowDeploymentStatus;
-        }>;
-        createdAt: import("drizzle-orm/pg-core").PgColumn<{
-            name: "created_at";
-            tableName: "workflow_deployment";
-            dataType: "date";
-            columnType: "PgTimestamp";
-            data: Date;
+        }, {}, {}>;
+        failureReason: import("drizzle-orm/pg-core").PgColumn<{
+            name: "failure_reason";
+            tableName: "workflow_run_execution";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
             driverParam: string;
-            notNull: true;
-            hasDefault: true;
+            notNull: false;
+            hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: undefined;
+            enumValues: [string, ...string[]];
             baseColumn: never;
             identity: undefined;
             generated: undefined;