@intx/db 0.2.2 → 0.4.0

package/dist/workflow-run-dispatch-store.js

@@ -0,0 +1,308 @@
+import { isDeepStrictEqual } from "node:util";
+import { and, asc, eq, inArray, isNull, lte, notInArray, or, sql, } from "drizzle-orm";
+import { RunGrantsFrame, SignalDeliverFrame, } from "@intx/types/sidecar";
+import { parseWorkflowRunDispatchRow } from "./parse-row.js";
+import { sidecarAllocation, workflowRun, workflowRunDispatch } from "./schema/index.js";
+export class WorkflowRunDispatchPayloadConflictError extends Error {
+    messageId;
+    payloadKind;
+    constructor(messageId, payloadKind, operation) {
+        super(`workflowRunDispatchStore.${operation}: ${payloadKind} ${messageId} conflicts with its durable payload`);
+        this.messageId = messageId;
+        this.payloadKind = payloadKind;
+        this.name = "WorkflowRunDispatchPayloadConflictError";
+    }
+}
+function databaseTimestamp(override) {
+    return override ?? sql `now()`;
+}
+function leaseCondition(expectedLeaseId) {
+    return expectedLeaseId === undefined
+        ? []
+        : [eq(workflowRunDispatch.deliveryLeaseId, expectedLeaseId)];
+}
+function byteArraysEqual(left, right) {
+    if (left.byteLength !== right.byteLength)
+        return false;
+    return left.every((value, index) => value === right[index]);
+}
+function grantsEqual(left, right) {
+    return isDeepStrictEqual(left, right);
+}
+function validateStepGrants(anchorRunId, stepGrants) {
+    return RunGrantsFrame.assert({
+        type: "run.grants",
+        agentAddress: "persisted@validation.invalid",
+        runId: anchorRunId,
+        stepGrants,
+    }).stepGrants;
+}
+async function insertOrReconcileDispatch(executor, args) {
+    const [anchor] = await executor
+        .select({ anchorRunId: workflowRun.anchorRunId })
+        .from(workflowRun)
+        .where(eq(workflowRun.id, args.anchorRunId))
+        .limit(1);
+    if (anchor?.anchorRunId !== args.anchorRunId) {
+        throw new Error(`workflowRunDispatchStore.${args.operation}: run ${args.anchorRunId} is not a deployment anchor`);
+    }
+    const now = databaseTimestamp(args.now);
+    const [inserted] = await executor
+        .insert(workflowRunDispatch)
+        .values({
+        id: args.id,
+        anchorRunId: args.anchorRunId,
+        messageId: args.messageId,
+        kind: args.kind,
+        senderAddress: args.senderAddress,
+        rawMessage: args.rawMessage,
+        stepGrants: args.stepGrants,
+        status: "pending",
+        nextAttemptAt: now,
+        createdAt: now,
+        updatedAt: now,
+    })
+        .onConflictDoNothing({
+        target: [workflowRunDispatch.anchorRunId, workflowRunDispatch.messageId],
+    })
+        .returning();
+    if (inserted !== undefined) {
+        return {
+            dispatch: parseWorkflowRunDispatchRow(inserted),
+            created: true,
+        };
+    }
+    const existing = await executor.query.workflowRunDispatch.findFirst({
+        where: and(eq(workflowRunDispatch.anchorRunId, args.anchorRunId), eq(workflowRunDispatch.messageId, args.messageId)),
+    });
+    if (existing === undefined) {
+        throw new Error(`workflowRunDispatchStore.${args.operation}: conflicting row disappeared for ${args.anchorRunId}/${args.messageId}`);
+    }
+    const parsed = parseWorkflowRunDispatchRow(existing);
+    if (parsed.kind !== args.kind ||
+        !byteArraysEqual(parsed.rawMessage, args.rawMessage) ||
+        !grantsEqual(parsed.stepGrants, args.stepGrants)) {
+        const payloadKind = args.kind === "mail" ? "message" : "signal";
+        throw new WorkflowRunDispatchPayloadConflictError(args.messageId, payloadKind, args.operation);
+    }
+    return { dispatch: parsed, created: false };
+}
+async function acknowledgeMatchingDispatch(executor, generation, conditions, nowOverride) {
+    const now = databaseTimestamp(nowOverride);
+    const [updated] = await executor
+        .update(workflowRunDispatch)
+        .set({
+        status: "acknowledged",
+        acknowledgedGeneration: generation,
+        acknowledgedAt: now,
+        attemptCount: sql `${workflowRunDispatch.attemptCount} + 1`,
+        nextAttemptAt: null,
+        deliveryLeaseId: null,
+        deliveryLeaseExpiresAt: null,
+        failureCode: null,
+        failureMessage: null,
+        updatedAt: now,
+    })
+        .where(and(...conditions))
+        .returning();
+    return updated === undefined ? null : parseWorkflowRunDispatchRow(updated);
+}
+export function createWorkflowRunDispatchStore(db) {
+    return {
+        async enqueue(args, tx) {
+            const stepGrants = validateStepGrants(args.anchorRunId, args.stepGrants);
+            return insertOrReconcileDispatch(tx ?? db, {
+                operation: "enqueue",
+                id: args.id,
+                anchorRunId: args.anchorRunId,
+                messageId: args.messageId,
+                kind: "mail",
+                senderAddress: args.senderAddress,
+                rawMessage: args.rawMessage,
+                stepGrants,
+                ...(args.now !== undefined ? { now: args.now } : {}),
+            });
+        },
+        async enqueueSignal(args, tx) {
+            const signal = SignalDeliverFrame.assert({
+                type: "signal.deliver",
+                ...args.signal,
+            });
+            const encoded = new TextEncoder().encode(JSON.stringify(signal));
+            return insertOrReconcileDispatch(tx ?? db, {
+                operation: "enqueueSignal",
+                id: args.id,
+                anchorRunId: args.anchorRunId,
+                messageId: signal.signalId,
+                kind: "signal",
+                senderAddress: null,
+                rawMessage: encoded,
+                stepGrants: [],
+                ...(args.now !== undefined ? { now: args.now } : {}),
+            });
+        },
+        async claimNextPending(args) {
+            return db.transaction(async (tx) => {
+                const [candidate] = await tx
+                    .select({ id: workflowRunDispatch.id })
+                    .from(workflowRunDispatch)
+                    .where(and(eq(workflowRunDispatch.status, "pending"), lte(workflowRunDispatch.nextAttemptAt, sql `now()`), ...(args.excludedDispatchIds !== undefined &&
+                    args.excludedDispatchIds.length > 0
+                    ? [
+                        notInArray(workflowRunDispatch.id, [
+                            ...args.excludedDispatchIds,
+                        ]),
+                    ]
+                    : []), or(isNull(workflowRunDispatch.deliveryLeaseExpiresAt), lte(workflowRunDispatch.deliveryLeaseExpiresAt, sql `now()`))))
+                    .orderBy(asc(workflowRunDispatch.nextAttemptAt), asc(workflowRunDispatch.createdAt))
+                    .limit(1)
+                    .for("update", { skipLocked: true });
+                if (candidate === undefined)
+                    return null;
+                const [claimed] = await tx
+                    .update(workflowRunDispatch)
+                    .set({
+                    deliveryLeaseId: args.leaseId,
+                    deliveryLeaseExpiresAt: sql `now() + (${args.leaseDurationMs} * interval '1 millisecond')`,
+                })
+                    .where(eq(workflowRunDispatch.id, candidate.id))
+                    .returning();
+                return claimed === undefined
+                    ? null
+                    : parseWorkflowRunDispatchRow(claimed);
+            });
+        },
+        async acknowledge(args) {
+            return db.transaction(async (tx) => {
+                const [allocation] = await tx
+                    .select({
+                    anchorRunId: sidecarAllocation.anchorRunId,
+                    status: sidecarAllocation.status,
+                    generation: sidecarAllocation.generation,
+                    ensureAcceptedGeneration: sidecarAllocation.ensureAcceptedGeneration,
+                })
+                    .from(sidecarAllocation)
+                    .where(eq(sidecarAllocation.id, args.allocationId))
+                    .limit(1)
+                    .for("update");
+                if (allocation === undefined ||
+                    allocation.anchorRunId !== args.anchorRunId ||
+                    allocation.status !== "allocated" ||
+                    allocation.generation !== args.generation ||
+                    allocation.ensureAcceptedGeneration !== args.generation) {
+                    return null;
+                }
+                return acknowledgeMatchingDispatch(tx, args.generation, [
+                    eq(workflowRunDispatch.anchorRunId, args.anchorRunId),
+                    eq(workflowRunDispatch.messageId, args.messageId),
+                    eq(workflowRunDispatch.kind, "mail"),
+                    eq(workflowRunDispatch.status, "pending"),
+                ], args.now);
+            });
+        },
+        async scheduleRetry(args) {
+            const [updated] = await db
+                .update(workflowRunDispatch)
+                .set({
+                nextAttemptAt: args.nextAttemptAt,
+                attemptCount: sql `${workflowRunDispatch.attemptCount} + 1`,
+                deliveryLeaseId: null,
+                deliveryLeaseExpiresAt: null,
+                failureCode: args.code,
+                failureMessage: args.message,
+                updatedAt: databaseTimestamp(args.now),
+            })
+                .where(and(eq(workflowRunDispatch.id, args.dispatchId), eq(workflowRunDispatch.status, "pending"), ...leaseCondition(args.expectedLeaseId)))
+                .returning();
+            return updated === undefined
+                ? null
+                : parseWorkflowRunDispatchRow(updated);
+        },
+        async settle(anchorRunId, messageId, now = new Date()) {
+            const [updated] = await db
+                .update(workflowRunDispatch)
+                .set({
+                status: "settled",
+                nextAttemptAt: null,
+                deliveryLeaseId: null,
+                deliveryLeaseExpiresAt: null,
+                failureCode: null,
+                failureMessage: null,
+                settledAt: now,
+                updatedAt: now,
+            })
+                .where(and(eq(workflowRunDispatch.anchorRunId, anchorRunId), eq(workflowRunDispatch.messageId, messageId), inArray(workflowRunDispatch.status, ["pending", "acknowledged"])))
+                .returning();
+            return updated === undefined
+                ? null
+                : parseWorkflowRunDispatchRow(updated);
+        },
+        async fail(args) {
+            const now = args.now ?? new Date();
+            const [updated] = await db
+                .update(workflowRunDispatch)
+                .set({
+                status: "failed",
+                nextAttemptAt: null,
+                deliveryLeaseId: null,
+                deliveryLeaseExpiresAt: null,
+                failureCode: args.code,
+                failureMessage: args.message,
+                updatedAt: now,
+            })
+                .where(and(eq(workflowRunDispatch.anchorRunId, args.anchorRunId), eq(workflowRunDispatch.messageId, args.messageId), inArray(workflowRunDispatch.status, ["pending", "acknowledged"])))
+                .returning();
+            return updated === undefined
+                ? null
+                : parseWorkflowRunDispatchRow(updated);
+        },
+        async failUnsettled(anchorRunId, code, message, now = new Date(), tx) {
+            const rows = await (tx ?? db)
+                .update(workflowRunDispatch)
+                .set({
+                status: "failed",
+                nextAttemptAt: null,
+                deliveryLeaseId: null,
+                deliveryLeaseExpiresAt: null,
+                failureCode: code,
+                failureMessage: message,
+                updatedAt: now,
+            })
+                .where(and(eq(workflowRunDispatch.anchorRunId, anchorRunId), inArray(workflowRunDispatch.status, ["pending", "acknowledged"])))
+                .returning({ id: workflowRunDispatch.id });
+            return rows.length;
+        },
+        async requeueUnsettled(anchorRunId) {
+            const rows = await db
+                .update(workflowRunDispatch)
+                .set({
+                status: "pending",
+                acknowledgedGeneration: null,
+                acknowledgedAt: null,
+                nextAttemptAt: sql `now()`,
+                deliveryLeaseId: null,
+                deliveryLeaseExpiresAt: null,
+                failureCode: null,
+                failureMessage: null,
+                updatedAt: sql `now()`,
+            })
+                .where(and(eq(workflowRunDispatch.anchorRunId, anchorRunId), inArray(workflowRunDispatch.status, ["pending", "acknowledged"])))
+                .returning({ id: workflowRunDispatch.id });
+            return rows.length;
+        },
+        async findById(id) {
+            const row = await db.query.workflowRunDispatch.findFirst({
+                where: eq(workflowRunDispatch.id, id),
+            });
+            return row === undefined ? null : parseWorkflowRunDispatchRow(row);
+        },
+        async listUnsettled(anchorRunId) {
+            const rows = await db
+                .select()
+                .from(workflowRunDispatch)
+                .where(and(eq(workflowRunDispatch.anchorRunId, anchorRunId), inArray(workflowRunDispatch.status, ["pending", "acknowledged"])))
+                .orderBy(asc(workflowRunDispatch.createdAt));
+            return rows.map(parseWorkflowRunDispatchRow);
+        },
+    };
+}

package/dist/workflow-run-launch-spec-store.d.ts

@@ -0,0 +1,13 @@
+import type { DB, DBExecutor } from "./client.js";
+import { parseWorkflowRunLaunchSpecRow } from "./parse-row.js";
+import { workflowRunLaunchSpec } from "./schema/workflow-run-launch-spec.js";
+type DBHandle = DB["db"];
+type LaunchSpecInsert = typeof workflowRunLaunchSpec.$inferInsert;
+type ParsedLaunchSpec = ReturnType<typeof parseWorkflowRunLaunchSpecRow>;
+/** Store for immutable workflow recovery inputs keyed by anchor run. */
+export declare function createWorkflowRunLaunchSpecStore(db: DBHandle): {
+    create(row: LaunchSpecInsert, tx?: DBExecutor): Promise<ParsedLaunchSpec>;
+    get(anchorRunId: string, tx?: DBExecutor): Promise<ParsedLaunchSpec | null>;
+};
+export type WorkflowRunLaunchSpecStore = ReturnType<typeof createWorkflowRunLaunchSpecStore>;
+export {};

package/dist/workflow-run-launch-spec-store.js

@@ -0,0 +1,30 @@
+import { eq } from "drizzle-orm";
+import { parseWorkflowRunLaunchSpecRow } from "./parse-row.js";
+import { workflowRunLaunchSpec } from "./schema/workflow-run-launch-spec.js";
+/** Store for immutable workflow recovery inputs keyed by anchor run. */
+export function createWorkflowRunLaunchSpecStore(db) {
+    return {
+        async create(row, tx) {
+            parseWorkflowRunLaunchSpecRow({
+                ...row,
+                schemaVersion: row.schemaVersion ?? 1,
+                toolPackagePins: row.toolPackagePins ?? null,
+                createdAt: row.createdAt ?? new Date(),
+            });
+            const [inserted] = await (tx ?? db)
+                .insert(workflowRunLaunchSpec)
+                .values(row)
+                .returning();
+            if (inserted === undefined) {
+                throw new Error(`workflowRunLaunchSpecStore.create: insert returned no row for ${row.anchorRunId}`);
+            }
+            return parseWorkflowRunLaunchSpecRow(inserted);
+        },
+        async get(anchorRunId, tx) {
+            const row = await (tx ?? db).query.workflowRunLaunchSpec.findFirst({
+                where: eq(workflowRunLaunchSpec.anchorRunId, anchorRunId),
+            });
+            return row === undefined ? null : parseWorkflowRunLaunchSpecRow(row);
+        },
+    };
+}

package/dist/workflow-run-store.d.ts

@@ -0,0 +1,54 @@
+import type { DB, DBExecutor } from "./client.js";
+import { workflowRun } from "./schema/workflow-run.js";
+import { parseWorkflowRunRow } from "./parse-row.js";
+type DBHandle = DB["db"];
+type WorkflowRunInsert = typeof workflowRun.$inferInsert;
+type ParsedWorkflowRun = ReturnType<typeof parseWorkflowRunRow>;
+/**
+ * Store for the `workflow_run` table, the per-run authorization subject that
+ * approvals and signal correlations anchor to. Each method accepts an optional
+ * transaction handle so the run row can be written in the same transaction that
+ * co-writes the run's principal or its approval.
+ */
+export declare function createWorkflowRunStore(db: DBHandle): {
+    create(row: WorkflowRunInsert, tx?: DBExecutor): Promise<ParsedWorkflowRun>;
+    /**
+     * Idempotent variant of `create`. On an `id` primary-key conflict the
+     * insert is a no-op and this returns `null` rather than throwing, so a
+     * redelivered createIfAbsent (workflow-log replay, supervisor restart
+     * re-emitting) does not fail the run's co-write. Returns the parsed row
+     * only when this call performed the insert.
+     */
+    createIfAbsent(row: WorkflowRunInsert, tx?: DBExecutor): Promise<ParsedWorkflowRun | null>;
+    /**
+     * Anchor an externally-triggered run onto its deploy-time anchor row. The
+     * anchor is created at deploy (born "deployed" with a null principal); the
+     * first trigger reconciles it here, attaching `principalId` and flipping
+     * "deployed" -> "running" in one UPDATE. The insert is a conflict-tolerant
+     * safety net: the anchor provably exists by the time a trigger runs, so it
+     * normally no-ops. The three-part guard makes the reconcile single-shot and
+     * safe: `principalId IS NULL` never overwrites a principal a concurrent
+     * winner already set, and `status = 'deployed'` never resurrects a run a
+     * concurrent teardown already settled terminal (the null-principal guard
+     * alone would). `principalId` must be non-null: only the externally-
+     * triggered path anchors through here, and it always mints one.
+     */
+    anchorWithPrincipal(row: WorkflowRunInsert & {
+        principalId: string;
+    }, tx?: DBExecutor): Promise<void>;
+    /**
+     * Atomically settle a live run into a terminal state. The live-status guard
+     * (`status IN ('deployed','running')`) makes the flip single-shot: the first
+     * caller stamps the terminal status and `endedAt` and gets the row back; any
+     * later caller matches no row and receives null, so the run is not
+     * re-terminated and its `endedAt` is not overwritten. Accepting "deployed"
+     * settles a deployment torn down before its first trigger. This is a safety
+     * property, not a recovery path -- it makes a second call (a manual replay
+     * against an already-settled run) a harmless no-op; it does not by itself
+     * re-drive a flip that failed. Returns the parsed row only on the winning
+     * flip.
+     */
+    markTerminal(runId: string, status: "completed" | "failed" | "cancelled", endedAt: Date, tx?: DBExecutor): Promise<ParsedWorkflowRun | null>;
+};
+export type WorkflowRunStore = ReturnType<typeof createWorkflowRunStore>;
+export {};

package/dist/workflow-run-store.js

@@ -0,0 +1,85 @@
+import { and, eq, inArray, isNull } from "drizzle-orm";
+import { liveWorkflowRunStatuses, workflowRun } from "./schema/workflow-run.js";
+import { parseWorkflowRunRow } from "./parse-row.js";
+/**
+ * Store for the `workflow_run` table, the per-run authorization subject that
+ * approvals and signal correlations anchor to. Each method accepts an optional
+ * transaction handle so the run row can be written in the same transaction that
+ * co-writes the run's principal or its approval.
+ */
+export function createWorkflowRunStore(db) {
+    return {
+        async create(row, tx) {
+            const [inserted] = await (tx ?? db)
+                .insert(workflowRun)
+                .values(row)
+                .returning();
+            if (inserted === undefined) {
+                throw new Error(`workflowRunStore.create: insert returned no row for ${row.id}`);
+            }
+            return parseWorkflowRunRow(inserted);
+        },
+        /**
+         * Idempotent variant of `create`. On an `id` primary-key conflict the
+         * insert is a no-op and this returns `null` rather than throwing, so a
+         * redelivered createIfAbsent (workflow-log replay, supervisor restart
+         * re-emitting) does not fail the run's co-write. Returns the parsed row
+         * only when this call performed the insert.
+         */
+        async createIfAbsent(row, tx) {
+            const [inserted] = await (tx ?? db)
+                .insert(workflowRun)
+                .values(row)
+                .onConflictDoNothing({ target: workflowRun.id })
+                .returning();
+            return inserted === undefined ? null : parseWorkflowRunRow(inserted);
+        },
+        /**
+         * Anchor an externally-triggered run onto its deploy-time anchor row. The
+         * anchor is created at deploy (born "deployed" with a null principal); the
+         * first trigger reconciles it here, attaching `principalId` and flipping
+         * "deployed" -> "running" in one UPDATE. The insert is a conflict-tolerant
+         * safety net: the anchor provably exists by the time a trigger runs, so it
+         * normally no-ops. The three-part guard makes the reconcile single-shot and
+         * safe: `principalId IS NULL` never overwrites a principal a concurrent
+         * winner already set, and `status = 'deployed'` never resurrects a run a
+         * concurrent teardown already settled terminal (the null-principal guard
+         * alone would). `principalId` must be non-null: only the externally-
+         * triggered path anchors through here, and it always mints one.
+         */
+        async anchorWithPrincipal(row, tx) {
+            const executor = tx ?? db;
+            const [inserted] = await executor
+                .insert(workflowRun)
+                .values(row)
+                .onConflictDoNothing({ target: workflowRun.id })
+                .returning();
+            if (inserted !== undefined)
+                return;
+            await executor
+                .update(workflowRun)
+                .set({ principalId: row.principalId, status: "running" })
+                .where(and(eq(workflowRun.id, row.id), isNull(workflowRun.principalId), eq(workflowRun.status, "deployed")));
+        },
+        /**
+         * Atomically settle a live run into a terminal state. The live-status guard
+         * (`status IN ('deployed','running')`) makes the flip single-shot: the first
+         * caller stamps the terminal status and `endedAt` and gets the row back; any
+         * later caller matches no row and receives null, so the run is not
+         * re-terminated and its `endedAt` is not overwritten. Accepting "deployed"
+         * settles a deployment torn down before its first trigger. This is a safety
+         * property, not a recovery path -- it makes a second call (a manual replay
+         * against an already-settled run) a harmless no-op; it does not by itself
+         * re-drive a flip that failed. Returns the parsed row only on the winning
+         * flip.
+         */
+        async markTerminal(runId, status, endedAt, tx) {
+            const [updated] = await (tx ?? db)
+                .update(workflowRun)
+                .set({ status, endedAt })
+                .where(and(eq(workflowRun.id, runId), inArray(workflowRun.status, [...liveWorkflowRunStatuses])))
+                .returning();
+            return updated === undefined ? null : parseWorkflowRunRow(updated);
+        },
+    };
+}

package/migrations/0037_credential_use_backfill.sql

@@ -0,0 +1,39 @@
+-- Backfill `credential:{id}` / `use` grants for the owner of every existing
+-- personal credential (rows where `principal_id` is set) that does not already
+-- have one. This keeps existing personal-credential owners working once
+-- launch enforcement fails closed. Organizational credentials
+-- (`principal_id` IS NULL) are intentionally excluded: they remain gated
+-- behind tenant-owner role inheritance and explicit administrative grants.
+--
+-- Idempotent: the `WHERE NOT EXISTS` guard skips any credential whose owner
+-- already holds a matching grant, so re-application inserts nothing and does
+-- not fail. Grant ids reproduce the app convention (`grt_` prefix followed by
+-- 32 hex characters) via `gen_random_uuid()`.
+INSERT INTO "grant" (
+  "id",
+  "tenant_id",
+  "principal_id",
+  "resource",
+  "action",
+  "effect",
+  "origin",
+  "expires_at"
+)
+SELECT
+  'grt_' || replace(gen_random_uuid()::text, '-', ''),
+  c."tenant_id",
+  c."principal_id",
+  'credential:' || c."id",
+  'use',
+  'allow',
+  'creator',
+  NULL
+FROM "credential" c
+WHERE c."principal_id" IS NOT NULL
+  AND NOT EXISTS (
+    SELECT 1
+    FROM "grant" g
+    WHERE g."principal_id" = c."principal_id"
+      AND g."resource" = 'credential:' || c."id"
+      AND g."action" = 'use'
+  );

package/migrations/0038_chilly_blacklash.sql

@@ -0,0 +1,37 @@
+CREATE TABLE "approval" (
+	"id" text PRIMARY KEY NOT NULL,
+	"tenant_id" text NOT NULL,
+	"instance_id" text NOT NULL,
+	"agent_id" text NOT NULL,
+	"origin_principal_id" text NOT NULL,
+	"correlation_id" text NOT NULL,
+	"tool_definition" jsonb NOT NULL,
+	"tool_arguments" jsonb NOT NULL,
+	"scope" text,
+	"status" text DEFAULT 'pending' NOT NULL,
+	"origin_kind" text NOT NULL,
+	"timeout_at" timestamp NOT NULL,
+	"resolved_at" timestamp,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	"updated_at" timestamp DEFAULT now() NOT NULL,
+	CONSTRAINT "approval_correlation_id_unique" UNIQUE("correlation_id")
+);
+--> statement-breakpoint
+CREATE TABLE "signal_correlation" (
+	"correlation_id" text PRIMARY KEY NOT NULL,
+	"tenant_id" text NOT NULL,
+	"deployment_id" text NOT NULL,
+	"agent_address" text NOT NULL,
+	"run_id" text NOT NULL,
+	"signal_name" text NOT NULL,
+	"kind" text NOT NULL,
+	"signal_id" text,
+	"resolved_at" timestamp,
+	"created_at" timestamp DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "approval" ADD CONSTRAINT "approval_tenant_id_tenant_id_fk" FOREIGN KEY ("tenant_id") REFERENCES "public"."tenant"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "approval" ADD CONSTRAINT "approval_instance_id_agent_instance_id_fk" FOREIGN KEY ("instance_id") REFERENCES "public"."agent_instance"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "approval" ADD CONSTRAINT "approval_agent_id_agent_id_fk" FOREIGN KEY ("agent_id") REFERENCES "public"."agent"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "approval" ADD CONSTRAINT "approval_origin_principal_id_principal_id_fk" FOREIGN KEY ("origin_principal_id") REFERENCES "public"."principal"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "signal_correlation" ADD CONSTRAINT "signal_correlation_tenant_id_tenant_id_fk" FOREIGN KEY ("tenant_id") REFERENCES "public"."tenant"("id") ON DELETE cascade ON UPDATE no action;

package/migrations/0039_quick_carnage.sql

@@ -0,0 +1,2 @@
+ALTER TABLE "approval" ALTER COLUMN "tool_definition" DROP NOT NULL;--> statement-breakpoint
+ALTER TABLE "approval" ALTER COLUMN "tool_arguments" DROP NOT NULL;

package/migrations/0040_reshape_approval_origin.sql

@@ -0,0 +1,24 @@
+-- Reshape `approval` so its origin is the workflow deployment it came from.
+-- The dropped instance/agent/origin-principal FKs had no valid referent: a
+-- workflow deployment has no agent_instance/agent row and its run principal is
+-- a substrate principal, not a `principal`-table row. The three added columns
+-- are NOT NULL with no default and no backfill; like the repo's other such
+-- adds (e.g. 0014, `workflow_deployment.address`), this relies on the table
+-- being empty when the migration runs. The table is unreleased -- the approval
+-- routes are 501 stubs -- so no populated row predates these columns.
+ALTER TABLE "approval" DROP CONSTRAINT "approval_instance_id_agent_instance_id_fk";
+--> statement-breakpoint
+ALTER TABLE "approval" DROP CONSTRAINT "approval_agent_id_agent_id_fk";
+--> statement-breakpoint
+ALTER TABLE "approval" DROP CONSTRAINT "approval_origin_principal_id_principal_id_fk";
+--> statement-breakpoint
+ALTER TABLE "approval" ADD COLUMN "deployment_id" text NOT NULL;--> statement-breakpoint
+ALTER TABLE "approval" ADD COLUMN "run_id" text NOT NULL;--> statement-breakpoint
+ALTER TABLE "approval" ADD COLUMN "agent_address" text NOT NULL;--> statement-breakpoint
+ALTER TABLE "approval" ADD CONSTRAINT "approval_deployment_id_workflow_deployment_id_fk" FOREIGN KEY ("deployment_id") REFERENCES "public"."workflow_deployment"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "approval_tenant_status_idx" ON "approval" USING btree ("tenant_id","status","created_at");--> statement-breakpoint
+CREATE INDEX "approval_deployment_idx" ON "approval" USING btree ("deployment_id");--> statement-breakpoint
+ALTER TABLE "approval" DROP COLUMN "instance_id";--> statement-breakpoint
+ALTER TABLE "approval" DROP COLUMN "agent_id";--> statement-breakpoint
+ALTER TABLE "approval" DROP COLUMN "origin_principal_id";--> statement-breakpoint
+ALTER TABLE "approval" DROP COLUMN "origin_kind";

package/migrations/0041_make_approval_timeout_at_nullable.sql

@@ -0,0 +1 @@
+ALTER TABLE "approval" ALTER COLUMN "timeout_at" DROP NOT NULL;

package/migrations/0042_youthful_mantis.sql

@@ -0,0 +1,2 @@
+ALTER TABLE "approval" ALTER COLUMN "tool_definition" SET NOT NULL;--> statement-breakpoint
+ALTER TABLE "approval" ALTER COLUMN "tool_arguments" SET NOT NULL;

package/migrations/0043_signal_correlation_deployment_fk.sql

@@ -0,0 +1 @@
+ALTER TABLE "signal_correlation" ADD CONSTRAINT "signal_correlation_deployment_id_workflow_deployment_id_fk" FOREIGN KEY ("deployment_id") REFERENCES "public"."workflow_deployment"("id") ON DELETE cascade ON UPDATE no action;

package/migrations/0044_model_offering_quirks.sql

@@ -0,0 +1 @@
+ALTER TABLE "model_offering" ADD COLUMN "quirks" jsonb;

package/migrations/0045_create_workflow_run.sql

@@ -0,0 +1,13 @@
+CREATE TABLE "workflow_run" (
+	"id" text PRIMARY KEY NOT NULL,
+	"deployment_id" text NOT NULL,
+	"tenant_id" text NOT NULL,
+	"principal_id" text,
+	"status" text DEFAULT 'running' NOT NULL,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	"ended_at" timestamp
+);
+--> statement-breakpoint
+ALTER TABLE "workflow_run" ADD CONSTRAINT "workflow_run_deployment_id_workflow_deployment_id_fk" FOREIGN KEY ("deployment_id") REFERENCES "public"."workflow_deployment"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "workflow_run" ADD CONSTRAINT "workflow_run_tenant_id_tenant_id_fk" FOREIGN KEY ("tenant_id") REFERENCES "public"."tenant"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "workflow_run" ADD CONSTRAINT "workflow_run_principal_id_principal_id_fk" FOREIGN KEY ("principal_id") REFERENCES "public"."principal"("id") ON DELETE set null ON UPDATE no action;

package/migrations/0046_approval_signal_correlation_run_fk.sql

@@ -0,0 +1,2 @@
+ALTER TABLE "approval" ADD CONSTRAINT "approval_run_id_workflow_run_id_fk" FOREIGN KEY ("run_id") REFERENCES "public"."workflow_run"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "signal_correlation" ADD CONSTRAINT "signal_correlation_run_id_workflow_run_id_fk" FOREIGN KEY ("run_id") REFERENCES "public"."workflow_run"("id") ON DELETE cascade ON UPDATE no action;